Apple updates, Teamviewer breached in cyber attack and critical MOVEit Transfer patch... all in this week's Security News...
Welcome to this week’s Security News. We’ve collated the best articles from the around the internet and put them all into one place. If you have any queries or concerns about anything in this week’s news, then please get in touch with our team who can advise further. For our existing clients, if we believe anything may affect your organisation, our team will be in touch directly.
Vulnerabilities and Patches
Apple Patches AirPods Bluetooth Vulnerability That Could Allow Eavesdropping
Apple has released a firmware update for AirPods that could allow a malicious actor to gain access to the headphones in an unauthorized manner. Tracked as CVE-2024-27867, the authentication issue affects AirPods (2nd generation and later), AirPods Pro (all models), AirPods Max, Powerbeats Pro, and Beats Fit Pro. “When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones,” Apple said in a Tuesday advisory. In other words, an adversary in physical proximity could exploit the vulnerability to eavesdrop on private conversations. Apple said the issue has been addressed with improved state management.
Exploit Attempts Recorded Against New MOVEit Transfer Vulnerability - Patch ASAP!
A newly disclosed critical security flaw impacting Progress Software MOVEit Transfer is already seeing exploitation attempts in the wild shortly after details of the bug were publicly disclosed. The vulnerability, tracked as CVE-2024-5806 (CVSS score: 9.1), concerns an authentication bypass that impacts the following versions – From 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, and from 2024.0.0 before 2024.0.2. “Improper authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass,” the company said in an advisory released Tuesday. Progress has also addressed another critical SFTP-associated authentication bypass vulnerability (CVE-2024-5805, CVSS score: 9.1) affecting MOVEit Gateway version 2024.0.0. Successful exploitation of the flaws could allow attackers to bypass SFTP authentication and gain access to MOVEit Transfer and Gateway systems.
Cyber Attacks
TeamViewer's corporate network was breached in alleged APT hack
The remote access software company TeamViewer is warning that its corporate environment was breached in a cyberattack yesterday, with a cybersecurity firm claiming it was by an APT hacking group. “On Wednesday, 26 June 2024, our security team detected an irregularity in TeamViewer’s internal corporate IT environment,” TeamViewer said in a post to its Trust Centre. “We immediately activated our response team and procedures, started investigations together with a team of globally renowned cyber security experts and implemented necessary remediation measures.” The company says that it plans to be transparent about the breach and will continuously update the status of its investigation as more information becomes available.
New Medusa Android Trojan Targets Banking Users Across 7 Countries
Cybersecurity researchers have discovered an updated version of an Android banking trojan called Medusa that has been used to target users in Canada, France, Italy, Spain, Turkey, the U.K., and the U.S. The new fraud campaigns, observed in May 2024 and active since July 2023, manifested through five different botnets operated by various affiliates, cybersecurity firm Cleafy said in an analysis published last week. The new Medusa samples feature a “lightweight permission set and new features, such as the ability to display a full-screen overlay and remotely uninstall applications,” security researchers Simone Mattia and Federico Valentini said. Medusa, also known as TangleBot, is a sophisticated Android malware first discovered in July 2020 targeting financial entities in Turkey. It comes with capabilities to read SMS messages, log keystrokes, capture screenshots, record calls, share the device screen in real-time, and perform unauthorized fund transfers using overlay attacks to steal banking credentials.
In Other News...
Microsoft pulls Windows 11 KB5039302 update causing reboot loops
Microsoft pulled the June Windows 11 KB5039302 update after finding that it causes some devices to restart repeatedly. The KB5039302 update is the June preview update released this week, allowing consumers and the enterprise to test new bug fixes and changes before they go live for everyone as part of July’s Patch Tuesday. In a new post to the Windows Message Centre, Microsoft says that after installing the KB5039302 update, some systems may reboot repeatedly. “After installing updates released June 26, 2024 (KB5039302), some devices might fail to start,” explains Microsoft. “Affected systems might restart repeatedly and require recovery operations in order to restore normal use.”
Google Introduces Project Naptime for AI-Powered Vulnerability Research
Google has developed a new framework called Project Naptime that it says enables a large language model (LLM) to carry out vulnerability research with an aim to improve automated discovery approaches. “The Naptime architecture is centred around the interaction between an AI agent and a target codebase,” Google Project Zero researchers Sergei Glazunov and Mark Brand said. “The agent is provided with a set of specialized tools designed to mimic the workflow of a human security researcher.” The initiative is so named for the fact that it allows humans to “take regular naps” while it assists with vulnerability research and automating variant analysis. The approach, at its core, seeks to take advantage of advances in code comprehension and general reasoning ability of LLMs, thus allowing them to replicate human behaviour when it comes to identifying and demonstrating security vulnerabilities.