TechRisk #85: Attack on 230M Cloud Environments
Plus, Slack AI leak sensitive info, 110,000 domains targeted due to Cloud misconfigurations, AI burning employees out, $5.1B in illicit crypto transactions linked to UK, and more!
Tech Risk Reading Picks
Cloud misconfigurations exploitation: A widespread cyber campaign is exploiting cloud misconfigurations to target over 110,000 domains, putting them at risk of extortion. Attackers are leveraging misconfigured public write permissions to alter DNS records, redirecting traffic to malicious sites or demanding ransoms to prevent such actions. The attack is sophisticated, targeting companies across various sectors, and highlights a critical security gap in cloud infrastructure management. This underscores the urgent need for organizations to thoroughly secure their cloud environments to prevent such vulnerabilities from being exploited. [more]
230M Cloud environments/systems under attack: Unit42 detected a massive cyberattack on Amazon Web Services (AWS) exploited vulnerabilities in misconfigured cloud environments and compromised around 230 million systems. The attackers used a technique known as "cloud jacking," where they exploited weak access controls and improperly secured credentials to infiltrate and move laterally within cloud environments. This allowed them to access and exfiltrate sensitive data from multiple industries. The incident reminded organisations the need to ensure proper cloud configuration, robust access controls, and regular security audits to prevent such breaches. [more]
AI burnout: The increasing use of AI in workplaces is driving burnout among employees. Many are overwhelmed by the rapid pace of technological change and the pressure to integrate AI into their roles. Although AI is designed to boost productivity, the constant need to adapt and the lack of clear guidance are causing heightened stress and fatigue. This growing trend underscores the challenges of balancing technological advancements with maintaining employee well-being. [more]
AI safeguards lagging: The PwC report on responsible AI underscores the critical need for organizations to adopt comprehensive safeguards as AI technologies become integral to business strategies. It emphasizes the importance of establishing robust governance frameworks to oversee AI implementation, ensuring transparency in AI decision-making processes, and embedding ethical considerations into AI development from the outset. The report also highlights the necessity of building stakeholder trust and staying compliant with evolving global regulations. Without these measures, businesses risk facing significant operational, legal, and reputational challenges as AI adoption accelerates. [more]
Bypassed Slack AI guardrails: Slack's AI was exploited to exfiltrate data by subtly manipulating the AI’s responses which lead to unauthorized access to sensitive information. Malicious instructions provided in a public channel can be used to exploit Slack AI as it is not able to distinguish between system and user prompts. [more][more-slack_ai_bypassed]
An attacker can create a public channel with a harmful message that manipulates Slack AI into including sensitive data, such as API keys, in a disguised malicious link when responding to user queries.
This attack is hard to trace because the injected messages are not cited in responses and may not appear in initial search results, making detection difficult and potentially leading to unauthorized data exfiltration.
Quantum overhyped: Professor Tommaso Calarco, a leading figure in quantum computing, warns against the overhyping of quantum computing's capabilities. He emphasizes that while quantum technology holds significant promise, it's still in its early stages, and unrealistic expectations could lead to disillusionment. Calarco advocates for a balanced approach, focusing on scientific rigor and realistic timelines, rather than speculative claims. His cautionary stance highlights the importance of managing public expectations to ensure the long-term success and credibility of quantum computing advancements. [more]
Web3 Cryptospace Spotlight
Ronin’s $10M error script: The $10 million Ronin bridge hack on August 6 was caused by a flaw in an upgrade deployment script, according to blockchain security firm Verichains. The script failed to initialize a key function, reducing the vote threshold to zero, allowing any user to withdraw funds without a signature. Fortunately, a white-hat MEV bot intercepted the transaction, returning most of the stolen funds. [more]
$5.1B in illicit crypto transactions linked to UK: The UK's National Crime Agency (NCA) has issued a report warning about the escalating threat of serious organized crime in the country. The report details how criminal groups are increasingly using advanced technology, such as encrypted communications and cryptocurrencies, to facilitate drug trafficking, money laundering, and cybercrime. These networks are becoming more sophisticated and globalized, making it harder for law enforcement to keep up. The NCA calls for enhanced cooperation between domestic and international agencies to effectively counter these threats. [more]
Over $55M DeFi vault targeted and drained: A group of exploiters, known as "whale hunters," successfully drained $55.47 million from a DeFi vault by exploiting vulnerabilities in its smart contract. They used a sophisticated strategy involving flash loans and manipulated market conditions to force the liquidation of the account's assets. This allows them to profit from the ensuing arbitrage opportunities. This attack is a reminder of the risks inherent in DeFi where large accounts can be targeted and exploited. [more]
Aviation Technology Risk
Aviation cyberattacks concerns: Robson Freitas emphasizes that cyberattacks are currently the biggest threats to aviation security. With the increasing reliance on digital technology in the industry, many are unaware of the necessary security measures to protect data and networks. Risks span across various areas, including aircraft systems (e.g., flight data sharing and GPS for landings), airport operations (e.g., automated boarding and security systems), and air operators (e.g., web check-in and onboard Wi-Fi). These vulnerabilities underscore the urgent need for enhanced cybersecurity knowledge and protections in aviation. Freitas foresees cyber-physical threats evolving with greater complexity, stressing the need for comprehensive training and preparedness in both companies and government agencies to proactively safeguard against these interconnected risks. [more]