zerofox logo
Advisories

Threat Intelligence Bulletin: 07/24/2020 - 07/30/2020

|by Alpha Team

banner image

Breach Disclosure: Dave.com

Dave.com, a digital banking app, confirmed a security breach on 25 July 2020. The blog post from the company said that a former third party service provider was compromised which resulted in unauthorized access to data on Dave.com's platform. The company said that names, emails, birth dates, physical addresses, phone numbers and bcrypt hashed passwords were compromised. In total, approximately 7,500,000 accounts were compromised.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

ZDNet broke the story on 26 July 2020. According to an email with Dave.com, a former business partner, Waydev, which was used by the engineering teams at Dave.com, was compromised and then used to pivot into their databases.

On 24 July 2020, ShinyHunters, a data breach broker that has been in the media numerous times as well as tracked by ZeroFOX Alpha Team, made a post on RaidForums advertising the breach.

Figure 1

The post made by ShinyHunters was one day before the public announcement by the Dave.com team.

Breach Disclosure: Promo.com

Promo.com, a popular video maker and a cloud-based video creation service, was recently breached impacting over 22.1 million user records. This breach was posted on a popular hacking forum on 20 July 2020 and is available for sale at an undisclosed price. On 26 July 2020, the company confirmed the breach with a post on their website.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Promo.com (a.k.a. Promo by Slidely or previously Slide.ly) is a popular video maker and a cloud-based video creation service that is allowing the creation of videos from stock videos, stock photos, video clips, and music. On 20 July 2020, a threat actor posted the Promo leak on the dark web, claiming that the leak impacts over 22.1 million users (2.6 million with passwords).

Figure 1 Figure 1. Promo’s Database available for sale on a popular hacking forum

The leaked information includes:

  • First name
  • Last name
  • Email addresses
  • Genders
  • General geographic locations
  • IP addresses
  • Passwords (encrypted, hashed, and salted)
  • The threat actor has posted the sample data from the leak and is selling the entire database at an undisclosed price

Figure 2 Figure 2. Sample Data posted by the threat actor selling Promo’s Database

Breach Disclosure: Hurb

On 23 July 2020, Hurb, one of the largest online travel agencies in Brazil, had contents of their internal database leaked on popular hacking and cybercrime forum RaidForums. The data breach broker, ShinyHunters, posted the breach for approximately 2 Euros. The breach contains 20,728,250 rows of user data, which include usernames, unsalted MD5 passwords and email addresses.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

ShinyHunters has been posting a number of breaches in late July. This specific breach is serious due to the use of the MD5 cryptographic hashing algorithm, as well as lack of password salts for users, which makes cracking the passwords trivial.

Figure 1 Figure 1: ShinyHunters Post

Breach Disclosure: Drizly

A US-based online alcohol delivery service, Drizly, suffered a data breach in July 2020. According to TechCrunch, the company sent emails to customers and alleged that ‘..a hacker obtained some customer data’. The data was sold online before being extensively redistributed on various dark web markets and forums. The stolen data was initially put up for sale on RaidForums by ShinyHunters.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Drizly is one of the biggest online alcohol delivery services in the U.S. and Canada. It suffered a data breach that exposed approximately 2.5 million Drizly accounts to hackers. Although the company said that no financial data was taken in the breach, a listing on a dark web marketplace from a well-known seller of stolen data claims otherwise.

Figure 1 Figure 1: Fresh Drizly Accounts for sale Source: TechCrunch

ShinyHunters posted the download link, schema and sample data on RaidForums, a popular hacking and cybercrime forum. The schema is as follows:

id
partner_id
email
status
first_name
last_name
legacy_password
password_hash
password_salt
braintree_id
card_status
billing_name_old
billing_address_old
billing_address2_old
billing_city_old
billing_state_old
billing_zip_old
billing_phone_old
delivery_name_old
delivery_address_old
delivery_address2_old
delivery_city_old
delivery_state_old
delivery_zip_old
delivery_phone_old
flag
birth_year
latitude_old
longitude_old
token_old
birth_date_string
birth_date
invite_promo_code_id
invite_reward_promo_code_id
referred_by_user_id
registerDate
logs
redacted_cc_old
device
version
user_agent
register_version
last_sign_in_at
button_access_token
store_group_id
is_covered
tax_exempt
sift_score
ip_address
covered_at
origin_country_id
marketing_optin
delivery_fee_override
substitution_preference
is_corporate
is_covered_by_shipping
is_covered_by_delivery
partner_token_id
phone

Breach Disclosure: Dunzo

An Indian delivery service company, Dunzo, suffered a data breach that involved unauthorized access to one of its databases. According to TheNewsMinute, the breach occurred on or around 11 July 2020. The compromised database contained a number of columns, including usernames, emails, mobile phone numbers and password hashes. The stolen data was initially put up for sale on RaidForums by ShinyHunters.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Dunzo is an Indian company that provides delivery services in Bengaluru, Delhi, Gurugram, Pune, Chennai, Jaipur, Mumbai and Hyderabad. It suffered a security breach that involved unauthorized access to one of its databases. The exposed data contained 3.5M unique email addresses.

Figure 1 Figure 1: ShinyHunters Post

The schema posted by ShinyHunters is as follows:

id
password
last_login
is_superuser
uuid
first_name
last_name
email
phone
country_code
type
status
device_token
phone_type
phone_make
date_joined
last_updated
secret_key
app_version
registered_on
registered_platform
send_logistics_pricing
send_logistics_pricing_image_format
last_pricing_version_shared
preferred_mode_of_payment
credit_amount
credit_score
maximum_retries_count
profile_data_updated_on_firebase
merchant_id
permission_role
user_status
flow_version
extra_data_json
city_id
current_runner_task_id
source
first_known_location
last_known_location
referral_code
referred_by_code
advertising_id
device_id
bucket_id

Breach Disclosure: Appen

In June 2020, Appen, an AI company, suffered a data breach exposing the details of almost 5.9 million users which were subsequently sold online. According to Bleeping Computer, Appen is one of the 38 companies targeted by a hacker group called ShinyHunters. The compromised data included 5.8 million user records.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Appen is an Australia-based AI company that provides data used for the development of machine learning and artificial intelligence products. Since July 21st, a hacker that goes by the name ShinyHunters began leaking the databases for free on RaidForums. Appen was one of the 38 compromised databases that was put up on sale. The stolen data included 5.8 million of rows of usernames, email addresses, bcrypt hashed passwords, names, IP addresses and phone numbers.

Figure 1 Figure 1 Appen accounts on sale on RaidForums

Breach Disclosure: Scentbird

In June 2020, the online fragrance service Scentbird suffered a data breach that exposed the personal information of over 5.8 million customers. Personal information including names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes and indicators of password strength were exposed.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Scentbird is a company that provides subscription service for designer fragrances. On July 27th, 2020, ShinyHunters posted a schema and sample data belonging to Scentbird on a popular hacking forum. This is one of many posts ShinyHunters has made in late July on RaidForums, where they provided access to breach data for approximately 2 EUR per breach.

Figure 1 Figure 1: Database Leak Post by ShinyHunters

Figure 2 Figure 2: Scentbird’s email:hashes offered for free

Cisco Network Security Flaw Leaks Sensitive Data

A high-security flaw, tracked as CVE-2020-3452, exists in Cisco’s network security Firepower Threat Defense (FTD) software and its Adaptive Security Appliance (ASA) software due to a lack of proper input validation of URLs in HTTP requests processed by affected devices. The vulnerability allows attackers to conduct directory traversal attacks, which is an HTTP attack enabling bad actors to access restricted directories and execute commands outside of the web server’s root directory. The vulnerability affects products if they are running a vulnerable release of Cisco ASA Software or Cisco FTD Software, with a vulnerable AnyConnect or WebVPN configuration. Currently, Cisco isn't aware of any malicious exploits for the vulnerability. However, a security researcher has released a proof-of-concept (POC) exploit code. Cisco users are urged to apply the latest updates to eliminate this vulnerability.

See the full report here: https://threatpost.com/network-security-cisco-flaw-leaks-sensitive-data/157691/

ASUS Home Router Bugs Open Consumers to Snooping Attacks

Security researchers at Trustwave have discovered a pair of flaws in ASUS routers that could allow an attacker to compromise the devices and eavesdrop on all of the traffic and data that flows through them. The bugs are specifically found in the RT-AC1900P whole-home Wi-Fi model, within the router’s firmware update functionality. The first issue, tracked as CVE-2020-15498, stems from a lack of certificate checking. The second bug, tracked as CVE-2020-15499, is a cross-site scripting (XSS) vulnerability in the Web Management interface related to firmware updates. ASUS has patched the issues in firmware version 3.0.0.4.385_20253 and has urged the owners to apply the updates as soon as possible.

