Cybercriminals are targeting YouTube creators with sophisticated phishing attacks disguised as brand collaborations. Learn how to identify these scams, protect your data, and safeguard your online presence

****summary****

*   **Phishing Attack**: Cybercriminals use fake brand collaboration emails to target YouTube creators.

*   **Malware Disguise**: Malicious files are hidden in password-protected attachments like contracts or promotional materials.

*   **Cloud Hosting**: Attackers leverage platforms like OneDrive to host malware, adding a layer of credibility.

*   **Sensitive Data Theft**: Malware steals login credentials, financial information, and grants remote access.

*   **Wide Reach**: Over 200,000 creators targeted globally, with thousands of phishing emails sent via automated tools.

CloudSEK’s threat research team has disclosed details of an advanced new phishing campaign targeting YouTube creators. According to CloudSEK’s investigation, shared exclusively with _Hackread.com_, scammers are using fake brand collaboration emails to steal accounts and spread scams to millions of followers.

****Campaign Analysis****

Report author Mayank Sahariya notes that this sophisticated phishing campaign involves impersonating trusted brands to distribute malware through fake collaboration offers. 

Attackers begin by scraping email addresses from YouTube channels, likely using a specialized parser tool. This allows them to target creators and organizations directly. With email addresses in hand, attackers use browser automation tools to send bulk phishing emails.

Next, the attackers send cleverly crafted emails that appear to be legitimate business proposals from well-known brands. These emails entice recipients with lucrative collaboration deals and include enticing compensation structures based on subscriber count. The malware is cleverly disguised within attachments such as Word documents, PDFs, or Excel files, often masquerading as promotional materials, contracts, or business proposals.

“At the end of the email, the threat actor includes instructions and a OneDrive link to access a zip file containing the agreement and promotional materials, secured with the password,” the report read.

The extracted files reveal four files, including Digital Agreement Terms and Payments Comprehensive Evaluation.exe, which is a malicious payload. Once downloaded and extracted, the zip file unleashes a malicious script disguised as a harmless file format, such as “webcams.pif.” This script leverages AutoIt3 automation software to execute further malware hidden within the archive.

To further bypass detection, the attackers host these malicious attachments on cloud storage platforms like OneDrive (form this ID- \[email protected\] created on August 15, 2024), protected by passwords. This tactic adds a layer of legitimacy, as recipients might expect collaboration agreements and promotional materials to be password-protected.

Once a curious YouTuber downloads the attachment, the malware installs itself on the victim’s system. This malware is designed to steal sensitive information, including login credentials, financial data, and intellectual property. In some cases, it can even grant remote access to the attacker, compromising the entire system.

Attack flow and malicious email used in the scam (Via CloudSec)

****Who are the Targets?****

According to CloudSec’s blog post, this global campaign primarily targets businesses and individuals involved in marketing, sales, and executive positions. These individuals are more likely to engage with brand collaborations and promotions, making them prime targets for this phishing scheme.  

So far, this campaign has targeted over 2 lakh YouTube creators, involving 500-1,000 phishing emails sent from a single email account and around 340+ SMTP servers have been weaponized for attacks.

To stay protected, YouTube creators should be cautious of unsolicited collaboration offers, especially password-protected attachments. Always double-check email addresses, and contact brands directly to confirm the legitimacy of collaboration offers. Also, avoid downloading attachments from unknown senders, even if password-protected to protect valuable data.

1.  **Scammers Rake in $600K with YouTube Deepfakes**
2.  **YouTube Channels Hacked to Spread Lumma Stealer**
3.  **Fake YouTube Android Apps Used to Distribute CapraRAT**
4.  **New YouTube phishing scam using authentic email address**
5.  **Get Paid to Like Videos YouTube Scam Empties Your Wallets**

Malware Hidden in Fake Business Proposals Hits YouTube Creators

Digital license plates sold by Reviver, already legal to buy in some states and drive with nationwide, can be hacked by their owners to evade traffic regulations or even law enforcement surveillance.

