Cyber, in brief

Chainalysis says attackers broke into its systems and internal tools this month. [1]

Chainalysis is a US company whose software traces crypto payments. [2]

Police, governments, crypto exchanges and banks use it to investigate fraud and ransomware. [1]

The attackers reached users' names, email addresses, user IDs and job-role labels. [1]

Chainalysis told customers to expect fake password resets and fake login prompts. [1]

It also warned of scammers posing as Chainalysis, offering to recover lost funds or jobs. [1]

It asked customers to turn on a second login check, called two-factor authentication. [1]

Nobody has said whether the attackers used an AI kit like ARTEX or their own. [1]

Chainalysis is still working out which records were taken for each customer. [1]

Until then, customers' staff must watch for fake messages without knowing if they are listed. [1]

Chainalysis says it is patching the flaws and using AI to review its own security. [1]

Chainalysis says each customer will get a detailed breakdown when its review ends. [1]

Chainalysis, whose software police use to trace crypto, had its customers' staff names and emails reached by attackers. [1]

It names people at police forces, exchanges and banks by role, which is why Chainalysis warns of impersonators. [1]

They were told to watch for fake password resets, login prompts and fake Chainalysis offers. [1]

How the attackers got into Chainalysis, and how long they were inside.

Chainalysis has not named the flaws, the tools reached or the time the attackers had. [1]

Whose records Chainalysis lost.

It is still working out which records were reached for each customer, and promises a breakdown later. [1]

The FBI, the main US federal police force, said on Saturday that North Korea robbed Binance. [3]

Binance, the world's biggest crypto exchange, had about $6.3bn stolen on Thursday. [3]

The FBI named TraderTraitor, a group believed to be part of North Korea's Lazarus Group. [5]

The FBI also blamed TraderTraitor for a $1.5 billion theft from Bybit, another exchange, last year. [4]

North Korea has always denied taking part in such attacks. [3]

Binance says it has replaced 90% of the stolen coins, using its own money. [4]

Part came from SAFU, a $1 billion fund Binance keeps to repay users after hacks. [4]

The last 10% is in coins that are harder to buy quickly, Binance says. [4]

Binance began letting users withdraw again on Sunday, in stages. [6]

The FBI published the thieves' crypto addresses and asked exchanges to block them. [4]

Blocking them is meant to stop the money being moved to hide where it came from. [6]

Risk managers call a fund like SAFU self-insurance: a firm saving to pay its own losses. [4]

Binance is paying for the theft from its own funds. [5]

Co-chief Richard Teng says users will not bear the financial impact. [5]

The FBI expects the stolen coins to be swapped again to hide them. [6]

Binance says users' bitcoin, ether and Tether holdings are fully covered. [3]

Binance says it has replaced 90% of the stolen coins from its own funds, so users keep their holdings. [4]

It set aside more than $6.34bn of company money to cover the theft. [3]

When Binance will cover the last 10% of the stolen coins.

Binance says those coins are harder to buy quickly and gave no date. [4]

How much of the $6.3bn will be caught before it is hidden.

The FBI expects the coins to be swapped again to hide them, and has asked exchanges to block the thieves' addresses. [6][4]

Binance says it has replaced 90% of the $6.3bn in stolen coins with its own money, and its users began withdrawing again on Sunday.

Northflank, a service that runs other companies' apps online, says it was broken into. [7]

It told every customer to assume their stored secrets had been unscrambled and stolen. [7]

Its warning read: "Assume all environment variables have been decrypted." [7]

Environment variables are settings where apps keep passwords and keys for other services. [7]

Several customers then reported strangers using the AI keys they had stored there. [7]

Wiz, a cloud security company, alerted Northflank at 11:43 UTC on 30 October. [7]

Engineers looked a minute later and sent out fixes at 12:50 and 13:05 UTC. [7]

Wiz counted at least 9 break-ins at AI developer platforms in October. [7]

In two cases, stolen logins made about 2.5 million AI requests costing about $100,000. [7]

Developers who stored AI keys there may face charges for AI use they never made. [7]

Wiz calls this LLMjacking: using someone else's AI account so they get the bill. [7]

Northflank has not said how attackers got in or how many customers were hit. [7]

Customers must change every stored key themselves, Northflank says. [7]

Northflank turned on activity records for every customer, free accounts included. [7]

AI keys that developers stored at Northflank were taken and used by strangers. [7]

They run AI on other people's accounts; in two cases Wiz studied, stolen logins ran up about $100,000 of AI use. [7]

How Northflank was broken into, and how many customers were hit.

Northflank has not said, and did not answer BleepingComputer's questions. [7]

Whether the nine break-ins at AI developer platforms are one group's work.

