Threat Intelligence Bulletin: 07/31/2020

Breach Disclosure: Chatbooks

The photo print service Chatbooks suffered a data breach in March 2020. According to BleepingComputer, this breach is part of a spree of leaks from a group of hackers that is now selling over 73 million user records from 11 companies. The stolen data included 15 million user records with 2.5 million unique email addresses alongside names, phone numbers, social media profiles and salted SHA-512 password hashes.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

ChatBooks is a photo print service that provides an easy way to create photo books using Instagram and Facebook social media accounts as the source. A hacker group called ShinyHunters on May 3 started advertising ChatBooks user records on Empire market. The breach contained 15 million user records with 2.5 million unique email addresses alongside names, phone numbers, social media profiles and salted SHA-512 password hashes. According to the security breach notification sent to users, the company learned about the intrusion on May 5, 2020. After forensic investigation, it was discovered that the breach occurred on March 26.

Figure 1: Chatbooks data on sale on dark web forums

The leaked information includes:

Email address

Name

Phone number

Social media profile

Salted SHA-512 password hashes

Breach Disclosure : Swvl

An Egypt-based bus operator app, Swvl, suffered a data breach which impacted over 4 million members. According to [PortSwigger] (https://portswigger.net/daily-swig/egyptian-bus-operator-swvl-hit-by-data-breach), the company became aware of unauthorized access to its IT infrastructure on July 3, 2020. All the stolen data is being shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Swvl is a bus-booking application based in Egypt, Kenya, and Pakistan. It suffered a data breach that impacted over 4 million members of the service. The company first detected the incident on July 3, 2020 when they detected unauthorized access to its IT infrastructure. A hacker, identified as ShinyHunters, posted the stolen data for sale on popular dark web forum RaidForums. The compromised data is now being extensively redistributed across multiple dark web forums and marketplaces.

Figure 1: Swvl accounts on sale on RaidForums

The leaked information includes:

Names

Email addresses

Phone numbers

Profile photos

Partial credit card data (type and last 4 digits)

Passwords stored as bcrypt hashes

Breach Disclosure: Havenly

In June 2020, the interior design website Havenly suffered a data breach which impacted almost 1.4 million members of the service. The exposed data included email addresses, names, phone numbers, geographic locations, and passwords stored as SHA-1 hashes, all of which were subsequently shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Since July 21st, a hacker that goes by the name ShinyHunters began leaking databases compromised by the group for free on a popular hacking forum. Havenly was one of the 38 compromised databases that were put up for sale.

Figure 1: Database Leak Post by ShinyHunters

Havenly has acknowledged the breach with an email to customers, however, failed to mention that customers data was compromised in their notification.

Breach Disclosure: Vakinha

The Brazilian fund raising service, Vakinha, suffered a data breach in June 2020, which impacted almost 4.8 million members. According to Bleeping Computer, Vakinha is one of 18 companies whose data was released by a hacker known as "ShinyHunters". Subsequently, the stolen data was shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Vakinha is an online web portal for campaigns that may vary from crowdfunding, birthdays, graduations, weddings, baby showers, and more. A hacker known as Shiny Hunters, posted the stolen data on July 27, 2020 on a popular hacking forum. The breach includes 4.8 million user records.

Figure 1: Vakinha accounts on sale on a hacking forum

The leaked information included in the posting includes email addresses, names, phone numbers, geographic locations, and passwords stored as bcrypt hashes.

Figure 2: Sample Data

Breach Disclosure: TrueFire

The popular guitar tutoring website, TrueFire, experienced a data breach back in February 2020, with around 600,000 users data impacted by this breach. According to Bleeping Computer, TrueFire is one of 18 companies whose data was released by a hacker known as "ShinyHunters". Subsequently, the stolen data was shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

TrueFire has experienced a breach prior to the ShinyHunters one, when back in August 2019 through January 2020 TrueFire was victim to a supposed Magecart style breach.

This new breach impacted around 600,000 accounts back in February, and included names, usernames, email addresses, phone numbers, birthdates, account balances, and unsalted MD5 password hashes.

Figure 1 Breach posting for sale on RaidForums

Breach Disclosure: GGumim.co.kr

The Korean interior decorating site, GGumim.co.kr, reportedly suffered a data breach in March 2020, which impacted almost 2.3 million members. According to Bleeping Computer, GGumim.co.kr is one of 18 companies whose data was released by a hacker known as "ShinyHunters". Subsequently, the stolen data was shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

This breach data became available on July 27, 2020 and was part of the massive upload by ShinyHunters to various hacking forums. This data impacted around 2.3 million members and included names, passwords, phone numbers, 3rd party tokens (Facebook, Google), and various preferences for the site.

Figure 1: Forum posting on RaidForums for the GGumim.co.kr breach

Breach Disclosure: Kreditplus

The Indonesian credit service, Kreditplus, suffered a data breach in July 2020, which impacted almost 896,000 users. According to Bleeping Computer, Kreditplus is one of 18 companies whose data was released by a hacker known as "ShinyHunters". Subsequently, the stolen data was shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Kreditplus experienced a breach with around 896,000 records, which included 769,000 unique email addresses. Included in the breached data for these accounts was email addresses, names, family information, income details, expenses, religion, and employment information. There is a substantial amount of information included in the breach that could be used by attackers to either phish them or be used to gain access to other accounts.