Digital license plates, already legal to buy in a growing number of states and to drive with nationwide, offer a few perks over their sheet metal predecessors. You can change their display on the fly to frame your plate number with novelty messages, for instance, or to flag that your car has been stolen. Now one security researcher has shown how they can also be hacked to enable a less benign feature: changing a car's license plate number at will to avoid traffic tickets and tolls—or even pin them on someone else.

Josep Rodriguez, a researcher at security firm IOActive, has revealed a technique to “jailbreak” digital license plates sold by Reviver, the leading vendor of those plates in the US with 65,000 plates already sold. By removing a sticker on the back of the plate and attaching a cable to its internal connectors, he's able to rewrite a Reviver plate's firmware in a matter of minutes. Then, with that custom firmware installed, the jailbroken license plate can receive commands via Bluetooth from a smartphone app to instantly change its display to show any characters or image.

That susceptibility to jailbreaking, Rodriguez points out, could let drivers with the license plates evade any system that depends on license plate numbers for enforcement or surveillance, from tolls to speeding and parking tickets to automatic license plate readers that police use to track criminal suspects. “You can put whatever you want on the screen, which users are not supposed to be able to do,” says Rodriguez. “Imagine you are going through a speed camera or if you are a criminal and you don't want to get caught."

One of Reviver's license plates, jailbroken to show any image IOActive researcher Josep Rodriguez chooses.

Photography: IOActive

Worse still, Rodriguez points out that a jailbroken license plate can be changed not just to an arbitrary number but also to the number of another vehicle—whose driver would then receive the malicious user's tickets and toll bills. “If you can change the license plate number whenever you want, you can cause some real problems,” Rodriguez says.

All traffic-related mischief aside, Rodriguez also notes that jailbreaking the plates could also allow drivers to use the plates' features, including its built-in GPS tracking, without paying Reviver's $29.99 monthly subscription fee.

Because the vulnerability that allowed him to rewrite the plates' firmware exists at the hardware level—in Reviver's chips themselves—Rodriguez says there's no way for Reviver to patch the issue with a mere software update. Instead, it would have to replace those chips in each display. That means the company's license plates are very likely to remain vulnerable despite Rodriguez's warning—a fact, Rodriguez says, that transport policymakers and law enforcement should be aware of as digital license plates roll out across the country. “It's a big problem because now you have thousands of licensed plates with this issue, and you would need to change the hardware to fix it,” he says.

IOActive says it repeatedly tried to contact Reviver about its findings over the past year, going so far as to describe its findings to US CERT, which then also tried to contact Reviver about the problem. Nonetheless, Reviver told WIRED that it only became aware of IOActive's jailbreaking research when WIRED reached out to the company last week.

In a statement, the company noted that jailbreaking a digital license plate to avoid tolls, tickets, or other law enforcement surveillance “would be a criminal act subject to prosecution by law enforcement.” The company adds that “the jailbreak technique identified by IOActive requires physical access to the vehicle and plate, plate removal, specialized tools, and expertise” and that “this scenario is highly unlikely to occur in real-world conditions, limiting it to individual bad actors knowingly violating laws and product warranties.” Reviver says it's also redesigning its license plates to avoid using chips vulnerable to Rodriguez's hacking technique in the future.

While Rodriguez agrees that jailbreaking a Reviver plate would require removing it from a vehicle, he disputes Reviver's claim that it would require “specialized tools” or “expertise.” To develop his jailbreaking method, he did use a fault-injection technique that required attaching wires to the plates’ internal chip, monitoring its voltage, and “glitching” that voltage at a specific moment to switch off its security features and gain the ability to analyze and rewrite its firmware. But once that reverse engineering process was complete, he used its results to develop a jailbreak tool that requires none of that technical complexity.

If that tool were to leak or be sold online—Rodriguez himself says he doesn't plan to publish his—he says anyone could use it to jailbreak their own plate in a matter of minutes. “They just need to connect a cable and install the new firmware, just like if you were jailbreaking your iPhone,” Rodriguez says.

