Welcome to today's issue of Secret CISO. We're diving into a sea of data breaches and security lapses that have been making waves in the tech world. From ZAGG Inc.'s credit card data breach to the White House's revelation of the 9th telecom company hit in the Salt Typhoon spree, it's clear that no industry is immune to cyber threats. We'll also be discussing the proposed changes to the HIPAA Security Rule, a move that aims to bolster the security of electronic protected health information. Meanwhile, Volkswagen Group is grappling with a massive data breach that has exposed the personal data of 800,000 EV owners in Europe.

In the wake of these incidents, lawsuits are being filed and ransoms are reaching record-breaking heights. We'll be examining the top 10 data breaches of 2024 and what they mean for the future of cybersecurity. On the other side of the globe, Andhra Pradesh Home Minister Anitha has ordered a probe into a security breach during Deputy CM Pawan Kalyan's visit. In the midst of these challenges, we'll also be exploring how rich text editors are helping government agencies maintain compliance with data security. Stay tuned for more updates on the Biden administration's proposed cybersecurity updates to curb healthcare data leaks, the massive VW Group data leak, and the latest research in AI safety and cybersecurity.

Remember, knowledge is power. Stay informed, stay secure.

Data Breaches

1. Hackers steal ZAGG customer's credit cards in third-party breach: ZAGG Inc. has reported a data breach where unauthorized individuals gained access to customer credit card data through a third-party compromise. Source: Bleeping Computer
2. White House says 9th telecom company hit in Salt Typhoon spree: The White House has reported that a ninth telecom company has been compromised due to lax security, with a single administrator account being the point of access. Source: Cybersecurity Dive
3. Volkswagen Group data breach exposes personal data of 800,000 EV owners in Europe: A data breach at Volkswagen Group has exposed the personal information of 800,000 electric vehicle owners in Europe. Source: Hindustan Times
4. Lawsuits filed in wake of RCI data breach that affected 225,000 people: Three people are pursuing federal class action claims following a data breach at a local health management company, RCI, that affected 225,000 people. Source: Star-Herald
5. Data-loss prevention company Cyberhaven hit by breach: Cyberhaven, a data-loss prevention company, has been hit by a data breach, according to a statement from the company. Source: ET CISO

Security Research

1. Hijacking of Legitimate Chrome Extensions for Data Theft: Cybercriminals have hijacked legitimate Chrome extensions in an attempt to steal user data. The attack, believed to be random, was not specifically targeting Cyberhaven. Source: The Verge
2. Stealing AI Models Without Hacking: Security researchers have discovered a method to steal AI models without resorting to hacking. The technique involves side channel attacks on edge devices. Source: Gizmodo
3. Potential Manipulation of ChatGPT Search Tool: A security researcher has found that the ChatGPT search tool could be manipulated using hidden content, potentially returning malicious code from websites it searches. Source: CNBCTV18
4. Security Concerns with TP-Link Routers: TP-Link routers are under scrutiny for potential security flaws, with the company actively seeking to identify and address these issues. Source: Houston Chronicle
5. AI Safety Fund's RFP for Biosecurity AI Research: The AI Safety Fund has issued a Request for Proposals (RFP) to support technical research evaluating potential risks and developing safety measures for AI systems. Source: Philanthropy News Digest

Top CVEs

1. CVE-2024-50716 - SQL Injection Vulnerability in Smart Agent v.1.1.0: A remote attacker can execute arbitrary code via the id parameter in the /sendPushManually.php. This vulnerability allows for potential unauthorized access and manipulation of data. Source: CVE-2024-50716
2. CVE-2024-50717 - SQL Injection Vulnerability in Smart Agent v.1.1.0: Another SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the client parameter in the /recuperaLog.php. This vulnerability poses a significant threat to data integrity and confidentiality. Source: CVE-2024-50717
3. CVE-2024-12991 - Cross Site Scripting in Beijing Longda Jushang Technology DBShop商城系统 3.3 Release 231225: A vulnerability in the /home-order file allows for cross-site scripting through the manipulation of the argument orderStatus. This vulnerability can be initiated remotely and can lead to unauthorized access to sensitive data. Source: CVE-2024-12991
4. CVE-2024-50944 - Integer Overflow Vulnerability in SimplCommerce: An integer overflow vulnerability exists in the shopping cart functionality of SimplCommerce. The issue lies in the quantity parameter in the CartController's AddToCart, potentially leading to unauthorized purchases or disruption of service. Source: CVE-2024-50944
5. CVE-2024-56732 - Heap-Based Buffer Overflow in HarfBuzz: A heap-based buffer overflow vulnerability exists in HarfBuzz, a text shaping engine. This vulnerability, present in versions 8.5.0 through 10.0.1, can lead to potential service disruption or unauthorized access to data. Source: CVE-2024-56732

Sponsored by Wallarm API Security Solution

Final Words

And that's a wrap for today's edition of Secret CISO. From the shocking credit card data breach at ZAGG to the proposed changes to HIPAA security rules, it's clear that cybersecurity remains a critical concern for businesses and individuals alike. As we navigate through the digital landscape, let's remember to stay vigilant and proactive in protecting our data. Remember, cybersecurity isn't just about protecting systems, it's about safeguarding our way of life in the digital age. So, let's continue to learn, adapt, and fortify our defenses against these ever-evolving threats.

If you found today's newsletter helpful, please consider sharing it with your friends and colleagues.

Let's work together to create a safer digital world. Until next time, stay safe and secure.