The Hacker News.

"THN Weekly Recap:  Top cybersecurity threats, tools and tips."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 06 January 2025, 1433 UTC.

Content and Source:  https://thehackernews.com.

Please check link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

Every tap, click, and swipe we make online shapes our digital lives, but it also opens doors—some we never meant to unlock. Extensions we trust, assistants we rely on, and even the codes we scan are turning into tools for attackers. The line between convenience and vulnerability has never been thinner. This week, we dive into the hidden risks, surprising loopholes, and the clever tricks cybercriminals are using to outsmart the systems we depend on. Stay with us as we unpack what’s happening behind the screen and how you can stay one step ahead.

 Threat of the Week

Dozens of Google Chrome Extensions Caught Stealing Sensitive Data — The challenges with securing the software supply chain reared once again after about three dozen extensions were found surreptitiously siphoning sensitive data from roughly 2.6 million devices for several months as part of two related campaigns. The compromises came to light after data loss prevention service Cyberhaven revealed that its browser extension was updated to include malicious code responsible for stealing credentials for Facebook and OpenAI ChatGPT and other data. The attack was made possible through a spear-phishing email sent to one of the company's employees, urging them to take immediate action for failing to comply with Google Chrome Web Store policies. A link in the email led to a Google consent screen requesting access permission for an OAuth application named Privacy Policy Extension. Once granted access, the rogue application gave the attacker the ability to push a malicious version of Cyberhaven's Chrome extension to the Chrome Web Store. Since then, it has emerged that several other extensions have been targeted in a similar manner. One of these extensions, named Reader Mode, is also said to have been targeted along with a few others as part of a related data-gathering activity that started no later than April 2023. The malicious code, which appears to be part of a monetization library, is designed to log every website visited on the browser. The development is another sign that browser add-ons are a weak link in the security chain. How to Conduct an AI Risk Assessment [Free Guide] The past two years have been as explosive for generative AI as they were for Taylor Swift. This guide will help you take practical steps to identify and mitigate GenAI risks so you can ensure safe and compliant use in your org. Get the Guide

 Top News

Apple Settles Siri Privacy Lawsuit — Apple has agreed to pay $95 million to settle a long-running class action lawsuit in the U.S. over claims that its voice assistant Siri routinely recorded private conversations. A payment of up to $20 per Siri-enabled device is expected for those submitting valid claims, with each affected U.S.-based customer limited to a maximum of five devices. The proposed settlement, currently pending approval by a federal judge, involved cases where Siri would be inadvertently activated and capture sensitive data without the users' knowledge. The lawsuit was filed in August 2019 following a report from The Guardian that the recordings were apparently prompted without users ever saying the wake words, "Hey, Siri." The report also alleged third-party contractors "regularly hear confidential medical information, drug deals, and recordings of couples having sex" while working on Siri quality control. It's currently unknown how many customers were affected. Apple isn't acknowledging any wrongdoing in the settlement. LDAPNightmare Exploit Could Crash Windows Servers — A proof-of-concept (PoC) exploit has been released for a now-patched security flaw impacting Windows Lightweight Directory Access Protocol (LDAP) that could trigger a denial-of-service (DoS) condition. The vulnerability, tracked as CVE-2024-49113 (CVSS score: 7.5), was patched by Microsoft last month, along with CVE-2024-49112 (CVSS score: 9.8), a remote code execution flaw in the same component. Organizations are recommended to apply the patches as soon as possible to avoid potential exploitation risks. U.S. Treasury Sanctions Beijing Cybersecurity Firm — The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned a Beijing-based cybersecurity company known as Integrity Technology Group, Incorporated for orchestrating several cyber attacks against U.S. victims. The attacks have been publicly attributed to a Chinese state-sponsored threat actor tracked as Flax Typhoon (aka Ethereal Panda or RedJuliett), which has controlled an Internet of Things (IoT) botnet called Raptor Train. A government contractor with ties to China's Ministry of State Security, Integrity Group has been accused of providing infrastructure support to Flax Typhoon cyber campaigns between mid-2022 and late-2023. "DoubleClickjacking" Bypasses Clickjacking Protections — Security researcher Paulos Yibelo has demonstrated a new type of browser-based attack called DoubleClickjacking that exploits the time delay between two successive clicks during a double-click sequence to trick users into performing unauthorized actions. The attack is notable for the fact that it gets around various defenses such as X-Frame-Options, SameSite cookies, and client-side protection. The development comes weeks after Google-owned Mandiant disclosed a "novel" technique to circumvent browser isolation by using machine-readable QR codes to send commands from an attacker-controlled server to a victim device, ultimately allowing a bad actor to remotely commandeer a compromised device. Browser isolation is a critical security mechanism that separates web browsing activity from the user's local device in a sandboxed environment to combat phishing and other threats. "Instead of returning the C2 data in the HTTP request headers or body, the C2 server returns a valid web page that visually shows a QR code," Mandiant said. "The implant then uses a local headless browser (e.g., using Selenium) to render the page, grabs a screenshot, and reads the QR code to retrieve the embedded data. By taking advantage of machine-readable QR codes, an attacker can send data from the attacker-controlled server to a malicious implant even when the web page is rendered in a remote browser." Chinese Threat Actors Target the U.S. Treasury Department — The U.S. Treasury Department revealed it suffered a "major cybersecurity incident" that allowed suspected Chinese threat actors to remotely access some computers and unclassified documents. The incident took place in early December 2024 after the threat actors gained access to a Remote Support SaaS API key associated with BeyondTrust that allowed them to reset passwords for local application accounts. BeyondTrust has not disclosed how the key was obtained, but said the API key has since been revoked and that impacted customers have been notified. The latest development comes at a time when the U.S. is already battling cyber attacks from other Chinese hacking groups tracked as Volt Typhoon and Salt Typhoon, both of which have targeted critical infrastructure and telecom networks in the country. According to a new report from the Wall Street Journal, the telecom-related hacks are so "severe" that "the U.S. may never be able to say with certainty that the Chinese hackers have been fully rooted out." Some of the other targets of Salt Typhoon hacks included Charter Communications, Consolidated Communications, and Windstream. "In the telecom attacks, the hackers exploited unpatched network devices from security vendor Fortinet and compromised large network routers from Cisco Systems," the deepdive report said. "In at least one case, they took control of a high-level network management account that wasn't protected by multi-factor authentication, a basic safeguard." Volt Typhoon, on the other hand, is said to have targeted several entities in Guam, including Guam.gov and Docomo Pacific. China has denied any involvement in these attacks, even going to the extent of branding the Volt Typhoon as a disinformation campaign.

