SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Oracle Denies Cloud Breach Because Servers Were 'Obsolete'
After denying that a reported March 20, 2025 breach of Oracle Cloud took place, Oracle has now sent emails to customers informing them that "a hacker did access and publish user names" and encrypted or hashed passwords, specifying that the credentials were on "obsolete servers that were never a part of OCI," and therefore that "the Oracle Cloud -- also known as Oracle Cloud Infrastructure or OCI -- has NOT experienced a security breach." Oracle's notification email states that in the specific context of OCI, customer environments, customer data, and cloud service have not been compromised. Multiple news sources have received confirmation of the leaked data's authenticity from Oracle customers. Kevin Beaumont characterized Oracle's response as "wordplay," and asked, "How long was the attacker in the SaaS solution (that Oracle manage)? What did they do with the access? How long were they in for? Why were 'legacy' systems containing customer info left unmanaged and insecure?" Oracle is currently facing a class-action lawsuit over a separate breach of Oracle Health servers, also not publicly acknowledged by the company.
Editor's Notes
- Slide 1 of 5
"No, it was an OLD plane that went down. It doesn't count as a crash!" The fastest way to lose trust is half-truths and evasiveness. I'm sure there are some great people doing great work there, but they're not putting their best foot forward.
- Slide 2 of 5
Clarification of the scope of the breach is helpful. The identities were stolen from the Oracle Cloud Classic (OCC) Oracle Identity Manager (IDM) database which included usernames, emails and hashed passwords. It is positioned as a legacy service, so you should be moving away from it if you are using it, disabling any remaining OCC IDM accounts. If you have an OCI account, which should have a different password from OCC, make sure that you're enforcing MFA.
- Slide 3 of 5
It would appear that Oracle is 'doubling-down' on their denial of a security breach of their network. If the servers were obsolete, then why not expunge all user data and take them off-line. It speaks to Oracle processes, or lack thereof. Honestly, it's not a good look for Oracle for being a responsible company.
- Slide 4 of 5
There is an ongoing lawsuit about this. I'm unsure I want to weigh in because I would prefer to look at the court documents to determine what is provided to the judge. Here is what I can tell you: this level of uncertainty may not be good for Oracle overall as it is trying to attract more customers onto its platform.
- Slide 5 of 5
As we noted last week, both orphan servers and data leak. Whether one calls this risk a "breach" is a matter of semantics. However, by whatever name, the risk must be identified and managed.
Slide 1 of 0- Slide 1 of 5
US Office of the Comptroller of the Currency Says Breach is Considered a Major Cybersecurity Incident
The US Office of the Comptroller of the Currency (OCC) told Congress that a February email system breach is considered a major cybersecurity incident. The breach was initially disclosed on February 26. The updated information provided to Congress says the OCC became aware of the incident on February 11. The breach led to the theft of "highly sensitive information relating to the financial condition of federally regulated financial institutions used in its examinations and supervisory oversight processes." The intruders had access to the email system for more than a year; in all, the incident compromised more than 150,000 emails from bank regulators dating back to 2023.
Editor's Notes
- Slide 1 of 3
The attackers had access to OCC email accounts, via compromised administrator accounts, for about 20 months, and the compromise was detected because of unusual interaction between administrator accounts and their mailboxes, which hints that behavior detection capabilities were recently enabled. The takeaway is to both enable behavior detection capabilities, and validate administrator accounts, to include enforcing MFA. Don't forget to not only monitor creation, but also reactivation of accounts.
- Slide 2 of 3
What's embarrassing is that the evildoer maintained persistence for over a year. It makes one wonder about the security controls in place, and oversight provided by the security staff. Let's worry less about who the threat actor is, and more on overhauling the security staff and monitoring of critical cybersecurity controls so that it 'happen again.
- Slide 3 of 3
While often beneath our notice, for most organizations, e-mail is a mission critical application. It is valuable resource requiring necessary protection and an attack vector and amplifier. Let this report be a warning.
