TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.

**Exploitability Metrics**

Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.

Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.

Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.

Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.

User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.

**Vulnerable System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

**Subsequent System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

GHSA-7rm3-4w6j-8xx4: TeamPass mail_me operation authorization issue

TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.

GHSA-9wmc-988h-2mv2: TeamPass privileges issue

The ABB Cylon Aspect BMS/BAS controller suffers from an unauthenticated shell command execution vulnerability through the deployStart.php script. This allows any user to trigger the execution of 'rundeploy.sh' script, which initializes the Java deployment server that sets various configurations, potentially causing unauthorized server initialization and performance issues.

Title: ABB Cylon Aspect 3.08.02 (deployStart.php) Unauthenticated Command Execution  
Advisory ID: ZSL-2024-5891  
Type: Local/Remote  
Impact: Security Bypass, DoS  
Risk: (5/5)  
Release Date: 30.12.2024

**Summary**

ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices.

**Description**

The ABB Cylon Aspect BMS/BAS controller suffers from an unauthenticated shell command execution vulnerability through the deployStart.php script. This allows any user to trigger the execution of 'rundeploy.sh' script, which initializes the Java deployment server that sets various configurations, potentially causing unauthorized server initialization and performance issues.

**Vendor**

ABB Ltd. - https://www.global.abb

**Affected Version**

NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio  
Firmware: <=3.08.02

**Tested On**

GNU/Linux 3.15.10 (armv7l)  
GNU/Linux 3.10.0 (x86\_64)  
GNU/Linux 2.6.32 (x86\_64)  
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz  
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz  
PHP/7.3.11  
PHP/5.6.30  
PHP/5.4.16  
PHP/4.4.8  
PHP/5.3.3  
AspectFT Automation Application Server  
lighttpd/1.4.32  
lighttpd/1.4.18  
Apache/2.2.15 (CentOS)  
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86\_64)  
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)  
ErgoTech MIX Deployment Server 2.0.0

**Vendor Status**

\[21.04.2024\] Vulnerability discovered.  
\[22.04.2024\] Vendor contacted.  
\[22.04.2024\] Vendor responds.  
\[02.05.2024\] Working with the vendor.  
\[03.12.2024\] Vendor releases version 3.08.03 to address this issue.  
\[30.12.2024\] Coordinated public security advisory released.

**PoC**

abb\_aspect\_rce19.txt

**Credits**

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk\>

**References**

\[1\] https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch  
\[2\] https://www.cve.org/CVERecord?id=CVE-2024-48840  
\[3\] https://packetstorm.news/files/id/183307/

**Changelog**

\[30.12.2024\] - Initial release  
\[02.01.2025\] - Added reference \[3\]

**Contact**

Zero Science Lab

Web: https://www.zeroscience.mk  
e-mail: lab@zeroscience.mk

ABB Cylon Aspect 3.08.02 (deployStart.php) Unauthenticated Command Execution

Palo Alto, Calif., USA, 30th December 2024, CyberNewsWire

**Palo Alto, Calif., USA, December 30th, 2024, CyberNewsWire**

SquareX, an industry-first Browser Detection and Response (BDR) solution, leads the way in browser security. About a week ago, SquareX reported large-scale attacks targeting Chrome Extension developers aimed at taking over the Chrome Extension from the Chrome Store.

On December 25th, 2024, a malicious version of Cyberhaven’s browser extension was published on the Chrome Store that allowed the attacker to hijack authenticated sessions and exfiltrate confidential information. The malicious extension was available for download for more than 30 hours before being removed by Cyberhaven. The data loss prevention company declined to comment on the extent of the impact when approached by the press, but the extension had over 400,000 users on the Chrome Store at the time of the attack.

Unfortunately, the attack took place as SquareX’s researchers had identified a similar attack with a video demonstrating the entire attack pathway just a week before the Cyberhaven breach. The attack begins with a phishing email impersonating Chrome Store containing a supposed violation of the platform’s “Developer Agreement”, urging the receiver to accept the policies to prevent their extension from being removed from Chrome Store. Upon clicking on the policy button, the user gets prompted to connect their Google account to a “Privacy Policy Extension”, which grants the attacker access to edit, update and publish extensions on the developer’s account.