See the full report here: https://threatpost.com/asus-home-router-bugs-snooping-attacks/157682/

A vigilante is sabotaging the Emotet botnet by replacing malware payloads with GIFs

An unknown vigilante hacker has been sabotaging the operations of the recently-revived Emotet botnet by replacing Emotet payloads with animated GIFs, effectively preventing victims from getting infected. The sabotage started three days ago, on July 21, and has grown from a simple joke to a serious issue impacting a large portion of the Emotet operation. Emotet, considered today's most dangerous malware strain, was recently silent for more than five months and came back to life last week. Since the Emote gangs use open-source scripts and also employ the same password for all of its web shells, its infrastructure can easily be hijacked if anyone can guess the web shell's password.

See the full report here: https://www.zdnet.com/article/a-vigilante-is-sabotaging-the-emotet-botnet-by-replacing-malware-payloads-with-gifs/

Malicious ‘Blur’ Photo App Campaign Discovered on Google Play

A new campaign of malicious photo apps on Google Play floods Android devices with random ads instead of functioning as advertised. Twenty-nine bad mobile apps with a combined 3.5 million downloads bombard users with out-of-context ads. They also evade detection by making its icon disappear from the device home screen soon after it’s downloaded. The researchers called the campaign “ChartreuseBlur,” in part because the majority of apps include the word “blur” in their package name. Many also claim to be photo editors that allow users to blur sections of an image. The apps in the campaign generally have a three-stage payload evolution. In the first two stages, the code appears innocent, but the third phase is where they detected nefarious activity. The apps have been removed from the Google Play store, but users are urged to remove any that have already been installed.

See the full report here: https://threatpost.com/malicious-photo-app-campaign-google-play/157712/

NSA Urgently Warns on Industrial Cyberattacks, Triconex Critical Bug

The U.S. National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have warned that adversaries could target critical infrastructure across the U.S. Corresponding with the alert, ICS-CERT has released an advisory about a handful of bugs in the Schneider Electric Triconex TriStation and Tricon Communication Module. The bugs impact TriStation 1131, v1.0.0 to v4.9.0, v4.10.0, and 4.12.0, operating on Windows NT, Windows XP, or Windows 7 and Tricon Communications Module (TCM) Models 4351, 4352, 4351A/B, and 4352A/B installed in Tricon v10.0 to v10.5.3 systems. One of the critical bug tracked as CVE-2020-7491 is an improper access control issue with a CvSS score of 10. The other four bugs: CVE-2020-7486 and CVE-2020-7484 are the uncontrolled resource consumption flaws with a CvSS score of 7.5, CVE-2020-7485 is a hidden-functionality issue with a severity rating of 5.5, CVE-2020-7483 with a severity rating of 5.3 allows cleartext transmission of sensitive information. The NSA/CISA alert urges patching and mitigations across the civilian and military OT landscape and offered steps to take within the advisory.

See the full report here: https://threatpost.com/nsa-urgent-warning-industrial-cyberattacks-triconex/157723/

US govt confirms active exploitation of F5 BIG-IP RCE flaw - BleepingComputer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published a warning confirming the active exploitation of the unauthenticated remote code execution (RCE) CVE-2020-5902 vulnerability affecting F5 Big-IP ADC devices. CISA has been working with several entities across multiple sectors to investigate potential compromises relating to this vulnerability and has confirmed two compromises during the investigation. The vulnerability is rated critical and impacts BIG-IP application delivery controller (ADC) devices. Exploits related to the vulnerability, are publicly available and can be used to steal data from and execute commands on unpatched devices. CISA's alert also provides additional mitigations and detection measures to help victims find out if their systems may have been compromised and recover after attacks that successfully exploited unpatched F5 devices.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-confirms-active-exploitation-of-f5-big-ip-rce-flaw/

5 severe D-Link router vulnerabilities disclosed, patch now - BleepingComputer

Security researchers at Loginsoft have reported 5 severe vulnerabilities in the D-Link router. The vulnerabilities include reflected Cross-Site Scripting (XSS) attacks, buffer overflows to means of obtaining admin credentials, bypassing authentication altogether, and executing arbitrary code and are tracked as CVE-2020-15892, CVE-2020-15893, CVE-2020-15894, CVE-2020-15895, and CVE-2020-15896. For most configurations, the attacker would need to be present on the same network as the router to access the router's web administration interface. If the remote admin interface is enabled, a remote attacker could request the router's public IP address, bypass authentication, and take-over the device and the network. The advisories also include proof of concept (PoC) exploits. The models DAP-1522 and DIR-816L that have reached their end-of-support phase and the devices running firmware versions v1.42 (and below) and v12.06.B09 (and below) remain vulnerable with no upgrade path. For the D-Link DAP-1520 model running vulnerable firmware versions v1.10B04 and below, the company has released an 'Exceptional Beta Patch Release' firmware version v1.10b04Beta02 that users could upgrade to.

