Building a great firewall around AI.

Key takeaways

Open-source AI models in China are both a strategic strength and a security concern, prompting potential export restrictions.
Critical infrastructure remains a target for coordinated cyber attacks; cross-agency collaborations are vital for rapid response.
Artificial intelligence amplifies cyber threats, making attacks like DNS hijacking and malware propagation more automated and scalable.
The supply chain of open source software is vulnerable to malicious modifications; dependency analysis and behavior monitoring are essential defenses.
Legal and privacy issues surrounding the use of privacy-enhancing tools like Graphene OS are evolving, especially in border security contexts.
Geopolitical tensions manifest in cyber conflicts, as seen with Russia's actions against Telegram and North Korea's internal hacking activities.

Summary

China's Balancing Act: Open AI and National Security

This section explores China's surprising embrace of open-source AI models, emphasizing affordability and global influence while grappling with security concerns. Officials worry that open models like Alibaba and Moonshot could be exploited for cyber attacks, scams, or bypass government censorship, undermining political stability. As a result, China is considering export restrictions, trying to balance promoting open AI with guarding strategic interests, reflecting similar debates in the US about open versus closed AI systems.

Cyber Attacks on Critical Infrastructure and Supply Chain Guidance

Minnesota experienced a coordinated cyber attack targeting over 30 water systems, focusing on operational technology but with no public health risk reported. Multiple agencies, including CISA and FBI, responded effectively. Additionally, CISA's updated guidance on software bill of materials (SBOM) now covers all software types, including open source and AI, aiming to improve software supply chain security by increasing visibility and risk management.

AI-Enhanced Threats and Vulnerabilities

Researchers demonstrated how AI could escalate existing cyber threats, notably dangling DNS record takeovers, making targets more widespread and destructive. A new AI-assisted attack involves a self-propagating worm embedded in Microsoft Word documents using Copilot, raising concerns about automated, stealthy malware spread. Furthermore, a critical vulnerability in Ruby on Rails' active storage can be exploited for unauthorized data access, prompting urgent patches.

Malware Campaigns and Dependency Risks

Attackers have disguised malware as legitimate AI tools like Claude on trusted platforms, leading to infections that steal data and establish remote control. Amazon links breaches in popular NPM packages to North Korean actors, with malicious code split across multiple packages to evade detection. These incidents highlight the dangers of dependency on open source in the supply chain and how AI can simplify malicious package creation and automated review evasion.

Geopolitical Cyber Conflicts and Legal Cases

Russia has charged Telegram founder Pavel Durov with aiding terrorism, accusing the platform of harboring channels linked to Ukrainian intelligence and extremists, illustrating government crackdowns amid ongoing conflicts. Additionally, a unique border case involves a man using Graphene OS to wipe his device when law enforcement sought to access it, raising legal and privacy concerns about the use of privacy-focused tools and their potential to hinder investigations.

Show notes

China embraces open AI models, then worries it’s become a national security risk. The cyberattack on Minnesota water systems proves larger than first reported. CISA updates its SBOM guidance. AI supercharges dangling DNS attacks. Researchers uncover a self-propagating Copilot worm. A critical Rails flaw demands urgent patching. Mac users are lured into installing malware through fake Claude guides. Amazon links a string of NPM compromises to North Korea. And Russia charges Telegram founder Pavel Durov with aiding terrorism. Ben Yelin joins us with a border search case that’s breaking new ground. Don’t bite the North Korean hand that feeds you.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Ben Yelin from University of Maryland Center for Cyber Health and Hazard Strategies talking about a border search case that’s breaking new ground. If you enjoyed this conversation, check out Ben on the Caveat podcast here.

Selected Reading

As China’s A.I. Gets Stronger, It Poses New Risks to Beijing (New York Times)

Minnesota Water Utilities Suffer ‘Coordinated Cyber Attack’ (GovTech)

CISA Updates Software Bill of Materials Guidance to Strengthen Supply Chain Security (HSToday)

‘DangleGeddon’: AI Could Weaponize Forgotten DNS Records at Global Scale (SecurityWeek)

Word worm crawls into Copilot, spreads chaos (The Register)

Possible arbitrary file read and remote code execution in Active Storage variant processing (GitHub)

Fake Claude Install Guide Leads to MacSync Stealer and RAT: What We Pulled From the Attacker's Servers (Huntress)

Amazon identifies North Korean hacker group behind open-source supply chain attacks (AWS Security Blog)

Russia accuses Telegram CEO Pavel Durov of aiding terrorism in its latest digital crackdown (AP News)

North Korea's elite hackers turned on their own government — and got caught (Bitdefender)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices