Threat Intelligence Bulletin: 06/05/20 - 06/11/20

Patch Tuesday 06/09/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Microsoft's Patch Tuesday update for June 2020 contained 132 vulnerabilities in total, with:

• 6 vulnerability rated as Critical
• 88 vulnerabilities rated as High
• 36 vulnerabilities rated as Medium
• 2 vulnerabilities rated as Low

Critical vulnerabilities

The most notable critical-rated vulnerabilities are tracked as CVE-2020-1331 and CVE-2020-9633.

CVE-2020-1331

CVE-2020-1331 is a spoofing vulnerability impacting Microsoft System Center 2016 Operations Manager. According to Microsoft, the vulnerability exists when System Center Operations Manager (SCOM) does not properly sanitize a specially crafted web request to an affected SCOM instance. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SCOM instance. The attacker who successfully exploits the vulnerability could then perform cross-site scripting attacks on affected systems and run the script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SCOM instance on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.

CVE-2020-1331

CVE-2020-1331 is an arbitrary code execution vulnerability in Adobe Flash Player affecting Microsoft Windows. Successful exploitation of this vulnerability could result in an attacker executing arbitrary code in the context of the affected application. Depending on the privileges associated with this application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of this vulnerability could have less impact than if it was configured with administrative rights.

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-1206, CVE-2020-1284, and CVE-2020-1301 which affects the Microsoft Windows SMB (Server Message Block) and Microsoft Windows SMBv3 Client/Server.

CVE-2020-1206

An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. According to Microsoft, an attacker who successfully exploits the vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability against a server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 server. To exploit the vulnerability against a client, an unauthenticated attacker would need to configure a malicious SMBv3 server and convince a user to connect to it. This vulnerability impacts the following Microsoft products:

• Windows Server version 1903 (Server Core installation)
• Windows 10 Version 1903 for 32-bit Systems
• Windows 10 Version 1903 for x64-based Systems
• Windows 10 Version 2004 for 32-bit Systems
• Windows 10 Version 1903 for ARM64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows Server version 2004 (Server Core installation)
• Windows 10 Version 2004 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows Server version 1909 (Server Core installation)
• Windows 10 Version 2004 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems

Proof-of-concept to exploit this vulnerability has been provided to Microsoft. The most recent Microsoft security update corrects how the SMBv3 protocol handles these specially crafted requests.

CVE-2020-1284

A denial of service vulnerability that exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. According to Microsoft, an authenticated attacker who successfully exploited this vulnerability against an SMB Server could cause the affected system to crash. An unauthenticated attacker could also exploit this vulnerability against an SMB client and cause the affected system to crash. To exploit the vulnerability against a server, an authenticated attacker could send a specially crafted packet to a targeted SMBv3 server. To exploit the vulnerability against a client, an unauthenticated attacker would need to configure a malicious SMBv3 server and convince a user to connect to it. This vulnerability impacts the following Microsoft products:

• Windows 10 Version 2004 for x64-based Systems
• Windows 10 Version 2004 for ARM64-based Systems
• Windows Server version 2004 (Server Core installation)
• Windows 10 Version 2004 for 32-bit Systems

The most recent Microsoft security update corrects how the SMBv3 protocol handles these specially crafted requests, for both vulnerabilities.

CVE-2020-1301

A remote code execution vulnerability exists in the way the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. According to Microsoft, an attacker who successfully exploits the vulnerability could gain the ability to execute code on the target server. To exploit the vulnerability, in most situations, an authenticated attacker could send a specially crafted packet to a targeted SMBv1 server. This vulnerability impacts the following Microsoft products:

• Windows 10 Version 1803 for x64-based Systems
• Windows Server version 1903 (Server Core installation)
• Windows Server 2012 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2012 R2 (Server Core installation)
• Windows 10 Version 1709 for ARM64-based Systems
• Windows Server version 2004 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows 10 Version 1803 for ARM64-based Systems
• Windows 10 Version 1709 for x64-based Systems
• Windows 10 Version 1903 for 32-bit Systems
• Windows 10 Version 1903 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2012
• Windows 10 Version 2004 for 32-bit Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows 10 Version 2004 for x64-based Systems
• Windows 7 for 32-bit Systems Service Pack 1
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows Server 2019
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1709 for 32-bit Systems
• Windows Server version 1803 (Server Core Installation)
• Windows Server 2016 (Server Core installation)
• Windows Server 2019 (Server Core installation)
• Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 10 Version 1903 for ARM64-based Systems
• Windows Server 2012 R2
• Windows 10 Version 1803 for 32-bit Systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows 10 Version 2004 for ARM64-based Systems
• Windows Server 2008 for Itanium-Based Systems Service Pack 2
• Windows 10 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server version 1909 (Server Core installation)
• Windows Server 2016
• Windows 8.1 for x64-based systems
• Windows RT 8.1

Proof-of-concept to exploit this vulnerability has been provided to Microsoft. The most recent security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.