See the full report here: https://www.bleepingcomputer.com/news/security/5-severe-d-link-router-vulnerabilities-disclosed-patch-now/

Hundreds Of Thousands Of Instacart Customers’ Personal Data Is Being Sold Online - BuzzFeed News

Personal information thousands of Instacart customers are being sold on the dark web for around $2 per customer. The personal data of people using Instacart accounts had been added throughout June and July, with the most recent upload being July 22. This data includes names, credit card numbers, and order histories, and appears to have affected customers who used the grocery delivery service recently. However, the company has denied the breach of its data. In cases of identity theft, it is always recommended including changing passwords, using a password manager, and turning on two-factor authentication. People who notice or suspect suspicious financial activity should contact their bank and credit card company.

See the full report here: https://www.buzzfeednews.com/article/janelytvynenko/instacart-customers-info-sold-online

Microsoft Edge now blocks abusive notifications to reduce web spam - BleepingComputer

Microsoft has introduced a new notification request experience called quiet notification requests in its Edge 84 to address webspam mess. Microsoft said that the new feature aims to reduce spam of notification permission requests. This feature can help people who commonly receive ads through web site notifications and have no idea how they are getting them once they unknowingly subscribe to a fishy website. The feature is enabled by default for all users, but users can turn off “Quiet notification requests” from the settings.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-now-blocks-abusive-notifications-to-reduce-web-spam/

Tech unicorn Dave admits to security breach impacting 7.5 million users

Digital banking application, Dave[.]com has disclosed a security breach after a hacker published the details of users on a public forum. According to the company, the security breach originated on the network of a former business partner, Waydev, an analytics platform used by engineering teams. Dave's data is currently offered on a public forum, impacting nearly 7,516,625 users. The exposed data includes names, phone numbers, emails, birth dates, home addresses, and for some users, payment card details and Social Security numbers were also included, but Dave said these details were encrypted. The company said that they had no evidence to suggest that hackers used the data to gain access to user accounts and execute any unauthorized actions.

See the full report here: https://www.zdnet.com/article/tech-unicorn-dave-admits-to-security-breach-impacting-7-5-million-users/

FBI warns US companies about backdoors in Chinese tax software

The US Federal Bureau of Investigation has warned US companies about backdoor malware that is silently being installed on the networks of foreign companies operating in China via government-mandated tax software. These backdoors would allow threat actors to execute unauthorized code, infiltrate networks, and steal proprietary data from branches operating in China. The FBI says that all foreign companies are required by local Chinese laws to install this particular piece of software to handle value-added tax (VAT) payments to the Chinese tax authority. FBI officials said the backdoor malware was spotted in the VAT software of two Chinese tech companies, Baiwang and Aisino. Currently, the FBI warning is being distributed to companies so they can investigate further.

See the full report here: https://www.zdnet.com/article/fbi-warns-us-companies-about-backdoors-in-chinese-tax-software/

FBI warns of new DDoS attack vectors: CoAP, WS-DD, ARMS, and Jenkins - ZDNet

The Federal Bureau of Investigation (FBI) sent an alert last week warning about the discovery of new network protocols that have been abused to launch large-scale distributed denial of service (DDoS) attacks. The alert lists three network protocols – CoAP (Constrained Application Protocol), WS-DD (Web Services Dynamic Discovery), ARMS (Apple Remote Management Service), and a web application – Jenkins web-based automation software as newly discovered DDoS attack vectors. These newly discovered DDoS vectors are network protocols that are essential to the devices used in IoT devices, smartphones, Macs making device manufacturers unlikely to remove or disable. FBI officials believe that these new DDoS threats will continue to be exploited further to cause downtime and damages for the foreseeable future. As of now, these four new DDoS attack vectors have been used sporadically, but industry experts expect them to become widely abused by DDoS-for-hire services.

See the full report here: https://www.zdnet.com/article/fbi-warns-of-new-ddos-attack-vectors-coap-ws-dd-arms-and-jenkins/

Ransomware attack takes out TV ratings - AdNews

A ransomware attack on Nielsen has lead to an unexpected disruption relating to the Australian TV Audience Measurement (TAM) data center environment, for six days. Due to the attack, the ratings for Big Brother’s penultimate episode and season finale which aired last week haven’t been released, as well as Nine’s Australian Ninja Warrior season launch last night. According to the ongoing investigations, Nielsen aims to have the TV Ratings data available by Wednesday, 29 July. As part of the recovery plan, Nielsen’s top priorities are to ensure that the environment is safe and to restore and release the overnight ratings, followed by releasing data for missing days.