Rodriguez also notes that his hacking technique could be used not just by a driver who wants to jailbreak their own plate, but also by someone targeting an unwitting owner of a plate too. If a hacker—or a parking valet or auto mechanic—could manage to remove a license plate and install their own firmware on it, Rodriguez warns, they could surreptitiously track a driver or even change their license plate number over the internet by programming the plate to connect to a server the hacker controlled.

In addition to the physical access and time necessary to pull off that hack, however, a license plate saboteur would also need to overcome a feature of Reviver's plates that sends a notification to the owner when it's detached from a vehicle. That would require jamming the plate's radio communications while tampering with it, Rodriguez notes, an added wrinkle that makes the attack even less practical, though perhaps not impossible.

Rodriguez isn't the first to hack Reviver's systems. In 2022, security researcher Sam Curry found vulnerabilities in the company's web infrastructure that allowed him to make himself an administrator in its backend database, with the ability to track or change license plates at will. Unlike Rodriguez's hardware hacking, however, Reviver was able to quickly patch its web-based bugs to prevent Curry's technique.

Although Curry's web hacking method was far easier to pull off prior to Reviver's patch than Rodriguez's hardware hacking, he says that Rodriguez's method would likely hold real appeal for certain scofflaw drivers, who might want to jailbreak their Reviver plates or simply buy pre-jailbroken plates online. “If you want to swap your license plate number, James Bond style, then drive at crazy speeds or something, you can change it for a few hours and change it back without even pulling into a parking garage,” says Curry. “The people who are causing havoc on the road would probably be into this.”

Digital license plates are currently legal to buy and register in California and Arizona (Michigan also briefly allowed them), with many more states considering legalizing them in years to come. As that rollout continues, Rodriguez and Curry argue that license plate makers, transit regulators, and law enforcement all need to be aware that any system that relies solely on license plates as an identifier may be susceptible to digital license plate hacking—with potentially chaotic consequences.

“You should assume people will mess with them,” says Curry. “And people need to accept the implications of that.”

_Updated 12:48 pm EST, December 16, 2024: Clarified Michigan's policy on digital license plates._

Hackers Can Jailbreak Digital License Plates to Make Others Pay Their Tolls and Tickets

Cybersecurity researchers are calling attention to a new kind of investment scam that leverages a combination of social media malvertising, company-branded posts, and artificial intelligence (AI) powered video testimonials featuring famous personalities, ultimately leading to financial and data loss.
"The main goal of the fraudsters is to lead victims to phishing websites and forms that harvest

New Investment Scam Leverages AI, Social Media Ads to Target Victims Worldwide

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.

Skip to content

**Navigation Menu**

*   *   GitHub Copilot
        
        Write better code with AI
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Actions
        
        Automate any workflow
        
    *   Codespaces
        
        Instant dev environments
        
    *   Issues
        
        Plan and track work
        
    *   Code Review
        
        Manage code changes
        
    *   Discussions
        
        Collaborate outside of code
        
    *   Code Search
        
        Find more, search less
        
    

*   Explore
    
    *   Learning Pathways
    *   White papers, Ebooks, Webinars
    *   Customer Stories
    *   Partners
    *   Executive Insights
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   *   Enterprise platform
        
        AI-powered developer platform
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-54682

**Mattermost Data Amplification vulnerability**

Moderate severity GitHub Reviewed Published Dec 16, 2024 to the GitHub Advisory Database • Updated Dec 16, 2024

**Package**

gomod github.com/mattermost/mattermost/server/v8 (Go)

**Affected versions**

\>= 10.1.0, < 10.1.3

\>= 10.0.0, < 10.0.3

\>= 9.11.0, < 9.11.5

\>= 9.5.0, < 9.5.13

**Patched versions**

10.1.3

10.0.3

9.11.5

9.5.13

**Description**

Published to the GitHub Advisory Database

Dec 16, 2024

Last updated

Dec 16, 2024

GHSA-v647-h8jj-fw5r: Mattermost Data Amplification vulnerability

Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side (webapp and mobile) DoS to users of particular channels, by sending a specially crafted post.