Office vulnerabilities

Microsoft Office and Excel have also received several updates on the Patch Tuesday update. The most notable among them are CVE-2020-1225 and CVE-2020-1226, which could allow remote code execution in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploits the vulnerability could run arbitrary code in the context of the current user. CVE-2020-1229 is yet another security bypass vulnerability that exists in Microsoft Outlook when Office fails to enforce security settings configured on a system. An attacker who successfully exploits this vulnerability could cause a system to load remote images. These images could disclose the IP address of the targeted system to the attacker.

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Breach Disclosure: Zoomcar

Zoomcar, an Indian self-drive car rental company, operating in 45 cities across the country has suffered a data breach, impacting more than 3.5 million customers. This breach was put up for sale on a popular hacking forum on May 19, 2020.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

A database containing over 3.5 million records of customers of Zoomcar, an Indian self-driving car rental company, has been leaked and sold on a dark web forum for a minimal price.

Figure 1. Zoomcar’s Database available for sale on a hacker forum.

The leaked information includes:

• Names
• Email addresses
• Phone numbers
• IP addresses
• Bcrypt-hashed passwords

Figure 2. Sample data posted by the threat actor selling Zoomcar’s database.

Breach Disclosure: Mathway

In January 2020, math problem solving forum Mathway experienced a data breach involving over 17 million records. Breached data includes full names, Google and Facebook IDs, email addresses and salted password hashes.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The data involved in this breach has been circulated on various hacking forums since May 2020. Initially, the price of this breach was higher than average, however, in recent weeks this price has dropped. This is likely because some forum members who obtained the breach are reselling the data at a lower price.

Figure 1: Database available for sale on a hacking forum

Breaking News: 2020-06-05 - 2020-06-11

New 'Tycoon' Ransomware Strain Targets Windows, Linux

Security researchers from BlackBerry and KPMG have discovered a new form of Java-based ransomware dubbed 'Tycoon' that has targeted educational institutions and software companies. The Tycoon ransomware has been observed in the wild since December 2019 and seen targeting both Windows and Linux machines. An attacker connected to the target system using a Remote Desktop Protocol (RDP) server on the network, can locate a target and obtain local administrator credentials and install process hacker-as-a-service, disable antivirus and drop a backdoor to gain re-entry. Tycoon is deployed as a Trojanized Java Runtime Environment (JRE) and compiled into a Java image file (JIMAGE), a special file format that stores custom JRE images and is designed to be used by the Java Virtual Machine (JVM) at runtime. JIMAGE is not normally parsed by antivirus and thus hackers used this technique to bypass security tools.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/new-tycoon-ransomware-strain-targets-windows-linux/d/d-id/1338006

Microsoft fixes admin mode bugs affecting Windows 10 PowerToys - BleepingComputer

Microsoft has released PowerToys version 0.18.2 for Windows 10 with improvements and fixes for the following issues: an issue affecting the search results displayed by the PowerToys Run launcher when running as admin, a bug causing the built-in launcher to run everything as admin when PowerToys itself was run as administrator, a bug that would cause PowerToys Run not to find newly installed apps and applications in the Windows 10 PATH and the ripple effect causing PowerToys Run to run in an elevated state when PowerToys is launched as admin.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-admin-mode-bugs-affecting-windows-10-powertoys/

Two Critical Flaws in Zoom Could've Let Attackers Hack Systems via Chat

Security researchers from Cisco Talos have discovered two critical vulnerabilities in Zoom (video conferencing software) that could have allowed attackers to hack into the systems of group chat participants or an individual recipient remotely. The first security vulnerability (CVE-2020-6109) resided in the way Zoom leverages GIPHY service, allowing an attacker to embed GIFs from a third-party attacker-controlled server. The second remote code execution vulnerability (CVE-2020-6110) resided in the way vulnerable versions of the Zoom application process code snippets shared through the chat. Both flaws in question are path traversal vulnerabilities that can be exploited to write or plant arbitrary files on the systems running vulnerable versions to execute malicious code. Zoom patched both critical vulnerabilities with the release of version 4.6.12 of its video conferencing software for Windows, macOS, or Linux computers.

See the full report here: https://thehackernews.com/2020/06/zoom-video-software-hacking.html

Mozilla Firefox to let you export saved passwords in plain text - BleepingComputer

Mozilla has added a new feature in its Firefox 79 Nightly build that will allow users to export their saved credentials to a CSV text file, that users can import into a password manager or store as a backup. The passwords will be stored in plain text and readable to anyone who has access to the file. Hence, as extra security, if a user continues with the export process, Windows will prompt the user to first enter their Windows account password. Upon entering the correct password, users will be prompted for a location to save the 'logins.csv' file, which will be used to export your login names and passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-firefox-to-let-you-export-saved-passwords-in-plain-text/

CPA Canada discloses data breach affecting 329,000 individuals - BleepingComputer

Chartered Professional Accountants of Canada (CPA) disclosed a data breach, impacting over 329,000 members and other stakeholders after the cyberattack against the CPA Canada website allowed unauthorized third parties to access their personal information. The attack was a result of a phishing campaign that targeted CPA Canada's members in April. According to the breach notification, the information exposed links to the distribution of the CPA Magazine and includes personal information such as names, addresses, email addresses, employer names, encrypted passwords, and full credit card numbers. Following the incident, CPA Canada immediately took measures to secure the compromised systems and notified the affected individuals and urges them to change their passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/cpa-canada-discloses-data-breach-affecting-329-000-individuals/

Business services giant Conduent allegedly hit by Maze Ransomware - BleepingComputer

The Maze ransomware group claims to have attacked Conduent, a New Jersey, USA based business services firm and stolen unencrypted files and encrypted devices on their network. To support their claims, the threat actors have published nearly 1GB worth of files, including various financial spreadsheets, customer audits, invoices, commission statements, and other miscellaneous documents. Conduent has confirmed that they suffered a ransomware attack on May 29th, 2020 that impacted services for approximately 10 hours.