Wiz says many of them went after AI keys, but it has not confirmed one attacker behind them all. [7]

A researcher published working attack code for an Android flaw called SMS of Death. [8]

The researcher, Mark Blah, says one specially built text can crash a phone's calling system. [8]

The crash drops calls in progress, including calls to emergency services. [8]

Android reads the message before it reaches the inbox, so the owner sees nothing. [8]

In tests, 20 such texts left some phones restarting again and again. [8]

One Android 12 phone restarted about every 90 seconds until it was wiped clean. [8]

Google fixed the flaw in October updates for Android 14 to 17, the researcher says. [8]

Phones on Android 12 and 13 did not get the fix, he says. [8]

The flaw is also missing from Google's October list of fixes. [8]

Owners of older Android phones stay open to a crash they cannot see coming. [8]

The text carries a length number, and Android used it without checking it. [8]

Programmers call that check input validation: testing what a sender claims before trusting it. [8]

Whether a phone gets the fix depends on its maker and its carrier. [8]

Google's fix stops the crash and deletes the bad messages from the phone. [8]

The researcher says they have no fix for a text that can drop their calls, emergency calls included. [8]

Whether Android 12 and 13 phones will ever get a fix for SMS of Death.

The researcher says they did not get Google's October fix, and the flaw is not on Google's October list. [8]

Cisco Talos, a security research team, found password-stealing malware that asks AI to judge its victims. [9]

The malware calls itself Volta-Autodoxer, Talos found. [9]

It takes saved passwords, login cookies, payment cards and crypto wallet phrases. [9]

It also takes logged-in sessions for Discord, Telegram, Steam and Roblox. [9]

Then it reads the victim's email, including food delivery receipts, to learn where they live. [9]

It sends the file to AI models for a report on what the victim is worth. [9]

Its instructions tell the AI it is "a forensic intelligence analyst". [9]

It asks Anthropic's Claude first, then Moonshot's Kimi or Google's Gemini if refused. [9]

It seems built for young people with busy online lives, Wired reports. [9]

Security researchers call this triage: deciding which victims to work on first. [9]

Faster sorting matters because stolen login tokens expire and passwords get changed, Fetterman says. [9]

Talos did not track whether Volta has been used against real people. [9]

Talos thinks Volta may be built to sell to many different attackers. [9]

Talos caught it with CAIRN, a new tool built to spot malware that uses AI. [9]

Why a leak of names and emails still matters

A company sorts the data it holds into levels by the harm a leak would do

Passwords, keys and case files are rated high, because they open things

Names, emails, job titles and birthdays open nothing alone, so they are rated low

Low-rated data is collected freely and guarded more lightly

A scammer uses it to pick the right person and make a fake message sound real

The low-risk label only checks whether data can open an account. A scammer cares whether it says whom to fool and how to sound believable.

Alexandre François checked 14 retailers. 8 of them asked for a birth date when a shopper signed up.

Retailers ask for a birth date because it helps their marketing, and a fake bank caller later reads it out to sound real.

It treats food delivery receipts and game logins as clues, then asks an AI model to rank each victim by worth.

Guarding every name as hard as a password would stop ordinary work, so firms still need the levels to decide where the strongest locks go.

The people on Chainalysis's list work at police forces and exchanges, and the shoppers in the Guardian story typed a birthday into a form.

Malware like Volta hands the sorting of stolen data to AI, which Talos says puts stronger tools in less skilled hands. [9]

Poryadok, a Russian chain selling home goods, closed some shops after a cyberattack. [10]

It runs 48 stores in 32 Russian cities. [10]

Its website and app were down for 5 days running, and some shops shut. [10]

Customers could not collect paid orders, use loyalty points or reach support. [10]

Local media say shops in Voronezh, where the company began in 2010, stayed shut. [10]

Poryadok confirmed a cyberattack but has not said how hackers got in. [10]

Hackers hit the Russian pizza chain Dodo Pizza in September. [10]

The travel site Anywayanyday paused bookings after an attack in mid-October. [10]

Poryadok says its shops will reopen, but it gave no date. [10]

Shoppers who had already paid were left without their goods or a way to ask. [10]

Nobody has said who attacked, or whether customer data was taken. [10]

For 5 days they could not collect paid orders, use loyalty points or reach support. [10]

Security experts told the Guardian that birthdays collected by shops help scammers. [11]

Alexandre François found 8 of 14 retailers he checked asked for a birth date. [11]

François investigates scams at WhoisXML API, an intelligence company. [11]

He says shops keep the field because it tells them customers' ages for marketing. [11]

Asos customers' birth dates were among the details taken in a recent hack. [11]

A fake bank caller can read out a person's name, address and birthday to sound real. [11]

ESET adviser Jake Moore says a birth date alone is "not particularly valuable" to criminals. [11]

Joined with names and phone numbers, it helps them pretend to be someone, he says. [11]

So a birthday typed into a shop form can later make a scam call sound real. [11]

Serpil Hall of Datos Insights says leaks get joined into an "enriched identity profile". [11]

Shops gain a customer's age, which helps them aim adverts. [11]

Customers carry the risk when that shop is hacked. [11]

François says only banks, tax offices and official checks truly need a real birth date. [11]

Retailers ask for a birth date because it helps their marketing, and a fake bank caller later reads it out to sound real.

Attackers this week went after companies that hold other people's details and keys.

The word non-sensitive sounds like nothing to worry about, but it only means the data cannot open an account on its own.