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-54083

**Mattermost Improper Validation of Specified Type of Input vulnerability**

Moderate severity GitHub Reviewed Published Dec 16, 2024 to the GitHub Advisory Database • Updated Dec 16, 2024

**Package**

gomod github.com/mattermost/mattermost/server/v8 (Go)

**Affected versions**

\>= 10.0.0, < 10.0.3

\>= 9.11.0, < 9.11.5

\>= 9.5.0, < 9.5.13

\>= 10.1.0, < 10.1.3

**Patched versions**

10.0.3

9.11.5

9.5.13

10.1.3

Published to the GitHub Advisory Database

Dec 16, 2024

Last updated

Dec 16, 2024

GHSA-69pr-78gv-7c6h: Mattermost Improper Validation of Specified Type of Input vulnerability

A fraudulent Google ad meant to phish employees for their login credentials redirects them to a fake browser update page instead.

On December 15, we detected a malicious campaign targeting Kaiser Permanente employees via Google Search Ads. The fraudulent ad masquerades as the health care company’s HR portal used to check for benefits, download paystubs and other corporate related tasks.

We believe the threat actors’ intent was to phish KP employees for their login credentials, but something unexpected happened. Instead, victims who clicked on the ad were redirected to a compromised website that prompted them to update their browser.

This notification is part of a malware campaign known as SocGholish that tricks users into running a script supposedly meant to update their browser. Rather, it infects machines and if the victim is deemed important enough, a human operator will gain access in order to perform nefarious actions.

In this blog post, we review how this attack unfolds and why a compromised website derailed the attackers’ plan. We already reported the malicious ad to Google.

Several criminal gangs are currently abusing Google Ads to phish victims of various large companies. They prey on employees simply googling for their HR portal so that they can display a malicious ad to lure them in.

Case in point, when searching for Kaiser Permanente’s HR portal, we saw the following ad:

We were able to identify the advertiser who registered a fake account under the name ‘Heather Black’. This ad was only showed for U.S.-based searches, as can be seen in the Google Ads Transparency Center report:

**Former company’s website hijacked for phishing**

The displayed url shown in the ad (_https://www.bellonasoftware\[.\]com_) does not look associated with Kaiser Permanente. According to LinkedIn, Bellona Software was a company based in Romania. We can see what their website looked like in 2021, using the Internet Archive:

Sometimes more recently, this same website was taken over by criminals who transformed it into a phishing page for Kaiser Permanente:

**Malicious redirect to SocGholish**

It looks like there was more than one cook in the kitchen, as malicious code was also injected in the core JavaScript libraries for that website, confirmed in a scan by Sucuri’s SiteCheck:

When potential victims clicked on the ad, they landed on that compromised website, which in turn briefly displayed the phishing template only for as long as a mouse scroll or click. Then, a new screen appeared with what looks like a Google Chrome notification claiming the user’s browser is out of date:

This screen, also known as SocGholish, is a long running malware campaign that targets vulnerable websites indiscriminately. When a user executes the downloaded _Update.js_ file, they are instead running a malicious script that will collect some of their computer’s information and relay it to a group of criminals. After this fingerprinting takes place, additional tooling such as Cobalt Strike may be downloaded, preparing the ground for a _human on keyboard_ type of attack.

To the best of our knowledge, the phishing campaign has nothing to do with SocGholish, and we assume that the original threat actors did not anticipate for the website they took over to be compromised. As for the gang behind SocGholish, the victims would come from a Google search, something they usually check for via the referer.

**Protecting against web threats**

For victims, neither the phishing scheme nor the malware are a happy outcome. While initially targeted because of what they searched for, they fell into the hands of a different criminal syndicate.

Such is the reality of web threats. This is a dynamic and ever changing landscape with a number of malicious players trying to lure users in their own way.

