Threat Intelligence Bulletin: 08/07/2020 - 08/13/2020

Breach Disclosure: Zoosk

The online dating site, Zoosk, was involved in a breach dating back to January of 2020, which was identified later in May of 2020. This breach was carried out by the group named "ShinyHunters", who have been compromising and uploading breached companies data to popular hacking forums for free as of late. Around 24,000,000 accounts were included in this breach.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

The data in the breach contained gender, sexuality, date of birth, height, weight, religion, ethnicity, and political views. Some of the data involved in this breach could be damaging to users of the platform in terms of blackmail, as well as attempts to blackmail the individuals included in the breach.

Figure 1: Zoosk breach data listed by a RaidForums member

While ShinyHunters are the purported hackers responsible for the breach, and the ones who typically upload the breaches to RaidForums among other forums, this one was uploaded by the user "Gameranx" with contents identical to other ShinyHunters posts on RaidForums. In the comments section of this breach, ShinyHunters acknowledge the post and reference how Gameranx was faster than them in posting this to RaidForums.

It is our assessment that ShinyHunters posted this to another hacking forum, where Gameranx then downloaded the contents and uploaded it to RaidForums before ShinyHunters could post there.

FudSender: An Analysis of a Phishing Kit Targeting Facebook Users

ZeroFOX Alpha Team has obtained a phishing kit that is freely available on EvilLeaks Forum. The phishing kit has been available from 30th July 2020 and targets users of popular social media and social networking platform, Facebook.

Phishing is often used to steal user data by masquerading as a trustworthy entity. In this case, the phishing kit uses a fake login page identical to a legitimate Facebook login page to trick the victims. This phishing kit also offers crawler/bot detection to prevent automated tools from scanning the fake page.

Recommendations

• Consider enabling multi-factor authentication for all accounts to prevent potential account takeover
• Always verify the sender of suspicious or unexpected emails and messages
• Never download attachments from unknown senders or suspicious emails
• Consider enabling the compromised credentials rule for relevant entities. If needed, reach out to [email protected] for assistance

Details

Phishing is a low-cost, low barrier to entry form of cyber-attack that aims to obtain sensitive information or data by tricking a victim into believing that they are on a legitimate website. The phishing kit landing page spoofs the legitimate login page of Facebook and prompts the victim to enter credentials.

Figure 1: Landing page of fake phishing kit

Two scripts, login.php and access.php, are loaded upon entering the credentials. The function of the login.php script is to grab the username and password information entered by the victim.

Figure 2: login.php script, used to log victims’ usernames and passwords

The other script, access.php grabs the IP address of the victim and uses it to fetch details such as City, Region, Internet Service provider (ISP), User-Agent, Screen Resolution, etc., from the location intelligence provider site “ipapi[.]co”.

Figure 3: access.php script, used to log victim IP address and its related information

Both of the scripts login.php and access.php are configured in such a way to dump all the collected information from victims into a “logs.txt” file, every time a new victim enters their credentials.

Figure 4: Information dumped into “logs.txt” file

The phishing kit has an extra crawler and bot detection feature that uses "CrawlerDetect", a PHP class created by Mark Beech which can detect 1,000's bots/crawlers/spiders via the user agent and http_from header. "CrawlerDetect" has been used by several phishing kits, including prolific ones such as 16Shop, as well as free kits like this one. It is open-source and available in Mark Beech’s public GitHub repository.

Figure 5: CrawlerDetect used to detect bots/crawlers/spiders

The phishing kit also has two additional scripts badAgents.php and index.php to further prevent bots from accessing the fake web page. The script badAgents.php grabs the IP address from the incoming HTTP/HTTPS requests and fetches its organization details from the location intelligence site “ipapi[.]co”. The organization information, which is typically the owner of the ASN returned by ipapi, is then compared against the list of organization names of security providers.

Figure 6: badAgents.php script, to detect the organization name of phishing detection providers.

The second script index.php uses the hostname, user agent and IP address information already collected by access.php script and compares it against the list of hostnames, user agent and IP address of well-known phishing detection and URL scanner service providers. The phishing kit is designed in such a way that it responds with an “HTTP 404” error if it detects a bots/crawlers/spiders/web scanner.

Figure 7: index.php script, to detect hostnames, user agents, and IP addresses of phishing detection providers.

This kit is available for free on EvilLeaks forum, and their associated Telegram group has 5,242 followers with almost 1,100 views specifically of the Facebook phishing kit. The kit download page remains active at the time of this publication.

Figure 8: Telegram group of EvilLeaks, advertising Facebook kit.