️ Trending CVEs

Your favorite software might be hiding serious security cracks—don’t wait for trouble to find you. Update now and stay one step ahead of the threats! This week’s list includes — CVE-2024-43405 (ProjectDiscovery Nuclei), CVE-2024-54152 (Angular Expressions), CVE-2024-12912, CVE-2024-13062 (ASUS router AiCloud), CVE-2024-12828 (Webmin CGI), CVE-2024-56040, CVE-2024-56041 (VibeThemes VibeBP), CVE-2024-56042, CVE-2024-56043, CVE-2024-56044, CVE-2024-56045, CVE-2024-56046 (VibeThemes WPLMS), CVE-2024-56249 (Webdeclic WPMasterToolKit), CVE-2024-56198 (path-sanitizer npm package), CVE-2024-55078 (WukongCRM), and CVE-2024-12583 (Dynamics 365 Integration plugin).

 Around the Cyber World

Two Indian Nationals Charged in the U.S. — The U.S. Department of Justice has announced charges against two Indian nationals, Ahmed Maqbul Syed, 57, and Rupesh Chandra Chintakindi, 27, for orchestrating a tech support fraud scheme targeting elderly victims in the U.S. Both have been charged with conspiracy to commit money laundering. Syed has also been charged with conspiracy to commit wire fraud. Each of these charges carries a maximum penalty of 20 years in prison and a $250,000 fine. In the operation, victims were lured through bogus pop-up notifications on their computers, warning that their machines had been hacked and instructing them to contact tech support or government representatives to resolve the problem. The defendants then asked the victims to withdraw funds from their accounts, or purchase gold under the pretext of securing their assets. They also urged them to purchase gift cards from various private businesses and transfer the gift card numbers to people who they said would help them. In at least one case, a victim was asked to make cash deposits into a Bitcoin ATM. FTC Orders Marriott and Starwood to Address Security Failures — The U.S. Federal Trade Commission (FTC) has ordered Marriott International and its subsidiary Starwood Hotels to define and implement a comprehensive data security program following security lapses that led to at least three separate data breaches from 2014 to 2020. The incidents enabled malicious actors to obtain vast amounts of personal information from hundreds of millions of consumers, including passport information, payment card numbers, and loyalty numbers affecting 344 million customers worldwide. The order also requires them to set up a link on their website for U.S. customers to request for personal information associated with their email address or loyalty rewards account number to be deleted. "The companies are also prohibited from misrepresenting how they collect, maintain, use, delete or disclose consumers’ personal information; and the extent to which the companies protect the privacy, security, availability, confidentiality, or integrity of personal information," the FTC said. In October 2024, Marriott agreed to pay a $52 million penalty to 49 states and the District of Columbia to resolve the data security allegations. U.S. Army Soldier Arrested Over AT&T, Verizon Hacking — Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier named Cameron John Wagenius (aka Kiberphant0m) for his alleged involvement in selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon. The arrest took place on December 20, 2024. According to security journalist Brian Krebs, Wagenius is a communications specialist who was recently stationed in South Korea. He is also said to have worked with Connor Riley Moucka (aka Judische), a Canadian cybercriminal who was arrested in late October 2024 for stealing data from and extorting dozens of companies that stored the information at the cloud service Snowflake. A third accused of being involved in the Snowflake incident, U.S. citizen John Erin Binns, was arrested by the Turkish authorities in May in connection with a separate 2021 attack on T-Mobile. $494 million Stolen in Wallet Drainer Attacks in 2024 — Malicious actors stole $494 million worth of cryptocurrency in wallet drainer attacks last year that targeted more than 332,000 wallet addresses. The figure represents a 67% increase year-over-year. The largest single thefts amounted to $55.48 million and $32.51 million in August and September, respectively, accounting for 52% of the year's total large-scale (above $1 million) losses, per