See the full report here: https://www.bleepingcomputer.com/news/security/business-services-giant-conduent-hit-by-maze-ransomware-attack/

Trump, Biden Campaign Staffers Targeted By APT Phishing Emails

In a new phishing operation, campaign staffers of both Donald Trump and Joe Biden are being targeted by advanced persistent threat (APT) groups. According to Google’s Threat Analysis Group, two separate phishing campaigns were recently detected. A China-linked APT group targeted Biden’s campaign staff, while an Iran-linked APT targeted Trump’s. Currently, there is no evidence that the phishing attempts were successful. Google’s Threat Analysis Group has sent the targeted users their standard government-backed attack warning, referred the incident to federal law enforcement, and encourages the campaign staff to use extra protection for their work and personal emails.

See the full report here: https://threatpost.com/trump-biden-campaign-apt-phishing-emails/156319/

U.S. Nuclear Contractor Hit with Maze Ransomware, Data Leaked

A U.S. military contractor, Westech International, involved in the maintenance of the Minuteman III nuclear-missile program and multiple branches of the military has suffered a Maze ransomware attack. The ransomware group has started to leak the stolen documents online, which include sensitive employee data such as payroll information and other personal details, along with company emails, which may or may not include classified military information. Westech International said that they experienced a ransomware incident, which affected some of their systems and encrypted some of their files. Following the incident, the company immediately contained its systems and is investigating the issue.

See the full report here: https://threatpost.com/nuclear-contractor-maze-ransomware-data-leaked/156289/

Windows 10 SMBGhost bug gets public proof-of-concept RCE exploit - BleepingComputer

Exploit code that achieves remote code execution for CVE-2020-0796 (a critical vulnerability in Microsoft Server Message Block SMB 3.1.1), is now publically available. The security flaw which is known by various names such as SMBGhost, CoronaBlue, NexternalBlue, and BluesDay, which can be leveraged by an unauthenticated attacker to spread malware from one vulnerable system to another without user interaction. SMBGhost affects Windows 10 versions 1909 and 1903, including Server Core. Microsoft has patched the vulnerability in March, warned that exploitation is “more likely” on both older and newer software releases, and has provided the severity rating of 10.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-10-smbghost-bug-gets-public-proof-of-concept-rce-exploit/

Kupidon is the latest ransomware targeting your data - BleepingComputer

Security researchers at MalwareHunter have observed a new ransomware strain called "Kupidon" that targets corporate networks as well as home user's data likely through exposed remote desktop servers. Once the threat actors gain access to the victim's device, they manually encrypt the files on the device and appends the ".kupidon" extension to it. Depending on whether the victim is a business or an individual, the ransom notes dropped will be slightly different and contain different ransom demands. Both ransom note variants will direct users to a TOR site that has information about what happened to a victim's files and an email address to contact for payment instructions.

See the full report here: https://www.bleepingcomputer.com/news/security/kupidon-is-the-latest-ransomware-targeting-your-data/

Ongoing eCh0raix ransomware campaign targets QNAP NAS devices - BleepingComputer

The threat actors behind the eCh0raix Ransomware have launched a brand new campaign that targets QNAP storage devices. The attackers gained access to QNAP devices through known vulnerabilities or by brute-forcing weak passwords used on the device and then installed the ransomware, which encrypts the files and appends the .encrypt extension to it. In the end, drops a ransom note named README_FOR_DECRYPT.txt that has a link to a Tor payment site. One of the victims has reported that strangely named QNAP apps found in his device's AppCenter after being encrypted.

See the full report here: https://www.bleepingcomputer.com/news/security/ongoing-ech0raix-ransomware-campaign-targets-qnap-nas-devices/

100,000 company inboxes hit with voice message phishing - BleepingComputer

A sophisticated phishing campaign has targeted companies that use private branch eXchange (PBX) telephone systems for communication to deliver fake email notifications for voice messages in an attempt to steal login credentials. The messages pretended to be voicemail notifications from PBX integrations and featured custom subject lines to pass a superficial legitimacy test. This customization allowed attackers to successfully bypass installed protections such as secure email gateways (SEGs) and the Domain-based Message Authentication, Reporting and Conformance (DMARC) system.

