Threat Intelligence Bulletin: 07/10/2020 - 07/16/2020

Major Influencer Twitter Breaches

On 15 July 2020, multiple high-follower and influential Twitter accounts started posting strange messages about a cryptocurrency giveaway. There were a number of posts made by celebrities and influencers involved in cryptocurrency, politics, and tech. Alpha Team immediately began tracking the posts, the bitcoin wallets and the website that the attackers used in this coordinated attack.

Recommendations

• Authenticate your organization's Twitter accounts with ZeroFOX and enable Hacked Account Post, which now contains bitcoin addresses and other indicators of compromises from the hacked posts related to this attack
• Review the whitelist of Twitter applications on ZeroFOX. Enable the Unauthorized Application rule which will catch any posts made from applications not authorized to post on your behalf
• Work with your ZeroFOX Account Manager and Platform Specialists to ensure authenticated protection of all of your social accounts

Details

On 15 July 2020, around 1630 EDT, multiple cryptocurrency exchanges and influencers started making posts directing users to a crypto-giveaway scam website.

Influencer accounts peddling crypto-giveaway scam

The initial rumor was that an admin panel belonging to a Twitter employee was hacked. Multiple “OG” trading forums and chatrooms, which specialize in account takeover, were chatting about the hack during it, and some warned to not do anything until the situation blew over:

User warning a Discord to not purchase any Twitter accounts

The initial posts contained a domain, cryptoforhealth[.]com, had text similar to many other crypto giveaway scams, as documented by Alpha Team:

Screenshot of the cryptoforhealth website

The site is now down. It was originally hosted on Cloudflare, and the origin IP address was hosted on 111.90.149.224 via Shinjuri Technology. Cloudflare quickly took the site down.

Shortly after, a new wave of posts started, which directed users to a Bitcoin wallet address directly in the tweet body. Below are tweets from President Barack Obama, Vice President Joe Biden and Elon Musk, who’s accounts fell victim to the attack.

President Barack Obama tweeting the wallet address for the scam

Vice President Joe Biden tweeting the wallet address for the scam

Elon Musk tweeting the wallet address for the scam

Victims started sending Bitcoin to this address, and as of 1900 EDT on 15 July 2020, the address has made 12.81 BTC, close to $120,000 USD. Other bitcoin addresses were also posted after this, and are included in the “indicators of compromise” section at the end.

At 1745 EDT, Twitter Support tweeted out that they are investigating the incident, and then subsequently mentioned that some users may not be able to tweet or reset their password.

Twitter Support acknowledging the incident

After 1800 EDT, the tweets seemed to stop for the most part, especially for verified accounts. This could be what Twitter Support was alluding to when they said some accounts could not tweet, as a number of verified accounts reported that they could not tweet after this announcement.

Indicators of Compromise

38qyALcxSnfzaFFTnt46xHMTN3GCGanKXC
rhYSX8qSpoU7Dwjh6vMSuACu8MBECn6bQR
Bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh
cryptoforhealth.com
111.90.149.224

Patch Tuesday 07/15/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Microsoft's Patch Tuesday update for July 2020 contained 123 vulnerabilities in total, with:

• 4 vulnerabilities rated as Critical
• 89 vulnerabilities rated as High
• 30 vulnerabilities rated as Medium

Critical vulnerabilities

The most notable critical-rated vulnerabilities in Microsoft's Patch Tuesday Update are tracked as CVE-2020-1350, CVE-2020-1147, CVE-2020-1439, and CVE-2020-1444.

CVE-2020-1350 CVE-2020-1350 is a Remote Code Execution Vulnerability impacting Windows DNS Server. According to Microsoft, the vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability. To exploit the vulnerability, an unauthenticated attacker could send malicious requests to a Windows DNS server. The vulnerability is assigned a CVSS Base Score 10 and affects the following Microsoft products:

Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2012 Windows Server 2012 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2016 Windows Server 2016 (Server Core installation) Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server, version 1903 (Server Core installation) Windows Server, version 1909 (Server Core installation) Windows Server, version 2004 (Server Core installation)

Proof-of-concept to exploit this vulnerability is available. The most recent Microsoft security update addresses the vulnerability by modifying how Windows DNS servers handle requests.

CVE-2020-1147 CVE-2020-1147 is also a Remote Code Execution Vulnerability impacting Microsoft .NET Framework, SharePoint Server, and Visual Studio. According to Microsoft, the vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the process responsible for deserialization of the XML content. To exploit this vulnerability, an attacker could upload a specially crafted document to a server utilizing an affected product to process content.

CVE-2020-1439 CVE-2020-1439 is a Remote Code Execution Vulnerability impacting Microsoft PerformancePoint Services for SharePoint Server. According to Microsoft, the vulnerability exists when the software fails to check the source markup of XML file input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the process responsible for deserialization of the XML content. To exploit this vulnerability, an attacker could upload a specially crafted document to a server utilizing an affected product to process content.

