Brief #28: JAXA Breached, ChatGPT Data Extraction Attack

TL;DR

Data Loss Bug in Google Drive Desktop App Affects Users Globally

Data Integrity Compromise in Cloud Storage: The recent Google Drive issue is characterized by a regression in stored data to snapshots dating back to April-May 2023. This anomaly suggests a failure in the data integrity mechanisms within Google Drive's cloud storage system, impacting both individual and business users relying on Google Workspace for data storage and synchronization.
Synchronization Breakdown Between Local and Cloud Storage: The core technical problem appears to be a malfunction in the synchronization process between local devices and the Google Cloud infrastructure. This malfunction led to the loss of data updates and changes in folder structure. The absence of a known recovery method for data in offline caches further complicates the issue, indicating a significant gap in Google Drive's data recovery capabilities.
Google's Response and Technical Support Limitations: Google's support engineers are currently investigating the issue, as indicated by communications from volunteer support agents. The lack of an immediate fix or recovery solution highlights the complexities involved in diagnosing and resolving cloud storage anomalies. The reliance on volunteer support forums, which offer limited technical insights, further exacerbates the challenge in providing immediate and effective assistance for such critical issues.
Technical Implications for Cloud Storage Users: This incident reveals key vulnerabilities in cloud storage systems, particularly in terms of data synchronization and integrity assurance. It highlights the necessity for robust error handling and recovery protocols in cloud storage services to safeguard against data loss and ensure reliable data availability, even under failure conditions.

Simple Attack Method to Extract ChatGPT Training Data

Apple Issues Critical Patches for Two Zero-Day Vulnerabilities in iOS, macOS, and Safari

Broad Impact of WebKit Vulnerabilities: Apple has released urgent updates for iOS, iPadOS, macOS, and Safari, addressing two actively exploited zero-day vulnerabilities within the WebKit engine. CVE-2023-42916, an out-of-bounds read issue, could lead to sensitive information leaks, and CVE-2023-42917, a memory corruption bug, allows arbitrary code execution. Both vulnerabilities pose significant risks due to the widespread use of WebKit in Apple's software and third-party iOS browsers.

Targeted Exploitation History: While specific details of the attacks exploiting these vulnerabilities remain undisclosed, prior iOS zero-days have often been used to deploy mercenary spyware targeting high-risk individuals like activists and journalists. Given WebKit's role in all iOS and iPadOS web browsers, these vulnerabilities represent a significant attack surface.

Updates and Affected Devices: The security updates include iOS 17.1.2 and iPadOS 17.1.2 for various iPhone and iPad models, macOS Sonoma 14.1.2 for Macs, and Safari 17.1.2 for macOS Monterey and Ventura users. Apple's swift response reflects the critical nature of these flaws and their potential for widespread impact.

Contextualizing the Threat Landscape: These updates mark Apple's proactive stance against zero-day threats, with 19 such flaws addressed since the start of 2023. This situation mirrors broader industry challenges, as highlighted by Google's recent patching of a high-severity Chrome flaw also under active exploitation.

Critical Design Flaw Discovered in Google Workspace’s Domain-Wide Delegation

DeleFriend Vulnerability Exposes Google Workspace: Cybersecurity researchers have uncovered a flaw, named "DeleFriend," in Google Workspace’s domain-wide delegation, allowing unauthorized API access without super admin privileges, enabling email theft and data exfiltration.

Flaw Mechanics and Potential Abuse: The vulnerability arises from the OAuth ID-based delegation configuration, letting attackers find combinations indicating enabled domain-wide delegation, risking sensitive data across Google services.

Google's Stance and Security Measures: Google is assessing the issue following its August 2023 disclosure but does not recognize it as a fundamental security flaw. They recommend limiting account privileges to prevent such attacks.

Severity and Stealth of the Threat: This long-term, hard-to-detect vulnerability poses a significant threat, as attackers with Super Admin access could compromise data across the entire Workspace domain.

Japan's Space Program at Risk After Microsoft Active Directory Breach

Breach of Active Directory in JAXA: Japan Aerospace Exploration Agency (JAXA) faced a significant cybersecurity incident with their Active Directory (AD) server being breached. The breach, disclosed in a press conference by Chief Cabinet Secretary Hirokazu Matsuno, underscores the criticality of this server in managing network operations and safeguarding sensitive information like employee credentials. The exact details and timing of the attack remain under investigation, but the breach’s potential impact is considerable due to the sensitive nature of the data involved.

Ongoing Investigation and Cybersecurity Response: The breach was first discovered in the fall when law enforcement informed JAXA of the compromised systems. In response, JAXA has been working closely with government cybersecurity experts and law enforcement to assess the full extent of the security compromise. While there is no current confirmation of a data leak, the situation is deemed very serious, given the potential visibility of most information on the hacked AD server.

Historical Context of Cyber Attacks on JAXA: This incident is part of a broader pattern of cyberespionage targeting JAXA, which has been happening for years. Previously in 2016 and 2017, JAXA and nearly 200 Japanese defense-related entities were targeted in a cyber assault attributed to the Chinese military hacking group Tick, also known as BRONZE BUTLER and STALKER PANDA. This historical context highlights the continuing cybersecurity challenges faced by JAXA and similar high-profile organizations.

Global Cybersecurity Implications and Threats: Adding to the complexity, a joint advisory from US and Japanese law enforcement and cybersecurity agencies in September 2023 warned of the resurgence of Chinese state-backed BlackTech hackers. These hackers are involved in backdooring corporate network devices, emphasizing the need for heightened vigilance and collaborative efforts to counter such sophisticated cyber threats on a global scale.

Brief #28: JAXA Breached, ChatGPT Data Extraction Attack

TL;DR

Data Loss Bug in Google Drive Desktop App Affects Users Globally

Simple Attack Method to Extract ChatGPT Training Data

Mandos Brief GPT

Apple Issues Critical Patches for Two Zero-Day Vulnerabilities in iOS, macOS, and Safari

Critical Design Flaw Discovered in Google Workspace’s Domain-Wide Delegation

Japan's Space Program at Risk After Microsoft Active Directory Breach

Query this dataset from your own AI.

TL;DR

Data Loss Bug in Google Drive Desktop App Affects Users Globally

Simple Attack Method to Extract ChatGPT Training Data

Mandos Brief GPT

Apple Issues Critical Patches for Two Zero-Day Vulnerabilities in iOS, macOS, and Safari

Critical Design Flaw Discovered in Google Workspace’s Domain-Wide Delegation

Japan's Space Program at Risk After Microsoft Active Directory Breach

Subscribe to Mandos Way

Query this dataset from your own AI.