Online ads, and in particular search ads, continue to be a threat. As we have showed many times on this blog, any brand is at risk of being impersonated. Unfortunately, this trend has continued unabated throughout 2024.

At the same time, ‘old’ malware campaigns like SocGholish pose a risk due to a never ending number of outdated websites ready to be compromised and act as a springboard for malware delivery.

When searching online, we urge to use extreme caution with any sponsored results and if possible add protection to your online browsing experience with tools like Malwarebytes Browser Guard.

We reported the malicious ad to Google and will update this blog if we hear anything back.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

**Indicators of Compromise**

Phishing site

bellonasoftware\[.\]com

SocGholish infrastructure

premium\[.\]davidabostic\[.\]com  
riders\[.\]50kfor50years\[.\]com

 Malicious ad distributes SocGholish malware to Kaiser Permanente employees 

IntroductionIn a previous article, I demonstrated how to configure the Automatic Certificate Management Environment (ACME) feature included in the Identity Management (IdM) Dogtag Certificate Authority (CA). Specifically, I covered installation of IdM with random serial numbers, and how to enable the ACME service and expired certificate pruning. This article explains the management of ACME (currently a technology preview) with IdM and Red Hat Enterprise Linux (RHEL) clients.Currently, mod_md is the only ACME client implementation completely supported and provided by Red Hat. For this article,

Automatically acquire and renew certificates using mod_md and Automated Certificate Management Environment (ACME) in Identity Management (IdM)

The security system that underlies the internet makes use of a curious fact: You can broadcast part of your encryption to make your information much more secure.

If you buy something using links in our stories, we may earn a commission. This helps support our journalism. Learn more. Please also consider subscribing to WIRED

_The original version of_ _this story_ _appeared in Quanta Magazine._

For thousands of years, if you wanted to send a secret message, there was basically one way to do it. You’d scramble the message using a special rule, known only to you and your intended audience. This rule acted like the key to a lock. If you had the key, you could unscramble the message; otherwise, you’d need to pick the lock. Some locks are so effective they can never be picked, even with infinite time and resources. But even those schemes suffer from the same Achilles’ heel that plagues all such encryption systems: How do you get that key into the right hands while keeping it out of the wrong ones?

The counterintuitive solution, known as public key cryptography, relies not on keeping a key secret but rather on making it widely available. The trick is to also use a second key that you never share with anyone, even the person you’re communicating with. It’s only by using this combination of two keys—one public, one private—that someone can both scramble and unscramble a message.

To understand how this works, it’s easier to think of the “keys” not as objects that fit into a lock, but as two complementary ingredients in an invisible ink. The first ingredient makes messages disappear, and the second makes them reappear. If a spy named Boris wants to send his counterpart Natasha a secret message, he writes a message and then uses the first ingredient to render it invisible on the page. (This is easy for him to do: Natasha has published an easy and well-known formula for disappearing ink.) When Natasha receives the paper in the mail, she applies the second ingredient that makes Boris’ message reappear.

In this scheme, anyone can make messages invisible, but only Natasha can make them visible again. And because she never shares the formula for the second ingredient with anyone—not even Boris—she can be sure the message hasn’t been deciphered along the way. When Boris wants to receive secret messages, he simply adopts the same procedure: He publishes an easy recipe for making messages disappear (that Natasha or anyone else can use), while keeping another one just for himself that makes them reappear.

In public key cryptography, the “public” and “private” keys work just like the first and second ingredients in this special invisible ink: One encrypts messages, the other decrypts them. But instead of using chemicals, public key cryptography uses mathematical puzzles called trapdoor functions. These functions are easy to compute in one direction and extremely difficult to reverse. But they also contain “trapdoors,” pieces of information that, if known, make the functions trivially easy to compute in both directions.

One common trapdoor function involves multiplying two large prime numbers, an easy operation to perform. But reversing it—that is, starting with the product and finding each prime factor—is computationally impractical. To make a public key, start with two large prime numbers. These are your trapdoors. Multiply the two numbers together, then perform some additional mathematical operations. This public key can now encrypt messages. To decrypt them, you’ll need the corresponding private key, which contains the prime factors—the necessary trapdoors. With those numbers, it’s easy to decrypt the message. Keep those two prime factors secret, and the message will stay secret.