The texts in the screenshot shared by the EvilLeaks group in their Telegram post led us to another website fudsender[.]com, which is the actual source of the phishing kit. FudSender is an illegal shopping site that sells Hacking tools, Malware, and Phishing kits.

Figure 9: FudSender Website Offering Facebook Phishing Kit.

The phishing kits offered by FudSender allow the attackers to spoof trusted brands increasing the chances of someone clicking on a fraudulent link.

Figure 10: Phishing Kits available for sale on FudSender that spoofs popular brands

The Crawler/Bot detection feature makes this phishing kit hard to detect with traditional security scanning technology. The availability of phishing kits makes it easy for cybercriminals, even those with minimal technical skills, to launch phishing campaigns. A phishing kit bundles phishing website resources and tools that need only be installed on a server. Once installed, all the attacker needs to do is send out emails to potential victims.

Conclusion

Phishing is a serious threat and hackers are deploying new tactics to steal information, for extortion, or even conventional fraud. The Facebook phishing kit is freely available and making it accessible to a wide range of would-be attackers, especially given that the group advertising this campaign has a considerable amount of followers. ZeroFOX recommends implementing the recommendations detailed above to reduce your risk of falling victim to these kinds of cyberattacks.

Patch Tuesday 08/11/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Microsoft's Patch Tuesday update for August 2020 contained 120 vulnerabilities in total, with:

• 2 vulnerabilities rated as Critical
• 91 vulnerabilities rated as High
• 27 vulnerabilities rated as Medium

Critical vulnerabilities

The most notable critical-rated vulnerabilities in Microsoft's Patch Tuesday Update are tracked as CVE-2020-1476 and CVE-2020-1472.

CVE-2020-1472

CVE-2020-1472 is an elevation of privilege bug impacting Microsoft’s Netlogon Remote Protocol. According to Microsoft, the vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.

Proof-of-concept to exploit this vulnerability is available. Microsoft is addressing the vulnerability in a phased two-part rollout. The most recent Microsoft update modifies how Netlogon handles the usage of Netlogon secure channels.

CVE-2020-1476

CVE-2020-1476 is an elevation of privilege vulnerability impacting Microsoft .NET Framework. According to Microsoft, the vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server.

The most recent Microsoft security update changes how ASP.NET and .NET handle requests.

Zero-day vulnerabilities

Microsoft has patched two zero-day vulnerabilities tracked as CVE-2020-1464 and CVE-2020-1380, that are being actively exploited in the wild.

CVE-2020-1464

CVE-2020-1464 is a spoofing vulnerability impacting Windows. According to Microsoft, the vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded. While this is being actively exploited in the wild, at this time there are few public details on the vulnerability. The most recent Microsoft update corrects how Windows validates file signatures.

CVE-2020-1380

CVE-2020-1380 is a remote code execution vulnerability impacting Internet Explorer. According to Microsoft, the vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. It could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. Microsoft’s release states that CVE-2020-1380 has been exploited in the wild, though no proof-of-concept code is publicly available. The most recent Microsoft security update modifies how the scripting engine handles objects in memory.

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-1379, CVE-2020-1477, CVE-2020-1492, CVE-2020-1525, CVE-2020-1554. The bugs could allow an adversary to corrupt memory in a way that would allow them to execute code remotely on the victim machine. Any of these vulnerabilities could be triggered if the target opens a specially crafted document or web page. The most recent Microsoft security update corrects how Windows Media Foundation handles objects in memory.

Two other high-rated vulnerabilities are tracked as CVE-2020-1555 and CVE-2020-1337.

CVE-2020-1555

CVE-2020-1555 is a remote code execution vulnerability impacting Microsoft Edge. According to Microsoft, the vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). It could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. The most recent Microsoft security update modifies how the scripting engine handles objects in memory.

CVE-2020-1337

CVE-2020-1337 is an elevation of privilege vulnerability impacting Windows. According to Microsoft, the vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application.

Proof-of-concept to exploit this vulnerability is available. The most recent Microsoft update corrects how the Windows Print Spooler Component writes to the file system.

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Breaking News: 2020-08-07 - 2020-08-13

Firefox gets fix for evil cursor attack

Mozilla has fixed a bug in Firefox that was being abused in the wild by tech support scammers to create artificial mouse cursors and prevent users from easily leaving malicious sites. The bug tracked as CVE-2020-15654, is a classic "evil cursor" attack and works because modern browsers allow site owners to modify how the mouse cursor looks while users are navigating their websites. In evil cursor attacks, malicious websites tamper with cursor settings to modify where the actual cursor is visible on the screen, and where the actual click area is. Firefox 79.0 mitigates this issue.

