According to a new report, Chinese threat actors breached North America’s largest transport network in a likely cyber-espionage campaign earlier this year.

The attackers reportedly exploited a zero-day vulnerability in the Pulse Connect Secure remote access product to penetrate the IT systems of New York’s Metropolitan Transportation Authority (MTA) in April.

Although they achieved persistence for several days and compromised three of the transit authority’s 18 computer systems, the MTA claimed that the actors stole no customer or internal data and made no changes to critical systems.

“Our response to the attack, coordinated and managed closely with state and federal agencies, demonstrated that while an attack itself was not preventable, our cybersecurity defense systems stopped it from spreading through MTA systems,” a statement sent to the New York Times revealed.

The MTA is said to have begun a forensic review following warnings about the zero-day by US authorities.

According to the report, the attack involved two sets of Chinese threat groups. A potential target for the attack was insider information on subway cars and rail networks that could allow the country to dominate the global market.

Pulse Secure customers were warned about the bug in late April. As Infosecurity reported at the time, CVE-2021-22893 has a CVSS score of 10.0 and is listed as a critical authentication bypass.

It was being exploited in combination with multiple legacy CVEs in the product from 2019 and 2020 to bypass multi-factor authentication — enabling attackers to install web shells and perform espionage activities.

Brooks Wallace, VP EMEA at Deep Instinct, argued that although the attackers didn’t cause any physical damage to transport networks around New York, they had the opportunity.

“This attack could easily have been a way for the attackers to determine whether or not an isolated infrastructure could be breached and taken down, with plans for a more widespread cyber-attack across the US in the future,” he added.

“Staying at the bleeding edge of innovation is the only way to outpace the attackers. The best protection against attacks such as this one is a multi-layered approach using a variety of solutions. A ‘prevention-first’ mindset is also key.”

Visitors to a Scottish tourism website were greeted with X-rated images after malicious cyber-criminals plastered its pages with pornographic promotions. 

The independent site eastlothianmuseums.org was set up by organizers ABC to help tourists seeking cultural experiences in East Lothian. 

“People usually tend to overlook museums when they are on a break because these places take time and lot of patience, but we at ABC are dedicated towards changing that mindset and introduce people to museums in East Lothian,” said the group. 

But despite describing themselves as a “team that loves museums and wants the natives of Scotland as well as travelers from other countries to know their importance,” ABC appears to have abandoned the website.

The East Lothian Courier reports that no news or updates have been posted to the eastlothianmuseums.org site in more than two years. 

After apparently being forsaken by its operators, the site fell into the hands of cyber-criminals hoping to lure victims with links to sexually explicit content. After hacking into the site, the threat actors posted links to adult websites that promise to fulfill “society’s darkest fantasies.”

In addition to adware, the site was laced with graphic descriptions of sex acts that could be viewed by clicking on certain links.

East Lothian Council said the racy site has now been updated with a security warning. 

“We are aware of this site, which details information on a range of museums and related visitor attractions across the county. It is not linked to or connected with East Lothian Council and our museums service or using the council branding style or logo.

“Anyone connecting to this site will see a security warning which indicates that continued use of the site may cause problems to the user.”

Enquiries by the council were unable to establish where the site might be hosted. But misspellings of the word ‘whisky’ suggest it may not be based in Scotland. 

Dirk Schrader, global vice president of security research at New Net Technologies, commented: “Websites are an easy target for attackers, as they are destined to be publicly available. This means the attacker can scan them with a range of automated penetration tools. 

“Badly maintained websites, using outdated content management systems, are the go-to place for attackers to install reflectors or agents to enable additional attacks.”

A partial settlement has been reached in a cyber-bullying case brought by the parents of a missing toddler against the operator of a chat group set up to discuss the fate of their son.

Dylan Ehler was three years old when he vanished from the backyard of his grandmother’s home in Truro, Nova Scotia, at around 1:15 pm on May 6, 2020. Searches for the missing child were called off after two weeks, and his whereabouts remain a mystery.

The only trace of the toddler discovered to date were his rubber boots, which were located roughly 150 meters apart along Lepper Brook.

In online discussions of the case, Ehler’s parents, Jason Ehler and Ashley Brown, have been variously accused without evidence of involvement in the boy’s disappearance and of murdering their son. 

In February, Ehler’s parents decided to take April Diane Moulton and Tom Hurley, also known as Tom Hubley, to court, arguing that the accusations and insults posted on a Facebook page administered by the pair constitute cyber-bullying.

The page, which was called “Dylan Ehler Open for Discussions” or “Dylan Ehler Open for Suggestions,” at one point had over 17,000 members. 

“It’s been horrific quite frankly,” said the parents’ lawyer, Allison Harris. “They’re dealing with looking for their son, and this has taken away from that.

“Every time they go online, they get these kinds of messages, and some of this has spilled over into the community, and that’s impacting them as well.”

In an order signed late last month in Nova Scotia Supreme Court, Moulton was prohibited from re-opening the now closed Facebook page about Dylan and from starting another one like it. Moulton is also banned from making any further public posts about the missing child or his parents.

Hurley was offered a similar agreement to the one accepted by Moulton but has not accepted it. He reportedly said that since he lives in the same small town as Ehler’s parents, he cannot agree to a ban on seeing them. 

The parties are due to meet face to face in court on August 3 for a hearing.