Threat Intelligence Bulletin: 09/13/2019 - 09/20/2019

Three Data Breaches Occurred This Week

Three data breaches where disclosed this week, affecting Minehut, LuminPDF and KiwiFarms.

For full details on this breach, please see the full disclosures here:

Minehut https://cloud.zerofox.com/alpha_team/advisories/1004

LuminPDF https://cloud.zerofox.com/alpha_team/advisories/1010

KiwiFarms https://cloud.zerofox.com/alpha_team/advisories/1005

Alpha Team Research: Dark Web Chronicles, Volume 1: Harm Reduction

In this advisory series, the Alpha Team will explore various parts of "the dark web" that are rarely discussed or known in the security research community. The goal is to showcase peculiarities or stories of the dark web, demystifying the medium as well as giving valuable insight to our customers. In this post, the team explores the concept of "Harm Reduction" on the dark web. On most marketplaces, especially with drugs, you'll see the phrase "harm reduction" be used by the market, vendors or the buyers themselves. Consequently, there are dark web and clear web markets dedicated to providing harm reduction for drugs, and some of them serve as an intermediary and validator for vendors to make sure that buyers aren't harming themselves from a bad batch of drugs.

Details

Harm reduction is a necessary part of an underground market. Much like Amazon reviews for a product, each dark web forum that is a well-known avenue for vendors to sell and buyers to purchase drugs operates on reviews. The burden of trust eventually lies with the market admins, but many vendors develop relationships with the market admins to show that they have quality products for their forum-goers. This is for a few reasons. Firstly, if a market admin allows vendors onto the market that are scamming their users and sending empty packages, or fake drugs, then this harms the reputation for the forum, thus making it lose viewership. A market will be successful if their vendors are successful, because the market takes a cut for each purchase. Secondly, market admins tend to act as arbiters and escrow services to prevent scammers. This level of insurance helps buyers feel safe buying drugs, as they are protected by the market admins. Lastly, markets will be shunned by their community if they allow a vendor to sell drugs that are harmful due to their composition - no one will buy if they cannot trust the market admin to vouch for the vendor's supply to be safe.

There are many websites dedicated to harm reduction for the public to consume. It is important to note that harm reduction is not just a "cybercriminal" term - for example, there's a "Harm Reduction Coalition" that provides resources to the general public to make sure they are using drugs in a safe manner. This is an important concept in the health of your population, but many purchasers of these products may not have access to a nationally syndicated organization, so the "dark web" may be the only place they can find information. For example, on Dreaddit, a reddit-style forum used as a dark web community site, has a whole page dedicated to harm reduction

Note there that the Dreaddit admin also compares and contrasts network security with harm reduction. There are a multitude of sub-forums dedicated to harm reduction on Dreaddit, and many cybercriminal forums have sections dedicated to operational security and harm reduction as it relates to staying anonymous.

One of the linked services, DNStars, has a community dedicated to testing of products and validation of vendors. Users discuss prices, vendor quality and trustworthiness of vendors frequently.

Their results page is even public. This shows the vendor, the alleged substance, its result from Energy Control and the form factor (pills, powder) of the drug. They also have blog posts updating members if any harm has come to forum dwellers:

" Community member blacked out, hit his head hard and is in A+E having ingested what is presumably more of the fake xanax going around. If there’s orange flecks in it, or it doesn’t taste bitter then it’s not xanax it’s going to be something else. Do yourself a favour and flush them down the toilet "

In conclusion, when working with any type of secondary market, illicit or not, trust is an inherit key to success for that market. If the market falls over, it is most likely due to a breach of trust between the admins, the admins and the vendors or the admins and it's members. Whether you agree or not with the premise of consuming illegal drugs, its interesting to study how these markets self-regulate to make sure members get the best product possible.

Breach Disclosure: Minehut

In May 2019, Minehut, a popular Minecraft server website suffered a data breach. The breach impacted all users of Minehut, which resulted in complete deletion of all player servers, as well as 397,000 email addresses gathered from a backup stored by Minehut.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

There is no indication in the posting by Minehut as to how the site was initially compromised, and the original forum post by Minehut has since been removed. While no personal or account data for the server was deleted, the attackers were able to take the 397,000 email addresses from a backup.

Breach Disclosure: Kiwi Farms

In September 2019, Kiwi Farms experienced a data breach impacting 4,611 users. In a forum post discussing the breach, the owner of the forum identified the data that was included in the breach, which consisted of IP addresses, account details, recent content created by users, conversations, and private board messages. There is no indication of how this breach occurred at this time.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

The owner of the Kiwi Farms site posted about the breach on the forum last week and identified multiple scenarios of how exposed users were that were included in the breach. They explained that all users included in the breach had IP addresses used since at least the beginning of September exposed, as well as account details (email, birthday), recent content that the users have made, and the recent titles and participants of conversations of users.

