Cisco faces fallout from a massive data leak exposing critical files, while China accuses the U.S. of cyber espionage amid rising tech tensions. AI governance sparks debate as Europe enforces strict rules, and ASIC sues HSBC for $23M scam failures. Global cyber affairs take center stage this week.
ASIC is suing HSBC Australia over $23M in scam losses, alleging systemic failures in fraud detection and delays in resolving complaints. Meanwhile, Singapore's proposed anti-scam law aims to freeze accounts of scam victims to prevent further losses, sparking debate on privacy and autonomy.
Broadcom joins Nvidia in the $1 trillion club, reshaping the AI chip race with a 51% revenue surge in Q4 2024 and VMware's $69B acquisition. As China invests $25B to boost semiconductor self-reliance, U.S.-China tensions escalate, redefining global innovation and geopolitical power dynamics.
CISA issued two ICS advisories on April 4, 2024, highlighting vulnerabilities in Hitachi Energy's Asset Suite 9 (CVE-2024-2244) and Schweitzer's SEL 700 series relays (CVE-2024-2103). Users should review and apply recommended security measures.
CISA released two vital ICS advisories on April 4, 2024. ICSA-24-095-01 discusses authentication vulnerabilities in Hitachi Energy's Asset Suite 9, while ICSA-24-095-02 addresses issues with undocumented features in Schweitzer Engineering Laboratories' SEL 700 series relays.
Users are urged to review these advisories for mitigation recommendations to bolster ICS security.
CISA encourages users and administrators to review the newly released ICS advisory for technical details and mitigations. These vulnerabilities impact Hitachi Energy Suite 9 and Schweitzer Engineering Laboratories SEL
Hitachi Energy's Asset Suite, versions prior to 9.6.3.13 and 9.6.4.1, is susceptible to an improper authentication vulnerability (CVE-2024-2244).
With a CVSS v4 score of 6.9, the flaw allows remote attackers to exploit an anomaly in the REST service authentication, potentially invoking the service without proper credentials.
The risk evaluation emphasises the possibility of unauthorised access, posing a threat to enterprise asset management systems.
Successful exploitation of the vulnerability could enable attackers to utilise an authentication anomaly to invoke the REST service without appropriate credentials, potentially compromising the system's integrity.
The vulnerability (CWE-287) lies in the REST service authentication mechanism, allowing service invocation with a "valid username/no password" combination, specifically for batch job processing.
Versions of Hitachi Energy's Asset Suite prior to 9.6.3.13 and 9.6.4.1 are affected. Both CVSS v3.1 and v4 scores have been calculated, indicating the severity of the issue.
Hitachi Energy advises users to update to version 9.6.3.13 or 9.6.4.1 to mitigate the vulnerability. Additionally, CISA recommends defensive measures such as minimising network exposure, using secure remote access methods like VPNs, and following cybersecurity best practices outlined on cisa.gov/ics. No known public exploitation targeting this vulnerability has been reported as of now.
Schweitzer Engineering Laboratories' SEL 700 series relays, specifically versions before certain updates, are found vulnerable to an inclusion of undocumented features flaw (CVE-2024-2103).
With a CVSS v4 score of 5.9, the vulnerability poses a threat as it could allow attackers with privileged access to make unauthorised modifications or trigger a denial-of-service situation remotely with low attack complexity.
The exploitation of this vulnerability could enable attackers to manipulate the behaviour of the relays unpredictably or cause a denial-of-service condition, potentially disrupting critical energy infrastructure.
The vulnerability, categorised as CWE-1242, arises due to the inclusion of undocumented features accessible to users with privileged access. Various SEL 700 series relays are affected, and CVE-2024-2103 has been assigned to this flaw.
Both CVSS v3.1 and v4 scores have been calculated, indicating the severity of the issue.
Schweitzer Engineering Laboratories advises users to update affected relays to the latest versions listed.
Additionally, CISA recommends defensive measures such as minimising network exposure, employing firewalls to isolate control system networks, and using secure remote access methods like VPNs.
Organisations are encouraged to implement recommended cybersecurity strategies and follow proper impact analysis and risk assessment protocols.
ASIC is suing HSBC Australia over $23M in scam losses, alleging systemic failures in fraud detection and delays in resolving complaints. Meanwhile, Singapore's proposed anti-scam law aims to freeze accounts of scam victims to prevent further losses, sparking debate on privacy and autonomy.
As Black Friday scams surge, Australians face rising threats with $500K lost to fake sites. Meanwhile, Salt Typhoon targets telecom giants in a global espionage campaign. RomCom exploits zero-day vulnerabilities on Firefox and Windows, while Trump eyes an 'AI czar' to reshape US tech policy.
Hacker "UnicornLover67" claims to have data on 47,300 Telstra employees, raising concerns in Australia. The UK launches an AI Security Lab to counter Russian cyber threats. The EU's Cyber Resilience Act mandates strict digital security from December 2024, with heavy fines for non-compliance.
Australia’s push for bold social media laws to protect youth faces challenges, Bunnings sparks backlash over its facial recognition rollout, and AI fuels parliamentary security debates. These key issues underscore the growing tension between innovation, governance, and safeguarding privacy rights.