CVE-2020-1444 CVE-2020-1444 is a Remote Code Execution Vulnerability impacting Microsoft SharePoint. According to Microsoft, the vulnerability exists when the software parses specially crafted email messages. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the system user. An attacker could then install programs; view, change, add, or delete data. To exploit this vulnerability, an attacker would need to send a specially crafted email to an affected SharePoint server, and then convince the recipient to perform multiple actions while replying to the message.

High-severity vulnerabilities

Among the 89 high-severity rated vulnerabilities, the most notable high-severity vulnerabilities are tracked as CVE-2020-1041, CVE-2020-1040, CVE-2020-1032, CVE-2020-1036, CVE-2020-1042, CVE-2020-1043 which affects the Microsoft Hyper-V RemoteFX vGPU. These six Hyper-V vulnerabilities could allow an attacker on a guest operating system to execute commands on the host. To exploit these vulnerabilities, an attacker could run a specially crafted application on a guest operating system, attacking certain third-party video drivers running on the Hyper-V host. This could then cause the host operating system to execute arbitrary code.

An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system. This vulnerability impacts the following Microsoft products: Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2016 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2016 (Server Core installation) Windows Server 2012 R2

There is no patch to fix this vulnerability, and the update provided by Microsoft Patch Tuesday Update will forcibly disable RemoteFX when applied.

Office vulnerabilities Microsoft Office has also received several updates on the Patch Tuesday Update. The most notable among them are CVE-2020-1458 and CVE-2020-1025. CVE-2020-1458 could allow remote code execution when Microsoft Office improperly validates input before loading dynamic link library (DLL) files. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. CVE-2020-1025 is an elevation of privilege vulnerability that exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access.

Windows vulnerabilities Along with CVE-2020-1350, which has been assigned with a CVSS score 10, Microsoft Windows has received multiple patches included in its July Patch Tuesday Update. The Most notable ones among many are CVE-2020-1436, CVE-2020-1410 and CVE-2020-1463. CVE-2020-1436 is a remote code execution vulnerability impacting the Windows font library. CVE-2020-1410 is also a remote code execution vulnerability that exists when vcard files in Windows Address Book (WAB) are improperly processed. CVE-2020-1463 is an elevation of privilege vulnerability that exists in the way that the SharedStream Library handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Breaking News: 2020-07-10 - 2020-07-16

Google bans stalkerware ads

Google announced its plans to ban ads that promote stalkerware, spyware, and other forms of surveillance technology that can be used to track other persons without their specific consent. The Google Ads policy will be updated to clarify restrictions on advertising for spyware and surveillance technology. The updated policy will prohibit the promotion of products or services that are marketed or targeted with the express purpose of tracking or monitoring another person or their activities without their authorization. The change is set to enter into effect next month, on August 11, 2020. Offenders who promote stalkerware will receive a seven-day warning, after which they'll be banned if they don't remove the offending ads. Private investigation services or products designed for parents to track or monitor their underage children are not banned under this new policy and will still be allowed to be advertised on its platform.

See the full report here: https://www.zdnet.com/article/google-bans-stalkerware-ads/

Huge DDoS Attack Launched Against Cloudflare in Late June

Cloudflare revealed that on June 21 it detected and mitigated a packet-based volumetric DDoS attack that peaked at 754 million packets-per-second. According to researchers, that peak was part of a four-day attack from June 18-21 that saw traffic from more than 316,000 different IP addresses directed at a single Cloudflare address. The attack used a combination of three TCP attack vectors: SYN floods, ACK floods, and SYN-ACK floods. Over the four-day period, the attack sustained rates exceeding 400-to 600 million packets-per-second for hours at a time, and peaked above 700 million packets-per-second multiple times. The packet-based attack attempted to overwhelm Cloudflare's routers and data center appliances rather than flood the in-bound data connections.

See the full report here: https://www.darkreading.com/attacks-breaches/huge-ddos-attack-launched-against-cloudflare-in-late-june/d/d-id/1338323

Persuasive Office 365 phishing uses fake Zoom suspension alerts

Microsoft Office 365 users are targeted by a new phishing campaign using fake Zoom notifications to warn those who work in corporate environments that their Zoom accounts have been suspended, with the end goal of stealing Office 365 logins. The phishing emails spotted by Abnormal Security's researchers, spoof an official Zoom email address and are designed to impersonate a legitimate automated Zoom notification. The targets are warned that their Zoom accounts were temporarily suspended and that they will not be able to join any calls and meetings until they re-activate their accounts. Victims are redirected to a fake Microsoft login page through an intermediary hijacked website and are asked to input their Outlook credentials. The stolen accounts later to be used as identity theft and fraud schemes such as Business Email Compromise (BEC) attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/persuasive-office-365-phishing-uses-fake-zoom-suspension-alerts/

Joker malware apps bypassed Google’s Play Store security checks

Researchers from security firm Check Point discovered a new variant of the Joker Dropper and Premium Dialer spyware uploaded on the official Play Store bypassing protections implemented by Google. Hiding in seemingly legitimate applications, the updated version of Joker malware allows attackers to perform a broad range of malicious operations, including disable the Google Play Protect service, install malicious apps, generate fake reviews, and show ads. The spyware can steal SMS messages, contact lists, device information, and sign victims up for premium service subscriptions without their knowledge or consent. Researchers discovered 11 apps in the Play Store and reported them to Google, which removed them from the store on April 30, 2020. Users are recommended to uninstall the infected applications from the devices.