Figure 1: RaidForums posting for Kreditplus breach data

Breach Disclosure: ProctorU

An online exam tool, ProctorU, experienced a data breach back in June 2020, with around 444,000 users data impacted by this breach. According to Bleeping Computer, ProctorU is one of 18 companies whose data was released by a hacker known as "ShinyHunters". Subsequently, the stolen data was shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

The data included in the breach contained emails, physical addresses, names, phones and bcrypt password hashes. In addition to user data, the breach contained names, addresses, user names and unencrypted passwords for members of the University of Sydney staff.

Many of the universities included in the breach began using ProctorU in the wake of the COVID-19 pandemic, since many schools were forced to use online options for training and administering tests.

Figure 1: ProctorU breach data listing for sale

Breaking News: 2020-07-31 - 2020-08-06

KDE archive tool flaw let hackers take over Linux accounts

A security researcher has discovered a path traversal vulnerability in the default KDE extraction utility called ARK that allows attackers to overwrite files or execute code on victim's computers simply by tricking them into downloading an archive and extracting it. Once a user opens the archive, the attacker can create autostarts that automatically launch programs that could encrypt a user's files with ransomware, install miners, or install backdoors that give remote attackers shell access to a victim's account. The researcher reported this vulnerability to the KDE security team and the bug was quickly fixed in Ark 20.08.0. As ARK is the default extractor in the KDE desktop environment and used in almost all Linux distributions, all users are advised to install the latest update as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/kde-archive-tool-flaw-let-hackers-take-over-linux-accounts/

Office 365 phishing abuses Google Ads to bypass email filters

An Office 365 phishing campaign abused Google Ads to bypass secure email gateways (SEGs), redirecting employees of targeted organizations to phishing landing pages and stealing their Microsoft credentials. The phishing emails were sent to employees of multiple organizations from compromised accounts wherein the potential victims were informed of recent policy changes and were asked to accept the changes to continue services. The accept button, however, redirects the victims to phishing landing pages with the help of a Google Ads redirect. Targets were first sent to a cloned Microsoft privacy policy page and then to the final phishing page that mimics the victims' company-branded Office 365 sign-in pages. Once they entered their credentials and hit the "Next" button, their account information was immediately sent to the phishers and a new page is displayed showing "We’ve updated our terms." message.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-phishing-abuses-google-ads-to-bypass-email-filters/

Kaspersky: New hacker-for-hire mercenary group is targeting European law firms

Researchers at Kaspersky have discovered a new hacker-for-hire mercenary group that appears to have been active for almost a decade. The group, codenamed Deceptikons, has primarily targeted law firms and fintech companies and mainly focused on stealing business and financial secrets, rather than government-related information. The targets are located in Europe, and occasionally some Middle East countries like Israel, Jordan, and Egypt. The group's most recent attacks included a 2019 spear-phishing campaign against a set of European law firms, where the group deployed malicious PowerShell scripts to infect hosts. Researchers observed that most attacks seem to follow a similar pattern, starting with a spear-phishing email that carries a malicious modified LNK (shortcut) file. -East/Africa

See the full report here: https://www.zdnet.com/article/kaspersky-new-hacker-for-hire-mercenary-group-is-targeting-european-law-firms/

Critical Security Flaw in WordPress Plugin Allows RCE

A critical vulnerability in a WordPress plugin called Comments – wpDiscuz could allow unauthenticated attackers to upload arbitrary files (including PHP files) and execute remote code on vulnerable website servers. Comments – wpDiscuz is a plugin that enables WordPress websites to add custom comment forms and fields to sites, and serves as an alternative to services like Disqus. In versions 7.x.x of the plugin, a feature gives users the ability to include image attachments in comments that are uploaded to a website. However, the implementation of this feature lacked security protections vetting file attachments in the comments to make sure they actually are image files, versus another type of file. This lack of verification could allow an unauthenticated user to upload any type of file, including PHP files. If exploited, this vulnerability could allow an attacker to execute commands on your server and traverse your hosting account to further infect any sites hosted in the account with malicious code. Users running any version from 7.0.0 to 7.0.4 of this plugin are recommended to update to the patched version, 7.0.5.

See the full report here: https://threatpost.com/critical-rce-flaw-wordpress-plugin-on-70k-sites/157824/

FBI warns of Netwalker ransomware targeting US government and orgs - BleepingComputer

The FBI has issued a security alert about Netwalker ransomware operators targeting the U.S. and foreign government organizations, advising their victims not to pay the ransom and reporting incidents to their local FBI field offices. According to the FBI, the ransomware operators began targeting the U.S. and foreign government organizations from June 2020. The threat actors also took advantage of the ongoing COVID-19 pandemic in their attacks to compromise victims in March, via phishing emails delivering a Visual Basic Scripting (VBS) loader. Starting with April 2020, Netwalker began exploiting the two vulnerabilities Pulse Secure VPN (CVE-2019-11510) and Telerik UI (CVE-2019-18935) to gain access to their victims' networks. Users are advised to use multi-factor authentication (MFA) with strong passwords and keep all devices and software on their networks up to date.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-netwalker-ransomware-targeting-us-government-and-orgs/

Security Flaws Discovered in OKCupid Dating Service

Researchers at Check Point have discovered multiple vulnerabilities in the mobile app and website for dating service OKCupid that could allow a malicious user to perform actions ranging from stealing users' personal data to performing in-app actions on behalf of those users. The vulnerabilities included off-app access to deep links within the app, cross-site scripting on the main OKCupid website, and malicious JavaScript injection in deep links. The developers have fixed the vulnerabilities.

