Cybersecurity Breaches: Salesforce, Workday, and Critical Infrastructure Hacked

In today's episode of 'Cybersecurity Today,' hosted by Jim Love, we cover several key issues in the cybersecurity landscape. Firstly, a breach involving Workday and social engineering attacks targeting Salesforce customers is discussed. Next, the risks posed by a recent Windows update potentially causing data corruption on SSDs and HDDs are highlighted. We also delve into a critical infrastructure breach where Russian hackers remotely accessed a Norwegian dam's control system. Additionally, the episode covers Google's vulnerabilities in its AI and Gmail services, and finally, Apple's significant privacy victory against the UK’s backdoor encryption mandate. The episode concludes with a call for listener support through donations to sustain the program.

00:00 Introduction and Headlines
00:23 Workday Data Breach Explained
02:15 Windows Update Issues
04:05 Norwegian Dam Cyber Attack
05:49 Google's Security Challenges
07:12 Apple's Privacy Victory
08:19 Conclusion and Listener Support

Episode Transcript

(00:00):
A Workday breach is tied to Salesforceand a social engineering campaign.
A Windows update, risks bricking,storage drives, hackers sees
control of a Norwegian dam.
Google keeps tripping up on Gmailand AI security, and Apple wins
a privacy victory as the UK backsoff encryption, backdoor mandates.

(00:21):
This is Cybersecurity today.
I'm your host, Jim Love Workday,one of the world's largest human
resources technology providers.
Said it was hit by a data breachearlier this month, but the attackers
didn't get in through its core systems.
On August 6th, the company discoveredhackers had slipped in through a

(00:43):
third party customer relationshipmanagement platform, not using
Workday's customer tenant environments.
The entry point was facilitatedthrough social engineering.
With attackers impersonating HR orIT in calls and text messages to full
staff into handing over credentials.

(01:04):
the exposed data was limited tobusiness contact details such as
names, emails, and phone numbers, andworkday emphasized there's no sign.
Its customer tenants orsensitive HR data were touched.
Investigators linked the breachto Shiny Hunters, a well-known
hacking group, active since 2020,they've built a reputation for

(01:26):
credential theft and sellingcorporate data on underground markets
with past victims, including Microsoftand dozens of others in this case,
Workday joins a long list of firmsincluding Google, Adidas, Qantas, and
Pandora, whose Salesforce CRM instanceswere targeted in the same campaign.

(01:47):
Workday said it cut off accessquickly and added new safeguards.
It also reminded users thatit never asks for passwords or
sensitive details over the phone.
The lesson is that even limitedcontact information can be
weaponized for more targeted attacks.
And with groups like Shiny Huntersspecializing in blending phishing with

(02:08):
stolen SaaS access, the weakest linkis often trust in familiar platforms.
Microsoft's August patchTuesday for Windows 11.
Version 24H2 included adefender update KB 50 63.
8 78 meant to fight the LlamaSteeler malware, but it's
causing unexpected trouble.

(02:31):
Several users report that under heavyfile, right operations, like copying
50 gigabytes or more solid stateand hard drives can vanish from the
system or even suffer data corruption.
In some cases, the system's smarttelemetry goes unreadable and the drive
becomes inaccessible until a reboot,and even then, they may not recover.

(02:55):
The issue tends to affectdevices using Phison based SSD
controllers, particularly Dr.
Less Models, though HDDshave also been implicated,
gamers and users doing large softwareinstalls are especially vulnerable.
The cause appears tied to how Windowshandles cached write operations post

(03:15):
update, possibly stressing firmwareedge cases in certain drives.
While Microsoft has yet to confirmthe issue, some strategies to cope
includes pausing the update, limitingbig file transfers, ensuring full
data backups, and waiting for officialfixes from Microsoft or SSD vendors.
I say these because they're recommended,but none of these are particularly great

(03:40):
options, and here lies the conundrum.
Businesses have to patch systems fast.
Vulnerabilities are exploited withinhours or days after being discovered
or after patches are released.
Yet in this case, applying the patchmay physically damage hardware and data.
It's a challenge, but we simplyhave to get better at this.