Illustration: Mark Belan/_Quanta Magazine_

The foundations for public key cryptography were first discovered between 1970 and 1974 by British mathematicians working for the U.K. Government Communications Headquarters, the same government agency that cracked the Nazi Enigma code during World War II. Their work (which remained classified until 1997) was shared with the US National Security Agency, but due to limited and expensive computing capacity, neither government implemented the system. In 1976, the American researchers Whitfield Diffie and Martin Hellman discovered the first publicly known public key cryptography scheme, influenced by the cryptographer Ralph Merkle. Just a year later, the RSA algorithm, named after its inventors Ron Rivest, Adi Shamir and Leonard Adleman, established a practical way to use public key cryptography. It’s still in wide use today, a fundamental building block of the modern internet, enabling everything from shopping to web-based email.

This two-key system also makes possible “digital signatures”—mathematical proof that a message was generated by the holder of a private key. This works because private keys can be used to encrypt messages too, not just decrypt them. Of course, this is useless for keeping messages secret: If you used your private key to scramble a message, anyone could just use the corresponding public key to unscramble it. But it does prove that you, and only you, created the message, since as the holder of the private key, only you could have encrypted the message. Cryptocurrencies like bitcoin couldn’t exist without this idea.

If two cryptographic keys instead of one is so effective, why did it take millennia to discover? According to Russell Impagliazzo, a computer scientist and cryptography theorist at the University of California, San Diego, the concept of a trapdoor function just wasn’t useful enough before the invention of computers.

“It’s a matter of technology,” he said. “A person in the 19th century thought of encryption as being between individual agents with military intelligence in the field—literally, in a field with guns firing. So if your first step is ‘pick two 100-digit prime numbers to multiply together,’ the battle is going to be over before you do that.” If you reduce the problem to something a human can do quickly, it’s not going to be terribly secure.

But while computers helped make public key cryptography possible, they’ve also created cracks in its armor. In 1994, the mathematician Peter Shor discovered a way for quantum computers to efficiently reverse the trapdoor functions that underlie most current public key cryptography systems, including prime factorization. This algorithm, if implemented, would act like an all-purpose “reappearing ink,” capable of making any invisible message reappear. Goodbye, internet security.

Luckily, quantum computers themselves are “still in the ENIAC phase,” Impagliazzo said, referring to the room-size machine built for the US Army in 1945. By the time quantum computers become sophisticated enough to pose a real threat to public key cryptography, its original trapdoor functions could be replaced by “quantum-safe” versions called lattice problems. Of course, this new computational “ink” may also become susceptible to attack in the future. But that’s the great thing about public key cryptography: As long as we can find new functions to use, we can just keep reinventing the wheel. Or in this case, the key.

_Original story_ _reprinted with permission from Quanta Magazine, an editorially independent publication of the_ _Simons Foundation_ _whose mission is to enhance public understanding of science by covering research developments and trends in mathematics and the physical and life sciences._

The Simple Math Behind Public Key Cryptography

Another day, another healthcare database misconfiguration exposing sensitive patient information.

****SUMMARY****

*   **Cybersecurity researcher Jeremiah Fowler discovered an unprotected Care1 database with over 4.8 million patient records.**

*   **Exposed data included names, addresses, medical histories, and Personal Health Numbers (PHNs).**

*   **Responsibility for the breach and its duration remains unclear.**

*   **Healthcare data breaches are increasing, posing significant privacy risks.**

*   **Stronger cybersecurity measures are essential for protecting sensitive patient information.**

Cybersecurity researcher **Jeremiah Fowler** recently discovered a massive database belonging to Care1, a Canadian company that provides AI-powered software solutions to optometrists. The database, containing over 4.8 million records of patient information (with a total size of 2.2 TB), was left completely unprotected, exposing sensitive data like patient names, addresses, medical histories, and even their unique Personal Health Numbers (PHNs).