See the full report here: https://www.darkreading.com/application-security/security-flaws-discovered-in-okcupid-dating-service-/d/d-id/1338484

Vermont Tax Department exposed 3 years worth of tax return info - BleepingComputer

The Vermont Department of Taxes disclosed that taxpayers' private information was exposed because of a security issue affecting its online filing site discovered on July 2, 2020. The data breach affected all Vermonters who electronically filed Property Transfer Tax returns using the tax department's site between February 2017 and July 2020. The stolen credentials could be used to access private information including the social security number of the buyer of the property, and the last four digits of the social security number of the seller of the property. Once it was alerted of the security vulnerability, it immediately disabled functionality that may have allowed unauthorized third parties to get access to others' tax data. Users are advised to review the bank statements and report any suspicious activity.

See the full report here: https://www.bleepingcomputer.com/news/security/vermont-tax-department-exposed-3-years-worth-of-tax-return-info/

Google is making autofill on Chrome for mobile more secure

Google announced a new autofill experience for Chrome on mobile that will use biometric authentication for credit card transactions, and an updated built-in password manager that will make signing into a site a bit more straightforward. Chrome already uses the W3C WebAuthn standard for biometric authentication on Windows and Mac. With this update, this feature is now also coming to Android. Chrome will let you enroll your device to retrieve card numbers via biometric authentication. You'll still need to provide the CVC the first time a card is used; after that, you can use biometrics to confirm a credit card. This feature is optional and can be enabled and disabled in Chrome Settings.

See the full report here: https://techcrunch.com/?p=2025133

Expert discloses details of 3 Tor zero-day flaws … new ones to come

A security researcher has published technical details about two vulnerabilities impacting the Tor network and the Tor browser. The first zero-day vulnerability could be leveraged to detect direct connections to Tor guard nodes that allow users to connect to the Tor Network and the second zero-day can be used to detect indirect connections. These connections are used to create Tor bridges which are a special type of entry point into the network that can be used when direct access to the Tor network is blocked by companies or ISPs. The researcher also plans to reveal at least three more Tor zero-days including one that can be exploited to show the real-world IP addresses of Tor servers. The Tor Project is aware of these issues and is working on the fix.

See the full report here: https://securityaffairs.co/wordpress/106567/hacking/tor-zero-day-flaws.html

QNAP urges users to update Malware Remover after QSnatch alert - BleepingComputer

QNAP urges its users to update the Malware Remover app and bolster their NAS devices' security following a QSnatch malware joint alert published earlier this week by UK's NCSC and the US CISA government cybersecurity agencies. Once it infects a QNAP NAS device, the malware gains persistence by editing cron job and init scripts to block any software updates, and it also prevents the Malware Remover app from running. The joint alert stated that around 62,000 QNAP NAS devices were found to be infected with QSnatch malware worldwide in mid-June 2020, of which 7,600 were found in the US and 3,900 in the UK. All QNAP NAS devices are potentially vulnerable to attacks using QSnatch malware if their software is not up to date. Organizations that are still running a vulnerable version must run a full factory reset on the device prior to completing the firmware upgrade to ensure the device is not left vulnerable.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-urges-users-to-update-malware-remover-after-qsnatch-alert/

Four suspects charged for roles in Twitter hack, Bitcoin scam - BleepingComputer

Four suspects were charged today for their supposed involvement in this month's Twitter hack according to press releases from the Department of Justice and State Attorney Andrew H. Warren. A teenager from Tampa, Florida, the first suspect and the one who orchestrated the hack, was arrested. According to Warren, the teenager gained access to Twitter accounts and internal support tools by compromising a Twitter employee. He then sold access to those accounts and, later, used the Twitter accounts of companies, politicians, executives, and celebrities he took over to run a Bitcoin scam on the social network's platform. Twitter stated that the attackers behind this hack took control of high-profile accounts after stealing Twitter employees' credentials following a phone spear-phishing attack on July 15, 2020. Using credentials of Twitter employees with access to internal support tools, they targeted a total of 130 high-profile accounts, tweeting Bitcoin scam messages from 45 of them, accessing the direct messages of 36 (including the inbox of Dutch Member of House of Representatives Geert Wilders), and eventually downloading the Twitter Data for 7 accounts. & Fraud

See the full report here: https://www.bleepingcomputer.com/news/security/four-suspects-charged-for-roles-in-twitter-hack-bitcoin-scam/

4 Unpatched Bugs Plague Grandstream ATAs for VoIP Users

Multiple high-severity vulnerabilities in the Grandstream HT800 series of Analog Telephone Adaptors (ATAs) threaten home office and midrange users alike, with outages, eavesdropping and device takeover. The HT800 series of ATAs is mainly designed for everyone from home or small-office users to medium-sized businesses, looking to connect their analog telephone devices to a VoIP network, unified communications system or other IP-based communications infrastructure. The bugs are tracked as CVE-2020-5760, CVE-2020-5761, CVE-2020-5762 and CVE-2020-5763. Grandstream HT800 series current firmware version 1.0.17.5 and below is vulnerable to all four bugs. The company is yet to release a fix to mitigate these vulnerabilities.