See the full report here: https://securityaffairs.co/wordpress/105712/malware/joker-bypasses-play-store-checks.html?utm_source=rss&utm_medium=rss&utm_campaign=joker-bypasses-play-store-checks

Zoom is working on a patch for a zero-day in Windows client

Researchers from cyber-security firm ACROS have disclosed a zero-day vulnerability in the Windows client of the video conferencing software Zoom. The vulnerability allows a remote attacker to execute arbitrary code on the victim's computer where Zoom Client for Windows, on any currently supported version, is installed by getting the user to perform some typical action such as opening a document file without any warning being shown to the user. Zoom clients running on Windows 8 or Windows 10 are not affected. The vulnerability affects Windows clients running on old versions of Windows OS, including Windows 7 and Windows Server 2008 R2 and earlier. The company posted a proof-of-concept video that shows how an exploit can be triggered. Zoom has confirmed the issue and working on the fix.

See the full report here: https://securityaffairs.co/wordpress/105735/hacking/zoom-zero-day.html?utm_source=rss&utm_medium=rss&utm_campaign=zoom-zero-day

What Social & Digital Platforms Can Tell Us About Vulnerability Prioritization

The security community misses the mark from time to time when it comes to vulnerability prioritization and impact. In the last week of June and the first week of July, security practitioners identified vulnerabilities in two critical networking devices with CVSS scores of 10. Using the information available on digital platforms, ZeroFOX's Alpha Team has compared the two vulnerabilities, CVE-2020-5902 and CVE-2020-2021. CVE-2020-5902, a vulnerability in BIG-IP F5 Networks TMUI, was announced on July 1, 2020, leading to an increase of social media mentions throughout the discovery of POC’s, in the wild exploits, and patches. Dark web hacking and cybercrime forum also had multiple threads and even Nmap NSE scripts shared for this vulnerability. On the other hand, CVE-2020-2021 (PAN-OS: Authentication Bypass in SAML Authentication) had a larger initial spike in tweets when the vulnerability was announced. Within two days, however, there was a drop off in interest, perhaps due to the F5 bug. As of 9 July 2020, there has been no PoC observed in any of these digital platforms or reports of exploits in the wild. When prioritizing vulnerabilities, you should consider a variety of factors, and digital platforms can help do the work for you and provide that data in most cases. Overall, based on Alpha Team assessment it is clear that the F5 vulnerability had a bigger impact and reach. While initial interest was low with this vulnerability, it gained traction as soon as PoCs were made and exploits were seen in the wild.

See the full report here: https://www.zerofox.com/blog/vulnerability-prioritization/

eToro accounts peddled by the thousands on cybercrime forums - BleepingComputer

A threat actor, identified as Sheriff, is selling 62,000 accounts belonging to users of the eToro social trading platform on a known cybercrime forum. The offer included login credentials, phone numbers, postal addresses, and balances for a starting price of $1,500. Each new bid would increase the price by $500, with the highest bidder winning the auction. The hacker claims that all accounts are active and all credentials work, meaning that buyers could withdraw funds or dabble in trading that is beneficial to them. Although Sheriff may look like a low-level actor, they’ve been collaborating with REvil ransomware on the corporate intrusion front. The researchers paint Sheriff as an "expert" in the financial sector and Citrix breaches which aligns with REvil’s latest choice of intrusion method. The evidence suggests that the two are working together.

See the full report here: https://www.bleepingcomputer.com/news/security/etoro-accounts-peddled-by-the-thousands-on-cybercrime-forums/

Google Tsunami vulnerability scanner is now open-source

Google has announced to release Tsunami security scanning engine to the open source communities. Tsunami was used internally by the IT giants and is designed to find vulnerabilities in large networks that include hundreds of thousands of devices. Tsunami is split into two main components and has a modular structure that allows to implement new features by adding specific plugins.The first component is a scanner based on nmap, which scans a company’s network for open ports and then tests each one. The second component uses the results of the scan of the fingerprinting module to test the devices against a list of vulnerabilities running known exploits.

