Breach Roundup: US Bans AI Robocalls

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, the U.S. banned AI robocalls, researchers discovered a Linux bootloader flaw, France investigated health sector hackings, the feds offered money for Hive information, Verizon disclosed an insider breach, Germany opened a cybersecurity center, and cyberattack victims reported high costs.

See Also: Live Webinar | Securing the Cloud: Mitigating Vulnerabilities for Government

The U.S. Federal Communications Commission banned unsolicited robocalls that use voices generated by artificial intelligence as the American election season ramps up.

Telecom regulators voted unanimously Thursday to make AI-generated robocalls illegal under the 1991 Telephone Consumer Protection Act, which prohibits robocalls from using “artificial” voices. The new rule allows the FCC to order telephone carriers not to facilitate illegal robocalls and empowers individual consumers or organizations to file lawsuits against violators.

The decision comes amid concerns that AI could be used to disseminate misinformation about the election. A robocall featuring a deepfake of President Joe Biden urging voters in New Hampshire to stay home on primary day caused controversy in January (see: AI Disinformation Likely a Daily Threat This Election Year).

The New Hampshire attorney general on Tuesday said he had identified the source of the calls as Texas-based Life Corporation and its owner, Walter Monk. State Attorney General John M. Formella said the calls had been routed through a provider called Lingo Telecom, also based in Texas. New Hampshire issued a cease-and-desist order to Life Corporation, and the FCC sent a cease-and-desist letter to Lingo Telecom.

“Bad actors are using AI-generated voices in unsolicited robocalls to extort vulnerable family members, imitate celebrities and misinform voters,” FCC Chairwoman Jessica Rosenworcel said in a statement. “We’re putting the fraudsters behind these robocalls on notice.”

A secure bootloader used by most Linux distributions contains a remote code execution vulnerability that stems from how the bootloader parses HTTP requests when booting over a network. The flaw affects “every Linux boot loader signed in the past decade,” said Microsoft researcher Bill Demirkapi, who identified the bug.

Red Hat, which maintains the open-source bootloader – known as Shim – issued a patch and Linux distributions including Debian, Ubuntu, Suse have started distribution, said firmware security firm Eclypsium on Tuesday. Red Hat said another possible mitigation is: If the system doesn’t boot from a network, disable the network boot.

The flaw, tracked as CVE-2023-40547, allows an attacker to craft a malicious HTTP message “leading to a completely controlled out-of-bounds write primitive and complete system compromise,” Red Hat said. The National Vulnerability Database assigned the flaw a CVSS score of 9.8, and Red Hat gave it a score of 8.3.

Exploiting it would require an attacker to perform a man-in-the-middle compromise between the system and the boot server. The flaw takes advantage of how Shim checks to see whether a system is configured to support network booting and attempts to load over HTTP a bootable image from a previously configured server.

Eclypsium wrote that in addition to launching a man-in-the-middle attack, attackers could exploit the vulnerability locally by modifying the boot sequence to load a vulnerable instance of Shim and load remote code. An attacker of the same network could also manipulate the preboot execution environment – known as PXE – “to chain-load a vulnerable shim bootloader.”

The French data protection authority said Wednesday that it has opened an investigation into hacking incidents at private health insurance payment processing providers Viamedis and Almerys. The National Commission on Informatics and Liberty – known as CNIL – said the two incidents affected more than 33 million people. Data exposed by hackers includes marital status, birthdate, Social Security number and health insurer. Financial and medical data or contact information – such as telephone numbers, home and email addresses – were not affected.

The Viamedis website remains offline; it disclosed the incident in a Feb. 1 LinkedIn announcement. Company General Director Christophe Cande said the breach had been the result of a phishing attack, not ransomware.

Almerys has not yet released a statement.

The U.S. Department of State on Thursday offered enough money to clear credit card debt and student loan payments to anyone who can provide information leading to the identification or location of any individual who holds a leadership position in the Hive ransomware operation. The maximum reward is $10 million.

The State Department is also offering up to $5 million to anyone who can provide it with information leading to the arrest or conviction of any individual in any country conspiring to participate in or attempting to participate in Hive ransomware activity.

A multinational law enforcement operation in January 2023 seized control of the digital infrastructure used by Hive. FBI agents penetrated the group’s computer networks and captured decryption keys, heading off $130 million in demanded extortion payments, U.S. Department of Justice officials said at the time (see: FBI Seizes Hive Ransomware Servers in Multinational Takedown).

U.S. telecommunications giant Verizon disclosed an insider data breach that affected about 63,206 employees. The Sept. 21 breach – not discovered until Dec. 12 – exposed information such as names, addresses, Social Security numbers and compensation details. Customer data was unaffected.

Germany has a cybersecurity center that seeks to counter surging ransomware and artificial intelligence-enabled threats. German Interior Minister Nancy Faeser on Tuesday unveiled the National IT Situation Center, which will operate as part of the Federal Office for Information Security, or BSI.

Around 100 IT staff will work at the center, which is primarily designed to coordinate cyber incidents between German federal- and state-level agencies. It will work to identify and mitigate vulnerabilities in software applications. BSI President Claudia Plattner on Tuesday said the center will also assist German states with malware detection and mitigation measures.

Bleach manufacturing giant Clorox and buildings management conglomerate Johnson Controls in regulatory filings reported significant expenses stemming from cyber incidents. Clorox – also the maker of Hidden Valley Ranch – faced operational disruptions, possibly due to ransomware, resulting in $49 million in expenses in the six months before January. The costs covered third-party consulting services and operational disruptions. Clorox said it anticipates ongoing expenses and hasn’t recognized any insurance reimbursements yet.

Global smart building and security systems maker Johnson Controls suffered a ransomware attack last year and incurred expenses of $27 million during the final quarter of 2023. The company said it expects additional expenses throughout 2024, primarily in the first half, to cover IT recovery, forensic experts and operational disruptions. Although the breach affected billing systems, the company said the impact on net income was immaterial. It expects that a significant portion of direct costs will be reimbursed through insurance coverage it said.

Other Coverage From Last Week

With reporting from Information Security Media Group’s Mihir Bagwe in Mumbai, India; Akshaya Ashokan in southern England; Chris Riotta in Washington, D.C.; and David Perera in Washington, D.C.