Threat Intelligence Bulletin: 07/12/2019

Vulnerability in Instagram Could Allow for Easy Account Takeover

When a user forgets their Instagram password, they are able to request a reset passcode be sent to their mobile device. This code can be used to change an account's password. A security researcher has discovered a method of brute forcing this code by bypassing request rate limiting to the password reset link, which could be used to change the password of any targeted account, enabling an attacker to access and log in as their victim. Facebook, who owns Instagram, has since patched this vulnerability.

Recommendations

Enable multi-factor authentication on accounts whenever possible.
Monitor logins to all social media accounts
Notify the account provider immediately if you receive a password recovery request email or text, and did not make the request.

Details

A security researcher who discovered a new method for Instagram account takeover was awarded a $30,000 bug bounty for providing Facebook with information to patch the vulnerability. When an Instagram user forgets their password, they are able to reset their password using a link on the mobile application. This prompts the sending of a six-digit passcode to the mobile number entered, which is used to change the account password. Because in theory, an attacker could brute force this kind of passcode by sending a huge number of requests until the code was successfully guessed, these kinds of requests are usually rate limited so that they cannot be brute forced within the code expiration window.

In this particular case, although the Instagram account recovery process is rate limited, an attacker is able to get around the limit by sending requests from different IP addresses. This allowed for bypass of the rate limiting mechanism by sending a large number of requests from many different IP addresses, which may have ultimately resulted in an attacker being able to brute force the password recovery code.

This vulnerability was reported to Facebook by the researcher, and was subsequently fixed.

16Shop Phishing Kit Targeting Apple and Amazon Customers

The 16Shop phishing kit has been targeting Apple customers lately, phishing for financial information about victims. This kit is offered for sale on various marketplaces, and also has an active social media presence. The Facebook support group for this tool has over 200 members. The actors behind this tool have also released a new kit that focuses on targeting Amazon customers in a similar manner.

Recommendations

Enable multi-factor authentication for all accounts to prevent potential account takeover.
Always verify the sender of suspicious emails.
Never download attachments from unknown senders or suspicious email.
Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed.

Details

Campaigns leveraging the 16Shop phishing kit have been spotted in the wild targeting Apple customers in the US and Japan. The kit can be used to generate and send phishing emails, as well as spin up the actual phishing website. In this campaign, potential victims receive emailed intended to look as though they are from Apple support. These emails contain PDF attachments, which redirect to a phishing site. The phishing site aims to gather information like name, birth date, phone number, and credit card details from victims.

16Shop is offered for sale on various exploit marketplaces by the author, who goes by the moniker DevilScreaM. This actor is likely involved in the Indonesian Cyber Army hacking group. The kit is also offered for sale on Facebook, in a group used for 16Shop license sales and support. Ths group has over 300 members and 200 posts, and has existed since late 2017.

Additionally, a new kit similar to the existing 16Shop kit has been targeting Amazon customers in a similar manner. Code similarities and social media activity of the suspected actor group behind the tool have led researchers to believe that this tool is also attributable to the 16Shop actors.

IOCs

URLs:
secure2app-accdetall1.usa.cc.servsdlay[.]com/?16shop
gexxodaveriviedt0[.]com/app1esubm1tbybz/?16shop
gexxodaveriviedt0[.]com/secur3-appleld-verlfy1/?16shop
sec2-accountdetail.accsdetdetail[.]com/?16shop
verification-amazonaccess.secure.dragnet404[.]com/
verification-amazon.servicesinit-id[.]com/
verification-amazonlocked.securesystem.waktuakumaleswaecdvhb[.]com/
verification-amazonaccess.jaremaubalenxzbhcvhsd[.]business/
verification-amazon.3utilitie[.]com/
verification-amaz0n[.]com/

Hashes:
34f33612c9f6b132430385e6dc3f8603ff897d34c780bfa5a4cf7663922252ba
b43c2ba4e312d36a1b7458d1342600957e0daf3d1fcd8c7324afd387772f2cc0
569612bd90de1a3a5d959abb12f0ec66f3696113b386e4f0e3a9face084b032a
d9070e68911db893dfe3b6acc8a8995658f2796da44f14469c73fbcb91cd1f73

Malware Update: New Linux Spyware

New spyware targeting Linux operating systems had been discovered by a group at Intezer Labs. EvilGnome includes functionality to screenshot a victim's desktop, listen in on microphone audio, and retrieve files from an infected device. Intezer has identified several possible correlations between this spyware and Gamaredon group activity.

Recommendations

Consider enabling the Cyber Chatter rule in order to monitor activity related to this threat.
Ensure defensive systems are up to date with the latest detection.
Blacklist network infrastructure associated with this campaign.