See the full report here: https://securityaffairs.co/wordpress/105686/hacking/google-tsunami-open-source.html?utm_source=rss&utm_medium=rss&utm_campaign=google-tsunami-open-source

Evilnum hackers use the same malware supplier as FIN6, Cobalt

Hackers at Evilnum have created a toolset that combines custom malware, legitimate utilities, and tools bought from a malware-as-a-service (MaaS) provider that caters to big fintech threat actors. The group has been active since at least 2018 and focuses on financial technology sectors. Attacks begin with spear phishing emails containing .LNK shortcut files pretending to be an image or a document (double extension). When the victim opens the file, a malicious JavaScript component deploys other malware like the Evilnum spying module, malware from the Golden Chickens MaaS, and multiple Python-based tools. The malicious components run independently and connect to different command and control (C2) servers to receive commands and post-compromise tools from the hackers. The C2 servers do not have a domain name and are pulled from GitHub, GitLab, and Reddit pages that have been created specifically for this task. Evilnum makes extensive use of tools from Golden Chickens, with the TerraLoader dropper and use Python-based tools are post-compromise analysis.

See the full report here: https://www.bleepingcomputer.com/news/security/evilnum-hackers-use-the-same-malware-supplier-as-fin6-cobalt/

Smartwatch hack could trick patients to ‘take pills’ with spoofed alerts - TechCrunch

Security researchers at UK based security firm Pen Test Partners have warned that a smartwatch, popular with the elderly and dementia patients could have been tricked into letting an attacker sending fake “take pills” reminders to patients. These watches are designed to help patients easily call their carers and for carers to track the location of their patients as they come with a cellular connection. The vulnerabilities were found in the back-end cloud system, known as SETracker, which powers the smartwatch as well as millions of other white-label smartwatches and vehicle trackers across Europe, all of which were vulnerable to basic attacks. The researchers have analyzed the source code of SETracker and found that the server was using a hard-coded key, which, if used, an attacker could have sent arbitrary commands to take control over the devices and trigger fake “take pills” alert, secretly make phone calls from the device, send text messages, or in the case of vehicle trackers cut the engine altogether. The researchers said that the vulnerabilities have now been fixed.

See the full report here: https://techcrunch.com/2020/07/09/smartwatch-hack-spoofed-alerts/

Over 1,300 phishing kits for sale on hacker forum - BleepingComputer

A hacker of a popular hacking forum is selling a huge collection of more than 1,300 phishing kits each for $25. The malicious trove is part of the seller’s collection and covers top-rated websites, banks, and financial organizations. According to the advertisement, the phishing kits (PHP, HTML, CSS, JavaScript) are unique and the size of the entire cache compressed is 3.3GB, each one is a ZIP archive. Looking at the targets they are impersonating, the list covers high-value services including PayPal, Dropbox, Amazon, OneDrive, Office 365, Outlook, Gmail, Spotify, Netflix, Bank of America, Chase, Wells Fargo, First Bank, Apple, Facebook, LinkedIn. Furthermore, most webmail logins are covered, including all versions of CPanel, Zimbra, and Microsoft Outlook OVA.

See the full report here: https://www.bleepingcomputer.com/news/security/over-1-300-phishing-kits-for-sale-on-hacker-forum/

Microsoft will not support PHP 8.0 for Windows in 'any capacity' - BleepingComputer

With PHP 8.0 scheduled for release in November 2020, Microsoft has announced that it will not offer support in 'any capacity' for PHP for Windows 8.0 when it is released. Microsoft has been providing support for the development and building of the PHP programming language on Windows, including developing security patches for PHP and creating native Windows builds. The announcement does not mean PHP 8.0 will not be supported in Windows. It just means that Microsoft will not be the one building and supporting it.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-will-not-support-php-80-for-windows-in-any-capacity/

Popular TP-Link Family of Kasa Security Cams Vulnerable to Attack

A popular TP-Link family of Kasa security cameras contains bugs that could open the hardware to remote attacks, such as giving hackers access to private video feeds and the ability to change device settings. According to the researcher who discovered the flaws, the most troubling bug was an insecure implementation of an SSL certificate on the Kasa mobile application, which could allow man-in-the-middle attacks. This flaw has been patched on June 11. However, it is unclear if the patch was pushed to devices or if consumers will need to download the patch themselves. TP-Link is yet to fix an account takeover (ATO) bug that opens the door to credential stuffing attacks.

See the full report here: https://threatpost.com/popular-tp-link-family-of-kasa-security-cams-vulnerable-to-attack/157371/

TrickBot malware is mistakenly warning victims they are infected - BleepingComputer

In a recent release of TrickBot malware analyzed by a security researcher, the malware developers mistakenly dropped a test version of the grabber.dll module, falsely warning victims that they are infected. The module when loaded displays a warning in the default browser stating that the program is gathering information and the victim should ask their system administrator. "Grabber.dll" is TrickBot's password and cookie-stealing module that attempts to harvest saved browser credentials and cookies from Chrome, Edge, Internet Explorer, and Firefox. Victims are advised to immediately disconnect their computer from the network and then perform a scan with their installed security software.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-malware-mistakenly-warns-victims-that-they-are-infected/

Zoom fixes zero-day RCE bug affecting Windows 7, more updates soon - BleepingComputer

​The Zoom web conference Client is vulnerable to a zero-day flaw that could allow attackers to execute commands on vulnerable systems remotely. The vulnerability was discovered by a researcher who reached out to 0patch, after which 0patch issued a micropatch for free till Zoom fixed the vulnerability. Complete details of the vulnerability are not disclosed yet. However, a Proof-of-Concept video has been posted, vaguely demonstrating the exploitation. The security flaw is exploitable in Windows 7 and older Windows systems. While Microsoft's official support for Windows 7 has ended this January, millions of home and corporate users are prolonging its life with Microsoft's Extended Security Updates. Zoom has released a patch in the latest version 5.1.3 (28656.0709) for Windows users as of July 10th, and users are advised to download the newest version of the client application.