Slide 1 of 0- Slide 1 of 3
CIS Will Provide Gap Funding for MS-ISAC
In the wake of funding cuts affecting the Multi-State Information Sharing and Analysis Center (MS-ISAC), the Center for Internet Security (CIS) has said they will provide temporary gap funding so MS-ISAC can continue providing services to state and local governments. MS-ISAC has more than 18,000 members, who receive services that include "network intrusion detection, a malicious domain blocking and reporting service, endpoint detection and response, a cybersecurity self-assessment program and a 24/7 security operations center."
Editor's Notes
- Slide 1 of 3
The MS-ISAC does wonderful work helping defend SLTTs who simply don't have the bench to do it all themselves. I sincerely hope they're able to continue their important work indefinitely!
- Slide 2 of 3
Along with the FS-ISAC, the MS-ISAC has been a leader, effective and useful. A new funding model should be found. My understanding is that the FS-ISAC is funded by subscription by its members.
- Slide 3 of 3
The core argument was the MS-ISAC functions were overlapping other CISA provided services, and CISA is facing cuts of their own. CIS's funding should last through the end of the fiscal year, allowing time to determine the long-term solution.
Slide 1 of 0- Slide 1 of 3
The Rest of the Week's News
Update WhatsApp for Windows to Fix Attachment RCE Flaw
Meta has published a security advisory disclosing a "spoofing issue" in WhatsApp Desktop for Windows, fixed as of version 2.2450.6. CVE-2025-30401, CVSS score not yet provided, would allow an attacker to use a maliciously crafted "mismatch" attachment to cause the recipient to "inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp," because the software would display the attachment according to its MIME type, but would select the file opening handler based on the filename extension. The flaw was reported through Meta Bug Bounty Submission by an external researcher. BleepingComputer notes that a similar flaw resulting in unwanted execution of Python and PHP attachments was patched by WhatsApp in July 2024.
Editor's Notes
- Slide 1 of 2
CVE-2025-30401 is still getting updates, and currently has a CVSS score of 6.7. Regardless, if you're using the Windows Desktop WhatsApp, update it. While there are not reports of active exploits, WhatsApp has been actively, successfully targeted in the past, as such, you want to review having it on desktops.
- Slide 2 of 2
Bug bounty programs have been available for well over a decade. They continue to prove their worth in finding critical vulnerabilities in both vendor and government programs. Product owners should not only focus on the immediate vulnerability but take the time to understand the root-cause for the vulnerability and fix it correctly.
Slide 1 of 0- Slide 1 of 2
CISA Adds Five CVEs to KEV, Including Vulnerabilities in CentreStack, Windows CLFS, and CrushFTP
The US Cybersecurity and Infrastructure Security Agency (CISA) has added five CVEs to their Known Exploited Vulnerabilities (KEV) catalog this week. The vulnerabilities include a use of hard-coded cryptographic key vulnerability in Gladinet CentreStack (CVE-2025-30406); a use-after-free vulnerability in Microsoft Windows Common Log File System (CLFS) Driver (CVE-2025-29824); an authentication bypass vulnerability in CrushFTP (CVE-2025-31161); and two vulnerabilities in Linux kernel: an out-of-bounds read issue (CVE-2024-53150) and an out-of-bounds access issue (CVE-2024-53197). The vulnerabilities have mitigation due dates between April 28 and April 30.
Editor's Notes
As government agencies go, CISA continues to be efficient and its services essential. Its funding is under pressure as much political as economic. It deserves our support.
Other Patch Tuesday Updates for April
Tuesday, April 8 also saw security updates from many other vendors, including Adobe, which patched 30 vulnerabilities in ColdFusion, 11 critical, as well as multiple vulnerabilities in a variety of products; Ivanti, which addressed six vulnerabilities in Endpoint Manager; VMware, which addressed vulnerabilities in Tanzu Greenplum and Tanzu Greenplum Backup; Zoom; Google Chrome; Siemens; Schneider Electric; Rockwell Automation, and ABB.
Editor's Notes
In case you were distracted by the Microsoft patch set, don't overlook all your browsers (Edge, Chrome, Firefox, etc.) and Adobe products, which addresses 54 flaws. Don't forget to review Apple's updates March 31 and April 1st. With spring break, make sure things didn't (or don't) get missed or postponed.
