Chinese Smart Home Manufacturer Orvibo (Still) Leaking Sensitive Information

Unsecured ElasticSearch clusters containing over two billion user logs were leaked from Chinese smart home manufacturer Orvibo over the weekend. Leaked logs were found to contain sensitive customer ranging from email addresses and passwords, to precise geolocation data and conversations recorded by Orvibo's so-called "smart camera." At the time of this publication, Orvibo has neither responded to attempts to contact the vendor, nor have they made any fixes to this security issue.

Recommendations

• If you are using an Orvibo device, ZeroFOX recommends immediately changing your login credentials to prevent the device from being accessed or rendered unusable by attackers.
• Ensure that you are not reusing passwords for multiple devices. If your credentials are leaked by a breach such as this one, it could result in a chain of account compromises.
• Consider enabling the Cyber Chatter rule to monitor for discussion of this leak on covert channels.

Details

In a breach disclosure released on July 1, 2018, it was revealed that the Chinese manufacturer Orvibo has failed to secure ElasticSearch clusters containing plain text, sensitive customer logs, and as a result, over two billion logs have been leaked. Orvibo sells everything from smart lighting, to home security devices, to HVAC and energy control devices. This breach contained information from customers all over the world, and included the following sensitive information, among other things:

• login credentials, including hashed but unsalted password that could easily be cracked by an attacker
• precise geolocation data
• IP addresses
• recorded conversations
• scheduling information

Repercussions of this breach could potentially be severe. An attacker could login as an affected user, and change log in credentials, effectively locking a victim out of their device. This would provide the attacker with full control of the device, which could provide an attacker with access to information like a video feed from a smart camera, or precise geolocation and scheduling information from a smart lock which would allow an attacker to unlock a victim's door. As of July 1, 2019, Orvibo has failed to respond to multiple attempts by researchers to disclose this breach, and the company has failed to offer any kind of fix or resolution of the massive information leak. As no resolution has been offered by Orvibo, it appears that sensitive customer information will continue to be leaked.

New Ransomware: LooCipher

A new strain of ransomware has been discovered, and dubbed LooCipher. This ransomware has been seen to be dropped by malicious Office documents, that use macros to download the binary from an onion site. As usual, this ransomware encrypts a victim's files and demands a bitcoin payment to decrypt them.

Recommendations

• Maintain and frequently update offline backups of all critical information.
• Ensure defensive systems are updated with the latest detection.
• Consider enabling the Cyber Chatter rule in order to monitor activity related to this malware family.

Details

Researchers at Yoroi have identified a new strain of ransomware. This new malware family has been dubbed LooCipher, an allusion to Lucifer. The malicious binary responsible for encrypting a victim's files is dropped using a simplistic malicious Microsoft Office document. The document contains a single text line, requesting that the viewer enable macros to view the file. The macro embedded in these Office documents retrieves the ransomware from an onion site. The ransomware then encrypts files on a victim machine, appending the extension ".lcphr." Rather than deleting the original files as is generally the case with ransomware, this malware forces a 0-byte size and removes the contents of the file. All command and control network traffic is done using onion addresses, so the malware makes use of various services that act as proxies between the dark and clear webs. As is the norm, this ramsomware demands a payment of bitcoins to decrypt affected files.

Ransomware Update: Surge in Ryuk Attacks

An advisory has been released by the UK National Cyber Security Center, concerning a new Ryuk ransomware campaign. Ryuk is a family of ransomware that was first observed in August 2018. It is generally linked with Emotet or Trickbot, but could also be dropped by other malware families. Ryuk has been used in a number of high-profile attacks against US government instituions in the last month, including the Georgia court system.

Recommendations

• Maintain and frequently update offline backups of all critical information.
• Ensure defensive systems are updated with the latest detection.
• Consider enabling the Cyber Chatter rule in order to monitor activity related to this malware family.

Details

The United Kingdom's National Cyber Security Center has released a new advisory on a recent spike in Ryuk ransomware activity. Ryuk is known for adjusting its ransom according to the victim's percieved ability to pay, and for its long waiting period between initial infection and actual encryption of an infected machine. Ryuk is often seen dropped by Emotet and Trickbot banking trojans, although it has also been observed to be dropped by other malware as well. Ryuk lacks the ability to move laterally within a network, however, it does have the ability to enumerate and encrypt accessible network shares, and uses a number of anti-analysis techniques.

Although Ryuk is not a new ransomware family, it has hit US news recently as it was utilized in an attack against the State of Georgia. Both the Judicial Council and the Administrative Office of the Courts. Ryuk was also used in three attacks against the State of Florida last month.

The following are indicators of compromise associated with this recent campaign:

Hashes: 3a1692a6d0f6881b45792dfc4649b166965744b3d387784494d67874cd5d379b b895399bdd8b07b14e1e613329b76911ebe37ab038e4b760f41e237f863b4964 fe55650d8b1b78d5cdb4ad94c0d7ba7052351630be9e8c273cc135ad3fa81a75 85e5aff9b169657ba912f4edc019e2d38dd3c3fb2be187309dd65d4ae8732529

IP Addresses: 200[.]107[.]59[.]130 5[.]196[.]154[.]93 94[.]103[.]94[.]154 186[.]42[.]186[.]202 177[.]52[.]79[.]29 187[.]8[.]169[.]10 187[.]65[.]49[.]88 200[.]83[.]49[.]141 200[.]35[.]56[.]81 177[.]183[.]194[.]194 200[.]110[.]72[.]134 186[.]248[.]163[.]198 191[.]241[.]233[.]195 187[.]95[.]32[.]18 187[.]95[.]123[.]179 177[.]52[.]28[.]238