See the full report here: https://www.bleepingcomputer.com/news/security/100-000-company-inboxes-hit-with-voice-message-phishing/

Fitness Depot hit by data breach after ISP fails to 'activate the antivirus' - BleepingComputer

Fitness Depot, the largest specialty exercise equipment retailer in Canada, experienced a data breach in February 2020. During the attack, the attackers may have accessed information of the clients who made purchases for delivery and or who made purchases for in-store pick up at one of Fitness Depot's retail locations. Based on the preliminary findings, Fitness Depot blamed Internet Service Provider [ISP], who neglected to activate the anti-virus software on their account.

See the full report here: https://www.bleepingcomputer.com/news/security/fitness-depot-hit-by-data-breach-after-isp-fails-to-activate-the-antivirus/

US aerospace services provider breached by Maze Ransomware - BleepingComputer

Maze Ransomware group has breached and stole sensitive information belonging to VT San Antonio Aerospace. VT San Antonio Aerospace is one of the leading North American aircraft MRO and is a subsidiary of ST Engineering. To support their claims, the threat actors have published the leaked documents consist of financial spreadsheets, cyber insurance contracts, proposals, and expired NDAs on their data leak site.

See the full report here: https://www.bleepingcomputer.com/news/security/us-aerospace-services-provider-breached-by-maze-ransomware/

Spear-Phishing Campaign Hits Developer Collaboration System Users

Zeplin, a collaboration system heavily used in software development and product design communities, has been the target of a sophisticated spear-phishing attack. Researchers discovered that the malware used for the attack have multiple command-and-control servers, and can communicate over various networking protocols.

See the full report here: https://www.darkreading.com/application-security/spear-phishing-campaign-hits-developer-collaboration-system-users-/d/d-id/1338012

Malware Uses USBs to Help Steal Data: Report - BankInfoSecurity.com

A hacking group is deploying a new malware strain dubbed USBCulprit that uses USBs and other storage devices to assist in stealing data, according to Kaspersky. This custom-built malware appears to part of the arsenal of an APT known as Cycldek, a.k.a. Goblin Panda, APT 27, and Conimes, which targets government entities. The attack starts with phishing emails, the malicious code, once it's installed on an air-gapped device, can copy and exfiltrate data from that device to portable storage devices, such as a USB drive. Once USBCulprit is loaded to memory and executed, it operates in three phases: Data scanning and recon, data exfiltration to or from a USB device, and lateral movement. The malware waits until it detects a USB key or other removable devices, these attacks likely rely on a human operator who gains access to these air-gapped devices. Organizations are advised to employ controls on hosts and networks to secure their air-gapped infrastructure.

See the full report here: https://www.bankinfosecurity.com/malware-uses-usbs-to-help-steal-data-report-a-14393

Office 365 phishing baits remote workers with fake VPN configs - BleepingComputer

Microsoft Office 365 customers are targeted by a phishing campaign using bait messages camouflaged as notifications sent by their organization to update the VPN configuration they use to access company assets while working from home. The phishing emails impersonating VPN configuration update requests sent by their company's IT support department have so far landed in the inboxes of up to 15,000 targets according to Abnormal Security. The attack originates from numerous IPs and different senders, the payload in each email was identical. The link in the email directs to a new VPN configuration for home access. The landing page is identical to the Office 365 login website. The page was displayed if the victim believes the message was hosted on Microsoft .NET platform. Users are advised to set up custom Office 365 block rules.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-phishing-baits-remote-workers-with-fake-vpn-configs/

ZEE5 allegedly hacked by 'Korean hackers', customer info at risk

Hackers breached systems of Indian video on demand giant ZEE5 and threatening to sell the data on the dark web markets. The hacker(s) going by the name of John Wick and Korean Hackers claim to have stolen over 150 GB data of live data along with the source code of the site. The email used by the hackers was previously seen in defaced sites claiming to have been done by Korean Hackers. As part of the proof, they shared images of a repository containing the stolen information. The leaked records contain private information on the subscribers including recent transaction data, email addresses, mobile phone numbers, passwords, etc. The company is investigating the incident and yet to reveal the details.

See the full report here: https://www.bleepingcomputer.com/news/security/zee5-allegedly-hacked-by-korean-hackers-customer-info-at-risk/

Fake ransomware decryptor double-encrypts desperate victims' files - BleepingComputer

A fake decryptor for STOP Ransomware, aka DJVU, is being distributed by creators of the Zorab ransomware that lures the victims with the promise of free decryption. The fake decryptor instead of recovering the files for free, it encrypts all of the victim's already encrypted data with another ransomware. Emsisoft and Michael Gillespie had previously released a decryptor for older STOP variants, but newer variants cannot be decrypted for free. Users are advised to be vigilant against such attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-ransomware-decryptor-double-encrypts-desperate-victims-files/

3 Reasons to Add Digital Risk Protection (DRP) to Your Security Defenses

Identifying the threats infiltrating an organization’s digital footprint, analyze their credibility, and take action to remediate malicious activity before it impacts the organization’s reputation helps to mitigate digital risks. There are several ways malicious activity can permeate an organization’s digital footprint. An effective DRP program provides tools to discover and assess references to names, brands, accounts, sites, products, executives, and employees associated with an organization. Providing threat intelligence to limit damage from data breaches by deactivating compromised user accounts, revoking stolen credentials it helps in strengthening security controls.

