Ernst and Young exposes a four terabyte database to the open internet.
A former L three Harris executive pleads guilty to selling zero
days to a Russian broker.
Chrome is hit by a sophisticated zero day spyware campaign.
And nation state hackers breach US telecom provider ribbon communication.
This is cybersecurity today.
I'm your host, Jim Love.
Even the world's biggest consulting firms can make the simplest of mistakes.
Dutch researchers revealed that Ernst and Young, or EY, one of the big four
accounting giants, accidentally let four terabytes of SQL server backup,
exposed to the open internet unencrypted and filled with sensitive data.
The backup contained API, keys, authentication tokens,
passwords, and user credentials.
Essentially, the master keys to EY systems, neo security.
the firm that discovered the exposure, said it was like finding the blueprint
and the physical keys to a vault with a note saying, free to a good home.
According to the reports, the leak happened because someone trying
to save a little time left a cloud bucket unprotected, one tiny move
that made the database public.
They left it that way for less than five minutes, but automated bots scooped up the
data like this within minutes of exposure.
What they didn't realize is that any data left unencrypted on the
internet for even a few minutes is going to be detected and stolen.
Once notified EYs team acted quickly and fixed the issue,
but the message here is simple.
You can't leave unencrypted data on the internet even for a few minutes.
It's a hard lesson to learn, but one that we can all take away from
this because given the right set of circumstances, almost any one of us
could have made the same mistake.
The former head of a US defense contractor cyber division has pleaded guilty to
selling classified hacking tools to a Russian broker, one that openly advertises
exploits to government clients in Moscow.
Peter Williams, a 39-year-old Australian who ran Trenchant, the cyber operations
unit of L three Harris admitted to stealing and selling national security
focused software that included at least eight zero day exploits, meant
only for the US and its allies.
The Justice Department said that Williams sold these tools for
millions in cryptocurrency and even agreed to provide ongoing support.
The scary part about this, if I read it right, was that Williams even
had a contract for the payment of these quote unquote services, and
ironically or criminally earlier this year, Williams had fired a developer.
He falsely accused of leaking Chrome zero days.
That developer later told one publication I was a scapegoat.
I wasn't guilty.
and I guess that developer's finally been vindicated now that Williams
is under house arrest in Washington DC awaiting sentencing in January,
2026, And it's a reminder that insider threats can come from anywhere.
Even the very top of a company.
Researchers have confirmed a vulnerability that let attackers break out of
Chrome's built in sandbox, and gain deep access to the operating system.
It is listed as CVE 20 25 27 83, described in the US National Vulnerability
Database as an incorrect handle in Chrome's Mojo component on Windows.
Attackers exploited it in espionage campaigns earlier this year.
How dangerous was it?
Well, in some cases, simply visiting a link in Chrome was
enough to trigger the exploit.
It is now patched, so if you're running the latest version You're safe, but
this is part of a much bigger story.
Browsers are now an extremely popular attack surface in cybersecurity, and
with the new AI browsers like Open AI's Atlas and Perplexity Comet,
both are built on the same Chromium foundation, so it's fair to ask whether
they'll be next and if Chrome after years of testing still has holes.
What about brand new AI browsers, rush to market and already
having prompt injection risks?
They may only be at the beginning of what some researchers
call a vulnerability harvest
. I'm a big believer in AI and believe we have to experiment with it, but until
we see some real independent security validation of these browsers, it might be
smart to be cautious or even to keep those AI browsers off your corporate network.
I confess this is not my big area of expertise, and if somebody out
there in the audience has some way we can talk about this at a deeper
level, get in contact with me.
And finally, hackers working for a nation state.
Breached Networks at Ribbon Communications, a US telecom services
provider that connects many of the world's biggest carriers, including
Verizon, BT, and Deutsche Telecom.
According to filings with the US Securities and Exchange Commission,
the breach began in December, 2024 and went undetected for nearly a year.
So far, three smaller customers were reportedly affected, although there's
no sign that government clients or core systems were compromised.
Cybersecurity experts say this fits a growing pattern of espionage
campaigns aimed at the telecom and network infrastructure providers,
the companies that sit at the very heart of global communications.
Pete Reus of Palo Alto Networks told Reuters that attackers target
these firms to establish long-term persistence within their networks
to enable global espionage Ribbons.
Customers include major carriers and government agencies making it a prime
target for these state aligned hackers, especially from China and Russia.
It is a stark reminder that the weakest points in the system
isn't always the end user.
Sometimes it's the service provider that connects to everyone else.
And that's our show for today.
You can reach me with tips, comments, or even some constructive criticism.
Check us out@technewsday.com or.ca.
Use the Contact us page.
If you're watching this on YouTube, just leave a note under the video.
I'm your host, Jim Love.
Thanks for listening.