Canada Orders TikTok to Shutter Two Offices Due to Security Concerns

Interpol takes down 1,037 servers and busts 41 in Operation Synergia II, Germany drafts law to protect security researchers, Chinese hackers targeted US natsec and policy officials, Nigerian real estate firm hacker sentenced to 25 years, S.Ct. hears Meta's Cambridge Analytica case, much more

Canada Orders TikTok to Shutter Two Offices Due to Security Concerns
Photo by Hermes Rivera / Unsplash
flag of Canada
Photo by Hermes Rivera / Unsplash

Sponsor Message

Armed with a complete view of your organization’s software assets, Anchore allows you to find and prevent malicious content from reaching your users. Anchore’s end-to-end, SBOM-powered software supply chain security management platform protects you and your customers at every step, from SBOM monitoring to policy enforcement to remediation. Anchore integrates at every stage of the software development process, from source code to build to runtime. Every package, every library, every version is cataloged and stored. This enables organizations to find out where content is, where it came from, and how it changed.

Are you interested in sponsoring Metacurity? Email info [at] Metacurity.com with the subject line "Sponsorship."


Innovation Minister François-Philippe Champagne said the decision to wind down TikTok's two Canadian offices in Toronto and Vancouver was based on information and evidence that surfaced during a national security review and the advice of Canada's security and intelligence community.

"We came to the conclusion that these activities that were conducted in Canada by TikTok and their offices would be injurious to national security," he told CBC News.

"I'm not at liberty to go into much detail, but I know Canadians would understand when you're saying the government of Canada is taking measures to protect national security, that's serious."

The statement stressed that the government is not blocking Canadians from accessing or using the app to create content.

Champagne urged Canadians to use TikTok "with eyes wide open." Critics have claimed that the Chinese government could obtain TikTok users' data.

"Obviously, parents and anyone who wants to use social platform should be mindful of the risk," he said.

The decision was made in accordance with the Investment Canada Act, which allows for the review of foreign investments that may harm Canada's national security.

A spokesperson for TikTok said the company plans to take legal action. (Catharine Tunney / CBC News)

Related: Reuters,  Government of CanadaCBC News, Security AffairsSilicon RepublicEngadgetAssociated PressNew York TimesPhoneArenaThe InformationTheCable LifestyleTikTokMichael GeistReutersMy Cowichan Valley NowiPhone in Canada BlogGlobal NewsTürkiye TodaySiliconANGLETimes ColonistGlobe and MailOttawa CitizenVancouver Sun, Yen.com.ghSocial Media TodayDigital Music NewsProfectioThe DeskBNN BloombergCP24CP24Anadolu Ajans, TechCrunch, PCMag

Interpol announced it had arrested 41 individuals and taken down 1,037 servers and infrastructure running on 22,000 IP addresses that facilitated cybercrime in an international law enforcement action titled Operation Synergia II.

The operation took place between April and August 2024, spanning 95 countries and resulting in 41 arrests of those linked to various crimes, including ransomware, phishing, and information stealers.

Interpol said its enforcement action was backed by intelligence provided by private cybersecurity firms like Group-IB, Kaspersky, Trend Micro, and Team Cymru, leading to the identification of over 30,000 suspicious IP addresses.

Eventually, around 76% of those were taken down, 59 servers were seized, and 43 electronic devices were confiscated, which will be examined to retrieve additional evidence.

In addition to the 41 individuals arrested, the authorities are investigating another 65 persons suspected of associating with illicit activities. (Bill Toulas / Bleeping Computer)

Related: Group-IB, InterpolKaspersky, PCMagInfosecurity Magazine, Silicon RepublicSecurityWeekTechRadarSC Media UKThe RecordThe Hacker NewsThe Cyber ExpressCybernews, Slashdot, Databreaches.net, The Register

Sources say hackers linked to Chinese intelligence used precision strikes to quietly compromise cellphone lines used by an array of senior national security and policy officials across the US government in addition to politicians.