See the full report here: https://threatpost.com/4-unpatched-bugs-grandstream-atas-voip/157927/

Bypassing Windows 10 UAC with mock folders and DLL hijacking - BleepingComputer

A new technique uses a simplified process of DLL hijacking and mock directories to bypass Windows 10's UAC security feature and run elevated commands without alerting a user. Windows UAC is a protection mechanism introduced in Windows Vista and above, which asks the user to confirm if they wish to run a high-risk application before it is executed. The inbuilt “exceptions” within the UAC framework allows trusted system DLLs located under C:\Windows\System32\ to “auto elevate” to higher privileges without displaying a UAC prompt. A researcher found 300 Windows executables were vulnerable to DLL hijacking that allows attackers to bypass the UAC security feature. Users are advised to set UAC to "Always Notify", to prevent such attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/bypassing-windows-10-uac-with-mock-folders-and-dll-hijacking/

IndieFlix streaming service leaves thousands of confidential agreements, filmmaker SSNs, videos exposed on public server

Security researchers at CyberNews discovered an unsecured data bucket on a publicly accessible Amazon Simple Storage (S3) server containing confidential data belonging to IndieFlix, a US-based entertainment company offering a subscription-based online video streaming service. The unsecured data bucket contained over 90,000 files related to the IndieFlix streaming service that included scans of confidential motion picture acquisition agreements, tax ID requests that include filmmaker social security numbers and employer identification numbers, as well as the relatively detailed contact information of thousands of film professionals. Additionally, the bucket hosts thousands of video files of short films, movie clips, and trailers that can be accessed and downloaded by anyone with a direct link to the files. CyberNews reported the incident to IndieFlix and Amazon Web Services. Following which the bucket has been secured and is no longer accessible.

See the full report here: https://securityaffairs.co/wordpress/106590/data-breach/indieflix-streaming-data-leak.html

Updates provided by Red Hat for BootHole cause systems to hang

This week, firmware security company Eclypsium reported that billions of Windows and Linux devices are affected by a serious GRUB2 bootloader issue (CVE-2020-10713), dubbed BootHole, that can be exploited to install a stealthy malware. The BootHole flaw affects any operating system that uses GRUB2 with Secure Boot. Immediately after the disclosure of the issue, Red Hat confirmed that the BootHole impacts Enterprise Linux 7 and 8, Atomic Host, and the OpenShift Container Platform 4 and recommended users to update their grub2, kernel, fwupdate, fwupd, shim, and dbxtool packages. Unfortunately, after updating the packages, users reported that their systems failed to boot. Now, Red Hat has updated its advisory recommending users to avoid updating the grub2, fwupd, fwupdate, or shim packages until new packages are available. The company stated that it has identified the cause of the problem and is working on a fix.

See the full report here: https://securityaffairs.co/wordpress/106601/security/red-hat-boothole-fix-problems.html

Cisco fixes critical flaws in data center and SD-WAN solutions

Cisco has released a new batch of critical security updates to address critical flaws in Cisco Data Center Network Manager (DCMN) and the Cisco SD-WAN Solution software. Among the addressed flaws, the most critical flaws include CVE-2020-3382, CVE-2020-3375, and CVE-2020-3374. CVE-2020-3382 is an authentication bypass vulnerability in Cisco Data Center Network Manager software, that could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. CVE-2020-3375 and CVE-2020-3374 are critical vulnerabilities in Cisco SD-WAN Solution software and Cisco SD-WAN vManage software, which could allow attackers to access sensitive information, modify the system configuration, or impact the availability of the affected system by causing a buffer overflow or by sending crafted HTTP requests. Cisco has fixed the flaws and urges admins to implement the security updates as soon as possible.

See the full report here: https://www.helpnetsecurity.com/2020/07/31/cisco-fixes-critical-flaws-in-data-center-and-sd-wan-solutions/

Canadian MSP discloses data breach, failed ransomware attack - BleepingComputer

Pivot Technology Solutions, a Canadian managed service provider, disclosed that it fell victim to a ransomware attack that resulted in sensitive information being accessed by the hackers. According to the company, the incident occurred in June and impacted data held by the parent company and its subsidiaries and/or former and current affiliates. Threat actors were not able to complete the attack and encrypt files on the company systems. However, they did access sensitive information and also stole some of it. Pivot's investigations have revealed that the intruders had access to and exfiltrated limited personal information of US employees and consultants including, names, addresses, dates of birth, gender, disability status, and type of insurance coverage. The attackers were also pulled payroll data, banking details, social security numbers, and related information. Pivot has notified the impacted parties and is offering them free monitoring solutions.