See the full report here: https://www.adnews.com.au/news/ransomware-attack-takes-out-tv-ratings

NSDC announces threat to state web resources due to data leak in DarkNet - 112 International

The National Security and Defense Council of Ukraine has declared a data leak from the websites of state resources and critical infrastructure resources, which may threaten their security. The National Cybersecurity Coordination Center under NSDC found in DarkNet a published list of almost 3 million sites that use the Cloudflare service to protect against DDoS and many other cyber attacks. The published list contains real IP-addresses of sites, which creates threats of attacks directed at them, among which, there are 45 entries with the gov.ua domain and more than 6.5 thousand with the ua. domain, in particular, resources, belonging to critical infrastructure facilities. The NSDC has notified the main cybersecurity entities and the owners of all affected resources and has advised them to change the IP addresses of hosting web resources and strengthen the monitoring of cyberattacks on these resources.

See the full report here: https://112.international/politics/nsdc-announces-threat-to-state-web-resources-due-to-data-leak-in-darknet-53374.html

Hackers reportedly demand $10 million ransom from Garmin - Cycling Weekly

Garmin confirmed that they were attacked by the WastedLocker ransomware, which led to a company-wide shutdown including all devices in their data center to try and avoid them being encrypted, which explains the global outage currently being experienced. Garmin issued an apology for the outage and believes that no customer personal data has been affected. Hackers have reportedly demanded a $10 million ransom from Garmin after confirmation the company was the victim of a ransomware attack.

See the full report here: https://www.cyclingweekly.com/news/latest-news/garmin-issue-apology-and-say-no-indication-personal-data-was-stolen-460638

Cerberus Android malware source code offered for sale for $100,000 - BleepingComputer

The authors of the Android Cerberus banking trojan are auctioning the project for a price starting at $50,000, with $100K the deal could be immediately closed. Cerberus, malware-as-a-service, is an Android RAT developed from scratch that doesn’t borrow the code from other malware. The overall project includes the source code of the components (the malicious APK, the admin panel, and C2 code), the installation guide, a collection of scripts for the setup, and a customer list with an active license, along with contacts for customers and potential buyers. According to a post from the seller on a Russian-speaking underground forum, the business is currently generating $10,000 every month. The maintainers of the Cerberus Android Trojan decided to sell the source code because the group split up and they have no time to provide 24/7 support. The malware has been heavily promoted on public channels and is well-known in cybercriminal communities. When the actors behind it started renting it, they claimed it had been used privately for two years.

See the full report here: https://www.bleepingcomputer.com/news/security/cerberus-android-malware-source-code-offered-for-sale-for-100-000/

Windows 10 Desktop Windows Manager crashes due to DirectX bug

Microsoft is working on a new issue causing the Desktop Windows Manager (DWM) to crash on laptops if the lid is repeatedly closed and opened. Desktop Window Manager (DWM) is a desktop composition Windows service introduced by Microsoft with the release of Windows Vista, forcing apps to draw pixels in video memory instead of the primary display device, rendering them to a desktop image that will then be displayed on the screen after applying visual effects and animations. Windows uses DWM as the go-to desktop composition tool to obtain the final desktop image, as well as for enabling high-resolution support and for adding desktop visual effects. This issue affects devices running all Windows 10 versions in scenarios involving displays configured to run at 4K resolution. This problem occurs because of an issue in the Microsoft DirectX Video Memory Management (Dxgmms2.sys) component. This is not a hardware issue. The resolution should be delivered to impacted devices as part of an upcoming Windows 10 release.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-desktop-windows-manager-crashes-due-to-directx-bug/

Office 365 adds new features to help identify malicious spam

Microsoft has announced the addition of spam verdict within Threat Explorer to help users identify if a particular email was Malware, Phish or Spam, and the introduction of Threat Type Filter for All Email View, so that users can directly go to All-Email view and filter out the malicious emails. This will provide more information on spam emails detected as malicious by the Office 365 Advanced Threat Protection (ATP) filtering stack and allow organizations to export their list of the top targeted users by phishing attacks. Additional improvements to the Office 365 ATP Threat Explorer will make it easier for users to gain access to extra details on post-delivery actions following Manual Remediation or Exchange Online zero-hour auto-purge (ZAP). These Office 365 enhancements are scheduled for roll out during Q3 2020 and to make them generally available for all customers with an Advanced Threat Protection plan in standard multi-tenant Office 365 environments.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-adds-new-features-to-help-identify-malicious-spam/