See the full report here: https://www.zerofox.com/blog/3-reasons-to-add-digital-risk-protection-to-your-organizations-security-defenses/

Hackers Target Fincantieri's Norwegian Unit With Ransomware - BNN

Shipbuilder Fincantieri S.p.A fell victim to a group of hackers who infected servers at the Norwegian unit, Vard Group AS, with ransomware. Fincantieri is the Italian state-owned shipyard that builds vessels for Carnival Corp. and other cruise companies. Fincantieri’s spokesman said immediate actions were taken and none of Fincantieri’s servers were involved in the attack.

See the full report here: http://www.bnnbloomberg.ca/hackers-target-fincantieri-s-norwegian-unit-with-ransomware-1.1446392

Vulnerability discovered in DNS recursive resolvers that can be abused to launch DDoS attacks against any victim - SecurityBrief Australia

Security researchers have discovered a vulnerability in the implementation of DNS recursive resolvers that can be abused to launch disruptive DDoS attacks against any victim. The attack leveraging the vulnerability dubbed as NXNSAttack that targets the domain name resolution capability of its victims. According to the researchers, this attack is hard to detect and mitigate at the authoritative server because the requests originate from legitimate recursive DNS servers. By disrupting name resolution for the domain, attackers effectively block access to all services provided under the domain. Recursive DNS providers can protect their infrastructure and protect the internet from attacks by applying the fix provided by DNS software suppliers or by implementing the Max1Fetch solution proposed by the researchers in their paper.

See the full report here: https://securitybrief.co.nz/story/vulnerability-discovered-in-dns-recursive-resolvers-that-can-be-abused-to-launch-ddos-attacks-against-any-victim

Apple publishes free resources to improve password security

Apple has published a collection of free tools and resources called Password Manager Resources on GitHub to help developers of password managers and other applications generate strong passwords. These tools include lists of password selection rules using which the password managers can reduce user experience (UX) errors and instances where users tend to choose their passwords. Apple has also published a list of websites that share login credentials to make password filling suggestions more useful. Additionally, Apple also shared a list of website URLs where users are currently redirected to change their passwords which will be useful for developers of password managers in case they detect a weak password and want to take users directly on the page where they could change the password, rather than let the user find that page on their own.

See the full report here: https://www.zdnet.com/article/apple-publishes-free-resources-to-improve-password-security/

San Beda student portal hacked, personal data of thousands stolen - Rappler

San Beda University's portal for students and parents, sis.sanbeda.edu.ph, was hacked on June 4, 2020. The portal is used by students to log in to their student account to check their grades. The exposed information included Full name of students, guardians, and faculty, dates of birth, addresses of students and guardians, passwords and email addresses, contact numbers of students and guardians, student grades, student identification number, student course, previous schools attended by the students and statement of accounts. The University is investigating the incident with the help of the National Bureau of Investigation and the National Privacy Commission.

See the full report here: https://www.rappler.com/nation/263117-san-beda-university-student-portal-hacked-personal-data-stolen

Stealthworker botnet targets Windows and Linux servers

Researchers at Akamai uncovered a malware campaign spreading a Golang-based malicious code tracked as Stealthworker. The malware targets Windows and Linux servers running popular web services and platforms. Operators behind the malware use the infected hosts to launch brute force attacks against machines exposed online. Each attackers’ infected system performs a limited number of login attempts to bypass limits on the number of login attempts. Once the malicious code has guessed the admin password, Stealthworker installs and deletes various components. All the passwords collected from the compromised machines are added into the list of logins that the Stealthworker operators use to compromise other machines. Experts noticed that even after cleaning a compromised system, the botnet would reinfect it within minutes, the only way to lock out attackers is to wipe the malware and change that passwords. Users are requested to use complex passwords and change them frequently.

See the full report here: https://securityaffairs.co/wordpress/104427/malware/stealthworker-botnet.html?utm_source=rss&utm_medium=rss&utm_campaign=stealthworker-botnet

Google's indexing of WhatsApp numbers raises privacy concerns - BleepingComputer

A security researcher has raised concerns over an issue with WhatsApp’s “wa.me” domain leaking contact phone numbers on Google. The “wa.me” domain is owned by WhatsApp and is used to host 'click to chat' links that allow users to begin a chat with people without having their phone number saved in users' phone's address book. According to the researcher, if individual phone numbers are leaked, an attacker can message them, call them, sell their phone numbers to marketers, spammers, scammers. Although publishing a mere phone number on the web does not automatically link to personally identifiable information or passwords, the researcher says that public indexing of phone numbers can prove to be a security or privacy risk, as phone numbers are linked to many online services.

