eMail subject: Sensitive Data Filter Easily Bypassed in Microsoft Recall; German Authorities Sinkhole Android Malware; CISA Invites Comment on New Cyber Incident Plan

Microsoft's Recall AI feature for Copilot+ PCs was delayed for six months before limited release in December, 2024, in large part due to alarms raised over its security risks. The feature captures screenshots every few seconds and uses AI to make them searchable in a timeline, but the database of screenshots was originally stored in plain text. The new release is opt-in rather than opt-out, and encrypts screenshots, but the "filter sensitive information" safeguard -- meant to prevent Recall from storing data such as credit card numbers or social security numbers -- works inconsistently and is trivial to bypass, as demonstrated in a report from Avram Piltch at Tom's Hardware. "It's pretty much impossible for Microsoft's AI filter to identify every situation where sensitive information is on screen and avoid capturing it," states Piltch, showing Recall capturing user credentials typed in Notepad, a social security number entered in a PDF in the Edge browser, and credit card details in a local HTML page. The article also shows how an attacker with a stolen PIN can bypass biometric security checks to open Recall, even through remote access software.

Germany's Federal Office for Information Security (BSI) published a press release on December 12 describing their successful campaign to intercept network traffic between over 30,000 malware-infected devices and their command-and-control (C&C) servers. BSI "instruct[ed] all internet providers in the country with more than 100,000 subscribers to help redirect traffic to the sinkhole." All devices observed by BSI, including media players, internet-connected picture frames, and possibly phones and tablets, were running outdated Android operating systems and were infected with BadBox malware at some point in the supply chain before being purchased. BadBox "can secretly create email and messenger accounts ... spread fake news, carry out advertising fraud, and serve as a proxy."

The Cybersecurity and Infrastructure Security Agency (CISA) is inviting public comment on an updated plan for public and private sector response in the event of "significant cyber incidents." The original plan was created in 2016, and CISA has collaborated with "over 150 experts from 66 organizations" to create this new draft in response to the 2023 National Cybersecurity Strategy and major changes in the threat landscape and "national response ecosystem," with the additional goal of broadening guidance to more "non-federal stakeholders." The plan emphasizes that "the NCIRP is not a step-by-step instruction manual on how to conduct a response effortÑnor could it be, as every incident and every response is different. Rather, the NCIRP sets out a flexible structure that responders can use to shape their efforts and maximize both efficiency and coordination." The four main elements of this structure are Asset Response, "assisting affected entities with protection of their assets"; Threat Response, conducted by law enforcement entities and the Secret Service; Intelligence Support to foster "threat awareness and sharing of related intelligence"; and the responsibility of each discrete "Affected Entity" to conduct its own incident response. Volt Typhoon is mentioned by name in the introduction.

Researchers at Aqua Nautilus have detected critical vulnerabilities that could affect more than 336,000 internet-exposed Prometheus servers and exporters. The Prometheus open-source monitoring and alerting toolkit is widely used. The vulnerabilities could be exploited to allow information disclosure, denial-of-service attacks, and remote code execution. Aqua researchers write that 'According to the Prometheus documentation it is presumed that untrusted users can view information about Prometheus.' The Aqua report suggests mitigations, including strengthening authentication and authorization, limiting external exposure, and inspecting open-source links to prevent RepoJacking.

Amnesty International has published a report describing instances and analysis of privacy intrusions on civilian devices by the Serbian government. According to Amnesty's researchers, during interviews the authorities unlocked confiscated devices with Cellebrite software and installed "a previously unknown form of spyware." Cellebrite is a forensic data extraction tool "used by police worldwide to crack into locked phones," and the new spyware (dubbed NoviSpy) discovered appears to have been purpose-built in Serbia for surveillance of Android phones; it allows "capturing sensitive personal data from a target's phone after infection and provides the ability to turn on the phone's microphone or camera remotely." Activists and dissident journalists appear to be the primary targets of these "unlawful and illegitimate" uses of Cellebrite, and an IP address receiving communication from NoviSpy links the spyware to Serbia's Security Information Agency (BIA). Amnesty asserts that "all information available to date indicates that Cellebrite has not taken sufficient and effective measures to use its leverage to address the human rights risks in Serbia."

A joint fact sheet published by the Cybersecurity and Infrastructure Security Agency (CISA) and the Environmental Protection Agency (EPA) on December 13 highlights the need to secure Human Machine Interfaces (HMIs) connected to the internet. After commonly finding exposed HMIs through public scanning, CISA and EPA urge implementation of a list of mitigations including taking inventory of internet-exposed devices and disconnecting HMIs from the internet if possible; eliminating default passwords and strengthening authentication with MFA; segmenting networks and using geo-fencing; patching and updating; screening IP addresses to limit access; being vigilant to remote login attempts; implementing vendor security recommendations; and using CISA's "free cybersecurity vulnerability scanning service."

A Rhode Island state benefits portal suffered a cyberattack earlier this month. Deloitte, which manages the RIBridges portal, says there is a 'high probability' that sensitive data were stolen. Deloitte notified the state of the incident on Friday, December 13. The portal allows Rhode Island citizens to apply to multiple benefits programs, including Medicaid, Supplemental Nutrition Assistance Program (SNAP), Child Care Assistance Program (CCAP), and General Public Assistance (GPA) Program. Because the RIBridges system is currently unavailable, residents will need to use the mail to send paper applications for services.

A December 11 service disruption that affected OpenAI's ChatGPT, the API, and Sora, has been blamed on the deployment of a new telemetry service. In all, the OpenAI service experienced roughly four hours of 'significant degradation or complete unavailability.' OpenAI writes that 'the new service's configuration unintentionally caused every node in each cluster to execute resource-intensive Kubernetes API operations whose cost scaled with the size of the cluster.'

South Carolina-based SRP Federal Credit Union has disclosed a cybersecurity incident that resulted in the theft of personal information belonging to more than 240,000 people. SRP says intruders had access to their network between September 5 and November 4, 2024. The credit union has notified the offices of attorneys general in Maine and Texas, and is sending written notification to affected individuals.