The site admin also identified another subset of users, which could have had the full conversations from users included in the breached data, as well as messages from moderator and private boards. The owner made some suggestions to users in dealing with this breach, which included things like using a VPN, creating a false identity to use online, and using a password manager. They also explained further steps they would take to reduce the impact of potential future breaches, to include automatically deleting conversations, modifying policies around account deletions and abandoning plans to monetize the forum.

Breach Disclosure: Lumin PDF

In April 2019, Lumin PDF, a PDF service that is most commonly used with Google Docs, experienced a breach of an exposed MongoDB server. The breach consisted of 24,386,039 users with varying levels of data exposed, which included full names, email addresses, gender, language and locale settings, and a hashed password string or Google access token.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media
• Disassociate the Lumin PDF app from your Google account, revoke the token associated with Lumin PDF, and then reconnect (if desired). Instructions can be found in this Google Drive support page.

Details

Roughly 5 months ago, the Lumin PDF MongoDB server was compromised and all records related to Lumin PDF were stolen. These types of attacks on open MongoDB servers (or other database servers) have been increasing in recent years due to companies deploying their servers in the cloud and not taking proper precautions to secure them properly, which leaves them vulnerable to being easily identified and subsequently compromised.

The hacker included a link to the 2.25GB ZIP file, which contained a 4.06GB CSV file containing the records of the 24,386,039 users. The majority of users had a Google access token associated with them, with about 118,746 users had a hashed password string which suggests this password was generated through the Lumin PDF website itself.

After the initial breach in April 2019, the server was compromised again and the data and server itself were destroyed by ransomware. At this time, the details around the second compromise which destroyed the server are not known, but it is not assumed to be related to the first compromise which stole the data.

There have been questions and concerns around the data contained in the breach, with the CEO of Lumin PDF stating that the leaked data did not contain valid Google access tokens. The tokens have not been tested for validity, so it is unknown whether or not these are legitimate and valid tokens. If they were valid, this would allow certain levels of access to Google Drive accounts based on the levels of permissions users granted those access tokens.

Breaking News: 2019-09-13 - 2019-09-19

Snoops can bypass iOS 13 lock screen to eyeball your address book. Apple hasn't fix it yet. Valid flaw? You decide

An information disclosure bug was found in iOS 13. The bug was supposedly demonstrated in it's beta version but Apple did not "fix" it. A researcher showed that by receiving a call on a locked iPhone, he could show the victim's contact list by responding to the call with a text and autofilling the "To" field using voice.

See the full report here: https://www.theregister.co.uk/2019/09/12/apples_ios_lock_workaround/

Cybercriminals Adding Sophistication to BEC Threats

BEC fraudsters are expanding their domains from just email. In this report, security firm FireEye states that BEC scams are increasing, with a particular focus on impersonation of executives and CEO wire-fraud .

See the full report here: https://threatpost.com/cybercriminals-adding-sophistication-to-bec-threats/148305/

North Korean Spear-Phishing Attack Targets U.S. Firms

North Korea strikes again - this time with a target set of US-based companies with an interest in nuclear deterrence. "Autumn Aperture" is the name of the group, and researchers who uncovered it have moderate confidence that they are linked to the North Korea-based Kimsuky threat actors. These actors send trojanized documents to victims that contained legitimate content, making it even easier for potential victims to open.

See the full report here: https://threatpost.com/north-korean-spear-phishing-attack-us/148299/

Emotet, today's most dangerous botnet, comes back to life

Emotet is back with a vengeance. The security research community is chatty today with new indicators for Emotet's revival. It looks like the botnet is specifically targeting Polish and German-speaking users. Once infected by Emotet, victims are added to a botnet that can download additional malware, as well as have their data pilfered.

See the full report here: https://www.zdnet.com/article/emotet-todays-most-dangerous-botnet-comes-back-to-life/

LastPass bug leaks credentials from previous site

Tavis Ormandy continues his foray into LastPass vulnerabilities. The Project Zero team disclosed a vulnerability to Last Pass that fixes a security bug where credentials from a previously visited site are exposed in an insecure way. When a victim visits a malicious page, malicious javascript could be executed that exposes the credentials of the user.

See the full report here: https://www.zdnet.com/article/lastpass-bug-leaks-credentials-from-previous-site/

Skidmap malware buries into the kernel to hide illicit cryptocurrency mining

A cryptomining malware that installs Linux Kernel Modules (LKMs) was found by two researchers this week. The malware is first installed on a vulnerable Linux server, which then adds a few user-land persistance mechanisms under crontab and SSH keys, and then moves to installing LKMs to trick the operating system and it's owners that everything is normal. Much like Stuxnet, this malware puts rose-colored glasses over CPU reporting statistics, so defenders won't be able to see a cryptominer taking up all the cycles on the machine.

