Risky Business #536 -- Mar-a-Lago arrest, ASUS supply chain attack and more

A recap of the last three weeks in infosec...
10 Apr 2019 » Risky Business

In this week’s show Patrick Gray and Adam Boileau recap all the infosec news of the last three weeks, including:

  • Chinese woman arrested at Mar-a-Lago being very shady
  • The ASUS supply chain attack
  • Flame-related malware lived on longer than expected
  • boostrap-sass Ruby gem backdoored
  • Latest on Norsk Hydro and other victims of the same crew
  • More trouble at Toyota
  • Huawei spanked by UK oversight panel
  • Exodus govvie malware affects Android and iOS
  • Plus much, much more

This week’s sponsor interview is with Kumud Kalia, the Chief Information and Technology Officer of Cylance. They actually dropped a really interesting product announcement at RSA a few weeks back and Kumud will be along later on to tell us about that. The tl;dr it’s an agent that models endpoint behaviour so when someone - or something - else starts using that endpoint to do things that don’t fit the user profile, action can be taken.

It’s the type of tech concept that normally belongs in academic papers, not in actual products people can actually buy. That’s an interesting chat.

Links to everything are below, and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Feds: Woman arrested at Mar-a-Lago had hidden-camera detector | Miami Herald
Hackers Hijacked ASUS Software Updates to Install Backdoors on Thousands of Computers - Motherboard
ASUS releases fix for Live Update tool abused in ShadowHammer attack | ZDNet
Researchers publish list of MAC addresses targeted in ASUS hack | ZDNet
Nation-state hacking kit ‘Flame’ had a second life, researchers say
Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem | Snyk
Norsk Hydro ransomware incident losses reach $40 million after one week | ZDNet
Norsk Hydro will not pay ransom demand and will restore from backups | ZDNet
Arizona Beverages knocked offline by ransomware attack | TechCrunch
Ransomware Forces Two Chemical Companies to Order ‘Hundreds of New Computers’ - Motherboard
Toyota announces second security breach in the last five weeks | ZDNet
Huawei's Problem Isn't Chinese Backdoors. It's Buggy Software | WIRED
In issuing 5G recommendations, E.U. spurns U.S. hardline on Huawei
Bezos’ Investigator Gavin de Becker Finds the Saudis Obtained the Amazon Chief’s Private Data
NSO Group Says It Didn’t Hack Jeff Bezos On Behalf of Saudi Arabia - Motherboard
'Exodus' Spyware Posed as a Legit iOS App | WIRED
Former NSA spies hacked BBC host, Al Jazeera chairman for UAE
Lazarus rises in Israel with attempted hack of defense company, researchers say
Defense Ministry rebukes Israeli spy tech company for unlawful exports | The Times of Israel
Islamic State's collapse hastened with help of Australian cyber spies - ABC News (Australian Broadcasting Corporation)
Company sues worker who fell for email scam - BBC News
Utah Just Became a Leader in Digital Privacy | WIRED
Office Depot rigged PC malware scans to sell unneeded $300 tech support | Ars Technica
Microsoft warns Windows 7 users of looming end to security updates | TechCrunch
Brace yourselves: Exploit published for serious Magento bug allowing card skimming [Updated] | Ars Technica
Warfare Plugins on Twitter: "WE ARE AWARE OF A ZERO-DAY EXPLOIT AFFECTING SOCIAL WARFARE CURRENTLY BEING TAKEN ADVANTAGE OF IN THE WILD. Our developers are working to release a patch within the next hour. In the meantime, we recommend disabling the plugin. We will update you as soon as we know more."
Pipdig Update: Dishonest Denials, Erased Evidence, and Ongoing Offenses
Two serious WordPress plugin vulnerabilities are being exploited in the wild | Ars Technica
Ex-NSA contractor pleads guilty to vast classified data leak, faces 9 years in prison
Report deems Russia a pioneer in GPS spoofing attacks | ZDNet
Above Us Only Stars - Exposing GPS Spoofing in Russia and Syria - Association of Old Crows
Researchers find 36 new security flaws in LTE protocol | ZDNet
AT&T, Comcast successfully test SHAKEN/STIR protocol for fighting robocalls | ZDNet
Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years — Krebs on Security
Third-Party Apps Exposed Over 540 Million Facebook Records | WIRED
Man Behind Fatal ‘Swatting’ Gets 20 Years — Krebs on Security
Top dark web marketplace will shut down next month | ZDNet
Lithuanian man pleads guilty to scamming Google and Facebook out of $123 million | ZDNet
China Considers Ban On Cryptocurrency Mining Because It's A Stupid Waste Of Energy | Gizmodo Australia
Vigilantes Counter Christchurch Manifesto with Weaponized Version
RedTeam Pentesting on Twitter: "We were also quite surprised to find this /etc/nginx.conf in… https://t.co/ymjjLM3eP7"
Announcing QueryCon 2019 | Trail of Bits Blog
PaperCall.io - QueryCon 2019
QueryCon 2019 — Hosted by Trail of Bits, with Kolide and Carbon Black Tickets, Thu, Jun 20, 2019 at 9:00 AM | Eventbrite