Hackers stole GitHub and GitLab OAuth tokens from Git analytics firm Waydev - ZDNet

Waydev, an analytics platform used by software companies, disclosed a security breach earlier this month and has stated that hackers used a blind SQL injection vulnerability to gain access to its database, from where they stole GitHub and GitLab OAuth tokens. The hackers then used some of these tokens to pivot to other companies' codebases and gain access to their source code projects. Currently, two companies, Dave.com and Flood.io, have reported security breaches and claimed Waydev responsible for the incident. Waydev said they learned of the attack on July 3 and patched the vulnerability exploited by attackers on the same day and also worked with GitHub and GitLab to delist their original apps, revoke all affected OAuth tokens, and create new OAuth apps. Waydev has notified US authorities about the security breach and is investigating the breach further.

See the full report here: https://www.zdnet.com/article/hackers-stole-github-and-gitlab-oauth-tokens-from-git-analytics-firm-waydev/

Promo.com discloses data breach after 22M user records leaked online

An Israeli-based marketing video creation site, Promo.com has disclosed a data breach after a database containing 22 million user records was leaked for free on a hacker forum. The exposed data includes first name, last name, email address, IP address, approximated user location based on the IP address, gender, as well as encrypted, hashed and salted password to the Promo or Slidely account. Following the incident, Promo immediately stopped all suspicious activity, launched an internal investigation, and issued a breach notification. Promo stated that no financial information was exposed. As a precaution, Promo is performing a mandatory reset on all affected accounts the next time they log into Promo.com. -East/Africa

See the full report here: https://www.bleepingcomputer.com/news/security/promocom-discloses-data-breach-after-22m-user-records-leaked-online/

Office 365 phishing baits employees with fake SharePoint alerts

In a new phishing campaign, aimed at stealing user accounts, attackers are making use of bait messages camouflaged as automated SharePoint notifications to target employees using Microsoft Office 365. The phishing emails delivered as part of this campaign are addressed to all employees working at targeted organizations and have until now reached an estimated number of up to 50,000 mailboxes based on stats from email security company Abnormal Security. These phishing emails are embedded with SharePoint themed malicious landing page link, where targets are required to click on a button to download "important documents," a button that will either download a PDF that sends them to another website or that will redirect them to a submission form where they are asked to input their credentials. Upon entering the details, the attackers can gain full control of the targets' Office 365 accounts, with their information to be stolen and used as apart of identity theft and fraud schemes such as Business Email Compromise (BEC).

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-phishing-baits-employees-with-fake-sharepoint-alerts/

Netflix credential phishing hides behind working CAPTCHA - BleepingComputer

A recent wave of phishing attacks aiming to steal payment card info and credentials for Netflix streaming service starts with redirecting to a functioning CAPTCHA page to bypass email security controls. The attack starts with a link in the message that takes to the phishing page. The threat actor used a "failed payment" theme to engage potential victims into the redirect chain leading to the phishing page. However, some security solutions fail to detect the page as a threat because it is hidden behind a functional CAPTCHA challenge-response test. The phishing page impersonates the original Netflix login portal and prompts for username and password and then redirects to another page that asks for a billing address and payment details. The actor is able to steal sensitive information using CAPTCHA as a bait.

See the full report here: https://www.bleepingcomputer.com/news/security/netflix-credential-phishing-hides-behind-working-captcha/

Hacker leaks 386 million user records from 18 companies for free - BleepingComputer

A threat actor is flooding a hacker forum with databases exposing over 386 million user records that they claim were stolen from eighteen companies during data breaches. Since July 21 2020, a seller of data breaches known as ShinyHunters has begun leaking the databases for free on a hacker forum known for selling and sharing stolen data. ShinyHunters has been involved in or responsible for a wide assortment of data breaches this past year, including Wattpad, Dave, Chatbooks, Promo.com, Mathway, HomeChef, and the breach of Microsoft private GitHub repository. Some of the databases released since July 21st are Havenly, Indaba Music, Ivoy, Proctoru, Rewards1, Scentbird, and Vakinha, have not been previously disclosed.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-leaks-386-million-user-records-from-18-companies-for-free/

Business giant Dussmann Group's data leaked after ransomware attack - BleepingComputer

Dresdner Kühlanlagenbau GmbH (DKA), one of the subsidiaries of the Dussmann Group, recently suffered a ransomware attack where their data was stolen. The Dussmann Group is the largest multi-service provider in Germany with subsidiaries focusing on facility management, corporate childcare, nursing and care for the elderly, and business systems solutions, including HVAC, electrical work, and elevators. The Nefilim operators claim to have stolen unencrypted files from the DKA attack before deploying the ransomware. To support their claims, the Nefilim operators have published two archives containing 14 GB worth of stolen files. According to the file lists, these archives contain numerous documents, including Word documents, images, accounting documents, and AutoCAD drawings. DKA has informed clients and employees about the cyber-attack and is investigating the issue further.