See the full report here: https://www.bleepingcomputer.com/news/security/canadian-msp-discloses-data-breach-failed-ransomware-attack/

CWT Travel Agency Faces $4.5M Ransom in Cyberattack, Report

CWT, a popular travel management company, has confirmed that they were hit in an unknown ransomware attack. As a precautionary measure, the company temporarily shut down its systems. An independent malware hunter who analyzed the malware sample used against CWT said that the ransomware in question could be Ragnar Locker. According to the ransom note, the hackers claim to have downloaded 2TB of the firm’s data, including billing info, insurance cases, financial reports, business audits, banking accounts, and other information about CWT's clients and have demanded a ransom of about $4.5 million. However, the company said that the investigation is ongoing and there are no indications that PII/customer and traveler information has been affected.

See the full report here: https://threatpost.com/cwt-travel-agency-ransom-cyberattack-report/157911/

GandCrab ransomware distributor arrested in Belarus - ZDNet

The Minister of Internal Affairs of Belarus has announced that an affiliate for the GandCrab ransomware operation was arrested recently in Belarus. The 31-year-old man is on charges of distributing the GandCrab ransomware, after allegedly renting access to a web panel where he tweaked settings to obtain a custom version of the GandCrab ransomware, which he would later send out as boobytrapped files to other internet users using email spam. Victims who opened the files would get infected and have their files encrypted, needing to pay a ransom fee to obtain a decryption app and recover their files. According to the officials, the suspect infected more than 1,000 computers with GandCrab and demanded around $1,200 paid in Bitcoin., from each victim.

See the full report here: https://www.zdnet.com/article/gandcrab-ransomware-distributor-arrested-in-belarus/

OkCupid Dating App Flaws Could've Let Hackers Read Your Private Messages - Internet

Cybersecurity researchers have disclosed several security flaws in popular online dating platform, OkCupid's Android and web applications that could allow the theft of users' authentication tokens, users IDs, and other sensitive information such as email addresses, preferences, sexual orientation, and other private data. The flaws were identified as part of reverse engineering of OkCupid's Android app version 40.3.1, which was released on April 29 earlier this year. According to Check Point, OkCupid's use of deep links could enable a bad actor to send a custom link defined in the app's manifest file to open a browser window with JavaScript enabled. The researchers also uncovered a separate flaw in OkCupid's settings functionality that makes it vulnerable to an XSS attack by injecting malicious JavaScript code. OKCupid has fixed the issues, stating that not a single user was impacted by these potential vulnerabilities.

See the full report here: https://thehackernews.com/2020/07/hacking-okcupid-account.html

Microsoft says it will continue discussions to buy TikTok's operations in the U.S. - ZDNet

On Sunday, August 2, Microsoft acknowledged publicly and officially that Microsoft is in discussions regarding purchasing the U.S. operations of the TikTok video platform. According to the blog post, the tech giant plans to continue discussions with TikTok's parent company, ByteDance, and will complete the discussions no later than September 15, 2020. It would ensure to add world-class security, privacy, and digital safety protections and all private data from TikTok's U.S. users will be transferred to and remain in the U.S. The data, if any, is currently stored or backed up outside the U.S., will be deleted from servers outside the country after it is transferred. -political

See the full report here: https://www.zdnet.com/article/microsoft-says-it-will-continue-discussions-to-buy-tiktoks-operations-in-the-u-s/

Havenly discloses data breach after 1.3M accounts leaked online - BleepingComputer

Havenly, a US-based interior design web site, has officially disclosed data breach after a hacker posted the database containing 1.3 million user records for free on a hacker forum. The company is emailing notifications to users about the incident and performed a mandatory reset of all passwords. The leaked databases contained 1.3 million user records for Havenly[.]com. The data include the user's login name, full name, MD5 hashed password, email address, phone number, zip, and various other data related to the usage of the site. The company stated that they do not store complete credit card information, and only the last four digits may have been exposed. The company is working with external security experts to investigate the incident. Havenly customers are recommended to change your password to a strong and unique one.

See the full report here: https://www.bleepingcomputer.com/news/security/havenly-discloses-data-breach-after-13m-accounts-leaked-online/

Zello resets all user passwords after data breach

The push-to-talk app, Zello, has disclosed a data breach that revealed user's email addresses and hashed passwords after discovering unauthorized activity on their systems. The mobile service company with 140 million users allows first responders, hospitality services, transportation, and family and friends to communicate via their mobile phones using a push-to-talk app. The company discovered unauthorized activity on one of their servers but did not mention the disclosure of customer information. According to the company, Zello Work and Zello for First Responders customers were not affected along with the usernames. Zello advised its users to reset the password on all the accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/zello-resets-all-user-passwords-after-data-breach/

