News of the Cyber World

[kyonides]

Car hackers discover vulnerabilities that could let them hijack millions of vehicles

The vulnerabilities could let attackers remotely track, stop or control a car — even an entire fleet of emergency vehicles. Another could give hackers access to some 15.5 million automobiles, allowing them to send commands to control braking systems.

In total, a group of ethical car hackers discovered at least 20 vulnerabilities within the application programming interfaces, or APIs, that automakers rely on so technology inside cars can interact. The vulnerabilities affected Ford, Toyota, Mercedes, BMW, Porsche, Ferrari and others.
...
One significant issue is that some automakers are relying on third-party API software instead of building the technology in-house, he said. “A lot of it comes down to API’s: everything wants to connect with everything else. So there’s been a proliferation of API interfaces and a single mobile app can have dozens of API calls.”
...
Cybersecurity journalist Andy Greenberg demonstrated in 2015 that hackers could manipulate a Jeep Cherokee as he was driving.
...
But while hackers taking over a car while someone is driving it is a made-for-movie moment, vulnerabilities in GPS systems, motions sensors, keyless systems, and operating systems are becoming more of a privacy and security concern, say experts. What’s more, the software flaws could lead to vehicle theft. Some of the vulnerabilities that Curry and the other researchers discovered would allow a hacker change the ownership status of the car.

“[Vehicle Identification Numbers] are super public, you can walk up to a car to get a VIN number,” Curry said. “But with a lot of these APIs, if you have the VIN number it would just return the full name of the person or the battery level of the vehicle and you can just add it to you account.”

The researchers were able to use a VIN number to not only take complete control of an owners’ vehicle account, which included a significant amount of private information, they were also able to remotely lock and unlock, stop engines, locate vehicles for Kia, Honda, Infiniti, Nissan and Acura.

European regulators fine Meta over $400 million for targeted ad program

Irish regulators fined Meta 390 million euros, or roughly $414 million, Wednesday for allegedly forcing users into its targeted advertising program in violation of Europe’s landmark privacy law.

The decision is just the most recent in a string of rulings in Europe against Facebook’s parent company over its advertising, privacy and data tracking practices that have totaled well over $1 billion in fines.

The latest fines resulted from an investigation into two 2018 complaints alleging that Meta essentially forced users to consent to behavioral advertising by including a clause allowing the practice within an updated terms of service agreement, which is required for use of the platform. European investigators determined that the behavior violated the General Data Protection Regulation, which guides how companies handle the data of EU citizens.

Regulators ultimately fined Meta Ireland for 210 million euros for a complaint about Facebook and 180 million euros for a complaint about Instagram.

Meta now has three months to bring its practices into compliance with GDPR. The tech giant says it plans to appeal the decision, potentially resulting in a drawn-out legal battle.

Do you care about Ukraine?
 Then let me warn you about the next cyber-news article handling Ukraine and its enemy Russia.

Notorious Russian hacking group appears to resurface
with fresh cyberattacks on Ukraine

But one group — known as Turla and widely regarded as one of Russia’s most capable — has been conspicuously absent from the conflict, until now.

On Thursday, researchers at Mandiant disclosed they discovered Turla targeting Ukrainian systems using run-of-the-mill commodity malware and by piggybacking on infrastructure used in earlier criminal operations.

Turla’s attack on Ukrainian systems began before the invasion, in December 2021, when an infected USB stick was inserted into a Ukrainian system and kicked off the campaign, the researchers found.

The stick contained a 2013 version of the Andromeda malware — a commercially available malware family — which began sending beacons to Turla’s command-and-control infrastructure, according to Mandiant. Turla appears to have repurposed that infrastructure from an earlier criminal campaign. Relying on expired domains previously used as part of a likely criminal hacking campaign, Turla re-registered these domains for its own operation.
...
Since invading, Russia doesn’t appear to have carried out the type of large-scale cyberattacks in Ukraine that many observers had expected, but Ukrainian officials have described a high volume of attacks aimed at supporting the Russian war effort.

Thursday’s report from Mandiant serves as a reminder that there may be significant Russian activity in cyberspace occurring under the radar. The operation described by Mandiant began in December 2021 and was not discovered until September of this year [2022].

So are we talking about Russian spies still working in Ukraine!?
If they have been successful until now, why would they stop  infecting more and more USB drives and computers out of the  blue?