This access allowed them to obtain call logs, unencrypted texts, and some audio from potentially thousands of Americans and others with whom they interacted.

Sources say the emerging picture of the intrusion’s reach helps confirm the intelligence community’s concerns about the attack's potentially dire national security consequences.

Hackers burrowed deep into US telecommunications infrastructure over eight months or more. With each network infrastructure layer they unlocked, the Beijing-linked group studied how America’s communications wiring works without detection, carrying out targeted thefts. (Dustin Volz, Aruna Viswanatha, Drew FitzGerald, Sarah Krouse / Wall Street Journal)

Related: BankInfoSecurity

When security research is conducted within the specified boundaries, those responsible will be excluded from criminal liability and the risk of prosecution.

German Federal Minister of Justice Dr. Marco Buschmann said, "With this draft law, we will eliminate the risk of criminal liability for people who take on this important task."

Additionally, the proposed amendment to the criminal law introduces stricter penalties for serious cases of data spying and interception, particularly when critical infrastructure is targeted.

The new draft law amends Section 202a of the Criminal Code (StGB) to protect IT security researchers, companies, and so-called "hackers" from punishment under computer criminal law.

This applies when their actions are carried out to detect and close a security vulnerability, as long as they are not considered "unauthorized."

The same exclusion from criminal liability applies to offenses pertaining to data interception (§ 202b StGB) and data modification (§ 303a StGB) as long as the related actions are deemed authorized.

At the same time, the draft fill introduces a penalty ranging from three months to five years of imprisonment for severe cases of malicious data spying and data interception (§ 202a StGB). (Bill Toulas / Bleeping Computer)

Related: BMJ.de, BMJ.de, Cybernews, The Cyber Express, Dark Reading, Tech Radar

Nigerian national Kolade Akinwale Ojelade, a resident of Leicester, UK, was sentenced to 26 years in prison in the US for stealing millions by compromising the email accounts of real estate businesses.

He was indicted in February 2023 and extradited to the US in April 2024. During the summer, he pleaded guilty to wire fraud and aggravated identity theft.

According to court documents, Ojelade relied on phishing to compromise the email accounts of real estate businesses and gain access to them.

He then monitored the conversations and, when noticing that large transactions were being prepared, intercepted the wire payment instructions and sent modified information from spoofed email accounts.

He then monitored the conversations and, when noticing that large transactions were being prepared, intercepted the wire payment instructions and sent modified information from spoofed email accounts.

The changed information instructed prospective homeowners looking to buy properties and real estate companies wiring money to title companies to send the funds to accounts controlled by Ojelade and his co-conspirators.

Once the funds were wired, Ojelade and his co-conspirators would withdraw or transfer them to other bank accounts.

The scheme is estimated to have caused roughly $12 million in actual losses. However, the prosecutors said the intended losses were more than $100 million.

In addition to serving 26 years in prison, Ojelade was ordered to pay over $3.3 million in restitution. After serving his sentence, he will be subject to deportation. (Ionut Arghire / Security Week)

Related: Justice Department, SC Media, Infosecurity Magazine, Security Week

A cyberattack on the telematics company Microlise has left British prison vans without tracking systems or panic alarms, although there is no evidence that criminals have attempted to exploit the situation.

Microlise informed the London Stock Exchange of the incident last week, although it did not provide details of the knock-on impact on customers.

In an updated statement, Microlise confirmed that the attackers may have accessed employee data but said it is “confident that no customer systems data has been compromised.”

Microlise added that it “has been bringing services back online and expects this to continue over the coming days, with the services essentially back to normal by the end of next week.”

Among its customers is Serco, an outsourcer that operates prisoner escort services for the Ministry of Justice. Serco staff were informed on Monday that “vehicle tracking, panic alarms, navigation and notifications related to estimated arrival times” were disabled due to the Microlise incident.