Hackers could have stolen PayPal funds from Meetup users

Security vulnerabilities in popular online meeting service and events website Meetup could have allowed cyber attackers to gain access to the profiles of millions of members. Two high-risk vulnerabilities were discovered by Checkmarx researchers, that’s used to create groups that host local in-person events, allowed attackers to easily take over any Meetup group, access all group functions and assets, and redirect all Meetup financial transactions to their PayPal account. For organizers outside the U.S., the platform offers PayPal support to charge attendees for a paid event. The researchers created proof-of-concept (PoC) code with a payload that increased privileges of a regular user to those of a group administrator and also describes a stored XSS (cross-site scripting) vulnerability that allowed a regular group member to have the same permissions as an organizer. Apart from these two bugs, Checkmarx also found security lapses in Meetup API, although the calculated rating is for medium severity. The company has confirmed the vulnerabilities are fixed.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-could-have-stolen-paypal-funds-from-meetup-users/

FBI Warns on New E-Commerce Fraud

The FBI is warning of a new surge of fraudulent shopping websites that are taking advantage of the rise in online shopping during the coronavirus pandemic. These fake websites are often advertised on social media platforms, take orders for a wide range of products, and then never deliver. According to the FBI's announcement, the fraudulent sites tend to offer prices considerably lower than comparable legitimate sites, require payment by online money transfer, and display content and layout copied from other, more traditional e-commerce sites. The FBI urges individuals or organizations that have been victims to report the activity to the Internet Crime Complaint Center or a local FBI field office. Shoppers are also advised to remain vigilant and verify the legitimacy of the websites before placing the orders.

See the full report here: https://www.darkreading.com/attacks-breaches/fbi-warns-on-new-e-commerce-fraud/d/d-id/1338534

Netgear Won't Patch 45 Router Models Vulnerable to Serious Flaw - Threatpost

Netgear Wi-Fi routers and home gateway models are vulnerable to a high-severity remote code execution flaw which could allow network-adjacent attackers to bypass authentication on vulnerable Netgear routers. This high-severity flaw exists within the httpd service, which listens on TCP port 80 by default and affects 79 Netgear Wi-Fi routers and home gateway models, but Netgear says that 45 of those router models are outside of its security support period. Netgear has rolled out patches for 34 of the vulnerable models. However, Netgear has stated that the remaining 45 products will remain unpatched as they are outside of its support window.

See the full report here: https://threatpost.com/netgear-wont-patch-45-router-models-vulnerable-to-serious-flaw/157977/

Newsletter plugin bugs let hackers inject backdoors on 300K sites

The Newsletter WordPress plugin contains flaws that could allow the hackers to inject backdoors, create rogue admins, and potentially take over their websites. The Newsletter WordPress plugin provides the tools needed to create responsive newsletter and email mail marketing campaigns on WordPress blogs using a visual composer, currently installed on more than 300,000 sites. Security researchers have spotted a reflected Cross-Site Scripting (XSS) flaw and a PHP Object Injection vulnerability, both fully patched by Newsletter's development team with the release of version 6.8.3. Newsletter users are urged to update the plugin to version 6.8.3 as soon as possible to best protect themselves from the attacks designed to add rogue admins or to inject backdoors on their sites.

See the full report here: https://www.bleepingcomputer.com/news/security/newsletter-plugin-bugs-let-hackers-inject-backdoors-on-300k-sites/

UberEats data leaked on the dark web

American online food ordering and delivery platform, UberEats, has been allegedly breached and the stolen data has been published on the dark web. Security researchers have analyzed almost 9 files leaked by the threat actor which contained the details of UberEats delivery drivers, delivery partners, and customers. The leaked files also include login credentials of 579 UberEATS customers and details of nearly 100 delivery drivers. Exposed records include information such as login credentials, full name, contact number, trip details, bank card details, account creation date.

See the full report here: https://securityaffairs.co/wordpress/106770/deep-web/ubereats-data-leaked-dark-web.html

Iranian hacker group becomes first known APT to weaponize DNS-over-HTTPS (DoH)

An Iranian hacking group known as Oilrig has become the first publicly known threat actor to incorporate the DNS-over-HTTPS (DoH) protocol in its attacks. According to a malware analyst at Kaspersky, Oilrig operators, also known as APT34, began using a new utility called DNSExfiltrator as part of their intrusions into hacked networks. DNSExfiltrator is an open-source project available on GitHub that creates covert communication channels by funneling data and hiding it inside non-standard protocols. The DoH protocol is currently an ideal exfiltration channel for two primary reasons. First, it's a new protocol that not all security products are capable of monitoring. Second, it's encrypted by default, while DNS is cleartext.

See the full report here: https://www.zdnet.com/article/iranian-hacker-group-becomes-first-known-apt-to-weaponize-dns-over-https-doh/

Firefox adds protections against redirect tracking

Mozilla has silently added a new feature called Enhanced Tracking Protection (ETP) in Firefox 79 to block invasive user-tracking techniques. This will block a new technique called "redirect tracking." After Firefox, Chrome, Brave, and other browsers have recently included privacy protections inside their code to block user tracking and user fingerprinting scripts. Some ad tech companies use the redirect tracking technique to redirect users (who interact with their ads) to one of their domains, read the cookie file, and then redirect the user to their destination effectively creating their own first-party (tracking) cookies instead of relying on third-party cookies created on other sites. The ETP clears first-party cookies every 24 hours for all known advertisers as a way to prevent redirect tracking. This way, even if advertisers employ redirect tracking, users will have a brand new identity each day, preventing companies from linking previous activity to a unique user profile.

