cyber.hendryadrian.com
YouTube · Security Now

Security Now: UniFi and Drupal Attacks, Charter Breach, and AI Security Research

· 3:19:51 · Watch on YouTube ↗

Summary

Steve Gibson discusses reported attacks on UniFi devices, an exploited Drupal flaw, the Charter breach, and AI-assisted vulnerability discovery. The episode also covers botnet disruption and new device isolation and session-cookie protections.

Key points

  • UniFi users reported unauthorized super-admin accounts on unpatched devices; Gibson said attackers appeared to use the backup feature to extract data.
  • CISA directed federal agencies to patch an actively exploited Drupal SQL injection flaw affecting PostgreSQL-backed sites.
  • Dutch authorities and a hosting provider took down infrastructure reportedly managing more than 17 million compromised devices used as residential proxies.
  • Charter confirmed a breach but disputed Shiny Hunters' claim that customer proprietary network information was stolen. Have I Been Pwned reported 4.9 million unique email addresses in the published data.
  • Microsoft Defender for Endpoint is previewing automatic isolation of suspected compromised devices while retaining connectivity to its security service.
  • Chrome made device-bound session cookies generally available; Gibson noted that websites also need server-side support.
  • Curl maintainer Daniel Stenberg reported 11 confirmed vulnerabilities in the current release cycle and attributed the discoveries to AI-powered tools other than Mythos.

Article Details

Topics
  • [14:53] Reported attacks on unpatched UniFi OS devices
  • [23:39] Exploitation and emergency patching of a Drupal SQL injection flaw
  • [40:11] Residential proxy botnet infrastructure takedown
  • [51:49] Automatic device isolation in Microsoft Defender for Endpoint
  • [55:50] Charter breach, data exposure and disputed extortion claims
  • [01:08:15] Device-bound session cookies in Chrome
  • [01:15:51] AI-assisted vulnerability discovery and open-source security

MITRE ATT&CK

T1090.002 · External ProxyThe reported residential proxy botnet routed traffic through compromised consumer devices.

People

Michael Maturi[26:10] The transcript credits the Google Mandant researcher with discovering the Drupal SQL injection vulnerability.

Threat Actors

Salt TyphoonThe transcript reports that this Chinese state-backed group previously compromised Charter and other telecommunications providers.

Vendors

MicrosoftMicrosoft described a preview feature that automatically isolates suspected compromised devices while preserving security-service connectivity.UbiquitiThe vendor issued a security advisory for UniFi vulnerabilities before users reported unauthorized administrator accounts.

Products

DrupalA SQL injection vulnerability affects PostgreSQL-backed Drupal sites; patches were released, including for older versions.Microsoft Defender for EndpointIts preview isolation feature blocks most network traffic from suspected compromised devices while retaining security-service connectivity.MythosAnthropic said a preview was being used for cybersecurity work and that additional safeguards were needed before general release.

Related Articles