PP130: News Roundup—FBI and Pentagon Breached, AI Amplifies Threat Actors, UK Rolls Out Passkey Option, and More

Drew Conry-Murray (0:06)

Hey, everybody, welcome to Packet Protector, the podcast at the intersection of networking and security. I'm Drew Connery-Murray here with the one and only JJ. This is our news roundup for October, and here's some of the things we're going to cover.

The Dutch arrested an alleged shiny hunters leader on September 16th and kept it quiet until shiny hunters breached the FBI. Then the FBI wanted people to know that somebody had been arrested.

Apple patched a core graphic zero-day already exploited in what they're calling extremely sophisticated targeted attacks. Someone built a fake LastPass installer repos on GitHub. There are three serious network edge zero-days, all on SysSysKev, known exploitable vulnerability list, including Citrus and Cisco, plus a bunch of other stories. So let's dive into it. So first off, a week after news emerged that shiny hunters threat actor group had stolen data on thousands of FBI employees, the FBI announced an alleged member of shiny hunters had been arrested by Dutch authorities. Just some background, in mid September, shiny hunters exploited a vulnerability to gain access to the FBI jobs web page. They defaced the web page, they put their own brand on it, and they claimed to have moved from those servers onto managed servers in AWS GovCloud. Shiny hunters claim they stole up to three terabytes of files on present, former and perspective FBI employees. The website 404 Media said Shiny hunters shared 5,000 stolen files with the news site, and 404 Media was able to authenticate some of them using publicly available sources. On September 28th, Dutch authorities announced they had arrested a guy named Pepin van der Stap, apologies if I pronounced that wrong, a Dutch national, who had previously been jailed for cybercrime and is currently employed by a Dutch cybersecurity company. So JJ, lots to chew on. What do you think?

JJ (1:44)

Yeah, I was just skimming back through to see because we had a few different shiny hunter stories all mixed together. And I know one of them was a people soft breach. I don't know if this was this one or the other one.

So like digging into this story at face value, it seemed very boring. But if you start to kind of, so I think you've got a link in here to Brian Krubs, who's always has just fantastic write ups and seriously digs into these things. Anyway, I think like some of the bizarre, twisty things is they're, okay, first of all, the guy that the Dutch guy that they arrested already had been charged with cyber crimes just a few years ago.

Drew Conry-Murray (2:23)

And went to jail for it.

JJ (2:24)

And went to jail for it and had just recently gotten out. Right.

Drew Conry-Murray (2:27)

And was working for a cybersecurity company.

JJ (2:29)

And was working for a cybersecurity company. And then was working for another cybersecurity company during this incident. And volunteering for like a vulnerability, disclosure nonprofit thing over there as well. So first of all, I mean, I don't know how everybody else feels about this. I know culture in Europe is a little bit different, but I think that's a hard no for over here. You know, you don't get third chances when we have ethics and morals, and you just don't get this kind of chances. So that in and of itself was already kind of weird that he was still involved with the nonprofit, had another job in cybersecurity doing offensive stuff.

So I thought all that was weird. Now, the other thing is, I guess, there's still some unknowns as to who actually did what, because there's the Shidy Hunters group that we keep hearing about recently. But then there's also these other kind of, there's Lapsus and then that other third group. And so there's this other person, like human person, who I guess is struggling with this Dutch guy for who's in control of Shidy Hunters.

Drew Conry-Murray (3:43)

There does seem to be some kind of internecine warfare going on about who is actually leading the Shidy Hunters group. There's another young person. I don't remember that person's name, but apparently they are in contention with Vanderstapp about who's in charge.

And it's possible based on Brian Krebs reporting. So this is getting into a lot of detail, but the Dutch person, his hacker name is a Pokemon character, and an image of that Pokemon character was used in the defacement of the FBI website, which is like kind of too on the nose. Like either the Dutch guy was like, you'll never catch me, or maybe he was being set up by this other person who knew they would go right to this person. So lots of like kind of like almost like real housewives of Beverly Hills kind of stuff happening inside Shiny Hunters.