ChatGPT Used in Business Spam Campaign
Researchers at SentinelOne's SentinelLABS have observed a spam campaign targeting small and medium-size business websites' contact forms and chat widgets, using the chat API for OpenAI's gpt-4o-mini model to generate customized text, then automating sending large quantities of messages using the AkiraBot framework. The researchers note that "the use of LLM-generated content likely helps these messages bypass spam filters, as the spam content is different each time a message is generated. The framework also rotates which attacker-controlled domain is supplied in the messages, further complicating spam filtering efforts." OpenAI has disabled the API key involved and is continuing to investigate; SentinelLABS recommends using the set of rotating attacker-controlled domains as indicators of compromise and blocking them, as the content of the messages is not consistent.
Editor's Notes
- Slide 1 of 3
I don't think a marketing campaign exists without ChatGPT involvement. Legit or not.
- Slide 2 of 3
Evildoers will always use the tools available to them to carry out their crime. GenAI simply automates the process and expertly gets around the capabilities of spam filters. Those evildoers innovate just like defenders; some would say, even more quickly. The best defense remains implementation of a cybersecurity framework, like IG1 of the CIS Critical Security Controls.
- Slide 3 of 3
Tools are neutral; most are subject to abuse and misuse. My Dad had a high speed grinder mounted on his work bench. When I was six or seven, I used it to sharpen one of his screw drivers to a sharp edge. Now ninety, I still remember his craftsman's respect for his tools.
Slide 1 of 0- Slide 1 of 3
Europol Report on Biometric Vulnerability Preparedness for Law Enforcement
Europol has published a report that "identifies potential ways of exploiting vulnerabilities, thus enabling law enforcement agencies to update their systems and detect such incidents during investigations." In addition to describing attack scenarios for a variety of biometric protections, the report offers mitigation suggestions, including raising awareness within law enforcement, adopting advanced evasion detection techniques, ensuring that biometric systems have security baked in from the beginning, collaborating with experts, establishing standardized reporting and data aggregation, and ensuring that data are processed securely. The report was created as a collaborative effort by Europol's Operational and Analysis Centre and the Europol Innovation Lab.
Editor's Notes
- Slide 1 of 2
When was the last time you reviewed the risks around biometric authentication, particularly factoring in masks, deep fakes, voice replay, and artificial fingerprints? This report goes into great depth on how the biometrics are faked, and while directed towards law enforcement, includes risks and mitigations you may not have considered. Consider leveraging ISO/IEC 30107-3 when evaluating biometric systems with presentation attack detection capabilities.
- Slide 2 of 2
These are not so much vulnerabilities as they are fundamental limitations of the technologies. Biometrics are much more about convenience than security but may be useful as evidence in systems of strong authentication. Even here they must be implemented in such a way as to compensate for these fundamental limitations such as counterfeiting or capture and replay.
Slide 1 of 0- Slide 1 of 2
Sensata Technologies Reports Ransomware Attack
Major industrial sensor manufacturer Sensata Technologies has filed an 8-K form with the US Securities and Exchange Commission (SEC) disclosing a "ransomware incident" involving encryption of company devices and theft of files, that took place on April 6, 2025, impacting "operations, including shipping, receiving, manufacturing production," and support functions, with no timeline given for full restoration of services. Interim measures are in place to maintain certain functions, and on learning of the attack Sensata proactively took its network offline, implementing response protocols and containment measures; third-party cybersecurity professionals are assisting with ongoing investigation. The company will notify individuals and regulatory authorities after reviewing the files that were accessed and stolen. The company does not currently expect the incident to have a material financial and operational impact between now and June 30, 2025.
Editor's Notes
Even large, well-resourced companies fall victim to ransomware attacks. In this case, a classic double-extortion ransom play. Once the investigation is complete it would be helpful to understand what security controls were in place and what was the root-cause of the successful attack. However, given the legalese in their 8-K filing, it's doubtful the company will be as forthcoming on those type of details. I do give them some props, however, for at least mentioning 'ransomware' in the filing.