See the full report here: https://www.bleepingcomputer.com/news/security/googles-indexing-of-whatsapp-numbers-raises-privacy-concerns/

Maze Ransomware adds Ragnar Locker to its extortion cartel - BleepingComputer

In an attempt to obtain potentially larger ransoms, Maze ransomware has teamed up with another ransomware called the Ragnar Locker. Ragnar Locker does have its own leak site. Just last week, Maze joined with LockBit ransomware to use their data leak platform to extort victims whose unencrypted files were stolen. The Maze operators have adopted the 'cartel' label as they continue to team up with other ransomware operations to increase the success of their attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/maze-ransomware-adds-ragnar-locker-to-its-extortion-cartel/

Canada's Fitness Depot Alerts Customers to Data Breach

Fitness Depot, the largest retailer of specialty exercise equipment in Canada, suffered a data breach, impacting its e-commerce platform. The incident took place in February 2020 and may have affected some shoppers' personal and financial information. Customers with home delivery were affected between Feb. 18 and April 27. From April 28 through May 22, any shopper who ordered for home delivery or in-store pickup also could have been affected. The exposed information includes customers' names, addresses, email addresses, phone numbers, and credit card numbers used during the transaction. The company has notified the impacted individuals.

See the full report here: https://www.darkreading.com/attacks-breaches/canadas-fitness-depot-alerts-customers-to-data-breach/d/d-id/1338025

CallStranger vulnerability lets attacks bypass security systems and scan LANs

A severe vulnerability (CVE-2020-12695), named CallStranger, could allow attackers to hijack smart devices for distributed denial of service (DDoS) attacks and also bypass security solutions to reach and conduct scans on a victim's internal network, thereby escalating attacker privileges. The flaw impacts UPnP, which stands for Universal Plug and Play, a collection of protocols that ship on most smart devices and with around 5.45 million UPnP-capable devices connected to the internet. Although Open Connectivity Foundation (OCF), who manages the development for UPnP has updated the UPnP protocols, it may take a long time for vendors to provide patches. A security researcher has published proof-of-concept scripts that companies can use to determine if their smart equipment is vulnerable to any of the CallStranger attacks and basic advice that enterprises can deploy to block any exploitation attempts.

See the full report here: https://www.zdnet.com/article/callstranger-vulnerability-lets-attacks-bypass-security-systems-and-scan-lans/#ftag=RSSbaffb68

US energy providers hit with new malware in targeted attacks - BleepingComputer

A new spear-phishing campaign is targeting U.S. energy providers with a new remote access trojan (RAT), dubbed FlowCloud, capable of providing attackers with full control over infected systems and harvesting, exfiltrating information to attacker-controlled servers. According to the researchers, the FlowCloud campaigns delivered the RAT payload using PE attachments between July and September 2019 and switched to Microsoft Word documents with malicious macros in November 2019, delivering spear-phishing emails impersonating the American Society of Civil Engineers (ASCE) by spoofing the legitimate asce[.]org domain. The attackers behind this campaign have been tracked as TA410.

See the full report here: https://www.bleepingcomputer.com/news/security/us-energy-providers-hit-with-new-malware-in-targeted-attacks/

Honda investigates possible ransomware attack, networks impacted - BleepingComputer

Honda has disclosed its computer networks in Europe and Japan is not functioning normally and is investigating the issues that are reportedly related to a SNAKE Ransomware cyber-attack. A company spokesperson confirmed that the Japanese production or dealer activities have not been influenced and that there is no impact on Honda customers. However, the company is investigating the issue to understand the nature of any impact in Europe. A security researcher has reportedly found a sample of the SNAKE (EKANS) ransomware submitted to VirusTotal that checks for the internal Honda network name of mds[.]honda[.]com and also contains an IP address that resolves to its internal hostname.

See the full report here: https://www.bleepingcomputer.com/news/security/honda-investigates-possible-ransomware-attack-networks-impacted/

Windows Group Policy flaw lets attackers gain admin privileges - BleepingComputer

All Windows versions since Windows Server 2008 are vulnerable to a flaw that could enable an attacker to exploit the Windows Group Policy feature to take full control over a computer. This flaw is tracked as CVE-2020-1317 and allows a local attacker to run any command with administrative privileges. Microsoft has addressed the vulnerability as part of its Patch Tuesday security updates. Windows administrators are urged to apply the relevant patches to mitigate risks.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-group-policy-flaw-lets-attackers-gain-admin-privileges/

Valak malware gets new plugin to steal Outlook login credentials - BleepingComputer

Valak, an information stealer, has been upgraded with a new plugin called “clientgrabber,” capable of stealing email credentials from the registry of a compromised machine. The “clientgrabber” plugin checks for passwords in registry locations related to Microsoft’s Outlook client. Upon successful identification, the plugin searches for the ‘keys’ and determines the encryption method and if the value contains password data that can be decrypted. Except for the password, all email account data (username, server) is stored in plain text.

See the full report here: https://www.bleepingcomputer.com/news/security/valak-malware-gets-new-plugin-to-steal-outlook-login-credentials/

KingMiner botnet brute-forces MSSQL databases to install cryptocurrency miner

Security researchers at Sophos have detected a botnet operation called KingMiner that targets MSSQL databases with brute-force attacks that attempt to guess the password for the "sa" (server administrator) account. Once the hackers break into a vulnerable MSSQL system, they create another database user named "dbhelp," and install a cryptocurrency miner that abuses the server's resources to generate profits for the gang. The KingMiner operation has now become persistent and is capable of gaining root privileges over the underlying Windows server where the MSSQL database is running by exploiting elevation of privilege bugs, such as CVE-2017-0213 or CVE-2019-0803. These bugs grant the KingMiner malware access to execute code with admin privileges. It is recommended to secure the server administrator account with a strong password to prevent KingMiner's attacks.