Details

Researchers at Intezer Labs have discovered a new family of spyware targeting Linux systems. Dubbed EvilGnome, the malware includes modules to screenshot a victim's desktop, steal files, and listen to audio over a device's microphone. Additionally, the binary includes an unfinished keylogger, which suggests that the binary is a developmental version.

Intenzer has identified several similarities between the EvilGnome command and control (C2) architecture, and that used by the Gamaredon threat actor group. Currently, EvilGnome operated on an IP address previously controlled by Gamaredon, and it also operates on an uncommon port number, 3436. Intezer has indentified an active Gamaredon Group C2 server with this port.

IOCs

Hashes:
a21acbe7ee77c721f1adc76e7a7799c936e74348d32b4c38f3bf6357ed7e8032
82b69954410c83315dfe769eed4b6cfc7d11f0f62e26ff546542e35dcd7106b7
7ffab36b2fa68d0708c82f01a70c8d10614ca742d838b69007f5104337a4b869

IPs:
195.62.52[.]101
185.158.115[.]44
185.158.115[.]154

Domains:
clsass.ddns[.]net
kotl[.]space

Breaking News - 07.15.2019

QNAPCrypt Ransomware Spotted Targeting NAS Servers

Ransomware typically targets Windows computers, so seeing some malware target Linux is both refreshing and horrifying. NAS is commonly deployed to Linux servers, especially as a backup service, so it makes sense for cybercriminals to target these troves of data. Researchers have identified 15 unique and ongoing campaigns targeting Linux servers

See the full report here: https://threatpost.com/linux-ransomware-nas-servers/146441/

PureScript NPM Installer Hijacked to Deliver Malicious Code

The npm registry is notorious for having dependencies upon dependencies within it's package structure. In this post, researchers report that a popular dependency in a large package contained malicious code that would be executed for anyone that installed PureScript.

See the full report here: https://www.theregister.co.uk/2019/07/15/purescripts_npm_installer/

New 0-day Reported in Windows 7 and Server 2008

Researchers at ESET have discovered a zero-day exploit being used in targeted attacks against Eastern European organizations. The attack leverages pop up window functionality in order to gain local privilege escalation. Micosoft has released a patch for this vulnerability (CVE-2019-1132), which is available here.

See the full report here: https://www.welivesecurity.com/2019/07/10/windows-zero-day-cve-2019-1132-exploit/

Breaking News - 07.17.2019

New Android Attack Allows Unauthorized Access to Loudspeaker Data

A novel attack against Android devices has been discovered by a team of researcher. Successful use of this method could allow an attacker access to a device's loudspeaker. This would grant access to any calls taken over speakerphone, voice notes received by the device, as well as multimediia played over the speaker.

See the full report here: https://thehackernews.com/2019/07/android-side-channel-attacks.html

Turla Actor Updates Attack Methods

Turla, a Russian-speaking threat actor group, has recently updated its attack vectors. One of the new tools, a piece of .NET malware named Topinambour, is used to build a fileless RAT such that it can evade detection. Other new tools include malware called RocketMan and MiamiBeach.

See the full report here: https://securelist.com/turla-renews-its-arsenal-with-topinambour/91687/

GandCrab Decryption Keys Released Publicly

The FBI has published decryption keys for the GandCrab ransomware family. Victims of these versions of GandCrab will be able use these keys to recover their files, making the ransomware family much less of a threat. This comes shortly after the June 1, 2019, announcement by the developers that GandCrab was shutting down operations.

See the full report here: https://www.darkreading.com/attacks-breaches/fbi-publishes-gandcrab-decryption-keys/d/d-id/1335258

Breaking News - 07.18.2019

Man Charged in Cyberattack Against Financial Records of 7 Million Bulgarians

20 year old Kristian Boykov has been arrested under suspicion of conducting a cyberattack against the Bulgarian NRA tax agency. The attack exposed financial records of nearly every citizen of Bulgaria, and has resulted in a fine of over $22 million for the agency. If found guilty, Boykov could face up to 8 years in jail.

See the full report here: https://www.theguardian.com/world/2019/jul/18/wizard-hacker-charged-after-financial-records-of-nearly-every-bulgarian-exposed

FaceApp Scritinized By US Senate Over Privacy Concerns

The popular mobile photo editor FaceApp is under fire from US Senator Chuck Schumer after a sudden resurgence in popularity. Schumer is requesting the Russian-owned app be reviewed by the FTC and FBI, to ensure that user information is not being relayed to third parties without user consent.

See the full report here: https://www.cnet.com/news/faceapp-might-face-fbi-ftc-investigation-over-security-concerns/