See the full report here: https://www.bleepingcomputer.com/news/security/business-giant-dussmann-groups-data-leaked-after-ransomware-attack/

Avon Server Leaks User Info and Administrative Data

Security researchers have discovered an unprotected server belonging to Avon, one of the world’s well-known cosmetic brands, that has exposed more than 7GB of data. The server included more than 19 million records, open and available with no authorization required. Critical details about individuals and administrative data, such as OAuth tokens and administrative user names were exposed. Avon issued a pair of statements indicating that a data breach had occurred and was also remediated as systems were restarted. Avon stated that no financial data was involved in the breach because that data was not stored on the server involved.

See the full report here: https://www.darkreading.com/application-security/avon-server-leaks-user-info-and-administrative-data/d/d-id/1338468

Emotet malware now steals your email attachments to attack contacts - BleepingComputer

The Emotet malware botnet has added an attachment stealer module code to use stolen attachments to increase the authenticity of spam emails used for infecting targets' systems. This new tactic adds to the Emotet gang's leveraging of hijacked email conversation threads where a malicious URL or attachment would be included in new emails attached to existing conversations as a concealment measure. The botnet has been delivering massive amounts of malicious spam emails, camouflaged as payment reports, invoices, employment opportunities, and shipping information, through all its server clusters starting with July 17, after more than five months of inactivity.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-your-email-attachments-to-attack-contacts/

Researchers Warn of High-Severity Dell PowerEdge Server Flaw

Security researchers have disclosed the details of a recently patched, high-severity Dell PowerEdge server flaw, CVE-2020-5366. If exploited, this flaw could allow an attacker to fully take over and control server operations. The vulnerability resides in the Dell EMC iDRAC remote access controller, technology embedded within the latest versions of Dell PowerEdge servers, and impacts Dell EMC iDRAC9 versions prior to 4.20.20.20. To secure Dell servers that use iDRAC, researchers recommended that customers place iDRAC on a separate administration network and don’t connect the controller to the internet. Companies also should isolate the administration network or VLAN (such as with a firewall) and restrict access to the subnet or VLAN to authorized server administrators only.

See the full report here: https://threatpost.com/researchers-warn-of-high-severity-dell-poweredge-server-flaw/157795/

Feature-rich Ensiko malware can encrypt, targets Windows, macOS, Linux - BleepingComputer

Security researchers at Trend Micro have discovered a new feature-rich malware dubbed "Ensiko" that can encrypt files on any system running PHP, making it a high risk for Windows, macOS, and Linux web servers. The malware is a web shell written in PHP and can remotely control a compromised system and run a host of malicious activities. Ensiko has a list of capabilities including a file-encryption component that can be used for ransomware attacks against servers, the symmetric Rijnadel-128 cipher in CBC mode to encrypt the file, and append the.BAK extension to processed files. The Ensiko downloads several tools from Pastebin and stores them in a directory named “tools_ensikology". One of the functions of the malware is called Steganologer, which can identify image files that have code in their metadata (EXIF headers) that are then extracted and executed on the compromised server. Further, the malware lets threat actors run brute-force attacks on FTP, cPanel, and Telnet, thus enabling them extended access.

See the full report here: https://www.bleepingcomputer.com/news/security/feature-rich-ensiko-malware-can-encrypt-targets-windows-macos-linux/

Alcohol delivery service Drizly confirms data breach

Drizly, one of the biggest online alcohol delivery services in the U.S. and Canada has been hit by a data breach and approximately 2.5 million Drizly accounts are believed to have been stolen. The company stated that hackers took customer email addresses, date-of-birth, passwords hashed using the bcrypt algorithm, and in some cases delivery address. The company said that no financial data was taken in the breach and advised its users to change their passwords. However, a listing on a dark web marketplace in February 2020 claims to have hacked Drizly accounts. The data is on sale for $14. Although no sample of data was offered, the listing claims to have valid Drizly credit card numbers and users’ order history.