See the full report here: https://www.bleepingcomputer.com/news/security/zoom-fixes-zero-day-rce-bug-affecting-windows-7-more-updates-soon/

Hacker breaches security firm in act of revenge

A hacker going by the name of NightLion, emailed tens of cyber-security reporters a link to a dark web portal where he claims to have published information about the hack of a cyber-security firm's "data leak detection" service. The databases have been collected inside DataViper, a data leak monitoring service managed by Vinny Troia, the security researcher behind Night Lion Security. The hacker claims to have spent three months inside DataViper servers while exfiltrating databases that Troia had indexed for the DataViper data leak monitoring service. The hacker also posted the full list of 8,225 databases that Troia managed to index inside the DataViper service, a list of 482 downloadable JSON files containing samples from the data they claim to have stoled from the DataViper servers, and proof that they had access to DataViper's backend. Furthermore, the hacker also posted ads on a dark web marketplace where they put up for sale 50 of the biggest databases that they found inside DataViper's backend.

See the full report here: https://www.zdnet.com/article/hacker-breaches-security-firm-in-act-of-revenge/

Microsoft spins out 5-year-old Chinese chatbot Xiaoice

Microsoft is shedding its chatbot Xiaoice into an independent entity. The announcement came several months after Microsoft announced it would close down its voice assistant app Cortana in China among other countries late last year. In 2014, a small team of Microsoft’s Bing researchers unveiled Xiaoice, “Little Bing” in Chinese. The bot immediately created a sensation in China and was regarded by many as their virtual girlfriend. The chatbot came just a few weeks after Microsoft rolled out Cortana in the country. Modeled on the personality of a teenage girl, Xiaoice aims to add a more human and social element to chatbots. The spinoff will see the new entity license technologies from Microsoft for subsequent research and development in Xiaoice and continue to use the Xiaoice brand (and Rinna in Japanese), while Microsoft will retain its stakes in the new company.

See the full report here: https://techcrunch.com/?p=2015513

Waterloo insurance firm Heartland Farm Mutual experienced data breach - TheRecord.com

Waterloo, Insurance firm Heartland Farm Mutual Inc. has confirmed it experienced a data breach that may have exposed personal information. The incident occurred between March 27 and April 3, which may have involved unauthorized access to an employee’s email inbox exposing policyholders' names, addresses, banking information, social insurance and credit card numbers, driver’s license information, and, in some cases, passport information. The company blocked unauthorized access to secure the information and working with cybersecurity experts. Affected individuals are notified and offered to cover the cost of credit monitoring for 12 months.

See the full report here: https://www.therecord.com/business/2020/07/08/waterloo-insurance-firm-heartland-farm-mutual-experienced-data-breach.html

Malware adds Any.Run sandbox detection to evade analysis - BleepingComputer

Malware developers are checking if their malware is running in the Any.Run sandbox to prevent their malware from being easily analyzed by researchers. Any.Run is a live malware analysis service for static and dynamic research that lets researchers and users safely analyze malware without risk to their computers. In a new password-stealing trojan spam campaign, malicious PowerShell scripts are downloading and installing malware onto a computer. If this script detects that the program is running on Any.Run, it will display the message 'Any.run Detected!' and exit. This will terminate the execution of the malware to evade analysis. Using this method, the threat actors make it more difficult for researchers to analyze their attacks using an automated system.

See the full report here: https://www.bleepingcomputer.com/news/security/malware-adds-anyrun-sandbox-detection-to-evade-analysis/

Delivery Start-up Dunzo Suffers Data Breach, Users’ Numbers Leaked - The Quint

Indian hyperlocal delivery service Dunzo has been hit by a data breach after the attackers compromised the servers of a third-party that Dunzo works with and gained access to the database. The incident has exposed the phone numbers and email IDs of its users. However, the number of compromised accounts is not known yet. No payment information like credit card details and passwords were compromised as Dunzo uses OTP. As a security measure, Dunzo has changed the access tokens and passwords to prevent any further data breach and has also secured all of its databases.

