Risky Bulletin: The EU publishes its upcoming cybersecurity standards

0:03The EU publishes its upcoming cyber security standards. Hackers breach France's tax agency. Threat actors exploit a geo-server zero day, hours after disclosure. And an exploit unlocks old AMD CPUs with one instruction. This is the Risky Bulletin, prepared by Katalin Kimpanu and read by me, Claire Aird. Today is the 17th of August and this podcast episode is brought to you by Socket. In today's top story, the European Telecommunication Standards Institute has published 17 cybersecurity standards for the upcoming EU Cyber Resilience Act. The standards are currently accepting public comment. They cover common technologies like firewalls, routers, operating systems, browsers, VPNs and security products.

0:54The CRA comes into effect in December 2027. At that time, products sold in the EU must comply with the final version of the standards. In other news, Taiwan simulated a cyber attack against its communications infrastructure by throttling mobile internet access in the country's northern region. It was throttled for 30 minutes during Taiwan's annual Han Kwong War Games last week. Officials said they wanted to test the public's psychological response and the island's logistical readiness. A hacker has stolen the tax information of more than 678 ,000 French citizens. The breach occurred at the French Directorate General of Public Finance between June and July.

1:39A hacker named Zero Bytes has taken credit for the intrusion. They claimed they were in the process of downloading the data of 20 million citizens before they were detected and evicted. The government of Kazakhstan is investigating a breach of its eGov portal. The investigation came after a hacker listed government data for sale on an underground hacking forum. The stolen information relates to 15 million citizens, or about three quarters of the country's population. Officials deny eGov systems were breached and believe the data was stolen from a separate government agency which can connect to the eGov database.

2:17Ukraine's GUR Military Intelligence Service claims to have disrupted the IT systems of Russia's largest online retailer, Wildberries. The hacks occurred days before the Ukrainian military used drones to destroy the company's largest logistics hub in Kolaidino near Moscow. GUR said the cyber attack disrupted the company's customer service and destabilised its payment infrastructure. AI security lab Irregular has accepted responsibility for frontier models from Anthropic and Meta escaping their test environments. Irregular says it used target names, similar to real company names, and accidentally left some test environments connected to the internet.

2:59Some models hacked real companies while believing they were still in a simulated environment. Anthropic says its agents engage in turf wars when they're given the same tasks. Agents deployed self-replicating malware, locked their rivals' accounts and deployed scripts that ran in a loop to disable competing agents' processes. Anthropic says the newer models like Mythos won by first revoking rivals' access and then negotiating truces. OpenAI has launched a new feature that records user activity for ChatGPT on macOS. The so-called computer history feature records what users click, type and open and makes that data searchable.

3:41The new feature will be off by default. German and Brazilian authorities have arrested members of a hacker group that stole more than€30 million from German bank accounts. Four suspects were detained in Brazil and three across Europe. The group allegedly exploited a vulnerability to steal the funds in 2023. Brazilian media has reported the company involved was Germany's Commerzbank, which was known to have been impacted by a€30 million incident at that time. Vietnamese police have arrested 12 suspects for infecting more than 94 ,000 systems with the PXA Steeler malware. The malware's creator has been identified as a 12th grader from the Tan Hwa province.

4:24The group allegedly made$380 ,000 from selling the malware. It also made a 15 % commission from the sale of any data stolen with PXA. A North Carolina man has been sentenced to two years in a U.S. prison for extorting his former employer. Cameron Curry worked as a data analyst contractor for Brightly Software until 2023. The day after his employment ended, Curry launched an extortion campaign against his former employer using salary data he'd stolen months earlier. He threatened to leak salary and employee details unless he was paid$2.5 million. The data extortion group, Exful Squad, most likely stole the data it's ransoming from Microsoft Dynamics 365 instances.

5:12Victims include Allstate, Frontier Airlines, the US cities of Atlanta and House, as well as the UK's Department of Education and National Police Force. Fortra researchers believe the group exploited misconfigured Microsoft power pages before pivoting to D365 environments. The CRP X0 ransomware group has leaked the data of 47 companies on its dark web leak site in its first week. Most victims are from the US and Turkey and include banks, healthcare organisations and Hyundai's Turkish branch. The CRP X0 began operations this month and is believed to be run by a known crypto scammer. Clusters of remote North Korean IT workers have been discovered operating from within buildings of at least two of the country's universities.

6:02Security firm Katoleski discovered the clusters at the Kim Chek University of Technology and Kim Il-sung University's Jinang Institute of IT Development. The workers operated from specific floors, suggesting the space was assigned to them. Another cluster was found operating at a Pyongyang Information Technology Centre, close to the headquarters of the North Korean Intelligence Service. A security researcher has developed an exploit to unlock closed areas of AMD CPUs. The exploit relies on a single CPU instruction and can grant access to areas like the platform security processor, the system management mode and every internal processor register.

6:45The exploit impacts AMD 15H and 16H families released between 2011 and 2015. The most widely used are the Puma and Jaguar families used for PlayStation 4 and Xbox One consoles. AMD says it won't patch the bug because the CPUs have reached end of life. Hackers began exploiting a GeoServer zero day, hours after the details of the bug were disclosed on X. The flaw allows attackers to run malicious code on the servers via a SQL injection. GeoServer released a patch on Friday. The project is an open source tool used to display geospatial and map data on the web. Hackers are exploiting a recently patched vulnerability to access SAP-based online stores.

7:33The bug was patched this month in the SAP Commerce Cloud platform. The vulnerability allows attackers to bypass authentication on some of the platform's components and run malicious code. According to security firm Diffused, attacks began three days after the bug was patched last week. And finally, a path traversal vulnerability allows attackers to install web shells on OpenCart online stores and run malicious code. The bug is a classic dot dot slash vulnerability. It can be exploited by malicious extensions that drop files outside their normal folders during the installation process. Security researchers were unable to contact the OpenCart team and a patch is not available.

8:17And that is all for this podcast edition. Today's show was brought to you by our sponsor, Socket. Find them at socket.dev. Thanks for your company.