Risky Bulletin: US warns of AI-assisted attacks against Siemens PLCs

0:03The US warns of AI-aided attacks against Siemens PLCs, hackers breached Latvia's road traffic agency. A new hacking tool enrols an attacker's passkey to your account. And academics find source code overlaps between Jeej devices and China's Great Firewall. This is the Risky Bulletin prepared by Katalin Kimpanu and read by me, Claire Aird. Today is the 21st of August and this podcast episode is brought to you by Socket. In today's top story, CISA and the FBI have urged American organisations to secure their Siemens programmable logic controllers. The agencies say threat actors are using AI to conduct reconnaissance and develop exploitation scripts.

0:49The attackers are focusing on the Siemens S7 PLCs. Organisations have been advised to remove the PLCs from the internet and strengthen their access controls. In other news, hackers have stolen the personal details of 1.2 million Latvian citizens from the country's road traffic agency. The stolen data includes personal details, payment information and license plates dating back to 2008. State officials have warned citizens to watch out for possible scams. The agency's supervisory board resigned following the hack. Hackers have compromised a Rust developer and injected malware into three of his Rust libraries in a supply chain attack on Thursday.

1:32The malicious libraries were live for only 23 minutes, but one of the three was Aray Ref, a library with almost 5 million weekly downloads. The Rust security team has since removed the malicious versions and locked the developer's account. According to cloud security firm Wiz, the attackers' infrastructure overlap with North Korean operations. Mozilla has removed 77 malicious Firefox extensions from its add-on store for stealing crypto wallet seed phrases and browser credentials. Most of the extensions mimicked crypto wallets, Web3 tools and sports scorekeeping tools. According to Socket Security, they all shared the same backend infrastructure and source code components.

2:16A threat actor has targeted security researchers who attended the Black Hat and DEF CON security conferences. The attacker attempted to trick victims into running malware by posing as the marketing director of cryptocurrency news site Coindesk. They approached targets via Twitter with an offer to speak at a cryptocurrency-themed security conference. Security firm Huntress discovered the campaign after one of its researchers was targeted. A threat actor is selling a phishing toolkit that can automatically enrol an attacker's passkey into a victim's account after a successful phish. The passkey is meant to allow future access to the account in case the victim changes their password or revokes active sessions.

2:58The toolkit, named iAuthFlow V2, is sold on hacking forums for$10 ,000 and supports passkey enrolment on Google, Microsoft, LinkedIn and iCloud. A new Android Trojan that targets Ukrainian banks has been discovered in the wild. Named Manik, the Trojan was discovered by mobile security firm Threat Fabric. It targets Ukrainian banks, government agencies, identity services and local messaging applications. Threat Fabric says the Trojan sits at the intersection of a banking Trojan and spyware. Besides showing phishing overlays, it can also steal local credentials and exfiltrate data through a local Wi-Fi mesh network.

3:40American academics have linked a Chinese company to the country's Great Firewall Traffic Filtering System via source code leaks. Researchers matched Jij's Tiango secure gateway device to the censorship system following a leak of more than 100 ,000 files from the company's network last year. The leak included source code which the academics used to build Jij's products. They were then able to match the product to the Great Firewall's filtering behaviour. Hackers are exploiting a recently patched vulnerability in the Zimbra collaboration suite. The floor was patched in late July. It allows attackers to run commands on Zimbra servers via a command injection floor in the SNMP monitoring component.

4:23CertPoland detected the attacks. Threat actors are exploiting a recent GitLab vulnerability. Attacks began two days after proof of concept code was posted online. The vulnerability allows unauthenticated attackers to remotely modify and delete GitLab projects or user data. Academics have discovered a DDoS technique that can take down websites and resources that are protected by content delivery networks. The attack exploits CDNs that support HTTP3 connections from regular internet users, but translate traffic to the HTTP1 protocol internally. The so-called CDN tsunami attack sends a small amount of HTTP3 traffic to the CDN, which then sends a large amount of HTTP1 data to its customers' sites.

5:13The research team says that only two CDNs have deployed mitigations since being notified. And finally, Cloudflare has seen no evidence that Spectre CPU vulnerabilities have been exploited in the last three years. The company has rolled out new protections to cover more recent Spectre attack variants. The dynamic process isolation feature isolates malicious-looking scripts into their own processors. The feature will now also isolate any long-lived executions and IO-heavy workloads, which are telltale signs of a Spectre attack. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Socket.

5:53Find them at socket.dev. Thanks for your company. Thank you.