Hello Secret CISO readers, In today's issue, we delve into a series of data breaches that have sent shockwaves across the globe. From the escalating fallout of a data breach scandal in Europe to the exposure of 7.55 million customers' database in India's boAt Lifestyle, the cybersecurity landscape is under siege. We also explore the investigation underway in the BJMP cybersecurity website breach in the Philippines, perpetrated by a notorious hacker group. Meanwhile, in the US, Americans can claim up to $10,000 from a $1.05 million data breach settlement, highlighting the financial implications of such security lapses. In the world of AI, TrojAI, a provider of enterprise AI security solutions, announced a $5.75 million funding round, signaling a growing focus on AI security. However, Elon Musk's Grok AI Chatbot was found to have the weakest security, according to researchers. We also touch on the implementation of Zero Trust Architecture in healthcare, a sector that has been a prime target for cybercriminals. In addition, we discuss the potential risks of using older iPhones, as warned by security researchers. Lastly, we look at the latest vulnerabilities reported in Google Chrome and other software, underscoring the importance of regular updates and patches. Stay tuned for these stories and more, as we keep you updated on the latest happenings in the world of cybersecurity. Stay safe! Best, [Your Name]

Data Breaches

1. "Fallout from data breach scandal escalates": A data breach scandal has escalated, causing significant fallout. The specifics of the breach are not detailed, but the impact is evidently substantial. Source: eKathimerini.com
2. "boAt Lifestyle India faces an alleged data breach, 7.55 million customers database exposed": In March 2024, boAt Lifestyle India suffered a data breach, with the data of 7.55 million customers exposed. The breached data was uploaded to a platform on April 5, 2024. Source: The Tech Outlook
3. "Investigation underway in BJMP cybersecurity website breach": The Bureau of Jail Management and Penology (BJMP) in the Philippines is investigating a cybersecurity breach on its website. The attack was carried out by a hacker group known as Philippines Exodus Security (PHEDS). Source: Manila Bulletin
4. "Americans can claim up to $10000 from $1.05 million data breach settlement": An ambulance company has agreed to settle its data breach lawsuit, with Americans able to claim up to $10,000 from a $1.05 million pot. The specifics of the breach are not detailed. Source: The US Sun
5. "US Health Dept warns hospitals of hackers targeting IT help desks": The US Health Department has issued a warning to hospitals about hackers targeting IT help desks. This follows a data breach that exposed the information of 827,000 patients. Source: Bleeping Computer

Security Research

1. Elon Musk's Grok AI Chatbot Has Weakest Security, While Meta's Llama Stands Strong: Security researchers tested the defenses of popular AI models and found that Elon Musk's Grok AI chatbot had the weakest security, while Meta's Llama was more robust. Source: Decrypt
2. Evaluating AI Model Security Using Red Teaming Approach: Researchers have developed various testing and evaluation methods to probe the defenses of LLMs and MLLMs, ranging from altering textual inputs to more complex techniques. Source: MarkTechPost
3. Here's how much zero-day hacks for iPhone, iMessage, and more are worth: Apple's Security Research Bounty program offers security researchers up to $2 million for discovering zero-day vulnerabilities. Source: 9to5Mac
4. Are Burglars Using Wi-Fi Jammers on Homes? Here's What You Should Know: Research suggests that burglars may be using Wi-Fi jammers to disable smart home security systems, highlighting the need for homeowners to understand their security technology. Source: BusinessGhana
5. Potentially Huge Cyberattack Stopped by a Single Person: A potentially massive cyberattack was thwarted by a single security analyst, demonstrating the importance of individual vigilance in cybersecurity. Source: Newser

Top CVEs

1. CVE-2024-3159: Google Chrome versions prior to 123.0.6312.105 have a vulnerability in V8 that allows remote attackers to perform arbitrary read/write via a crafted HTML page. This is due to an out of bounds memory access issue. Source: CVE-2024-3159
2. CVE-2024-3156: Google Chrome versions prior to 123.0.6312.105 have a vulnerability in V8 that allows remote attackers to potentially perform out of bounds memory access via a crafted HTML page. This is due to an inappropriate implementation issue. Source: CVE-2024-3156
3. CVE-2024-3158: Google Chrome versions prior to 123.0.6312.105 have a vulnerability in Bookmarks that allows remote attackers to potentially exploit heap corruption via a crafted HTML page. This is due to a use after free issue. Source: CVE-2024-3158
4. CVE-2024-22328: IBM Maximo Application Suite 8.10 and 8.11 have a vulnerability that allows a remote attacker to traverse directories on the system. This can be done by sending a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Source: CVE-2024-22328
5. CVE-2024-2132: The Ultimate Bootstrap Elements for Elementor plugin for WordPress versions up to, and including, 1.4.0 is vulnerable to Stored Cross-Site Scripting via the Image Widget. This is due to insufficient input sanitization and output escaping on user supplied attributes. Source: CVE-2024-2132

Final Words

And that's a wrap for today's edition of Secret CISO. From the escalating fallout of data breaches to the increasing importance of maintaining a strong security posture, it's clear that cybersecurity is a field that never sleeps. As we navigate these complex issues, let's remember that we're all in this together. If you found today's newsletter insightful, consider sharing it with your friends and colleagues. After all, in the world of cybersecurity, knowledge is our greatest weapon. Stay safe, stay informed, and see you in the next edition of Secret CISO.