See the full report here: https://www.thequint.com/tech-and-auto/tech-news/dunzo-app-suffers-data-breach-phone-numbers-and-email-of-users-exposed

LiveAuctioneers reports data breach after user records sold online - BleepingComputer

LiveAuctioneers, an auction site that allows people worldwide to bid on auctioned items in real-time, has disclosed a data breach on July 11th, after its database was listed for sale on the dark web. A data breach broker is selling a database that allegedly contains 3.4 million user records stolen from the LiveAuctioneers' site. This data allegedly contains the user's email addresses, usernames, MD5 hashed passwords, names, phone numbers, addresses, IP addresses, and social media profiles. The company confirmed that credit card information and bidding history were not affected in the attack. The leaked user records were have been verified. LiveAuctioneers has disabled the passwords for all bidder accounts and is urging members to perform a password reset.

See the full report here: https://www.bleepingcomputer.com/news/security/liveauctioneers-reports-data-breach-after-user-records-sold-online/

RECON bug lets hackers create admin accounts on SAP servers

SAP has released a patch today for a major vulnerability, dubbed RECON, that impacts the vast majority of its customers. The bug can allow malicious threat actors to create an SAP user account with maximum privileges on SAP applications exposed on the internet, granting attackers full control over the hacked companies' SAP resources. Tracked as CVE-2020-6287, the flaw resides in a default component included in every SAP application running the SAP NetWeaver Java technology stack, namely in the LM Configuration Wizard component of the SAP NetWeaver Application Server (AS). This vulnerability has received a maximum 10 out of 10 rating on the CVSSv3 vulnerability severity scale. Administrators of SAP systems are advised to apply SAP's patches as soon as possible.

See the full report here: https://www.zdnet.com/article/recon-bug-lets-hackers-create-admin-accounts-on-sap-servers/

Collabera hacked: IT staffing'n'services giant hit by ransomware, employee personal data stolen

A New Jersey-based IT services and staffing company, Collabera, has been hit by ransomware. According to the company's notification, the malware in its network system consistent with a ransomware attack was identified on June 8, 2020, and on June 10, the company became aware that the unauthorized party obtained some data from their system. The stolen data appears to have included workers' names, addresses, contact and social security numbers, dates of birth, employment benefits, and passport and immigration visa details. Collabera has restored access to its backup files and has launched an investigation to determine the nature and scope of the event. The company is offering its staff two years of credit and identity monitoring services.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/07/14/collabera_ransomware/

New AgeLocker Ransomware uses Googler's utility to encrypt files - BleepingComputer

Age, an encryption tool created by a Google employee, is being used in new and targeted ransomware named AgeLocker to encrypt victim's files. Currently, it is not known how the threat actors are gaining access to victim's computers, but once they gain access to the system, they utilize the Age encryption tool to encrypt the victim's files. While encrypting data, a custom extension created with the victim's initials will be appended to each encrypted filename. The attackers then email the victim the ransom note, listing the devices encrypted by the ransomware and instructions on how to get payment information. According to experts, the threat actors behind AgeLocker appear to be using the Age command-line tool to encrypt a victim's files. According to one of the victims of the latest ransomware, the threat actors are demanding 7 bitcoins, or approximately $64,500, to decrypt the files.

See the full report here: https://www.bleepingcomputer.com/news/security/new-agelocker-ransomware-uses-googlers-utility-to-encrypt-files/

Lost in Translation: Serious Flaws Found in ICS Protocol Gateways

Researchers at Trend Micro found multiple vulnerabilities in ICS protocol gateways software, which translate and carry traffic between older industrial networks and IP-based ones. These vulnerabilities can be triggered remotely, but the attacker would need to be in the network. The tests were conducted on the protocol translation process for the popular Modbus serial-protocol used in automobiles and industrial plants. Users are recommended to keep the firmware’s up-to-date.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/lost-in-translation-serious-flaws-found-in-ics-protocol-gateways-/d/d-id/1338341

A hacker is selling details of 142 million MGM hotel guests on the dark web - ZDNet

The MGM Resorts 2019 data breach is now believed to have impacted more than 142 million hotel guests. The new finding came to light after a hacker put up for sale the hotel's data in an ad published on a dark web cybercrime marketplace. According to the ad, the hacker is selling the details of 142,479,937 MGM hotel guests for $2,900. The hacker claims to have obtained the hotel's data after they breached DataViper, a data leak monitoring service operated by Night Lion Security; DataViper denies the statement. MGM Resorts issued a statement claiming they were aware of the scope of the breach and notified impacted customers.