Care1 is a specialized healthcare technology company with over 170 partner optometrists and over 150,000 patient visits managed using their software. They specialize in eyecare disruption using artificial intelligence, leveraging advanced software engineering and extensive partnership networks.

According to Fowler’s investigation, published by vpnMentor, the exposed data included detailed eye exam reports with patient information, doctor’s notes, and images. Eye exam reports were in PDF format and included patient PII, doctor’s comments, and images.

In addition, CSV and XLS spreadsheets were also part of the exposed database and listed patients with home addresses, Personal Health Numbers (PHNs), and other health-related information, including doctor’s comments and images from the eye exams.

For your information, in the Canadian healthcare system, a Personal Health Number (PHN) is a unique identifier that ensures a patient’s health information is accessible to all providers. While the PHN itself might not directly lead to financial fraud, it can be a valuable piece of information for criminals to build a comprehensive profile of an individual.

It’s unclear whether the database was directly owned and managed by Care1 or handled by a third-party contractor. It is also unclear for how long it remained exposed or whether it was accessed by any unauthorized individual unless an internal forensic audit is conducted. According to Fowler’s **blog post**, he sent a responsible disclosure notice to the company and public access was restricted promptly. 

With the increasing reliance on digital systems in **healthcare**, the potential for data breaches is also increasing. This level of exposure poses significant privacy risks for patients, as their medical information could be misused for identity theft or other malicious activities. In 2023, Fowler **discovered** a non-password-protected database belonging to Indian medical diagnostics firm Redcliffe Labs, containing over 12 million records, including sensitive patient data like medical scans and test results.

These incidents reflect the need for heightened security measures within the healthcare sector. Companies like Care1, which handle sensitive patient information, must prioritize stringent cybersecurity measures, including strong encryption, access controls, and regular security audits.

1.  **7TB of Healthcare Data Leak Affects 12 Million Patients**
2.  **AI Firm’s Server Exposed 5.3 TB of Mental Health Records**
3.  **How Artificial Intelligence (AI) is Impacting Modern Healthcare**
4.  **Dark Web Sales Fuel 32% Increase in Healthcare Cyberattacks**
5.  **AI in Healthcare: ChatGPT Helps Boy Get Diagnosis After Doctors Fail**

Canadian Eyecare Firm Care1 Exposes 2.2TB of Patient Records

Open to players of all skill levels, the "Snow-mageddon" cybersecurity competition takes place in the world of Santa, elves, and Christmas mayhem.

The North Pole is on the verge of a civil war. Santa is missing. It’s elf vs. elf. Factions have formed, and it's up to you to save the day, block a ransomware attack, and untangle multiple cybersecurity snafus to ensure this year's holiday gifts don't get buried under a mountain of snowballs.

No, it's not a children's story with a cyber twist. The Holiday Hack Challenge from SANS Institute is back for another season of wintery fun. Open to players of all skill levels, the online competition with real-world cybersecurity problems is set in the world of Santa, elves, and Christmas mayhem. This year's competition is open and will run through Jan. 3, 2025.

"There's some really good stuff in there with ransomware analysis, Web application penetration testing, incident response and incident analysis," says Ed Skoudis, founder of the Holiday Hack Challenge and president of the SANS Institute.

Skoudis calls the Holiday Hack Challenge, now in its 21st year, SANS's gift to the cybersecurity community. The goal is to provide a learning environment that is freely available to everyone in the world to learn skills while having fun, as well as to build a community where people work together and get to know each other. Players don't have to play through the game in one sitting or in order. Anyone who needs help can ask the elves in the game — the elves are very promiscuous hint-givers, Skoudis says — or join the Discord server to chat with other players.