Fig 1. Phishing email targeting extension developers

Fig 2. Fake Privacy Policy Extension requesting access to “edit, update or publish” the developer’s extension

Extensions have become an increasingly popular way for attackers to gain initial access. This is because most organizations have limited purview on what browser extensions their employees are using. Even the most rigorous security teams typically do not monitor subsequent updates once an extension is whitelisted.

SquareX has conducted extensive research and demonstrated at DEFCON 32, how MV3-compliant extensions can be used to steal video stream feeds, add a silent GitHub collaborator, and steal session cookies, among others. Attackers can create a seemingly harmless extension and later convert it into a malicious one post-installation or, as demonstrated in the attack above, deceive the developers behind a trusted extension to gain access to one that already has hundreds of thousands of users. In Cyberhaven’s case, attackers were able to steal company credentials across multiple websites and web apps through the malicious version of the extension.

Given that developer emails are publicly listed on Chrome Store, it is easy for attackers to target thousands of extension developers at once. These emails are typically used for bug reporting. Thus, even support emails listed for extensions from larger companies are usually routed to developers who may not have the level of security awareness required to find suspicion in such an attack. As per SquareX’s attack disclosure and the Cyberhaven breach that occurred within the span of less than two weeks, the company has strong reason to believe that many other browser extension providers are being attacked in the same way. SquareX urges companies and individuals alike to conduct a careful inspection before installing or updating any browser extensions.

Fig 3. Contact details of extension developers are publicly available on Chrome Store

SquareX team understands that it can be non-trivial to evaluate and monitor every single browser extension in the workforce amidst all the competing security priorities, especially when it comes to zero-day attacks. As demonstrated in the video, the fake privacy policy app involved in Cyberhaven’s breach was not even detected by any popular threat feeds.

SquareX’s Browser Detection and Response (BDR) solution takes this complexity off security teams by:

*   Blocking OAuth interactions to unauthorized websites to prevent employees from accidentally giving attackers unauthorized access to your Chrome Store account
*   Blocking and/or flagging any suspicious extension updates containing new, risky permissions
*   Blocking and/or flagging any suspicious extensions with a surge of negative reviews
*   Blocking and/or flagging installations of sideloaded extensions
*   Streamline all requests for extension installations outside the authorized list for quick approval based on company policy 
*   Full visibility on all extensions installed and used by employees across the organization

> SquareX’s founder Vivek Ramachandran warns: “Identity attacks targeting browser extensions similar to this OAuth attack will only become more prevalent as employees rely on more browser-based tools to be productive at work. Similar variants of these attacks have been used in the past to steal cloud data from apps like Google Drive and One Drive and we will only see attackers get more creative in exploiting browser extensions. Companies need to remain vigilant and minimize their supply chain risk without hampering employee productivity by equipping them with the right browser native tools.”

**About SquareX:**

SquareX helps organizations detect, mitigate, and threat-hunt client-side web attacks happening against their users in real-time.

SquareX’s industry-first Browser Detection and Response (BDR) solution, takes an attack-focused approach to browser security, ensuring enterprise users are protected against advanced threats like malicious QR Codes, Browser-in-the-Browser phishing, macro-based malware, and other web attacks encompassing malicious files, websites, scripts, and compromised networks.

With SquareX, enterprises can provide contractors and remote workers with secure access to internal applications, and enterprise SaaS, and convert the browsers on BYOD / unmanaged devices into trusted browsing sessions.

**Contact**

**Head of PR**  
**Junice Liew**  
**SquareX**  
**\[email protected\]**

SquareX Researchers Expose OAuth Attack on Chrome Extensions Days Before Major Breach

The ABB Cylon controller suffers from an authenticated path traversal vulnerability. This can be exploited through the 'devName' POST parameter in the ethernetUpdate.php script to write partially controlled content, such as IP address values, into arbitrary file paths, potentially leading to configuration tampering and system compromise including denial of service scenario through ethernet configuration backup file overwrite.

Title: ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) Authenticated Path Traversal  
Advisory ID: ZSL-2024-5890  
Type: Local/Remote  
Impact: Manipulation of Data, DoS, Security Bypass  
Risk: (4/5)  
Release Date: 30.12.2024

**Summary**

ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices.