See the full report here: https://www.zdnet.com/article/kingminer-botnet-brute-forces-mssql-databases-to-install-cryptocurrency-miner/

New CrossTalk attack impacts Intel's mobile, desktop, and server CPUs

University academics have identified a vulnerability (CVE-2020-0543) in Intel processors, dubbed CrossTalk, a type of MDS (microarchitectural data sampling) attack, that could allow attacker-controlled code executing on one CPU core to leak sensitive data from other software running on a different core. CrossTalk attacks data while it's being processed by the CPU's Line Fill Buffer (LBF). Intel has made changes to the hardware design of its CPUs, and most of its recent products are not vulnerable to this attack. For older Intel CPU lines, Intel has released microcode (CPU firmware) updates to patch the CrossTalk vulnerability.

See the full report here: https://www.zdnet.com/article/new-crosstalk-attack-impacts-intels-mobile-desktop-and-server-cpus/

SMBleed: A New Critical Vulnerability Affects Windows SMB Protocol

Security researchers found a critical vulnerability affecting the Server Message Block (SMB) protocol’s decompression function that impacts Windows 10 versions 1903 and 1909. The flaw, CVE-2020-1206, dubbed as SMBleed could allow attackers to leak kernel memory remotely, and when combined with a previously disclosed "wormable" bug, it can be further exploited to achieve remote code execution attacks. Users are recommended to install the latest Windows security updates. For systems where the patch is not applicable, advised blocking port 445 to prevent lateral movement and remote exploitation.

See the full report here: https://thehackernews.com/2020/06/SMBleed-smb-vulnerability.html

Arm CPUs impacted by rare side-channel attack

Chip manufacturer company Arm has issued an advisory to address a new vulnerability in its Armv8-A (Cortex-A) CPU architecture. Codenamed SLS (Straight-Line Speculation), this bug is a classic side-channel speculative execution attack, which impacts Arm Armv-A processors only. Speculative execution is a concept of CPUs processing data in advance for speed and performance reasons and then discarding the computational branches they don't need. Side-channel attacks in speculative execution allow malicious threat actors to leak these temporary computations and see what the CPU might be working on. The Arm has contributed patches to various software projects and operating systems, including FreeBSD, OpenBSD, Trusted Firmware-A, OP-TEE, GCC, and LLVM.

See the full report here: https://www.zdnet.com/article/arm-cpus-impacted-by-rare-side-channel-attack/

Fake SpaceX YouTube channels scam viewers out of $150K in bitcoin - BleepingComputer

Scammers have hijacked three YouTube channels to display bitcoin scams impersonating Elon Musk's SpaceX channel. Three YouTube channels that were previously known as 'Juice TV,' 'Right Human,' and 'MaximSakulevich' were hijacked and renamed to 'SpaceX Live' or 'SpaceX.' All of these hijacked channels are now live streaming recordings of Elon Musk being interviewed or a SpaceX conference, and promote scams asking people to send in a small amount of Bitcoins to get double the amount back. These scams have raked in close to $150,000 in bitcoins in two days. Users are advised to stay vigilant to suspicious giveaways.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-spacex-youtube-channels-scam-viewers-out-of-150k-in-bitcoin/

IBM releases open-source toolkits implementing FHE to process data while encrypted

IBM has released open-source toolkits for implementing fully homomorphic encryption (FHE), which allows researchers to process encrypted data without having access to the actual data. These toolkits are available on GitHub for macOS and iOS while Android and Linux versions will be available soon. FHE can be beneficial for many industries including financial and healthcare sectors. The application can be implemented to enact the privacy-preserving search that allows users to search against a cloud service without revealing their queries’ data to the cloud provider.

See the full report here: https://securityaffairs.co/wordpress/104438/security/ibm-fhe-toolkits.html?utm_source=rss&utm_medium=rss&utm_campaign=ibm-fhe-toolkits

Thanos ransomware auto-spreads to Windows devices, evades security - BleepingComputer

Security researchers have identified new ransomware named "Thanos" that is being promoted as Ransomware-as-a-Service on Russian-speaking hacker forums since February 2020. Thanos is enlisting hackers and malware distributors to spread the ransomware that earns them a revenue share, which is typically around 60-70%, of any ransom payments. The affiliates who join the Thanos RaaS gain access to a 'Private Ransomware Builder' that generates custom ransomware executables and comes with features such as a built-in unencrypted file stealer, automated spreading to other devices, and the adoption of the researcher-disclosed RIPlace evasion technique. Thanos includes a ftp_file_exfil() function that automatically performs file exfiltration to a remote FTP site as it encrypts a computer. It also includes a feature that attempts to spread the ransomware laterally to other devices on the network.