See the full report here: https://www.zdnet.com/article/firefox-adds-protections-against-redirect-tracking/

CISA, DOD, FBI expose new versions of Chinese malware strain named Taidoor - ZDNet

Three agencies of the US government, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (DHS CISA), the Department of Defense's Cyber Command (CyberCom), and the Federal Bureau of Investigations (FBI) have alerted on a new strain of malware called Taidoor, that has been used during recent security breaches by Chinese government hackers. According to the US Cyber Command, the malware has been around and silently deployed on victim networks for at least 12 years, since 2008. The Taidoor malware is usually installed on a victim's systems as a service dynamic link library (DLL). The DLL also contains a loader that decrypts the second file, Remote Access Trojan (RAT). The FBI says Taidoor is normally deployed together with proxy servers to hide the true point of origin of the malware's operator. The Taidoor RAT is then used to allow Chinese hackers to access infected systems and exfiltrate data or deploy other malware. The three agencies have published a joint Malware Analysis Report (MAR) that contains recommended mitigation techniques and suggested response actions.

See the full report here: https://www.zdnet.com/article/cisa-dod-fbi-expose-new-chinese-malware-strain-named-taidoor/

NodeJS module downloaded 7M times lets hackers inject code - BleepingComputer

A Node.js module contains a security flaw known as Prototype Pollution that can enable attackers to perform a denial-of-service (DoS) attack on a server or get full-fledged remote shell access. The vulnerability is tracked as CVE-2020-7699 and exists in the "express-fileupload" npm component, which has been downloaded at least 7.3 million times from npm. The vulnerability can be exploited using the "parseNested" feature provided by express-fileupload. When enabled, the "parseNested" option is responsible for "flattening" the uploaded JSON data into nested objects. Successful exploitation can also enable an attacker to get a shell on the vulnerable system. The flaw impacts only those applications with "parseNested" option enabled are vulnerable to this prototype pollution flaw. Users are advised to update to the patched version 1.1.9 from npm to avoid risks emanating from the vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/nodejs-module-downloaded-7m-times-lets-hackers-inject-code/

Cluster of 295 Chrome extensions caught hijacking Google and Bing search results

Nearly 295 Chrome extensions were caught hijacking and inserting ads inside Google and Bing search results and were installed by more than 80 million Chrome users. According to the researchers at AdGuard, the vast majority of the malicious extensions (245 out of the 295 extensions) were simplistic utilities that had no other function than to apply a custom background for Chrome's "new tab" page. All extensions loaded malicious code from the fly-analytics[.]com domain and then proceeded to quietly inject ads inside Google and Bing search results. Google has started pulling down the extensions and once an extension is removed an from the Chrome Web Store for malicious activity, the extension is also disabled in users' browsers and marked as "malware" in Chrome's Extension section. However, users still have to manually uninstall it from their browsers.

See the full report here: https://www.zdnet.com/article/cluster-of-295-chrome-extensions-caught-hijacking-google-and-bing-search-results/

Hacker leaks passwords for 900+ enterprise VPN servers

Details of more than 900 Pulse Secure VPN enterprise servers have been published on the dark web by a hacker. The exposed list contains IP addresses of Pulse Secure VPN servers, Pulse Secure VPN server firmware version, SSH keys for each server, a list of all local users and their password hashes, admin account details, last VPN logins (including usernames and cleartext passwords), and VPN session cookies. Security researchers believe that all the Pulse Secure VPN servers included in the list were running a firmware version vulnerable to the CVE-2019-11510 vulnerability and the hacker must have scanned the entire internet IPv4 address space for Pulse Secure VPN servers, used an exploit for the CVE-2019-11510 vulnerability to gain access to systems, dump server details (including usernames and passwords), and then collected all the information in one central repository. Organizations are advised to patch their Pulse Secure VPNs and change passwords as soon as possible.

See the full report here: https://www.zdnet.com/article/hacker-leaks-passwords-for-900-enterprise-vpn-servers/

New EtherOops attack takes advantage of faulty Ethernet cables

EtherOops, which can be used to attack devices located inside internal corporate networks. The EtherOops attack is basically a packet-in-packet attack where packets are nested inside each other. The outer shell is a benign packet, while the inner one contains malicious code or commands. The outer packet allows the attack payload to slip by initial network defenses, such as firewalls or other security products, while the inner packet attacks devices inside the network. The technique works only if the targeted network contains faulty Ethernet (networking) cables on the attacker's path to their victim. Faulty cables, either due to imperfect cabling, or malicious interference attacks, will suffer from unwanted electrical interference and flip bits inside the actual packet, slowly destroying the outer shell and leaving the internal payload active. Although it is a theoretical attack scenario and requires special conditions, the attack can be pulled off by determined attackers.