See the full report here: https://www.zdnet.com/article/skidmap-malware-buries-into-the-kernel-to-hide-cryptocurrency-mining/

Exclusive: Thousands of Google Calendars Leaking Private Information Online

Approximately 8,000 Google Calendars that are supposed to be marked "private" were indexed by Google and explorable by anyone. This allowed a security researcher to view private events, meeting links, phone numbers and addresses that weren't necessarily intended to be shared to the world. This research outlines the importance of user experience when it comes to cybersecurity, as the researcher here specified that it is hard for a normal every day user to see whether or not a calendar is public.

See the full report here: https://thehackernews.com/2019/09/google-calendar-search.html

Gootkit malware crew left their database exposed online without a password

A database open on the internet isn't old news at this point, but having the database belong to malware operators is definitely interesting news. The maintainers of Gootkit left their MongoDB database open to the internet, allowing a security researcher to download its contents. The databases contained approxiamtely 1.5 million emails, over 2 million passwords and 750,000 usernames as well as other stolen information of it's victims.

See the full report here: https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/

Most Cyber Attacks Focus on Just Three TCP Ports - BleepingComputer

Interesting study done by Alert Logic - it shows that the top 3 ports used by attackers are 80, 443 and 22. RDP follows closely in 4th place. HTTP/HTTPS/SSH make sense to attack since these are generally open to the internet. Many of the vulnerabilitiies listed for this report are old vulnerabilitiies that are commonly attacked, giving credence yet again to having a security program that regularly patches its software.

See the full report here: https://www.bleepingcomputer.com/news/security/most-cyber-attacks-focus-on-just-three-tcp-ports/

Warning: Researcher Drops phpMyAdmin Zero-Day Affecting All Versions

A researcher dropped a 0-day on Full Disclosure this week after phpMyAdmin engineers failed to patch it within the standard 90 day window. This CSRF vulnerability allows an attacker to craft a malicious page where if a server admin of a php install visits the page, they will delete their server install.

See the full report here: https://thehackernews.com/2019/09/phpmyadmin-csrf-exploit.html

Beware of Venmo Scams Targeting Users via Text Messages - BleepingComputer

A US police department has reported a wave of smishing attacks abusing the Venmo service. The text involves a victim needing to verify their Venmo account, where they visit a malicious page and input their Venmo credentials as well as bank account information. Paypal reported in Q1 this year that Venmo has approximately 40 million active users.

See the full report here: https://www.bleepingcomputer.com/news/security/beware-of-venmo-scams-targeting-users-via-text-messages/

Panda Threat Group Mines for Monero With Updated Payload, Targets

An interesting story derived from research from Cisco TALOS. The Panda threat group uses a combination of open source tools, publicly available exploits and cryptominers to rake in cash on victim machines. Although they may not be an APT, they seem to adjust fairly quickly to security researchers publishing IOCs to defend against the attacker. The group so far has amassed close to $100,000 in Monero cryptocurrency.

See the full report here: https://threatpost.com/panda-threat-group-mines-for-monero-with-updated-payload-targets/148419/

DNSSEC fueling new wave of DNS amplification attacks

DNSSEC was identified as a culprit in an increase of DNS amplification attacks this year. The original idea behind DNSSEC was to provide a secure and private way for users to query for domains, but it is now being used by miscreants to target organizations and hopefully degrade the availability of these services.

See the full report here: https://www.helpnetsecurity.com/2019/09/18/dns-amplification-attacks/

These software vulnerabilities top MITREs most dangerous list

MITRE finally updated their top vulnerabilities list after a number of yearsnd. The results are listed under the Common Weakness Enumeration (CWE) format, a helpful format to create a taxonomy of styles of vulnerabilities in software. The top 3 are CWE-119, a memory buffer restriction vulnerabiliity, CWE-79, cross-site scripting and CWE-20, improper input validation.

See the full report here: https://www.zdnet.com/article/these-software-vulnerabilities-top-mitres-most-dangerous-list-in-2019/

Microsoft Phishing Page Sends Stolen Logins Using JavaScript - BleepingComputer

The MalwareHunterTeam uncovered a new phishing technique that uses the SmtpJS service to send stolen credentials via email back to the attacker. This was seen in a Microsoft phishing page recently, and while the landing page had no new techniques or novel approaches, this does give defenders an opportunity to thwart attempts using this technique. Since the configuration used by SmtpJS is sent back to smtpjs.com, if your organization is able to block access to this site, you would prevent phishing pages utilizing this method. This also benefits defenders and researchers, since inspecting the page content will allow you to identify where the credentials are being sent back to, allowing you to identify malicious actors using these phishing pages.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-phishing-page-sends-stolen-logins-using-javascript/

Old Magecart web domains resurrected for fraudulent ad schemes

Domains once belonging to the attacks carried out by Magecart, which was a activity group linked with compromising online merchants and services which use payment portals, are being given a new life. These domains that were once sinkholed and siezed, would eventually be released by the registrars, which would allow the same threat actors to register the domains, and pick up where they left off. The domains are seen implementing their previous attacks, or doing new attack types geared towards malvertising or ad fraud.

See the full report here: https://www.zdnet.com/article/old-magecart-domains-reincarnated-in-new-attacks/