Other affected Microlise customers are DHL Supply Chain and local convenience store chain Nisa, which uses DHL's services.

The Ministry of Justice declined to comment. It is understood that officials regard the incident as having no operational impact on the British prisoner escort service. (Alexander Martin / The Record)

Related: London Stock Exchange, The Cyber Express, The Register, Infosecurity Magazine, Cybernews, TechRadar, Financial Times, Daily Mail, ITPro

The US Supreme Court appeared closely divided over whether to allow shareholders to proceed with a lawsuit accusing Meta’s Facebook of misleading investors about risks from the massive data privacy breach involving Republican-aligned political consulting firm Cambridge Analytica.

The Securities and Exchange Commission requires companies to disclose information about investment risks, and a 1934 federal law and related regulations prohibit companies from making misleading or false statements related to the purchase or sale of stock.

Shareholders, led by Amalgamated Bank, said Facebook made misleading statements and omitted important information about a known risk to the personal data of Facebook’s users and the control of their data — allegations the company disputes.

At issue for the justices Wednesday was how much information public companies must disclose about potential investment risks, including past events. (Ann E. Marimow / Washington Post)

Related: Inc., Reuters, PYMNTS, UPI, C-SPAN, Fudzilla, Ars Technica

Following a four-year investigation, South Korea’s Personal Information Protection Commission fined social media company Meta 21.6 billion won ($15 million) for illegally collecting sensitive personal information from Facebook users, including data about their political views and sexual orientation, and sharing it with thousands of advertisers.

The privacy watchdog concluded that Meta unlawfully collected sensitive information about around 980,000 Facebook users, including their religion, political views, and whether they were in same-sex unions, from July 2018 to March 2022.

It said the company shared the data with around 4,000 advertisers.

The company categorized ads to identify users interested in themes such as specific religions, same-sex and transgender issues, and issues related to North Korean escapees, said Lee Eun Jung, a director at the commission who led the investigation on Meta.

“While Meta collected this sensitive information and used it for individualized services, they made only vague mentions of this use in their data policy and did not obtain specific consent,” Lee said. (Kim Tong-hyung / Associated Press)

Related: Reuters, Tech.co, Security Affairs, ReadWrite, Teiss, NewsBytes, Campaign Asia

The toolkit is the equivalent of the Sliver and Cobalt Strike post-exploitation frameworks, and Trend Micro documented it this summer in a report on attacks against Chinese users.

At the time, a threat actor tracked as Void Arachne/Silver Fox lured victims with offers of various software (VPNs, Google Chrome browser) modified for the Chinese market that bundled the malicious component.

Fortinet says hackers now rely on games and game-related files in their continued targeting of Chinese users to deliver payloads that execute a series of malicious actions.

Fortinet describes the framework as a powerful one that can be used to control compromised systems, with functionality similar to Cobalt Strike and Sliver. (Bill Toulas / Bleeping Computer)

Related: Fortinet, Dark Reading, Infosecurity Magazine, HackRead

Source: Fortinet.

Kaspersky researchers discovered a new malicious package called 'SteelFox' that mines for cryptocurrency and steals credit card data using the “bring your own vulnerable driver” technique to get SYSTEM privileges on Windows machines.

The malware bundle dropper is distributed through forums and torrent trackers as a crack tool that activates legitimate versions of software such as Foxit PDF Editor, JetBrains, and AutoCAD.

Using a vulnerable driver for privilege escalation is common for state-sponsored threat actors and ransomware groups. However, the technique now appears to extend to info-stealing malware attacks.

The researchers discovered the campaign in August but say that the malware has been around since February 2023 and has increased distribution lately using multiple channels (e.g., torrents, blogs, and posts on forums).

According to the company, its products detected and blocked SteelFox attacks 11,000 times.

Kaspersky reports that malicious posts promoting the SteelFox malware dropper include complete instructions on how to activate the software illegally.