See the full report here: https://www.zdnet.com/article/new-etheroops-attack-takes-advantage-of-faulty-ethernet-cables/

Microsoft Teams Vulnerable to Patch Workaround, Researchers Report

Security researchers have discovered a way to use the Microsoft Teams Updater to download malware and bypass a patch released earlier this year. This method would let an attacker use Microsoft Teams Update[.]exe as a living-off-the-land binary (LOLbin). Living off the land uses known, common tools to download and execute malware from a location of the attackers' choosing. Microsoft issued a fix last year to prevent Teams from being downloaded via HTTP or HTTPS and allowed only download updates via local shares provided by the administrative team. A researcher at SpiderLabs recently found that the fix is incomplete as an attacker could work around the fix by pointing to a remote Server Message Block (SMB) share. To exploit it, an attacker would first need to get the malicious file inside the network in an open shared folder, then access the payload from that share to the victim machine. Microsoft has stated that it is a design issue and it does not plan to issue a patch because many of its customers distribute updates via UNC share. As a workable solution, users can limit inbound and outbound SMB connections.

See the full report here: https://www.darkreading.com/attacks-breaches/microsoft-teams-vulnerable-to-patch-workaround-researchers-report/d/d-id/1338583

Black Hat: How hackers gain root access to SAP enterprise servers through SolMan - ZDNet

Security researchers at Onapsis uncovered the vulnerabilities found in SolMan called the 'technical heart of the SAP landscape' that could allow unauthenticated attackers to compromise every system connected to the platform, including SAP ERP, CRM, HR, and more. SolMan is a centralized application designed to manage IT solutions on-premise, in the cloud, or hybrid environments. The first vulnerability tracked as CVE-2020-6207 was found in SAP Solution Manager (User Experience Monitoring) that does not perform any authentication for a service resulting in a complete compromise of all SMDAgents connected to the Solution Manager. The other vulnerabilities tracked as CVE-2020-6234 and CVE-2020-6236 were found in the SAP Host Agent that could give remote attackers the ability to execute files including malicious payloads as a root user, granting them overall control of SMDAgents connected to SolMan. The bugs were reported to SAP and were fixed.

See the full report here: https://www.zdnet.com/article/black-hat-solman-how-hackers-could-gain-root-access-to-sap-enterprise-servers/

FBI is warning of cyber attacks against Windows 7 systems that reached end-of-life

The Federal Bureau of Investigation (FBI) is warning companies running Windows 7 systems of the greater risk of getting hacked because the Microsoft OS has reached the end of life on January 14. The experts explained that threat actors could exploit multiple known vulnerabilities impacting Windows 7 to compromise the systems. Microsoft still allows its Windows 7 users to upgrade to Windows 10 for free, but sometimes the underlying hardware doesn’t support the free upgrade. According to the FBI, several companies have yet to patch its systems and urged them to apply the upgrade, the agency also provided recommendations.

See the full report here: https://securityaffairs.co/wordpress/106846/security/fbi-warning-windows-7-eof.html

Microsoft adds Windows 10 DNS over HTTPS settings section

Microsoft has announced that Windows 10 customers can now configure DNS over HTTPS (DoH) directly from the Settings app starting with the release of Windows 10 Insider Preview Build 20185 to Windows Insiders in the Dev Channel. DoH allows DNS resolution over encrypted HTTPS connections, while DoT encrypts DNS queries via the Transport Layer Security (TLS) protocol, instead of using plain text DNS lookups. Customers can add any IP address of a currently supported DoH-enabled DNS server and choose the preferred DNS encryption method to have the DNS queries automatically encrypted. The encrypted DNS controls are not yet available by going to individual networks' property pages.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-adds-windows-10-dns-over-https-settings-section/

Twitter for Android vulnerability gave access to direct messages - BleepingComputer

Twitter today announced that it fixed a security vulnerability in Twitter for Android, related to an underlying Android OS security issue affecting OS versions 8 and 9, that could have allowed attackers to gain access to users' private Twitter data including direct messages. According to the company, there is no evidence that Twitter for Android vulnerability was exploited by attackers. Twitter urges all Android users to update Twitter for Android to the latest released version. Further, the company stated that this issue does not impact Twitter for iOS or Twitter[.]com.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-for-android-vulnerability-gave-access-to-direct-messages/

Canon hit by Maze Ransomware attack, 10TB data allegedly stolen - BleepingComputer

Japanese optical and imaging products vendor Canon has suffered a ransomware attack that impacts numerous services, including Canon's email, Microsoft Teams, USA website, and other internal applications. In addition to knocking a long list of Canon websites offline, the attack is said to have resulted in 10 terabytes of data being stolen from Canon servers. Canon reportedly sent out a company-wide alert to inform employees of widespread system issues affecting multiple applications. Bleeping Computer identifies Canon ransom note is from the Maze ransomware. Maze declined to share any further info about the attack including the ransom amount, proof of stolen data, and the number of devices encrypted.

See the full report here: https://www.bleepingcomputer.com/news/security/canon-hit-by-maze-ransomware-attack-10tb-data-allegedly-stolen/

Microsoft fixes 'No Internet' bug in latest Windows 10 Dev build

Microsoft has addressed the known issue, which was causing the "No Internet access" tray indicator to show up in the Windows taskbar on affected devices even though they are connected to the Internet, with the release of Windows 10 Build 20185 for Windows Insiders in the Dev Channel. Microsoft customers have reported encountering this issue after upgrading to Windows 10 2004, with system reboots, router resets, and driver updates not fixing the problem. Regular users will have to resort to other solutions to deal with this problem.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-no-internet-bug-in-latest-windows-10-dev-build/