Secret CISO #17: ChatGPT is in APT NOW among High-Profile Breaches at EY, Southern Water, and Beyond.

Secret CISO

Feb 14, 2024 — 7 min read

Happy to be with you again in this Wednesday edition of the Secret CISO newsletter! As we continue to navigate the ever-evolving landscape of cybersecurity, our commitment to keeping you informed and ahead of the curve remains steadfast.

Today, we're delving into a range of significant developments that have captured our attention. From the challenges and potential decline of ransomware groups to innovative uses of AI by APTs for vulnerability research and malware scripting, the cybersecurity world is buzzing with activity. We'll also explore notable data breaches, including the recent incidents at prominent organizations like BMW and Ernst & Young, underscoring the importance of vigilance and robust security measures.

Additionally, we'll spotlight the latest in cybersecurity career opportunities, highlighting the demand for leadership in safeguarding digital assets across various industries. As we share insights and analyses on these critical topics, we also want to take a moment to wish everyone a Happy Valentine's Day. May this day remind us of the importance of connections, not just personally but professionally, as we work together to secure our digital world. Stay safe, stay informed, and let's continue to rise above the challenges together.

1. Data Breaches

Aristocrat Technologies Data Breach

Aristocrat Technologies experienced a significant data breach, as investigated by Lynch Carpenter. The breach potentially exposed sensitive information, including Social Security numbers, national identifiers, and government-issued identifiers of individuals. This incident highlights the growing threat to the security of personal information in the technology sector and underscores the importance of robust data protection measures.

Ernst & Young Data Breach

Ernst & Young, a leading professional services firm, suffered a data breach that prompted an investigation by Lynch Carpenter, LLP. The breach notification sent to affected individuals raises concerns about the security of personal and sensitive information managed by global consultancy firms. This breach is particularly concerning given the vast amount of confidential client information Ernst & Young handles.

Southern Water Data Breach

Southern Water confirmed that hackers stole the personal data of approximately 470,000 customers in a recent cyberattack. This breach is one of the largest affecting UK utility customers, compromising personal details and highlighting the vulnerabilities in the infrastructure of essential service providers.

Jeff Wyler Automotive Data Breach

Jeff Wyler Automotive Family experienced a data breach when an unauthorized third party accessed its computer systems, potentially compromising personal consumer information. This breach underscores the cybersecurity risks facing the automotive industry and the importance of safeguarding customer data against unauthorized access.

Signature Performance Data Breach (January 2024):

Signature Performance, Inc. reported a data breach in early 2024, affecting an unspecified number of individuals. The breach involved unauthorized access to sensitive information, prompting a formal notice to the Montana Attorney General. This incident highlights the ongoing cybersecurity challenges in the healthcare and service provider sectors, emphasizing the critical need for enhanced data protection strategies.

2. Top CVE

CVE-2024-24691

Zoom Desktop Client Vulnerability. This vulnerability in the Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows stems from improper input validation. It could allow an unauthenticated user to escalate their privileges through the network. This highlights the critical importance of input validation in software development and the potential for significant security implications for users and organizations relying on Zoom for communication.

CVE-2024-21412

Internet Shortcut Files Security Bypass. This vulnerability represents a security feature bypass through the manipulation of Internet Shortcut files. The exploitation of this flaw could allow attackers to bypass security mechanisms designed to protect users from malicious websites or code. It underscores the need for continuous enhancement of security features to address novel bypass techniques.

CVE-2024-21410

Microsoft Exchange Server Vulnerability.This elevation of privilege vulnerability in Microsoft Exchange Server could allow an attacker to gain elevated privileges within the server environment. It demonstrates the ongoing challenges in securing complex server infrastructures and the importance of robust access control and monitoring systems to prevent unauthorized access.

CVE-2024-21351

Windows SmartScreen Security Bypass. This vulnerability allows attackers to bypass the Windows SmartScreen feature, which is designed to warn users about running untrusted software. The ability to bypass such a critical security feature poses significant risks, highlighting the constant arms race between security professionals and attackers seeking new methods to circumvent protective measures.