See the full report here: https://www.bleepingcomputer.com/news/security/thanos-ransomware-auto-spreads-to-windows-devices-evades-security/

Critical Intel Flaws Fixed in Active Management Technology

Intel’s Active Management Technology (AMT) is vulnerable to two critical flaws that can potentially allow an unauthenticated user to gain elevated privileges via network access. These flaws are tracked as CVE-2020-0594, an out-of-bounds read vulnerability, and CVE-2020-0595, a use-after-free vulnerability. Intel has addressed these flaws in its June security updates along with many other vulnerabilities. Users are advised to update to the latest fixed versions to alleviate risks.

See the full report here: https://threatpost.com/critical-intel-flaws-fixed-in-active-management-technology/156458/

Jenkins team avoids security disaster after partial user database loss

On June 2, the Jenkins open source automation server lost its partial user database. resulting in an outage to the Jenkins Artifactory portal, used by Jenkins plugin developers to upload and manage plugin artifacts. Among the lost accounts was the corporate account of 42Crunch, who followed the Jenkins team instructions and re-registered their old account and found that this new account automatically got access and permissions that the old account had. 42Crunch raised the issue that attackers could have impersonated them and pushed a malware update to users on their behalf. Following the concerns of 42Crunch, the Jenkins team blocked all uploads of new artifacts to the Jenkins Artifactory portal to prevent any threat actor from taking advantage of this loophole and replacing plugin artifacts (files) with malicious versions. Jenkins is currently preparing to disclose the incident to all Artifactory users who had their accounts deleted during the outage.

See the full report here: https://www.zdnet.com/article/jenkins-team-avoids-security-disaster-after-partial-user-database-loss/

FBI warns of increased hacking risk if using mobile banking apps - BleepingComputer

The U.S. Federal Bureau of Investigation (FBI) has warned mobile banking app users that they will be increasingly targeted by hackers trying to steal their credentials and take over their banking accounts. Threat actors have focused their attacks on mobile banking customers since most Americans are using such services for making payments, transferring funds, and cashing checks. Malicious actors use techniques such as fake banking apps or app-based banking trojans to lure the victim into downloading an app-based banking trojan onto their tablet or smartphone. Fake banking apps, on the other hand, are impersonating the banks' real mobile apps and, once installed on a victim's device, will collect the users' credentials when they try logging in.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-increased-hacking-risk-if-using-mobile-banking-apps/

Fake Black Lives Matter voting campaign spreads Trickbot malware - BleepingComputer

Security researchers have uncovered a new phishing email campaign that spreads the TrickBot information-stealing malware. The malicious email pretends to be from Country administration, asking the recipients to "Vote anonymously about Black Lives Matter" and contains an attachment in Word format. When opened, it prompts the victim to click on the 'Enable Editing' and 'Enable Content' buttons to view the contents properly and which in turn runs macros that downloads a malicious DLL "TrickBot trojan" to the computer and execute it. It further downloads modules to the infected computer to steal files, passwords, security keys, spread laterally throughout the network, and allow other threat actors to install ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-black-lives-matter-voting-campaign-spreads-trickbot-malware/

Office 365 phishing baits business owners with relief payments - BleepingComputer

A new phishing campaign is targeting business owners with Microsoft Office 365 accounts by using bait emails impersonating Small Business Grants Fund (SGF) relief payment messages from the UK government. The attackers use automated Dropbox Transfer notifications to send their baits from [email protected], embedded with a link to a COVID-19-Relief-Payment.PDF document, that supposedly contains the documentation, the SMB owners need to file with the authorities to prove their eligibility in relief fund programs. Upon clicking the link embedded in the phishing email, it redirects the victims to a benign Dropbox Transfer landing page that asks them to download or save the PDF file into their Dropbox account. Further, the PDF instructs them to open a document hosted on Microsoft OneDrive by clicking on an Access Document button that redirects to a Google Docs document with a Google Form that asks them to log in with their Office 365 credentials, hence compromising their accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-phishing-baits-business-owners-with-relief-payments/

Babylon Health admits to leak of GP video consultations

Babylon, a private health firm, has disclosed a data breach that mistakenly granted access to videos recorded by other patients. The company acknowledged the breach was a result of a software error whereby a new feature worked improperly, showing videos recorded by other people when patients who booked an audio-only consultation switched to video. Following the incident, the video access feature was switched off and the company began assessing the impacted patients.

See the full report here: https://www.itpro.co.uk/security/data-breaches/356001/babylon-health-admits-data-breach-of-gp-video-consultations

Self-destructing skimmer steals credit cards of Greenworks customers - BleepingComputer

The website of Greenworks hardware tools, greenworkstools[.]com, has been compromised by the attackers to steal its customers' payment card information. The malicious script used to steal the data is a highly-sophisticated, self-cleaning, and self-destructing skimmer. According to the researchers investing the issue, which is currently active, card data entered on the site's payment form lands on the hacker's server at 'congolo[.]pro'. Along with the card information such as card number, CVV, and expiration date, account details such as usernames and passwords, and personal customer data such as delivery addresses, phone numbers are also stolen. Customers on the U.S. website of Greenworks Tools who have purchased since June 8 are encouraged to contact their banks and cancel their payment cards.

See the full report here: https://www.bleepingcomputer.com/news/security/self-destructing-skimmer-steals-credit-cards-of-greenworks-customers/