Many of the challenges are taken from real-world cybersecurity incidents. Each challenge is ranked by difficulty, from one to five snowballs, with five being the most difficult. What's new this year is that every challenge can be solved in two ways: an easy mode and hard mode. Players don't know which mode they are in, but if their solution took the easy method, they'll "receive" a silver trophy. Solving the hard way results in a gold trophy. And skipping a challenge gives them a bronze participation trophy. A certain number of points are assigned for bronze, silver, and gold for each challenge, which are then summed into the player's score. A leaderboard displays player scores — and people who signed up as a cohort have their own private scoreboard.

"All year long, we're canvassing, looking for ideas of novel attacks that everybody should know about and know how to investigate, know how to do penetration tests for, and we're pulling those ideas together and putting them in holiday hack at the highest quality we can," Skoudis says.

This year's challenges fall into the following categories:

*   Ransomware Reverse Engineering
    

*   Web App Hacking with MQTT and Video Feed Manipulation
    

*   Mobile App Penetration Testing
    
*   OSINT via Drone Path Analysis
    
*   Web Exploration with cURL
    
*   PowerShell for Cyber Defense
    

**The Best Prize of All**

Winners will be announced in a webcast on Jan. 16, 2025. The grand prize winner will get a free SANS on-demand course, though some previous winners have found themselves with something more: a full-time job.

Janusz Jasinski first participated in the Holiday Hack Challenge in 2018 and was hired as a senior technical engineer by Counter Hack in 2023 after networking with people he encountered in the community. He is now involved with the challenge as a game designer. Finding the sweet spot of something that's not too easy yet not too hard is the greatest challenge in designing the game, Jasinski said. He designed this year's mobile app penetration test challenge.

"My challenge this year was \[a difficulty level of\] two or three out of five,” Jasinski says. "It's easy to do \[create\] a very easy challenge, it's easy to do a very hard challenge. It's very hard to do those in the middle, and just getting the right amount of complexity in there was a bit challenging. But further this year, we had the gold and silver, i.e., easy and hard routes. So to bake that in was now an extra level of difficulty."

But the fun part, he says, is having people in the real world playing and actually succeeding in the challenge, then sharing their solutions on Discord or social media.

Participating in the Holiday Hack Challenge and joining the community also led Kyle Parrish to a role behind the scenes. Parrish first played the Holiday Hack Challenge in 2018, winning an honorable mention early in his cybersecurity career.

"I played it and absolutely loved it — the practical application of the challenges and the just goofy video game feel," he says. "It was a ton of fun. I learned a lot of tools that I literally was able to start using in my work and help me progress as a young security engineer."

Parrish says he enjoyed the competition and sense of community so much that he played annually and volunteered to be a concierge in Discord, helping others with the challenges, in 2023. In January 2024, he joined the Counter Hack team as a senior technical engineer and is also now involved in designing the challenges.

"My favorite part is how, basically, the entire game is run off an Excel spreadsheet, which just kind of blew my mind," Parrish says. "And to see the skill that was put into it by some of our other teammates on building this game engine … to create these environments in this virtual world where players can interact with these challenges. It's so much fun."

It's also exciting to see how people solve his challenge, he adds.

"Somebody found an exploit in it and was able to get root against the challenge, which was awesome," Parrish says. "It was really cool to see that I had an intended path, but you were able to have an alternate path and were able to escalate your privileges. And that just makes for an even better write-up and a better learning experience for everybody involved."

Though it may come cloaked in snowball fights and elf espionage, real-world training and building a peer community is the real point of the challenge.

"I hope players develop cybersecurity skills that they can use in their actual job," Skoudis says. "That's the bottom line. And at the same time, I hope we have spoonfuls of holiday sugar that helps make the medicine go down, you know?"

**About the Author**

Contributing Writer

Jennifer Lawinski is a writer and editor with more than 20 years experience in media, covering a wide range of topics including business, news, culture, science, technology and cybersecurity. After earning a Master's degree in Journalism from Boston University, she started her career as a beat reporter for The Daily News of Newburyport. She has since written for a variety of publications including CNN, Fox News, Tech Target, CRN, CIO Insight, MSN News and Live Science. She lives in Brooklyn with her partner and two cats.

Tag

#web