CVE-2024-22131

SAP ABA Interface Vulnerability. In SAP ABA versions, this vulnerability allows an authenticated attacker with remote execution authorization to exploit a vulnerable interface. This can lead to unauthorized application function invocations, potentially compromising system integrity. It accentuates the need for secure coding practices and thorough access control measures within enterprise applications to prevent exploitation.

3. Security Research

Ransomware Decline Observation

BankInfoSecurity and GovInfoSecurity report that ransomware groups may be struggling, suggesting a possible decline in ransomware activities. Researchers like Yelisey Bohuslavskiy and Marley Smith from RedSense indicate that advancements in cybersecurity measures and increased security awareness among organizations could be contributing factors. This shift underscores the importance of maintaining robust security postures and the potential for a changing landscape in cyber threats.

APT Groups Utilizing ChatGPT

SecurityWeek highlights an intriguing development where Advanced Persistent Threat (APT) groups are using ChatGPT for vulnerability research and malware scripting. This novel approach by cybercriminals to leverage AI tools for malicious purposes emphasizes the evolving nature of cyber threats and the need for adaptive security strategies to counteract sophisticated techniques.

Ubuntu Exploit Warning

Researchers at Aqua Security, as reported by OMG! Ubuntu, have discovered a security flaw in Ubuntu's "command not found" feature, which could be exploited to push malicious snaps. This vulnerability illustrates the continuous need for vigilance and prompt patching in the open-source community to protect against innovative attack vectors.

BMW Security Lapse

Yahoo Finance and TechCrunch report a security lapse at BMW, discovered by security researcher Can Yoleri from SOCRadar. An exposed cloud storage server at BMW could have led to the leak of sensitive company information. This incident highlights the critical importance of secure cloud storage practices and the potential risks associated with data exposure.

KTrust's Automated Red Team for Kubernetes Security

TechCrunch introduces KTrust's launch of an automated red team solution for Kubernetes security, aiming to provide continuous threat exposure management (CTEM). This tool represents a significant advancement in automated security testing, offering organizations the ability to proactively identify and mitigate vulnerabilities in their Kubernetes environments.

4. CISO Jobs

Danone Cyber Security Leadership Opportunity

Danone is seeking a Head of Cyber Security in Broomfield, CO, offering a salary range of $130K to $160K per year for a hybrid work model. This position highlights the growing demand for cybersecurity leadership within the food and beverage industry, emphasizing the importance of protecting sensitive data and ensuring compliance with industry regulations.

Intaso's Sales Leadership in Cybersecurity

Intaso is looking for a Regional Cybersecurity Sales Director in Charlotte, NC, with a remote work arrangement. The role offers $150K per year plus stock options and commission, reflecting the lucrative opportunities in cybersecurity sales and the importance of strategic regional leadership to drive growth in cybersecurity solutions.

U.S. Department of Transportation Cybersecurity Director

The U.S. Department of Transportation is offering a position for a Director of Cybersecurity & Privacy in Great Neck, NY, with a hybrid work model and a salary range of $160K to $190K per year. This role underscores the government's commitment to enhancing cybersecurity and privacy protections within the transportation sector.

C3 AI's Head of Information Security

C3 AI in Redwood City, CA, is seeking a Head of Information Security for an on-site role, with a salary ranging from $200K to $295K per year. This position highlights the critical need for top-tier security leadership in AI-driven enterprises, focusing on safeguarding intellectual property and customer data in the rapidly evolving tech landscape.

Paycor's Executive Cybersecurity Position

Paycor is looking for a Vice President & Chief Information Security Officer, offering a remote position across the United States with a salary range of $197.9K to $337.8K per year, including a 401(k) benefit. This executive role reflects the strategic importance of cybersecurity in the fintech sector, emphasizing the need for senior leadership to oversee comprehensive information security strategies and initiatives.

Final Words

Thank you for reading Secret CISO #17!

We hope you found the insights and updates both informative and valuable. As we continue to navigate the evolving landscape of cybersecurity, sharing knowledge and staying informed are more crucial than ever.

Please consider sharing this newsletter with friends and colleagues who might also benefit from these updates. As a token of our appreciation for your support and to add a bit of digital cheer, we're sharing a "cyber bee" digital gift with you. Enjoy, and let's keep the conversation on cybersecurity buzzing!

Thank you again for your time and interest in our newsletter!

Always with you in all the cyber challenges, Secret CISO Team.