**Description**

The ABB Cylon controller suffers from an authenticated path traversal vulnerability. This can be exploited through the 'devName' POST parameter in the ethernetUpdate.php script to write partially controlled content, such as IP address values, into arbitrary file paths, potentially leading to configuration tampering and system compromise including denial of service scenario through ethernet configuration backup file overwrite.

**Vendor**

ABB Ltd. - https://www.global.abb

**Affected Version**

NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio  
Firmware: <=3.08.02

**Tested On**

GNU/Linux 3.15.10 (armv7l)  
GNU/Linux 3.10.0 (x86\_64)  
GNU/Linux 2.6.32 (x86\_64)  
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz  
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz  
PHP/7.3.11  
PHP/5.6.30  
PHP/5.4.16  
PHP/4.4.8  
PHP/5.3.3  
AspectFT Automation Application Server  
lighttpd/1.4.32  
lighttpd/1.4.18  
Apache/2.2.15 (CentOS)  
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86\_64)  
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)  
ErgoTech MIX Deployment Server 2.0.0

**Vendor Status**

\[21.04.2024\] Vulnerability discovered.  
\[22.04.2024\] Vendor contacted.  
\[22.04.2024\] Vendor responds.  
\[02.05.2024\] Working with the vendor.  
\[03.12.2024\] Vendor releases version 3.08.03 to address this issue.  
\[30.12.2024\] Public security advisory released.

**PoC**

abb\_aspect\_dir2.txt

**Credits**

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk\>

**References**

\[1\] https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch  
\[2\] https://packetstorm.news/files/id/183306/

**Changelog**

\[30.12.2024\] - Initial release  
\[02.01.2025\] - Added reference \[2\]

**Contact**

Zero Science Lab

Web: https://www.zeroscience.mk  
e-mail: lab@zeroscience.mk

ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) Authenticated Path Traversal

Proactive defenses, cross-sector collaboration, and resilience are key to combating increasingly sophisticated threats.

Source: Artur Szczybylo via Alamy Stock Photo

From the growing sophistication of zero-day exploits to the entrenchment of nation-state and cybercriminal alliances, 2024 delivered more evidence of how quickly the threat landscape continues to evolve. The year reinforced hard truths about the persistence of attackers and the systemic challenges of defense. We look back on some of the events that defined 2024 and the tactical insights that security teams can apply to stay ahead in the ongoing battle in 2025.

**Surging Zero-Day Exploits and Nation-State Collaboration**

Threat researchers continued to see a year-over-year increase of zero days. Recent analysis by Mandiant of 138 vulnerabilities that were disclosed in 2023 found the majority (97) were exploited as zero-days — an increase from 2022. Tom Kellermann, senior vice president of cyber strategy at Contrast Security, expects that number to increase in 2024.

The growth is a direct result of geopolitical tensions, he says. Nation-state actors, particularly China, are exploiting these types of vulnerabilities at unprecedented rates.

"The Chinese specifically have been doing tremendous research into exploiting zero-days and discovering them," Kellermann says. "I think everyone's kind of on their back foot when dealing with this because traditional cybersecurity defenses can't thwart those attacks."

The rise in these kinds of attacks includes a new trend in 2024: collaboration or coordination between nation-states and cybercrime rings, says Stephan Jou, senior director of security analytics at OpenText Cybersecurity.

"In this model, an attack with nation-state characteristics is launched at the same time, or followed closely by, an attack on the same target by an independent for-profit threat actor. Russia, for example, has been seen to collaborate with malware-as-a-service gangs, including Killnet, LokiBot, Gumblar, Pony Loader, and Amadey. China has entered similar relationships with the Storm-0558 and Red Relay cybercrime rings, typically to support its geopolitical agenda in the South China Sea."

Chester Wisniewski, global field CTO at Sophos, says China-sponsored attackers have developed assembly-line zero-day exploits shared through state-mandated disclosure laws. Attackers initially used zero-days in targeted attacks, then escalated them to widespread exploitation to cover their tracks. Proactive patch management and collaboration between vendors and organizations to mitigate threats is critical, he says.

