Episode 88: Firmware, Fraud, and Federal Fumbles

Links https://www.wral.com/story/a-hacker-s-ransom-inside-the-cyberattack-that-compromised-nc-student-and-teacher-records/21989281 https://thehackernews.com/2025/05/breaking-7000-device-proxy-botnet-using.html https://www.bleepingcomputer.com/news/security/magento-supply-chain-attack-compromises-hundreds-of-e-stores https://www.washingtonpost.com/technology/2025/05/06/signal-archive-cybersecurity-waltz-wyden https://www.washingtonpost.com/politics/2025/05/01/waltz-signal-app-photo-cabinet https://en.wikipedia.org/wiki/United_States_government_group_chat_leaks PowerSchool Breach: When 'Delete' Doesn't Mean Gone Executive Summary PowerSchool, who is a major educational data management provider, suffered a significant data breach, then assured victims that the situation was contained and the stolen data deleted after a ransom payment. Now, threatening emails demanding cryptocurrency payments are sent to North Carolina public school employees, indicating that the compromised data remains in the hands of malicious actors. DetailsThe Initial BreachIn December 2024, PowerSchool's systems were breached, exposing personal data of students and teachers.The breach was reportedly due to compromised credentials lacking multifactor authentication, allowing unauthorized access to sensitive information.Ransom Payment and AssurancesPowerSchool paid a ransom and claimed to have witnessed the deletion of the stolen data via video.They assured stakeholders that the situation was contained, and that the data would not be made public.Emergence of Threatening EmailsIn May 2025, North Carolina public school employees received emails from individuals claiming to possess the stolen data, demanding cryptocurrency payments to prevent its release.Response from AuthoritiesThe North Carolina Department of Public Instruction (DPI) and PowerSchool have notified law enforcement agencies in the U.S. and Canada.DPI advised recipients of the threatening emails not to engage and to report such incidents through official channels. Transition to a New SystemNorth Carolina public schools plan to transition from PowerSchool to Infinite Campus for data management starting July 1, 2025. This decision was made to enhance data security and restore trust in the system. DefenseImplement Robust Access ControlsEnsure all accounts, especially those with administrative privileges, use multifactor authentication to prevent unauthorized access.Vet Third-Party Vendors ThoroughlyConduct comprehensive security assessments of third-party vendors handling sensitive data. Regular audits and compliance checks can help identify potential vulnerabilities.Develop a Comprehensive Incident Response PlanPrepare for potential breaches with a well-defined incident response plan, including communication strategies, data recovery procedures, and legal considerations.Educate and Train StaffRegularly train employees on cybersecurity best practices, recognizing phishing attempts, and proper data handling protocols.Limit Data Collection and RetentionCollect only necessary data and establish clear retention policies to minimize the amount of sensitive information at risk.Monitor for Unusual ActivityImplement monitoring tools to detect unusual activities or access patterns that could indicate a breach or attempted intrusion. Communicate Transparently In the event of a breach, maintain transparent communication with stakeholders, providing timely updates and guidance on protective measures. When Your Toaster Joins a Cybercrime Ring Executive Summary In a significant cybersecurity operation dubbed "Operation Moonlander," Dutch and U.S. authorities dismantled a sprawling proxy botnet comprising over 7,000 infected Internet of Things (IoT) and end-of-life (EoL) devices. This network, powered by the "TheMoon" malware, had been operational since 2004, offering anonymized proxy services to cybercriminals. The illicit enterprise generated over $46 million in revenue by compromising devices such as routers, primarily in the U.S., Canada, and Ecuador. StoryInfrastructureThe botnet exploited vulnerabilities in IoT and EoL devices, particularly routers, to create a vast proxy network.Infected with "TheMoon" malware, enabling persistent remote access and control.The malicious network facilitated anonymous cyber activities, including credential stuffing and other illicit operations.Financial OperationsCybercriminals monetized the botnet by offering proxy services through websitesUsers paid subscription fees ranging from $9.95 to $110 per monthamassing over $46 million in revenue.Provided anonymity for various malicious activities.Law Enforcement InterventionIn May 2025, coordinated efforts by Dutch and U.S. law enforcement agencies led to the takedown of the botnet's infrastructure.Four individuals (three Russian nationals and one Kazakhstani) were charged by the U.S. Department of Justiceroles in operating and profiting from the proxy servicesSeized domains and disrupting command-and-control servers based in Turkey. Technical InsightsThe botnet's command-and-control infrastructurefive serversfour communicating over port 80one using UDP on port 1443.Servers managed the infected devices, facilitating data exfiltration and control. malware exploited known vulnerabilities in outdated devices DefenseRegularly Update and Patch DevicesEnsure all network-connected devices, especially IoT and routers, receive timely firmware and security updates. Outdated devices are prime targets for exploitation.Replace End-of-Life Equipmentretire devices that no longer receive manufacturer support or security patches. Continuing to use EoL hardware exposes networks to unnecessary risks. Implement Network Segmentation Isolate IoT devices from critical network segments to contain potential breaches and limit lateral movement within the network.   