See the full report here: https://www.zdnet.com/article/a-hacker-is-selling-details-of-142-million-mgm-hotel-guests-on-the-dark-web/

Microsoft extends security for Azure Storage file shares, data lakes

Microsoft announced Advanced Threat Protection (ATP) for Azure Storage, allows customers to protect data stored in Azure Files file shares and Azure Data Lake Storage Gen2 API data stores. ATP for Azure Storage is designed as an additional security intelligence layer to help detect malware uploaded to cloud storage accounts, access from suspicious sources, including but not limited to TOR exit nodes, and potentially harmful data exfiltration activities. Advanced threat protection for Azure Storage needs to be toggled on for all storage accounts containing file shares and blob containers that need to be protected. ATP for Azure Storage is available in all both public clouds and US government clouds, but it cannot be used in other sovereign or Azure Government cloud regions.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-extends-security-for-azure-storage-file-shares-data-lakes/

This botnet has surged back into action spreading a new ransomware campaign via phishing emails - ZDNet

Phorpiex, aka Trik, has been used to distribute spam campaigns for other forms of ransomware and being used to mine for cryptocurrency on infected machines. Researchers at Check Point found that the Phorpiex botnet has been delivering the Avaddon ransomware, a new Ransomware-as-a-Service (RaaS) variant that emerged in early June, via malspam campaigns. Phorpeix attempts to lure victims into opening a Zip file attachment in a phishing email that uses a wink emoji as the subject. The malware is capable of scrambling data on a computer and demanding a ransom in return for file decryption. Users are advised to be vigilant in opening suspicious emails & links.

See the full report here: https://www.zdnet.com/article/this-botnet-has-surged-back-into-action-spreading-a-new-ransomware-campaign-via-phishing-emails/

New Mirai Variant Surfaces with Exploits for 9 Vulnerabilities Products

Security researchers at Trend Micro have discovered a brand-new Mirai variant that is designed to exploit the nine previously disclosed vulnerabilities in routers, IP cameras, DVRs, and other products from multiple vendors, including Comtrend, D-Link, MV Power, Symantec, and AVTech. One of the vulnerabilities, tracked as CVE-2020-10173, is a remote code execution flaw in a router model from Comtrend that allow attackers to take control of the network managed by the router. Another vulnerability is a remote code execution bug in Netlink GPON Router 1.0.11 that has been already exploited by a variant of Gafgyt/Bashlite IoT botnet. The remaining seven vulnerabilities are all older ones and have been previously exploited by other malware. The attackers use such variants to compromise vulnerable IoT devices and assemble them into botnets for launching distributed denial-of-service attacks, distributing malware, or carrying out other malicious activities. Thus, it is recommended that organizations pay closer attention to the procurement of IoT devices also implement proper authentication and credential management processes and use encryption wherever possible.

See the full report here: https://www.darkreading.com/attacks-breaches/new-mirai-variant-surfaces-with-exploits-for-9-vulnerabilities-products-/d/d-id/1338345

New GoldenHelper malware found in official Chinese tax software - BleepingComputer

Researchers at Trustwave SpiderLabs have found a new backdoor dubbed GoldenHelper embedded within Golden Tax Invoicing Software, part of the Chinese government' Golden Tax Project. The software is used for issuing invoices and paying value-add tax (VAT) taxes. The campaign distributing the GoldenHelper malware was active between January 2018 and July 2019. The malware uses sophisticated techniques to hide its delivery, presence, and activity. This includes randomization of name whilst in transit, randomization of file system location, timestomping, IP-based DGA (Domain Generation Algorithm), UAC bypass, and privilege escalation. The final payload of the malware gets downloaded and executed with SYSTEM level privilege from multiple locations on the infected systems. While the GoldenHelper campaign is no longer active, the security threat posed by this final payload remains since it can't be established if it's still operational.

See the full report here: https://www.bleepingcomputer.com/news/security/new-goldenhelper-malware-found-in-official-chinese-tax-software/

Wattpad data breach exposes account info for millions of users - BleepingComputer

A database containing 270 million records of Wattpad users is being sold online on various hacking forums and marketplaces. Wattpad is a popular website that allows members to publish user-generated stories on a variety of different topics. The stolen database included usernames, names, hashed passwords, email addresses, and general geographic location. The company has stated that they do not process financial information through our impacted servers, and active Wattpad users’ passwords are salted and cryptographically hashed. They are currently working to investigate, contain, and remediate the issue with the assistance of external security consultants.

See the full report here: https://www.bleepingcomputer.com/news/security/wattpad-data-breach-exposes-account-info-for-millions-of-users/

Critical DNS Bug Opens Windows Servers to Infrastructure Hijacking

A critical Microsoft Windows Server bug opens company networks to hackers, allowing them to potentially seize control of IT infrastructures. Tracked as CVE-2020-1350 and named as SigRed, the bug could enable a hacker to craft malicious DNS queries to the Windows DNS server, and achieve arbitrary code execution that could lead to the breach of the entire infrastructure. It is a 17-year-old bug that is wormable and impacts Windows Server versions from 2003-2019. While this vulnerability is not currently known to be used in active attacks, customers are urged to apply Windows updates to address this vulnerability as soon as possible.

See the full report here: https://threatpost.com/critical-dns-bug-windows-servers-infrastructure-takeover/157427/

Adobe Issues July 2020 Critical Security Patches for Multiple Software

Adobe has patched 13 vulnerabilities affecting Adobe Creative Cloud Desktop Application, Adobe Media Encoder, Adobe Genuine Service, Adobe ColdFusion, and Adobe Download Manager. None of the security vulnerabilities fixed in this batch of Adobe updates were publicly disclosed or found being exploited in the wild. However, Adobe users are highly recommended to download and install the latest versions of the affected software to protect their systems and businesses from potential cyber-attacks.