"The real problem is this accumulation of stuff that's not getting patched," Wisniewski says. "We just keep launching more equipment out there onto the Internet. And it's getting more and more polluted, and nobody's responsible for taking care of it."

Jou agrees and says the lesson here is that defense against even sophisticated attacks comes back to the same basics: patch management, endpoint protection, email security, awareness training, and backup and disaster recovery planning.

"By ensuring that these unglamorous but essential best practices are in place, security teams can rob threat actors of many of their favorite tactics to abuse networks and businesses," he says.

**Resiliency Planning Needs More Focus**

Ransomware attacks in 2024 highlighted the fragility of supply chains and business continuity. Ransomware operators are now targeting service providers and supply chain networks, Wisniewski says. A cyberattack on Ahold Delhaize, the parent company of major US supermarket chains, including Stop & Shop, Hannaford, Food Lion, and Giant Food, disrupted services across its network in November, impacting more than 2,000 stores. For several days, customers had issues with online grocery delivery, offline websites, and limited pharmacy services.

Improving business continuity strategies to include modern segmentation tools can help minimize operational disruptions during incidents, Wisniewski says.

"When one part of a supply chain goes down, it impacts thousands of businesses," he says. "This amplifies the economic and operational pressure to comply with attackers' demands. You can't plan never to fail, but you can plan to fail gracefully."

Another headline-making business continuity incident this year was the CrowdStrike outage. In July, the company released a faulty software update that affected approximately 8.5 million devices running the Windows operating system. The glitch triggered widespread system crashes that resulted in multiple disruptions, particularly in the travel industry. Delta Air Lines was forced to cancel thousands of flights due to system disruptions. 

The event dominated news cycles for several days. In its wake, analysts pointed to the critical need for better process adherence and visibility. But Dror Liwer, cofounder of Coro, says it also highlights a need for security leaders to  effectively communicate with diverse stakeholders — whether technical teams, business executives, or external parties — when managing the fallout of a large-scale incident.

**Critical Infrastructure Is a Growing Target**

Attacks on critical infrastructure reached new levels in 2024. In September, the Cybersecurity and Infrastructure Security Agency (CISA) issued a notice that government-run water systems were at risk of attack by nation-states after officials reported a cybersecurity issue at a facility in Arkansas City, Kansas, which was forced to switch to manual operations while the situation was resolved.

Barry Mainz, CEO of Forescout, says cyberattacks are evolving to target critical services, like municipal water authorities and airport landing systems. This year made it clear that attackers are shifting their focus from well-protected facilities to more vulnerable upstream systems, like water supplies and power grids, he says.

"If you just zoom out a bit and look at where the vulnerabilities are, the bad actors are saying, 'Well, it's a lot harder now since people are spending money to secure certain IT functions. We're going to go down the food chain a little bit,'" Mainz says.

One of the key challenges in securing critical infrastructure is the inherent complexity of operational environments. Many industrial systems operate using legacy equipment that was never designed with cybersecurity in mind. In addition, there is often a lack of visibility into connected devices within these environments, which can make detecting threats extremely difficult.

"I think the lesson is we've got to invest in a cybersecurity strategy for not only IT systems but \[operational technology\] systems," Mainz says. "And also we need to think structurally about how we manage those systems because the people that actually manage those OT systems, they're not IT professionals.”

A better approach, he says, involves adopting advanced monitoring and threat detection tools as well as fostering collaboration between IT and OT teams. By breaking down silos and improving communication, organizations can better address the unique security requirements of critical infrastructure. Mainz pointed to the importance of government and private-sector partnerships in bolstering defenses.

**Telecom Can't Be Trusted**

We wrap up 2024 with news that Salt Typhoon, a cyber-espionage group allegedly linked to the Chinese government, has successfully infiltrated telecommunications networks in multiple countries. In the US alone, FBI officials say at least eight major telecom companies, including AT&T, Verizon, and Lumen Technologies, were compromised. The group gained access to sensitive data, such as call logs, unencrypted text messages, and, in some cases, live call audio. The FBI recommended that Americans use encrypted messaging apps, like Signal and WhatsApp, to ensure their communications stay hidden.