Scam Sniffer. A noteworthy trend is the increased use of malicious ads on Google, X, and Telegram to direct traffic to phishing websites. In a related report, CertiK revealed that 760 Web3 security incidents resulted in losses totaling over $2.3 billion worth of cryptocurrency in 2024. "The average amount lost per hack in 2024 was $3,108,880 and the median amount stolen was $150,925," it said. "Ethereum experienced the highest number of security incidents, with a total of 403 hacks." Phishing and private key compromises were the top attack vectors. EC2 Grouper Actor Targets the Cloud — A threat actor known as EC2 Grouper has been observed leveraging AWS Tools for PowerShell to carry out their attacks, Fortinet FortiGuard Labs said. The intrusions entail the likely use of AWS keys available on GitHub repositories, followed by executing commands to inventory Elastic Compute Cloud (EC2) types within the environment and facilitate remote access. "It could be either that EC2 Grouper is selective in their escalation or compromised accounts were detected and quarantined before they had the opportunity to escalate," the company said. "Despite this, resource hijacking is likely the general objective. However, to what end is currently unconfirmed."

 Expert Webinar

Future-Ready Trust: Manage Certificates Like Never Before — Trust is the foundation of every digital interaction, but managing it across users, devices, and systems is harder than ever. Join our webinar to see how DigiCert ONE simplifies certificate management, automates trust operations, and ensures compliance—all in one powerful platform. Discover how to future-proof your organization’s digital trust strategy with ease. AI in Cybersecurity: Insights from 200 Cybersecurity Experts — AI in cybersecurity: game-changer or just hype? Join us to uncover insights from 200 industry leaders, explore real-world AI applications in vulnerability management, and gain actionable strategies to enhance your security. Don’t miss this chance to cut through the noise—register now.

 Cybersecurity Tools

Adalanche is a powerful open-source tool designed to simplify Active Directory security. It provides instant visual insights into permissions, helping you uncover who can access or control accounts, machines, or even the entire domain. With its all-in-one binary, Adalanche collects and analyzes data effortlessly, highlighting vulnerabilities and misconfigurations. Hawk-eye helps you find hidden secrets and sensitive data (PII) across your entire system in no time. From cloud storage to databases and files, it scans everything with precision, using smart tools to keep your data safe. Quick to set up and easy to use, Hawk-eye makes protecting your digital world simple and effective.

 Tip of the Week

Upgrade Your Network Security — Take your network security to the next level with powerful, free tools designed to keep threats at bay. Use PfSense for enterprise-grade firewall protection and pair it with Suricata or Snort for real-time threat detection. Detect rogue devices with WiFiGuard and suspicious Wi-Fi activity with Kismet. Secure your communication with ZeroTier for private networking and encrypt DNS queries using DNSCrypt-Proxy or NextDNS to block malicious domains. Plant decoys using Canarytokens to catch intruders, monitor activity with Wireshark, and safeguard SSH with Fail2Ban against brute-force attacks. Strengthen Wi-Fi with WPA3 and 802.11w Management Frame Protection, and track your network’s health in real-time using Netdata. These free tools give you enterprise-level defense at no cost—your network’s secret weapon.

Conclusion

That’s a wrap for this week! If there’s one thing we’ve learned, it’s that staying safe online isn’t just about tech—it’s about the choices we make every day. Whether it’s ignoring a shady email, keeping your apps updated, or thinking twice before clicking “yes,” small steps can make a big difference. The digital world moves fast, but with a little care and attention, we can stay ahead. Keep asking questions, stay alert, and remember—we’re all in this together. See you next week with more updates to keep you informed and ready. View email in browser The Hacker News · Pearl Omaxe Tower · 810/8 Nsp, Pitampura · New Delhi, Delhi 110034 · India update your preferences or unsubscribe