The Phantom Backdoor: Six Years of Silent Sabotage Executive Summary A coordinated supply chain attack has compromised between 500 and 1,000 Magento-based e-commerce stores through 21 backdoored. These extensions, some infected as far back as 2019, contained dormant PHP backdoors that were activated in April 2025, granting attackers full control over affected servers. The malicious code allowed for arbitrary code execution, data theft, and administrative access, posing significant risks to both merchants and customers. StorySansec is a company that does ecommerece vulnerability and malware scanning.Sansec researchers identified 21 Magento extensions injected with a PHP backdoor, primarily from Tigren, Meetanshi, and MGS.backdoor resided in license verification files and remained dormant for years before activation. April 2025 dormant backdoors were activatedexecute arbitrary PHP codeupload web shells gain administrative access Vendors Varied Responses via SanSecTigrenDenied any breach and continues to distribute the affected extensions.MeetanshiAcknowledged a server breach but did not confirm extension compromise. MGS Did not respond to inquiries. Indicators of Compromise (IoCs) Check ExtensionsTigrenAjaxsuite, Ajaxcart, Ajaxlogin, Ajaxcompare, Ajaxwishlist, MultiCODMeetanshiImageClean, CookieNotice, Flatshipping, FacebookChat, CurrencySwitcher, DeferJS MGS Lookbook, StoreLocator, Brand, GDPR, Portfolio, Popup, DeliveryTime, ProductTabs, Blog DefenseAudit Installed ExtensionsRegularly review and audit all installed extensions for signs of tampering or unauthorized code.Source Extensions from Trusted VendorsOnly install extensions from reputable vendors with a track record of security and prompt vulnerability disclosures.Implement File Integrity MonitoringUse tools to monitor critical files for unexpected changes, which can indicate a compromise.Regularly Update and Patch SystemsKeep Magento and all extensions up to date with the latest security patches to mitigate known vulnerabilities.Conduct Security ScansEmploy security scanning tools to detect malware and vulnerabilities within your Magento installation.Backup and Recovery PlanningMaintain regular backups and have a recovery plan in place to restore systems in the event of a breach. Educate Development Teams Train developers and administrators on secure coding practices and the importance of supply chain security. The TeleMessage Debacle in Government Communications Develop an incident response plan to address security breaches swiftly. This includes identifying the breach, containing it, notifying affected parties, and taking corrective actions to prevent future incidents. Executive Summary To archive encrypted communications, the Trump administration adopted TeleMessage, a modified version of the Signal app. However, this solution introduced significant security vulnerabilities, leading to breaches by hackers who accessed data from U.S. agencies. Senator Ron Wyden has called for a Justice Department investigation into whether the use of TeleMessage has compromised national security and violated federal laws. StoryThe administration sought a solution to archive encrypted messages.TeleMessage, an Israeli-developed app, was adopted to fulfill this needHackers successfully breached TeleMessage systems, accessing data from U.S. agencies such as Customs and Border Protection.The contents of messages were not disclosedbreach highlighted the app's vulnerabilities and the potential exposure of sensitive information.The Justice Department to investigate TeleMessage's security practicesquestioning whether the company misrepresented its product's security featurespotential violations of the False Claims Act and the involvement of foreign governments. Debate about the use of third-party applications for official government communications.need for rigorous security assessments adherence to federal records laws DefenseVet Third-Party Applications ThoroughlyBefore adopting any third-party communication tools, conduct comprehensive security assessments to ensure they meet the organization's security and compliance requirements.Implement Robust Security ProtocolsEstablish clear policies for secure communication, including the use of approved applications, regular security training for staff, and protocols for handling sensitive information.Monitor and Audit Communication ChannelsRegularly monitor and audit communication channels to detect unauthorized access or potential breaches. Implement intrusion detection systems and maintain logs for accountability.Ensure Compliance with Legal and Regulatory StandardsStay informed about legal and regulatory requirements related to data security and records retention. Ensure that all communication practices comply with applicable laws to avoid legal repercussions. Respond Promptly to Security Incidents