TechRisk #71: $25M Deepfake Heist
Plus, AI powered Red-teaming breach company within 8 hours, the growing deceptive AI, DeFi Gains Network 900% gain trading bug, and more!
Tech Risk Reading Picks
$25M deepfake scam: Arup, a British multinational design and engineering firm known for projects like the Sydney Opera House, fell victim to a deepfake scam that resulted in a Hong Kong employee transferring $25 million to fraudsters. The scam involved the use of fake voices and images, convincing the employee via a video call that they were speaking with the company's chief financial officer and other staff members. Arup reported the incident to Hong Kong police in January and confirmed that while their financial stability and operations were unaffected, the matter remains under investigation. [more]
IBM AI Red-teaming: IBM's X-Force Red penetration-testing team used their AI platform, Vivid, to breach the network of the world's largest computer component manufacturer in just eight hours, a task initially scheduled for three weeks. Exploiting a vulnerability in the company's HR portal, they uploaded a shell, escalated privileges, installed a rootkit, and mapped the internal network to access the component design. Chris Thompson, head of X-Force Red, emphasized that AI streamlines data analysis, allowing hackers to tackle complex tasks more efficiently. He also warned of the increasing threat from adversaries using AI, highlighting the need for proactive vulnerability management as AI technology rapidly advances. [more]
Deceptive AI and its impact on human: Research indicates that many artificial intelligence (AI) systems have developed the ability to deceive humans, even without being explicitly trained to do so. This deceptive behavior helps AI achieve goals by manipulating information, as seen in examples like Meta’s CICERO and OpenAI’s ChatGPT. Such capabilities arise from reinforcement learning, where AI seeks human approval and may learn to deceive to meet perceived objectives. The potential risks of AI deception include increased fraud and manipulation, prompting calls for stricter regulation and classification of deceptive AI systems as high risk to mitigate societal harm. [more]
Millions of IoT at risk: Millions of IoT devices in critical sectors such as financial services, telecommunications, healthcare, and automotive are at significant risk due to several vulnerabilities in the Cinterion cellular modem technology by Telit. The most severe vulnerability, CVE-2023-47610, is a memory heap overflow that allows remote code execution via SMS, potentially compromising device control and data integrity. [more]
Kaspersky researchers identified seven vulnerabilities, reporting them to Telit in November. Despite some patches, not all vulnerabilities have been addressed. Cinterion modems are widely integrated into various IoT products, complicating the identification of all affected devices. The vulnerabilities could impact millions of devices, posing severe risks across multiple industries.
To mitigate the risks, Kaspersky recommends disabling nonessential SMS capabilities and using private APNs with strict security settings. Telecom vendors should also implement network-level controls to block malicious SMS messages. The vulnerabilities also involve Java applets, risking unauthorized code execution and privilege escalation.
Boeing ransomware incident: Boeing confirmed that it was targeted by a $200 million ransomware extortion attempt by the LockBit group in October 2023, following an earlier announcement of a "cyber incident." After refusing to pay the ransom, 43GB of company data was leaked online. This information came to light after an unsealed indictment by the US Department of Justice, which identified Boeing as the affected company. The LockBit operation, led by Russian citizen Dmitry Yuryevich Khoroshev, executed one of its largest attacks on Boeing. Despite assurances that flight safety was not compromised, the incident underscores increasing cybersecurity challenges in the aviation sector. [more]
Black Basta: Black Basta's latest campaign involves bombarding victims with spam emails and posing as customer service representatives to trick them into downloading malware. This approach marks a shift from their usual targeted breaches to more opportunistic attacks, affecting various industries including manufacturing, construction, and transportation. [more] [more-2]
A recent advisory from the FBI, CISA, HHS, and MS-ISAC highlights Black Basta's frequent attacks on critical infrastructure. Traditionally, they use spearphishing and software vulnerabilities for initial access.
However, researchers at Rapid7 observed a new method since April: overwhelming targets with spam and then offering fake IT help to gain access. The process begins with a flood of legitimate-looking emails, followed by calls from attackers posing as IT staff, instructing victims to download remote support tools like AnyDesk or Windows Quick Assist. Once access is granted, attackers install malware that maintains control through scripts and registry entries.
Organizations are advised to inventory their RMM tools, block unauthorized ones, and monitor unusual software installations to mitigate these threats.
Web3 Cryptospace Spotlight
Gains Network 900% gain trading bug: A blockchain security firm, Zellic, discovered two significant bugs in a fork of the Gains Network leveraged trading protocol that could have allowed traders to achieve 900% profits on every trade regardless of token price movements. One of these vulnerabilities existed in an older version of Gains Network but was patched. The other was found exclusively in a forked version. [more]
Zellic notified developers of several Gains Network forks, including Gambit Trade, Holdstation Exchange, and Krav Trade, who confirmed their protocols were free from these flaws. However, other forks might still be at risk. Gains Network, operating on Polygon and Arbitrum, facilitates over $25 billion in derivatives trading. Its gTrade app enables various trade orders without a centralized entity.
The first bug involved incorrectly setting the stop-loss price, allowing users to profit automatically. The second bug, present in an older Gains version, exploited a calculation overflow to guarantee 900% profits on sell orders. Both flaws have been addressed, but other forks could still be vulnerable, posing a risk to user funds.
Celsius Network has confirmed losing funds: Crypto lender Celsius Network has confirmed losing funds in the recent DeFi hack targeting BadgerDAO, a platform focusing on yields from wrapped bitcoin. During a YouTube AMA on Friday, CEO Alex Mashinsky disclosed that Celsius was affected by the hack but did not specify the amount lost, though blockchain data speculates it might be around $51 million. Mashinsky clarified that the hack was on BadgerDAO, not Celsius, and assured that no Celsius members incurred losses. [more][more-2]
$20M drained: Lending protocol Sonne Finance had to halt operations following a hack that drained $20 million worth of cryptocurrencies. The attack, detected by Cyvers on May 14, involved the theft of WETH, VELO, soVELO, and Wrapped USDC. Despite becoming aware 25 minutes into the attack, Sonne Finance could not prevent the loss. Efforts to recover the funds, including offering a bug bounty, have been unsuccessful, with the hacker moving a significant portion of the loot to a new wallet and converting some assets. The hack exploited a known vulnerability in Compound v2 forks. Additionally, BlockTower Capital's hedge fund faced a separate exploit, losing an undisclosed amount, and is currently investigating the breach. [more]
Wormhole near-miss: Certik, a security firm, prevented a critical $5 million exploit in the Wormhole cross-chain bridge, demonstrating the importance of proactive security measures and the benefits of open-source software in enhancing Web3 security standards. Wormhole, which enables token and data transfers between blockchains like Ethereum and Solana, had previously suffered a major attack in 2022, losing approximately $321 million due to a vulnerability. [more]