Pokie Huang:

From Sourced Network Production in New York city. “It’s 5:05”. I’m Pokie Huang. Today is Thursday, July 13th. Here is the full story behind today’s cyber security and open source headlines.

Edwin Kwan: 

This is Edwin Kwan from Sydney, Australia. 

The New South Wales cashless gambling trial suffered a setback recently when it suffered a cyber attack. According to the government, Australians have a gambling problem. We spend and lose more money gambling across all formats compared to any other country in the world.

 Australians spend on average $1,135 per person each year. More than half of the money gambled comes from New South Wales. Within New South Wales, around three quarters of that is from gambling machines or pokies, as we call it. 

 The New South Wales government is looking to introduce cashless gambling to address this. This would require people to load a special card up with money at the venue and then insert it into the machines to play. The government is considering introducing limits on how much a person can gamble by capping losses to $1,000-$ 1,500 each day with the cuts linking to a particular person and bank account to prevent anonymous betting. They believe that this will result in a 15-25% reduction in the amount gambled each year.

However, during a recent trial of the system, the digital payments process firm suffered a ransomware attack. This resulted in the termination of the trial. The state’s gaming minister said that it would soon announce an oversight panel, which among other focuses, will also be looking into the data security and data privacy of trial participants.

 Law enforcement is currently investigating the alleged ransomware attack.

Olimpiu Pop: 

The other week, I decided that ChatGPT is obsolete. It’s been available since November, 2022. In the rapid pace of Generative AI, that should be a tombstone with RIP written all over it. I wanted to try Google Bard. Whoops. It doesn’t work. According to the site, it’s not available in the EU. Does it have something to do with the new European AI Act? I used the vintage Google Search to see what others are thinking. A bunch of thoughts and articles came out, but the title of the article from WIRED stuck: ” More Penguins than Europeans can use Google Bard.” Not that the penguins don’t have rights, but why? 

PALM2, the model behind Google Bard, scored 27 out of a maximum of 48 points in the compliance study led by Stanford. The three categories that scored zero out of four are copyrighted data, compute, and energy. 

Even if the last two are worrying as well, Google preferred to wait a bit before rolling it in the EU. Why? It has more to lose from the copyright than OpenAI does. More than the AI Act, GDPR and Digital Services Act might stop the rolling out in the block of other services too.

More details can be found in the resources section of 505updates.com.

 Olimpiu Pop reporting from Transylvania Romania. 

Kadi Grigg: 

The Android Malware family now has a new member: Fluhorse, a dangerous android malware that is targeting users in Eastern Asia. The article titled “Fluhorse: Flutter-Based Android Malware,” highlights a newly discovered threat to Android users. 

Fluhorse, a malicious software has been identified as a form of malware designed to compromise user data on Android devices. The malware is built on the popular Flutter framework, enabling it to infiltrate a wide range of devices. 

Fluhorse employs sophisticated techniques to evade detection and gain unauthorized access to sensitive information. It primarily spreads through malicious apps disguised as legitimate applications, making it difficult for users to identify and avoid.

Once installed, it exhibits a variety of harmful behaviors, including the theft of personal data, unauthorized access to device functionalities, and the potential for additional malicious actions. 

The malware is concerning due to its ability to bypass security measures such as antivirus software and app store restrictions. Fluhorse takes advantage of its integration with the Flutter framework to exploit vulnerabilities in Android’s security system. By utilizing this powerful cross-platform development framework, the malware can quickly adapt and evade detection, posing as a significant threat to user privacy and security.

Security researchers and experts have emphasized the importance of being cautious when downloading and installing apps, especially from third-party sources. They recommend sticking to official app stores and carefully reviewing user reviews and permissions before installing any applications. 

 Additionally, users are advised to keep their devices updated with the latest security patches to mitigate the risk of being targeted by Fluhorse and similar malware. 

This represents a concerning development in Android malware. It’s utilization of the Flutter framework makes it particularly challenging to detect and combat effectively. Users are urged to exercise caution and adopt preventative measures to protect their devices and personal information from this evolving threat.

This is Kadi Grigg in Alexandria, Virginia. 

Katy Craig: 

The fallout from the widespread hack of MOVEit’s file transfer application continues to send shock waves across organizations worldwide. The breach continues to result in sensitive data exposure. 

This is Katy Craig in San Diego, California. 

Brett Callow, a threat analyst at Emsisoft reports that over 200 organizations have fallen victim to the MOVEit bug exploitation. This led to 33 breach disclosures affecting the personal information of more than seventeen and a half million people. The scale of the breach is staggering. 

Shell, the multinational oil and gas giant confirmed this week that the exploitation of the MOVEit tool resulted in employee’s personal data being exposed. While Shell describes the tool’s usage as limited to a small number of employees and customers, the impact is significant. 

First Merchants Bank, a US Financial Holding Company, also disclosed that a MOVEit breach compromised sensitive customer data. This includes highly confidential details such as addresses, social security numbers, user names, payee information, and financial account information.

The implications for affected customers are deeply concerning. Furthermore, US learning institutions have not been spared from these attacks. The National Student Clearinghouse and the Teacher’s Insurance and Annuity Association of America are among the organizations impacted by the MOVEit hacks. Callow warns that the majority of schools in the US may also have been affected, indicating the widespread nature of these breaches.

This is Katie Craig, stay safe out there. 

Pokie Huang:

That’s our updates for today, July 13th. I’m Pokie Huang. We’ll be back tomorrow… at 5:05.