The ongoing issues around nation-state attackers and their use of telecom is one of his biggest worries heading into 2025, Kellermann says. He also points to T-Mobile's acquisition of Sprint in 2020, which he says is concerning because "Sprint used to be the classified backbone network of the US government." This means that if there are security vulnerabilities within T-Mobile's infrastructure, they could potentially compromise sensitive government communications or systems that were part of Sprint's legacy network. 

"I think the people are ignoring that and are not paying attention fully," he says.

**About the Author**

Contributing Writer, Dark Reading

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online.

What Security Lessons Did We Learn in 2024?

KrebsOnSecurity.com turns 15 years old today! Maybe it's indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024's most engrossing security stories were about bad things happening to bad guys. It's also an occasion to note that despite my publishing fewer stories than ever this past year, we somehow managed to attract near record levels of readership (thank you!).

Image: Shutterstock, Dreamansions.

KrebsOnSecurity.com turns 15 years old today! Maybe it’s indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024’s most engrossing security stories were about bad things happening to bad guys. It’s also an occasion to note that despite my publishing fewer stories than ever this past year, we somehow managed to attract near record levels of readership (thank you!).

In case you missed any of them, here’s a recap of 2024’s most-read stories. In January, KrebsOnSecurity told the story of a Canadian man who was falsely charged with larceny and lost his job after becoming the victim of a complex e-commerce scam known as triangulation fraud. This can occur when you buy something online — from a seller on **Amazon** or **eBay**, for example — but the seller doesn’t actually own the item for sale. Instead, they purchase the item using stolen payment card data and your shipping address. In this scam, you receive what you ordered, and the only party left to dispute the transaction is the owner of the stolen payment card.

Triangulation fraud. Image: eBay Enterprise.

March featured several investigations into the history of various people-search data broker services. One story exposed how the Belarusian CEO of the privacy and data removal service **OneRep** had actually founded dozens of people-search services, including many that OneRep was offering to remove people from for a fee. That story quickly prompted Mozilla to terminate its partnership with OneRep, which Mozilla had bundled as a privacy option for Firefox users.

A story digging into the consumer data broker **Radaris** found its CEO was a fabricated identity, and that the company’s founders were Russian brothers in Massachusetts who operated multiple Russian language dating services and affiliate programs, in addition to a dizzying array of people-search websites.

Radaris repeatedly threatened to sue KrebsOnSecurity unless that publication was retracted in full, alleging that it was replete with errors both factual and malicious. Instead, we doubled down and published all of the supporting evidence that wasn’t included in the original story, leaving little room for doubt about its conclusions. Fittingly, Radaris now pimps OneRep as a service when consumers request that their personal information be removed from the data broker’s website.

Easily the longest story this year was an investigation into Stark Industries Solutions, a large, mysterious new Internet hosting firm that materialized when Russia invaded Ukraine. That piece revealed how Stark was being used as a global proxy network to conceal the true source of cyberattacks and disinformation campaigns against enemies of Russia.

The homepage of Stark Industries Solutions.

Much of my summer was spent reporting a story about how advertising and marketing firms have created a global free-for-all where anyone can track the daily movements and associations of hundreds of millions of mobile devices, thanks to the ubiquity of mobile location data that is broadly and cheaply available.

Research published in September explored the dark nexus between harm groups and cybercrime communities consumed with perpetrating financial fraud. That analysis found an increasing number of young, Western cybercriminals are also members of fast-growing online groups that exist solely to bully, stalk, harass and extort vulnerable teens into physically harming themselves and others.

One focus of that story was a Canadian cybercriminal who used the nickname **Judische.** Identified by the Mandiant as one of the most consequential threat actors of 2024, Judische was responsible for a hacking rampage that exposed private information on hundreds of millions of Americans.  That story withheld Judische’s real name, but the reporting came in handy in late October when a 25-year-old Canadian man named Connor Riley Moucka was arrested and charged with 20 criminal counts connected to the Snowflake data extortions.

A surveillance photo of Connor Riley Moucka, a.k.a. “Judische” and “Waifu,” dated Oct 21, 2024, 9 days before Moucka’s arrest. This image was included in an affidavit filed by an investigator with the Royal Canadian Mounted Police (RCMP).