See the full report here: https://www.zdnet.com/article/firefox-gets-fix-for-evil-cursor-attack/

Netwalker ransomware operators claim to have stolen data from Forsee Power

Netwalker ransomware operators have added a new company to its victim list - Forsee Power, which provides advanced lithium-ion battery systems for any mobility application. Netwalker ransomware operators announced the attack with a message posted on their online blog and shared a few screenshots as proof of the alleged security breach. One of the images shared by the group shows a directory containing folders such as accounts receivable, finance, collection letters, expenses, and employees.

See the full report here: https://securityaffairs.co/wordpress/106833/malware/forsee-power-netwalker-ransomware.html

Hackers abuse lookalike domains and favicons for credit card theft

Hackers are abusing a new technique that combines homoglyph domains with favicons to conduct credit card skimming attacks. Homograph attacks consist of abusing domains with homoglyphs: the characters that look the same to dupe users. Accroding to the resaerchers at Malwarebytes, a threat actor is using this technique on several domain names to load the popular Inter skimming kit inside of a favicon file. In one such instance, a .ico file was found to be associated with the cigarpaqe[.]com domain created by the attackers to mimic the real cigarpage.com. It turns out, the legitimate cigarpage.com website was hacked, and the attackers tactfully replaced its real website icon with the fake cigarpaqe[.]com's one. The illicit icon being loaded from the homoglyph domain has JavaScript appended to it. When this script loads along with the site's icon, sensitive information, including credit card numbers, can be exfiltrated to the attackers.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-abuse-lookalike-domains-and-favicons-for-credit-card-theft/

KrØØk attack variants impact Qualcomm, MediaTek Wi-Fi chips

KrØØk (formally CVE-2019-15126) is a vulnerability in Broadcom and Cypress Wi-Fi chips that allows unauthorized decryption of some WPA2-encrypted traffic. Qualcomm and MediaTek Wi-Fi chips were also found to have been impacted by new variants of the KrØØk information disclosure vulnerability, discovered by ESET researchers. The new vulnerability, tracked CVE-2020-3702, is triggerable by disassociation and led to undesirable disclosure of data by transmitting unencrypted data in the place of encrypted data frames. The number of Wi-Fi-enabled devices exposed to KrØØk attacks exceeded one billion according to ESET. Qualcomm released a fix for the proprietary driver affected by the newly discovered KrØØk attack in July, and MediaTek fixed the flaw during March and April 2020. A security update that fixed the bug impacting the MT3620 microcontroller was released later, in July, with Azure Sphere OS version 20.07.

See the full report here: https://www.bleepingcomputer.com/news/security/kr-k-attack-variants-impact-qualcomm-mediatek-wi-fi-chips/

Nearly 50% of all smartphones affected by Qualcomm Snapdragon bugs

Check Point researchers found several security vulnerabilities in Qualcomm’s Snapdragon chip Digital Signal Processor (DSP) chip, allowing attackers to take control of smartphones, spy on users, and create un-removable malware capable of evading detection. DSPs are system-on-chip units are used for the audio signal and digital image processing, and telecommunications, in consumer electronics including TVs and mobile devices. Apple's iPhone smartphone line is not affected by these security issues. Qualcomm has patched six security flaws, mobile vendors still have to implement and deliver security fixes to their devices.

See the full report here: https://www.bleepingcomputer.com/news/security/nearly-50-percent-of-all-smartphones-affected-by-qualcomm-snapdragon-bugs/

Unpatched bug in Windows print spooler lets malware run as admin

Researchers found a way to bypass a patch Microsoft released to address a bug in the Windows printing services, which gives attackers a path to executing malicious code with elevated privileges. Tracked as CVE-2020-1048, the initial flaw received an initial fix in May and another one is coming with this month’s rollout of security updates from Microsoft. The vulnerability affects Windows Print Spooler, the service that manages the printing process. Technical details for the new bug are still private but will be published after the release of the patch, along with a proof-of-concept. The researchers will present the findings on the Black Hat USA security conference.