See the full report here: https://techcrunch.com/?p=2023532

US defense and aerospace sectors targeted in new wave of North Korean attacks

North Korean hackers were targeting the US defense and aerospace sectors with fake job offers in the hopes of infecting employees looking for better opportunities and gaining a foothold on their organizations' networks. According to McAfee researchers, the attack began in late March and lasted throughout May 2020. Tracked under the codename of "Operation North Star," these attacks use spear-phishing emails to entice recipients to open boobytrapped documents containing a possible job offer. However, the efficacy of the campaign is unknown.

See the full report here: https://www.zdnet.com/article/us-defense-and-aerospace-sectors-targeted-in-new-wave-of-north-korean-attacks/

Microsoft to remove all SHA-1 Windows downloads next week - ZDNet

Microsoft announced plans to remove all Windows-related file downloads from the Microsoft Download Center that are cryptographically signed with the Secure Hash Algorithm 1 (SHA-1). The files will be removed on August 3, the company said. Most software companies have recently begun abandoning the SHA-1 algorithm after a team of academics broke the SHA-1 hashing function at a theoretical level in February 2016. Microsoft, since August 2019, no longer uses SHA-1 to sign and authenticate Windows OS updates. Currently, Microsoft is in the process of replacing SHA-1 with SHA-2 across its products. The company yet to confirm the Windows-related files that are being removed from its downloads center on Monday will be replaced with new download links signed with SHA-2.

See the full report here: https://www.zdnet.com/article/microsoft-to-remove-all-sha-1-windows-downloads-next-week/

TrickBot's new Linux malware covertly infects Windows devices - BleepingComputer

TrickBot's Anchor malware platform has been ported to infect Linux devices and compromise further high-impact and high-value targets using covert channels. In late 2019, Researchers reported a new TrickBot framework called Anchor that utilizes DNS to communicate with its command and control servers. Anchor_DNS is now ported to a new Linux backdoor version called 'Anchor_Linux.' In addition to acting as a backdoor that can drop malware on the Linux device and execute it, the malware also contains an embedded Windows TrickBot executable. It can also be used to copy the embedded TrickBot to Windows hosts on the same network using SMB and $IPC. The malware acts as a covert backdoor persistence tool in the UNIX environment, used as a pivot for Windows exploitation as well as used as an unorthodox initial attack vector outside of email phishing. With this evolution of the TrickBot malware, it is increasingly important for Linux systems and IoT devices to have adequate protection and monitoring to detect threats.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbots-new-linux-malware-covertly-infects-windows-devices/

Undetectable Linux Malware Targeting Docker Servers With Exposed APIs

Security researchers at Intezer have uncovered a completely undetectable Linux malware dubbed 'Doki,' that exploits undocumented techniques to stay under the radar and targets publicly accessible Docker servers hosted with popular cloud platforms. An ongoing Ngrok mining botnet campaign scans the Internet for misconfigured Docker API endpoints to take control over them and exploit them to set up malicious containers with crypto miners running on the victims' infrastructure. The malware has been designed to execute commands received from its operators, utilizes the DynDNS service and a unique Domain Generation Algorithm (DGA) based on the Dogecoin cryptocurrency blockchain to find the domain of its C2 in real-time, uses the embedTLS library for cryptographic functions and network communication, and crafts unique URLs with a short lifetime and uses them to download payloads during the attack. Besides this, the attackers have also managed to compromise the host machines by binding newly created containers with the server's root directory, allowing them to access or modify any file on the system. The malware also leverages compromised systems to further scan the network for ports associated with Redis, Docker, SSH, and HTTP. Users and organizations that run Docker instances are advised not to expose docker APIs to the Internet.

See the full report here: https://thehackernews.com/2020/07/docker-linux-malware.html

BootHole GRUB bootloader bug lets hackers hide malware in Linux, Windows - BleepingComputer

A severe vulnerability exists in almost all signed versions of GRUB2 bootloader used by most Linux systems. When exploited, it could allow threat actors to compromise an operating system’s booting process even if the Secure Boot verification mechanism is active. The flaw is named 'BootHole' that permits executing arbitrary code in GRUB bootloader. An attacker could use it to plant malware known as bootkit that loads before the operating system (OS). Security researchers at Eclypsium found a buffer overflow (CVE-2020-10713) that in the way GRUB2 parses content from its configuration file, “grub.cfg,” located externally, in the EFI System partition that could be modified by the threat actors because it is a text file that lacks integrity protections such as a digital signature. Eclypsium has already disclosed the vulnerability with OS vendors, computer makers, and CERTs. Advisories and mitigations are expected to be released today from multiple organizations in the industry.

See the full report here: https://www.bleepingcomputer.com/news/security/boothole-grub-bootloader-bug-lets-hackers-hide-malware-in-linux-windows/

Tags: weekly bulletin, all industries, global