Although SteelFox is relatively new, "it is a full-featured crimeware bundle," the researchers say. Analysis of the malware indicates that its developer is skilled in C++ programming, and they managed to create formidable malware by integrating external libraries. (Bill Toulas / Bleeping Computer)

Related: Securelist

Source: Kaspersky.

Cisco has fixed a maximum severity vulnerability, CVE-2024-20418, that allows attackers to run commands with root privileges on vulnerable Ultra-Reliable Wireless Backhaul (URWB) access points that provide connectivity for industrial wireless automation.

The flaw was found in Cisco's Unified Industrial Wireless Software's web-based management interface. Unauthenticated threat actors can exploit it in low-complexity command injection attacks that don't require user interaction.

"This vulnerability is due to improper validation of input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system," Cisco said.

"A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device."

Cisco's Product Security Incident Response Team (PSIRT) has yet to discover evidence of publicly available exploit code or that this critical security flaw has been exploited in attacks. (Sergiu Gatlan / Bleeping Computer)

Related: Cisco, Help Net Security, GBHackers

Voters in the US presidential election or a previous election were probably doxed by VoteRef, a website powered by a right-wing group.

VoteRef makes it trivial for anyone to search the name, physical address, age, party affiliation, and whether someone voted that year for people living in most states instantly and for free. This can include ordinary citizens, celebrities, domestic abuse survivors, and many other people.

Voting rolls are public records, and ways to more readily access them are not new. But during a time of intense division, political violence, or even the broader threat of data being used to dox or harass anyone, sites like VoteRef turn a vital part of the democratic process—simply voting—into a security and privacy threat.

The Voter Reference Foundation, which runs VoteRef, is a right-wing organization helmed by a former Trump campaign official, ProPublica previously reported. The goal for that organization was to find irregularities in the number of voters and ballots cast, but state election officials said their findings were “fundamentally incorrect,” ProPublica added. (Joseph Cox / 404 Media)

Screenshot of the VoteRef site. Source: 404 Media

Google announced that to enhance security, multi-factor authentication (MFA) will be mandatory on all Cloud accounts by the end of 2025.

Google Cloud is a product designed for businesses, developers, and IT teams to build, deploy, and manage applications and infrastructure in the cloud.

The mandatory MFA rollout will affect admins and users with access to Google Cloud services but not general consumer Google accounts.

Starting this month, users not using MFA on their accounts will be encouraged to do so via a reminder on the console screen. According to Google, this concerns roughly 30% of Cloud users, with the rest already having activated the extra security step on their accounts. (Bill Toulas / Bleeping Computer)

Related: Google Cloud, Security Week, Tech Radar, Infosecurity Magazine, IT Pro, Help Net Security, TechCrunch, Tech Monitor, Techzine, The Register, Dataconomy

CrowdStrike is acquiring Israeli cyber startup Adaptive Shield for an estimated $300 million.

Adaptive Shield assists information security teams by monitoring and controlling all security aspects in cloud environments, continuously identifying potential attacks. Its SSPM and ITDR solutions help security teams manage the organization’s applications and identities and detect unusual behavior within the SaaS ecosystem.

This acquisition marks CrowdStrike’s fifth in Israel and its second this year. CrowdStrike previously acquired DSPM startup Flow Security for around $200 million in March, six months after purchasing Bionic for $350 million. (Meir Orbach / CTech)

Related: Business Wire, CrowdStrike, Globes, Seeking Alpha,  SiliconANGLECRNConstellation ResearchPaymentSecurity.ioCRN, SecurityWeek

Best Thing of the Day: Taking Hackers on the Hill to the UK

Hackers in the UK are launching Hackers in the House to brief UK policymakers on the cybers.

Worst Thing of the Day: Look Twice at EDR Requests You Receive

The FBI is warning that the increase in postings on criminal forums of fraudulent emergency data requests and the sale of compromised credentials has led to their increased use.

Closing Thought