If you use Google Chrome or any Chromium-based browser (such as Microsoft Edge), we recommend you to please update it asap! In the past few weeks, the Chromium security team, in collaboration with Microsoft, has fixed two critical vulnerabilities, identified as CVE-2024-7971 And CVE-2024-7965which had been exploited in early August by a hacker group linked to the North KoreaThe group, known as “Citrine Street”targeted some organizations and stole cryptocurrencies from them. Both vulnerabilities are included in the Known Exploited Vulnerabilities Catalog (i.e. the catalog of known exploited vulnerabilities) of the CISA (Cybersecurity and Infrastructure Security Agency) and are solved with the Google Chrome version 128.0.6613.84 And 128.0.2739.42 by Microsoft Edge.
The security flaw exploited by North Korean hackers
CVE-2024-7971 It was the first zero-day vulnerability in Chromium – the open source version of Google’s browser on which other web browsers, such as Edge, are based. detected by Microsoft on August 19, 2024The Redmond giant discovered that the vulnerability in question was being used by the North Korean criminal group “Citrine Street” to target financial institutions linked to the world of cryptocurrencies, using social engineering techniques to trick victims into downloading malicious software. This type of attack uses human psychology to manipulate people into making mistakes that could compromise their security or that of the company they work for.
A classic example is the sending of phishing emails or seemingly harmless instant messages, such as urgent requests for sensitive data from a “colleague” or a government agency. These attacks aim to exploit trust or fear, convincing victims to download infected software or provide private information. The second vulnerability, CVE-2024-7965follows a similar dynamic. It was reported on July 30, 2024 by a researcher known as “TheDog” and concerns a flaw that could be exploited to perform attacks very similar to those described for CVE-2024-7971.
The dynamics of the attack are well explained by the report drawn up by Microsoft itself, where we read:
The threat actor creates fake websites masquerading as legitimate cryptocurrency trading platforms and uses them to distribute fake job applications or trick targets into downloading a weaponized cryptocurrency wallet or a legitimate app-based trading application. Citrine Sleet most commonly infects targets with its proprietary Trojan malware, AppleJeus, which gathers information needed to take control of the targets’ cryptocurrency assets.
The attack was perpetrated thanks to the ability of cybercriminals to trick a victim into visiting a web domain controlled by them. Then, also exploiting a Windows Kernel Vulnerabilitythey proceeded to install a malware that has deep access to the operating system, on the attacked PC.
The vulnerability was fixed thanks to collaboration between Microsoft and the Chromium team.
Why you should update Chrome and how to do it on your devices
If you are still wondering Why you should update Chrome or any other Chromium-based browseryou should know that software vulnerabilities represent a golden opportunity for malicious people, who can exploit them to infest the system with malware, steal personal data or even remotely control devices. Installing security updates is essential to counter the actions of unscrupulous cyber criminals, interested in penetrating the systems not only of companies and organizations of a certain importance, but also the systems of private users.
If you don’t know How to update Chromefollow these simple steps:
- From computer: open Chrome, click on the button ⋮ top right, follow the path Help > About Google Chrome and, if an update is available, download it by clicking the button Update Google Chrome. After the update is complete, click on Restart.
- From Android: open the Google Play Storetouch yours profile picture top right and select Manage apps and device. In the section Updates availablesearch for Chrome and tap Update.
- From iPhone or iPad: open theApp Storetouch yours profile picture top right, scroll down to the section Updates available and search for Chrome. If a new update is available, select Update.
If you use a another Chromium based browser (for example Microsoft Edge), we suggest you update this one as well. The steps to follow are more or less the same as those we indicated for Chrome.
If you haven’t already done so, however, we recommend that you enable automatic updates from your device’s settings, so that you can install updates promptly as soon as they are released.
