News of the Cyber World

[kyonides]

TikTok Challenge Leads to 85 Percent Jump in Hyundai, Kia Car Theft in Los Angeles

A new trend on the TikTok social media platform has led to an 85 percent increase in Hyundai and Kia car thefts in Los Angeles from last year, according to Police Chief Michel Moore.
...
These viral videos, which have been circulating on TikTok since May, show people how to break into Hyundai and Kia vehicles made between 2010 and 2021.

These cars were targeted because they lack an ignition immobilizer system, making them vulnerable to hot-wiring—a method to start a car without a key, according to the Los Angeles Police Department (LAPD).

...
People are hot-wiring the vehicles by disassembling a portion of the ignition and using a USB cord to start the engine, according to Moore. The videos have been viewed “tens of thousands of times, which we believe is influencing the theft of these vehicles,” he said.

It’s estimated that 1,600 Kia and Hyundai vehicles have been stolen this year so far. The department is recovering about 55 percent of the vehicles, with most of them being found both in other parts of the city and outside the city.

Moore is asking residents who own one of these cars to install a steering wheel lock, which can offer “both a visual and physical deterrent” to thefts.

Los Angeles isn’t the only city where such car thefts are on the rise. In Chicago, authorities reported a 767 percent increase in Hyundai and Kia vehicle thefts since the beginning of July.
...
Overall car thefts increased by 15 percent in Los Angeles last year, according to the LAPD.

Before you ever read the following article, heed my voice and remember this: stop using TikTok, guys!

TikTok Executive Won’t Commit to Halting Flow of Americans’ Data to China

A TikTok executive declined on Sept. 14 to make a commitment that the hugely popular short-video app would cut off flows of Americans’ data to China, during the first U.S. Senate hearing since recent reports on the company’s connections to the regime in Beijing.

TikTok Chief Operating Officer Vanessa Pappas, along with executives from other U.S. big tech companies, testified before the Senate Homeland Security Committee. During the hearing, Pappas faced a barrage of questions regarding Tiktok’s ties to Beijing and the potential for U.S. users’ data to be obtained by the Chinese Communist Party (CCP), which has become a bipartisan concern.
...
The short-video app...was founded by and is owned by ByteDance, a Beijing-based tech giant. The ties have drawn concerns in the United States and elsewhere over whether its data can be accessed by the CCP, given that its laws compel companies to cooperate with security agencies when asked.

Officials and experts say the personal data harvesting from Americans could be used by the CCP to conduct espionage operations, or even shape their perceptions to be favorable to the Chinese regime.
...
Between at least September 2021 and January, ByteDance engineers in China had access to nonpublic data of TikTok’s U.S. users, according to leaked recordings of 80 internal meetings cited by BuzzFeed News. In addition, TikTok employees at times had to turn to their colleagues in China to determine how U.S. data was flowing, which the U.S. staff weren’t authorized to independently access, the report said.

Albania says Iranian hackers hit the country with another cyberattack

Hackers tied to the Iranian government launched an attack against Albania’s government system used to track border crossings, Albanian officials said over the weekend.

The attack comes several days after the Albanian government cut diplomatic relations with Iran over a July 15 cyberattack attributed to multiple groups aligned with Iranian aims, and international condemnation of the attacks from the U.S., the U.K., and others. The U.S. government on Friday sanctioned Iran’s Ministry of Intelligence and its minister of intelligence over the attacks.
...
The U.S. first helped Albania implement the Total Information Management System (TIMS) in 2007, CNN’s Sean Lyngaas reported. The attack targeted the data storage and transmission systems for TIMS, the Albanian Ministry of the Interior said in a statement. Homeland Justice, the front group that claimed responsibility for the July attacks, posted a video to both its Telegram channel and website showing what appeared to be a video feed from the TIMS system.

Iran’s foreign ministry spokesperson Nasser Kanaani on Saturday condemned the U.S. sanctions and Albania’s decision to cut diplomatic ties...He added that the the U.S. is “giving full support to a terrorist sect,” referring to the Mojahedin-e-Khalq (MEK), an Iranian opposition group that the Iranian government considers terrorists.

Nope, people. I am not double posting here. It just happens that Iran keeps targeting US allies out of mere amusement (among many other things), guys. Therefore, US government needs to take some extra measures to deter them from attacking more systems in the Western world.

U.S. government takes sweeping action against Iranian hackers accused of ransomware spree

The U.S. government on Wednesday announced wide-ranging punitive actions against 10 Iranians and two Iranian companies — including sanctions, indictments and multiple $10 million rewards — related to a spree of breaches and ransomware attacks around the U.S. dating to October 2020.

All 10 people and the two companies are affiliated with Iran’s Islamic Revolutionary Guard Corps, the U.S. Treasury Department said in a statement.
...
According to an indictment unsealed today, Mansour Ahmadi, Ahmad Khatibi and Amir Hossein Nickaein Raviri “engaged in a scheme to gain unauthorized access to the computer systems of hundreds of victims in the United States, the United Kingdom, Israel, Iran, and elsewhere, causing damage and losses to the victims,” according to a Department of Justice statement.

Each face charges of conspiring to commit computer fraud and related activity in connection to computers, intentionally damaging a protected computer and transmitting a demand in relation to damaging a protected computer. Ahmadi faces an additional count of intentionally damaging a protected computer, the DOJ said.

The State Department’s Rewards for Justice announced rewards of up to $10 million each for information on the suspects’ location.

Blame game follows Uber hack. Experts say don't fault employee.

In the wake of the Uber hack, allegedly by an 18-year-old who claimed he pwned the company because it had weak security, the conversation in infosec circles quickly centered on how it could possibly have been so easy to compromise one of the world’s most valuable tech companies.
...
[He] told The New York Times late Thursday that they’d socially engineered an Uber employee to gain access to the company’s systems. Screenshots shared across Twitter and other platforms seemed to demonstrate the wide-ranging access the attacker achieved, including to Uber’s accounts with Amazon Web Services, Google Suite and HackerOne.

The attacker told Corben Leo, a researcher and developer, that they gained access to a privileged access management tool which, when queried, revealed the credentials for the range of services.

That relative ease...shows that this is a structural systems problem, not a problem at the individual employee level.
...
Bill Demirkapi, a researcher and security engineer with Microsoft, pointed out on Twitter that “the scope of the attack demonstrates another problem with centralizing authentication,” which is that “it can often be a single point of failure that can give attackers a wide variety of access, as we’ve seen in this example.”

If the details are accurate about how the attacker gained access, initially by spamming the employee with push-based multi-factor authentication requests, Demirkapi added, then this is not just an Uber problem. “The practices that led to their compromise are shockingly common,” he tweeted. “Vulnerable MFA is used everywhere, >60% of sites don’t even support hardware tokens.”

Similar attack methods were used in the recent breaches of Twilio, Okta and roughly 130 other companies, according to Group-IB, and experts say it’s a tactic on the rise.