See the full report here: https://thehackernews.com/2020/07/adobe-security-patch-july.html

Android chat app uses public code to spy, exposes user data - BleepingComputer

Welcome Chat, a chat application for Android claiming to be a secure messaging platform, is targeting Arabic-speaking users and relies on open source code for recording calls, stealing text messages, and tracking. Researchers say that monitoring the communication with other Welcome Chat users is at the core of this malicious app, which is complemented by the following malicious actions, exfiltrate sent and received text messages, steal call history log, steal the victim’s contact list, steal user photos, exfiltrate recorded phone calls, send the GPS location of the device along with system info. Also, transmitted data is not encrypted, available to the attacker, and is freely accessible to anyone on the same network. Included in the app’s database on the server is everything but the user account password, names, email addresses, phone numbers, device tokens, profile pictures, messages, and friends list. Researchers have found that the app was never part of the official Android store. If users fail to notice this red flag, the app asks for permission to send and view SMS messages, access files, record audio, and access contacts and device location.

See the full report here: https://www.bleepingcomputer.com/news/security/android-chat-app-uses-public-code-to-spy-exposes-user-data/

Google launches Confidential VMs for sensitive data processing

Google launches Confidential VMs, which is the first product in Google Cloud’s new confidential computing portfolio. Google’s new feature is an evolution of its Shielded VMs, a tool launched in 2018 that companies could deploy to strip out most of the potentially vulnerable startup processes that trigger when attempting to create a new environment. The Confidential VMs feature, available as a beta today, will allow customers to encrypt their data in memory, meaning encryption can be maintained while it is being used, indexed, queried, or trained on.

See the full report here: https://www.itpro.co.uk/cloud/virtual-machines/356441/google-launches-confidential-vms-for-sensitive-data-processing

Microsoft Outlook is crashing worldwide with 0xc0000005 errors, how to fix

Microsoft Outlook is immediately crashing worldwide when users start the application. Users who examined their Application event logs will see an error log stating that the OUTLOOK.EXE program has crashed with an exception code 0xc0000005. The Microsoft 365 Status Twitter account has tweeted that this is being caused by the new update and they are investigating the issue. Microsoft Outlook users have had success rolling back to a previous version of Microsoft Outlook to resolve this issue. The company suggests users use the web and mobile clients until the issue is resolved.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-is-crashing-worldwide-with-0xc0000005-errors-how-to-fix/

Twitter confirms internal tools used in bitcoin-promoting attack

After many high profile Twitter accounts, including those belonging to Bill Gates, Elon Musk, and Apple, were breached on Wednesday, resulting in anyone with a verified account unable to tweet for hours, the social media giant, Twitter said it detected a coordinated social engineering attack by people who successfully targeted some of the company's employees that have access to internal systems and tools. The company immediately locked the affected accounts and removed tweets posted by the attackers and access would be restored to the original owner only if it is certain that this could be done securely.

See the full report here: https://www.zdnet.com/article/twitter-confirms-internal-tools-used-in-bitcoin-promoting-attack/

New Attack Technique Uses Misconfigured Docker API

Researchers at Aqua ’s cybersecurity have discovered a new type of attack against container infrastructure. The attacker exploits a misconfigured Docker API port to build and run a malicious container image on the host to bypass defense mechanisms, thus increase the persistency of his infrastructure. The name and ID for these images are randomly generated and are unique to each host. The adversary used a Docker SDK for Python package to send commands to a misconfigured Docker API. The container is initiated with a command aimed to run a shell script, downloaded from a remote source during the build. The Shell script main.sh was designed to download and run an ELF file named XMRIG which is designed to hijack resources from the host by mining cryptocurrency. Administrates are recommended to scan all Docker images on the organization's servers.

See the full report here: https://www.darkreading.com/attacks-breaches/new-attack-technique-uses-misconfigured-docker-api/d/d-id/1338366

KingComposer patches XSS flaw impacting 100,000 WordPress websites

A reflected cross-site scripting (XSS) vulnerability impacting 100,000 websites has been patched in the KingComposer WordPress plugin. KingComposer is a drag-and-drop page builder for WordPress-based domains that removes the need to program or directly code websites powered by the content management system (CMS). The Wordfence team found the security flaw in Ajax functions used by the plugin to facilitate page builder features and tracked as CVE-2020-15299. One of the Ajax functions was not in active use but could still be launched by sending a POST request to a script called admin-ajax.php with an action parameter set to kc_install_online_preset. The function renders JavaScript across a variety of parameters that are then base64-decoded. The security issue was resolved by removing the vulnerable Ajax function.

See the full report here: https://www.zdnet.com/article/kingcomposer-wordpress-plugin-patches-xss-flaw-impacting-100000-websites/