Malicious Code Founds in xz utils; US House of Representatives Bans Microsoft Copilot AI Chatbot; Help Us Improve NewsBites

Both RedHat and the US Cybersecurity and Infrastructure Security Agency (CISA) have warned of embedded malicious code in xz utils data compression library versions 5.6.0 and 5.6.1. CISA recommend downgrading to an unaffected version of the library. Researchers Andres Freund reported the vulnerability to Openwall on Friday, March 29.

The US House of Representatives has barred staff members from using the Microsoft Copilot AI chatbot. Microsoft Copilot “has been deemed by the Office of Cybersecurity to be a risk to users due to the threat of leaking House data to non-House approved cloud services.“ This is not the first timer legislators have restricted the use of AI applications: in June 2023, the House banned staffers’ use of the free version of ChatGPT and allowed only limited use of the paid version of the application.

Please take 3 minutes to give us your suggestions.

The US National Institute of Standards and Technology (NIST) has posted a new statement regarding the backlogs of analyzed CVEs in the National Vulnerability Database (NVD). Thousands of recently-reported CVEs have not undergone analysis, leaving them without important enrichment data. NIST says they are prioritizing the most pressing issues for analysis and “are working with [their] agency partners to bring on more support for analyzing vulnerabilities and have reassigned additional NIST staff to this task as well.” More than 20 security professionals recently signed an open letter to Congress and Commerce Secretary Gina Raimondo. The letter underscores the NVD’s importance to the cybersecurity community and “urges [the recipients] to expeditiously investigate the ongoing issues with the NVD to ensure NIST is provided with the necessary resources to not only resume normal operations of this critical service but to also improve it further to resolve extant issues that preceded the February 2024 service degradation.”

On March 27, JetBrains released TeamCity 2024.03, which includes fixes for 26 security issues. While JetBrains did not disclose details about the issues addressed in the update, they did note that it includes fixes for seven CVEs, including a high-severity improper validation of consistency with input issue (CVE-2024-31136) that could be exploited to bypass two-factor authentication. The other six CVEs are rated medium severity.

A vulnerability affecting the “wall” command in the util-linux core utilities package can be exploited to leak passwords and modify the clipboard. The researcher who discovered the vulnerability, which has been dubbed “WallEscape” described the issue in an advisory: “The util-linux wall command does not filter escape sequences from command line arguments.”

Last week, Python Package Index (PyPI) maintainers temporarily suspended new project creation and user registration while mitigating a malware upload campaign. The issue has been resolved and the suspension has been lifted. PyPI imposed a similar temporary suspension between December 27, 2023 and January 2, 2024.

Researchers at Lumen have identified “a multi-year campaign” that uses malware known as TheMoon. The campaign has been targeting end-of-life home and small office routers and IoT devices, recruiting them into a botnet that the threat actors rent out as a proxy service for cyber criminals. As of earlier this year, the botnet comprised more than 40,000 devices in 88 countries. TheMoon was first detected a decade ago.

A chatbot set up by New York City government to answer questions about city policy, laws, and regulations has been found to provide incorrect information about housing policy, rules regarding employee rights, whether businesses may refuse to accept cash payments (they may not), and other issues. In February, a court forced Air Canada to honor an inaccurate refund policy offered by its chatbot. In an emailed statement, a spokesperson for the NYC Office of Technology and Innovation said that they “will continue to focus on upgrading this tool so that we can better support small businesses across the city.”

The US Federal Communications Commission’s (FCC’s) Public Safety and Homeland Security Bureau (PSHSB) wants to know more about how communications service providers are implementing security measures to prevent spying via wireless protocols. Specifically, the FCC wants to know what the providers have done to harden their networks against the exploitation of the SS7 and Diameter protocols, which contain algorithmic weaknesses that could expose communications. The PSHSB also wants to know of any instances in which the protocols were successfully exploited.

AT&T has acknowledged that data leaked to dark web last month includes more than 70- million records of data belonging to current and former customers. Of those roughly 7.6 million are current customers; AT&T has reset passcodes for those individuals. All the compromised data appear to be from 2019 or earlier.