In November, KrebsOnSecurity published a profile of Judische’s accomplice — a hacker known as **Kiberphant0m** — detailing how Kiberphant0m had left a trail of clues strongly suggesting that they are or recently were a U.S. Army soldier stationed in South Korea.

My reporting in December was mainly split between two investigations. The first profiled **Cryptomus**, a dodgy cryptocurrency exchange allegedly based in Canada that has become a major payment processor and sanctions evasion platform for dozens of Russian exchanges and cybercrime services online.

How to Lose a Fortune with Just One Bad Click told the sad tales of two cryptocurrency heist victims who were scammed out of six and seven figures after falling for complex social engineering schemes over the phone. In these attacks, the phishers abused at least four different Google services to trick targets into believing they were speaking with a Google representative, and into giving thieves control over their account with a single click. Look for a story here in early 2025 that will explore the internal operations of these ruthless and ephemeral voice phishing gangs.

Before signing off for 2024, allow me to remind readers that the reporting we’re able to provide here is made possible primarily by the ads you may see at the top of this website. If you currently don’t see any ads when you load this website, please consider enabling an exception in your ad blocker for KrebsOnSecurity.com. There is zero third-party content on this website, apart from the occasional Youtube video embedded as part of a story. More importantly, all of our ads are static images or GIFs that are vetted by me and served in-house directly.

Fundamentally, my work is supported and improved by _your_ _readership_, tips, encouragement and, yes, criticism. So thank you for that, and keep it coming, please.

Here’s to a happy, healthy, wealthy and wary 2025. Hope to see you all again in the New Year!

Happy 15th Anniversary, KrebsOnSecurity!

IN THIS ARTICLE, YOU WILL LEARN: NFT-focused news website NFTEvening and the NFT market’s data and analytics-based platform…

**IN THIS ARTICLE, YOU WILL LEARN:**

*   **Study Overview**: NFTEvening and Storible collaborated on a study to test whether AI, specifically Long Short-Term Memory (LSTM) networks, can recover missing cryptocurrency seed phrases by analyzing 85.7 million combinations using the BIP39 word list.

*   **AI’s Capabilities**: The neural network, trained for 30 days, achieved a prediction rate of 994,051 guesses per second. It could recover one missing word in 0.02 seconds, two words in 29 seconds, and three words in 2.28 hours. Recovery of up to four words required 178 hours, with recovery times increasing exponentially for more missing words.

*   **LSTM Functionality**: LSTMs are a type of RNN that excels in sequential data processing, using memory cells and gates to predict and complete patterns in text-like data, making them suitable for seed phrase prediction.

*   **Security of Crypto Seed Phrases**: Despite AI’s advancements, the massive number of possible seed phrase combinations makes it practically impossible for AI to recover enough words to breach cryptocurrency wallets. For example, cracking eight missing words would take 174 times the universe’s age.

*   **Conclusion and Disclaimer**: The study shows that AI is not a current threat to cryptocurrency seed phrase security if the phrase remains secret. However, these findings are based on current AI capabilities and computational limits.

NFT-focused news website NFTEvening and the NFT market’s data and analytics-based platform Storible collaborated to conduct a study to investigate whether powerful AI, specifically a type called Long Short-Term Memory (LSTM), can crack cryptocurrency seed phrases. 

For this research, they analysed 85,714,285 seed phrase combinations using 2048 words from the BIP39 word list to determine the time it takes for AI to recover missing crypto seed phrases and the feasibility of LSTM networks in recovering lost or incomplete cryptocurrency phrases.

For this, a neural network was trained on a cloud-based server for 30 days to predict seed phrases and estimate recovery time. The model used LSTM architecture, achieving an average prediction rate of 994,051 guesses per second. The recovery time was analyzed using scenarios from one to twelve missing words.

The results showed that AI could retrieve one missing word in 0.02 seconds, two words in 29 seconds, three words in 2.28 hours, and up to four words in a max recovery time of 178. Moreover, AI can discover the correct seed phrase sequence of 12 words in just 8 minutes, whereas the time needed to recover 8 missing words from a seed phrase is 174 times longer than the universe’s current age.