(04:05):
We've warned for years that one daycyber criminals would breach a major
piece of critical infrastructure.
We've done some programs on this.
Well, that day has arrived on April 7th.
Attackers remotely accessed theBremer Dam in Western Norway
and forced open a floodgate
water poured out at a rate of 500 liters,and for our American audience, that's

(04:26):
about 132 gallons every second for fourhours before the breach was stopped.
Thankfully water levels were low, sothere was no flooding and no injuries.
But Norwegian authorities confirmedthat Russian or pro-Russian
hackers were behind the attack.
A three minute video of the dam'scontrol panel watermarked with the groups

(04:50):
insignia was later posted to Telegram.
Investigators verifiedthe video as authentic.
The head of Norway's police securityservice Bote Gangas said the purpose
wasn't physical damage, but psychologicalto influence and cause fear and
chaos among the general population.

(05:12):
Okay, you got our attention.
but we've seen the degree to which foreignactors are embedded in the operational
technology that runs everything fromtelecommunications to water treatment.
And it is time to take this seriously.
I won't.
speak for the US but for Canada,where I live, our Prime Minister has
declared it's time to build baby build.

(05:34):
And I'm gonna say we have a challengethat we have to add to that.
It should be build andsecure, baby build and secure.
I don't want everybody to think weonly pick on Microsoft about updates.
Google Long seen as a leader in cloud andAI security is also showing some cracks.

(05:56):
Researchers recently foundthat Gmail's AI generated email
summaries could be manipulated tohide phishing links, bypassing the
very spam and security filters.
Businesses rely on.
The rollout of Gemini AI into Gmailand Google Docs introduced a new
weakness for prompt injection attacks.

(06:18):
Hackers can craft malicious inputsto trick Gemini into leaking
sensitive information or ignoring.
Its built-in safeguards on mobile,Google's own August security update,
patched three zero day vulnerabilitiesin Android, one of which was already
being actively exploited on Pixelphones before the fix arrived.

(06:39):
For years, Google set the bar withsafe browsing and Project Zero, but now
flaws are appearing in the very coreof its productivity and AI platforms.
Now, if Microsoft's updates are unreliableand Google's safeguards are slipping,
enterprises are left asking a hardquestion, who can you still trust?

(07:01):
And I will suggest that
The company that successfully answersthat question may find themselves
benefiting from it commercially.
In a major win for digital privacy,the UK has backed off its demand
that Apple build a backdoor intoits encrypted Cloud services.
US Director of National Intelligence,Tulsi Gabbard, confirmed on August 19th

(07:25):
that after months of behind the scenestalks, including interventions from
President Trump and Vice President Vance,the UK has agreed to drop its requirement
for Apple to weaken encryption.
Earlier this year, Apple removed itshigh security, advanced data protection,
or ADP feature from iCloud in the UK.

(07:46):
Rather than comply with the orderissued under the Investigatory
Powers Act, privacy groups welcomethe UK's reversal warning that a
backdoor creates a vulnerability,governments or hackers can exploit.
This isn't just a win forApple, it's a global statement.
Back doors may help one agency,but by definition they weaken

(08:09):
the system for everyone.
Apple argued that encryption mustbe absolute, not negotiable, and
it appears in this case they won.
That's our show for today.
You can reach me with tips, comments, andeven constructive criticism if you like,
and if you're enjoying the return of ourprograms on Google and Alexa, a reminder
that paying contractors to deal with techproblems is just another of our expenses,

(08:34):
one that you could help us with by goingto tech newsday.com and clicking on donate
The cost of a cup of coffee permonth makes a big difference
when it's spread over.
A lot of listeners, and you mayhave noticed, we won't compromise
to get corporate sponsorship,so we do depend a lot on our
listeners and we thank you for it.

(08:57):
I'm your host, Jim Love.
Thanks for listening.