Cloud services with weak credentials were a prime target for attackers, often resulting in lateral movement attempts, a Google Cloud report found.
Dive Brief:
Cloud services accounts with weak or non-existent credentials were the most common entry point for attackers in the second half of 2024, Google Cloud said Wednesday in its Threat Horizons Report.
Attacks involving weak or no credentials accounted for nearly half of intrusions observed or studied by Google Threat Intelligence Group, Mandiant, Google Cloud’s Office of the CISO and other Google intelligence and security teams during the second half of last year.
Misconfigurations in cloud services were the second most common initial access vector, representing more than 1 in 3 attacks Google Cloud studied. The report noted a sharp increase in compromised application programming interfaces and user interfaces, which accounted for almost 1 in 5 attacks during the second half of the year.
A malicious software development kit (SDK) used in Android and iOS apps has been found to use optical character recognition to scan victims’ photo libraries, looking for cryptocurrency wallet IDs and recovery key information.
Any cryptocurrency information it finds hiding within the victim’s photo libraries is transmitted back to the operators, who then use it to gain access to and drain the wallets of their currency.
While not entirely unimaginable, this is a pretty novel attack method, and many people take photos of, for example, important information for safekeeping. Advances in OCR, including Apple and Google’s own machine learning algorithms, now make it trivial to search for certain content amongst thousands of photographs quickly.
DeepSeek, a Chinese competitor to OpenAI’s ChatGPT, received massive public attention and soared to the top of the App Store download charts when in launched recently. Here are some of the security-related events that subsequently occured.
Harmonic Security took a look at the data privacy concerns around the Chinese AI company, highlighting vague statements about data retention within the People’s Republic of China. The AI security firm concluded that very few (0.21%) of its customer’s users were actually using DeepSeek though. harmonic.security
DeepSeek limited signups amid a sudden wave of interest and in response to what it described as “large-scale malicious attacks on DeepSeek’s services”. theregister.com
Lots of examples have been shared on social media of DeepSeek refusing to answer questions about topics the Chinese Communist Party deems sensitive, such as the Tiananmen Square Massacre. An analysis by PromptFoo of 1,156 prompts found that these “canned refusals” were given 85% of the time and were reasonably easy to circumvent, suggesting, they say, that the censorship is more of a “crude, blunt-force” implementation rather than deeply baked into the reasoning model itself. arstechnica.com
The Chinese company appears to have pretty sloppy security engineering practices: Wiz security researchers found a publicly accessible database containing “a significant volume of chat history, backend data and sensitive information, including log streams, API Secrets, and operational details,” within ‘minutes’ of scanning DeepSeek’s infrastructure. The HTTP interface to the database allowed Wiz to run a SHOW TABLES; query, returning all the accessible tables. The log stream data may have included plaintext passwords and chat history. DeepSeek promptly fixed the issue after being notified. theregister.com
Italy blocked DeepSeek over privacy concerns after the company told the Italian data protection regulator that it did not fall under the purview of GDPR. therecord.media
A ransomware attack on Blue Yonder, a critical supply chain management software provider, has forced Starbucks to revert to manual processes for managing employee schedules and payroll systems.
The incident, which began on November 21, 2024, has not affected customer service or store operations.
Store managers are now using pen and paper to track employee hours, as the attack disrupted the company’s back-end scheduling and time management processes.
The attack has created ripple effects across multiple industries:
UK Retail Impact: Major British supermarket chains Morrisons and Sainsbury’s reported disruptions to their warehouse management systems, though they have implemented backup systems.
Corporate Response: Blue Yonder has enlisted external cybersecurity firms to assist with recovery efforts and implemented defensive protocols. The company has not provided a specific timeline for service restoration.
The incident highlights the vulnerability of supply chain systems during the holiday season. Blue Yonder serves an extensive client base, including:
46 of the top 100 manufacturers
64 of the top 100 consumer product goods makers
76 of the top 100 retailers globally
This attack adds to a growing list of cybersecurity incidents affecting major food service companies. Earlier in 2024, both McDonald’s and Panera experienced technical outages, with Panera’s incident resulting in a class action lawsuit after employee data was compromised.
“We are working around the clock to respond to this incident and continues to make progress. There are no additional updates to share at this time with regard to our restoration timeline following our post yesterday,” reads the Blue Yonder report.
The timing of the attack is particularly significant, as research shows that 86% of ransomware attacks target organizations during holidays or weekends. In 2023, cybercriminals extracted $1.1 billion in ransom payments globally despite governmental efforts to curb such activities.
This disruption presents an additional challenge for Starbucks’ new CEO, Brian Niccol, who is already dealing with three consecutive quarters of declining sales.
While the company works to resolve the situation, it prioritizes maintaining normal customer service operations and ensuring proper employee compensation.