****What is LSTM?****

For your information, a seed phrase is like a secret password for your cryptocurrency. It is a list of 12-24 words that gives you access to your digital wallet.

LSTM networks are Recurrent Neural Networks (RNN) that excel in remembering information over extended sequences. They incorporate memory cells and gates to control information flow, allowing them to effectively learn and predict patterns in sequential data like text and time series.

****How LSTMs Work in Seed Phrase Recovery****

LSTMs can predict the next likely word in a sequence or complete missing words by observing patterns in known seed phrases. Memory cells store crucial information, with three gates – forget, input, and output – regulating the flow of information. The forget gate discards irrelevant information, the input gate determines new information, and the output gate controls the next word prediction.

The researchers tried to use this AI to guess missing words in seed phrases. They tested it on millions of possible combinations. They found that even with this powerful AI, it would take an incredibly long time, longer than the universe’s age, to guess enough words to steal someone’s cryptocurrency.

The research indicates that AI is not a threat to your cryptocurrency if you keep your seed phrase secret. While AI may eventually crack seed phrases, it is currently highly secure. Though LSTMs offer powerful capabilities for sequence learning, the sheer number of possible combinations and the inherent complexity of seed phrase structures make successful recovery highly improbable.

_**Disclaimer:** This analysis provides an estimate based on current AI capabilities and computational power._

1.  AI-based Model to Predict Extreme Wildfire Danger
2.  Are We on the Brink of Saying Goodbye to Passwords?
3.  Google’s Gemini AI Chatbot Keeps Telling Users to Die
4.  Guessing passcode “just from the way we tilt our phone”
5.  unCAPTCHA algorithm Crack Google’s AI System reCAPTCHA

Study Finds AI Can Guess Crypto Seed Phrases in 0.02 Seconds

A new attack campaign has targeted known Chrome browser extensions, leading to at least 16 extensions being compromised and exposing over 600,000 users to data exposure and credential theft.
The attack targeted publishers of browser extensions on the Chrome Web Store via a phishing campaign and used their access permissions to insert malicious code into legitimate extensions in order to steal

16 Chrome Extensions Hacked, Exposing Over 600,000 Users to Data Theft

Secure Gaming during holidays is essential as cyberattacks rise by 50%. Protect accounts with 2FA, avoid fake promotions,…

Secure Gaming during holidays is essential as cyberattacks rise by 50%. Protect accounts with 2FA, avoid fake promotions, use secure downloads, and trust verified tools to enjoy safe, uninterrupted gameplay.

The holiday season is a time of joy for gamers, with more free time to play, exciting events, and in-game promotions. However, this festive period comes with higher risks of cyberattacks than any other period of the year.

Studies by Wowvendor, a company dealing in WoW services, indicate that hackers increase their activity by 50% during the holidays and especially prey on gamers via malware and phishing. This article will detail these risks and give some useful advice on how to enjoy gaming without compromising your account security.

****The Rise of Cyber Threats During Holidays****

The gaming community gets busy during the holidays. Unfortunately, cybercriminals find this an attractive target. The key reasons for increased risks are as follows:

*   **Increased player traffic** – A large consumer base of online gaming creates, in turn, more opportunities for hackers to exploit vulnerabilities.
*   **Attractive holiday promotions** – Many players get tricked into fake giveaways and deals, without knowing it compromises their data security.
*   **Malware in pirated games** – Most of the time, hackers put harmful software inside cracked versions of popular titles.

For instance, cybersecurity companies have informed that the number of phishing emails with “in-game rewards notifications” and “discount offers” have spiked around the times of past holiday seasons. These examples of threats put the importance of vigilance during peak gaming hours deeper into focus.

****Common Cyber Threats to Gamers****

Cyber threats range from gaming cyber attacks and data security incidents to DDoS attacks. This will likely impact some players more and possibly their performance during peak gaming periods. Understanding these dangers can help players stay protected:

****Fake add-ons, mods and Phishing schemes** **

Hacks through counterfeit mods are common in games such as World of Warcraft. Hackers distribute these infected mods using counterfeit mods and give the malware the chance to steal login credentials or infect the device they’re playing on. Additionally, fraudulent links and websites trick people into providing personal information or downloading malicious software.

****DDoS attacks** **

The gaming industry is seeing a lot of DDoS attacks (distributed denial of service attacks), wherein hacker group gets a network of infected devices (botnet) that perform a network DDoS attack to inundate a game server or a group of players with a massive amount of traffic. This overload disrupts the server or network connection and has broken the game so that normal users can’t even get in.

These attacks send many requests and place a heavy load onto the server. Hackers aim at certain players’ IP addresses and try to degrade their connection, or that of the player behind it, to give themselves an in-game advantage. This type of targeted interference disrupts competitive gameplay and can negatively impact a game’s experience for the player.

Additionally, the number of ransomware attacks against gaming accounts has risen as well. They involve locking players out of their accounts and asking for payment to access them. When you are faced with unfamiliar software or links, it’s best to stay awake and alert to risks.

****Best Practices for Secure Gaming****

A large number of cyber attacks on gamers can stem from unauthorized downloads, according to leading cyber security firm Kaspersky. To enjoy your games safely during the holidays, follow these cybersecurity tips:

*   **Download software from official sources** — Do not download games or updates from untrusted websites — they can hide malware.
*   **Use two-factor authentication (2FA)** — It simply gives you extra protection for your gaming accounts.
*   **Verify promotional offers** — Don’t accept offers that are simply too good even to be true. There are always official channels for you to confirm their legitimacy.
*   **Avoid cracked games** — First and foremost pirated games are illegal, and they’re dangerous for security reasons too.

Working with your use of strong, unique passwords across all your accounts, these measures can go a long way toward mitigating your risk of being victimized in this way.

****The Role of Gaming Companies****

Leading gaming companies have stepped up their efforts to combat cyber threats. Their initiatives include:

*   **Enhanced security systems** – AI detecting and blocking unusual activity on gaming networks.
*   **Regular updates and patches** – Time and time again, developers release updates to patch vulnerabilities, and protect players with updates.
*   **Player education** – Many platforms offer users a way of recognizing and preventing scammers.

For instance, World of Warcraft’s creators, Blizzard Entertainment, is constantly monitoring its ecosystem for threats and expelling them while at the same time urging players to use solutions, for example, 2FA. Machine learning has been introduced into other companies, such as Valve and Riot Games, in an attempt to detect possible hacking through in-game behaviours.

****Advanced Cybersecurity Tools for Gamers****

Gamers now have access to cutting-edge cybersecurity solutions tailored to safeguard their online experience:

*   **Gaming-optimized VPNs** – VPN services will make sure that you have safe, encrypted connections while reducing latency and optimizing the routing of the server. It shields against DDoS attacks and keeps the gameplay smooth.
*   **Anti-phishing extensions** – Google Safe Browsing and Microsoft Defender SmartScreen are tools that actively block malicious sites and alert players that a phishing page is attempting to lure them into a trick.
*   **Behavioural analytics and anti-cheat systems** – Dedicated platforms use machine learning to analyze login patterns and in-game behaviour, detecting anomalies like hacking or unauthorized access.
*   **DDoS mitigation services** – Distribution denial-of-service attacks that cause gaming servers to stop working are identified and neutralized by Cloudflare, Akamai Prolexic, and other companies that protect gaming servers so that gamers can continue enjoying online sessions uninterrupted.

With these state-of-the-art tools, gamers will be protected from changing threats, which will protect gaming for the holidays and beyond.

****Stay on the Safe Side****

The holiday season is a wonderful opportunity to connect with your favourite games and communities. While cyber threats do increase during this period, staying informed and adopting secure practices can protect your gaming experience. From using official platforms to enabling two-factor authentication, every step you take helps reduce risks.

Gaming companies are also playing their part by providing services and insights that enhance player safety. By working together and staying alert, gamers can fully embrace the holiday spirit, free from cybersecurity concerns.

1.  What is Blockchain Gaming and its Play-to-Earn Model?
2.  Exploring Data Privacy and Security in B2B Gaming Data
3.  The Rise of Blockchain Gaming and Secure Marketplaces
4.  Winos4.0 Malware Targeting Windows via Fake Gaming Apps
5.  Gcore Thwarts 500 Million PPS DDoS Attack on Gaming Company

Tag

#web