See the full report here: https://www.bleepingcomputer.com/news/security/unpatched-bug-in-windows-print-spooler-lets-malware-run-as-admin/

BEC Campaigns Target Financial Execs via Office 365

The attackers, dubbed Water Nue, have been targeting executives of more than 1,000 companies, most recently in the US and Canada through a series of business email compromise (BEC) campaigns. The ongoing BEC campaigns target office 365 accounts of business executives since March 2020 who they spear-phish to steal credentials to conduct further fraud. The phishing emails redirect victims to fake Office 365 login pages and thereby harvest credentials to send emails to the executives' subordinates containing invoices with altered banking info to steal funds via transfer requests. The attackers use basic phishing tools and do not involve backdoors or Trojans. They rely on public cloud services to obfuscate operations by hosting infrastructure in the services. & Fraud

See the full report here: https://www.darkreading.com/bec-campaigns-target-financial-execs-via-office-365/d/d-id/1338611

TeamViewer fixes bug that lets attackers access your PC - BleepingComputer

Popular remote access and troubleshooting app, TeamViewer has patched a vulnerability that could let attackers quietly establish a connection to your computer and further exploit the system. When successfully exploited, this bug would let an unauthenticated, remote actor execute code on your Windows PC, or obtain password hashes. The vulnerability has been tracked as CVE-2020-13699. The company confirmed the bug existed in multiple TeamViewer versions running on Windows and released a patch.

See the full report here: https://www.bleepingcomputer.com/news/security/teamviewer-fixes-bug-that-lets-attackers-access-your-pc/

CCleaner fixes bug that wipes Firefox extension settings - BleepingComputer

Piriform released CCleaner 5.70 to address a bug that was causing the app to wipe settings for Firefox extensions installed after upgrading to Firefox 79 when cleaning the web browser's Internet cache. This issue was caused by a change made by Mozilla in the way Firefox 79 stores extensions' data within the storage.sync area used to sync data to all devices signed in to the same Firefox Account. Once migrated, the extension data will be moved to be stored locally in a new storage-sync2.sqlite file saved in the user's profile folder. CCleaner does not recognize the two new companion files and deletes them, which causes your extension settings to be lost. CCleaner was notified of this bug and it released CCleaner v5.70.7909 on the same day to fix the issue for all Firefox 79 users.

See the full report here: https://www.bleepingcomputer.com/news/software/ccleaner-fixes-bug-that-wipes-firefox-extension-settings/

FBI: Iranian hackers trying to exploit critical F5 BIG-IP flaw - BleepingComputer

The Federal Bureau of Investigation (FBI) has warned organizations on Iranian hackers, who are actively attempting to exploit an unauthenticated remote code execution flaw affecting F5 Big-IP application delivery controller (ADC) devices used by Fortune 500 firms, government agencies, and banks. The FBI says that after compromising an organization's network, the Iranian state-backed threat actors may collect and steal sensitive information that could get into the hands of other hackers or the Government of Iran. F5 Networks (F5) has patched the critical vulnerability, tracked as CVE-2020-5902, on July 3, 2020, and according to its security advisory, any remaining unpatched devices are most likely already compromised, IT admins are advised to use F5's CVE-2020-5902 IoC Detection Tool to scan for IOCs within their organization's environment.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-iranian-hackers-trying-to-exploit-critical-f5-big-ip-flaw/

Bugs in HDL Automation expose IoT devices to remote hijacking - BleepingComputer

Multiple vulnerabilities have been found by a security researcher in the HDL automation system that could have allowed the attackers to fully compromise the IoT devices. The researcher noticed that registering a new account on the mobile app of the HDL automation system, automatically generates another account for applying the settings, which allows defining a new password for the “debug” account while the one for the user remains the same. An attacker could register the email address for the “debug” username to receive the instructions for changing the password. Once the procedure completes, the attacker can control the components (lights, temperature, cameras, various sensors) in the HDL automated environment as well as configure them. The company has fixed the issues.

See the full report here: https://www.bleepingcomputer.com/news/security/bugs-in-hdl-automation-expose-iot-devices-to-remote-hijacking/

Fake security advisory used in clever cPanel phishing attack - BleepingComputer

Starting last Wednesday, cPanel and WebHost Manager (WHM) users began reporting a targeted phishing email campaign with an email subject of "cPanel Urgent Update Request" that was pretending to be a security advisory from the company, which states that updates had been released to fix "security concerns" in cPanel and WHM software versions 88.0.3+, 86.0.21+, and 78.0.49+ and recommends all users install the updates. cPanel is an administrative software installed on shared web hosting services. If the target of this phishing email falls for the scam and clicks on the 'Update your cPanel & WHM installations', they are redirected to a phishing website that prompts a user to log in with their cPanel credentials, with an intent to steal them. Targets of this scam are suggested to immediately log in to their web hosting provider and change the password on your account.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-security-advisory-used-in-clever-cpanel-phishing-attack/

Cryptocurrency 'fraud' sues T-Mobile for letting him get hacked - New York Post

Reggie Middleton, the acting chief executive officer of a crypto company, Veritaseum, has accused the telecommunications provider, T-Mobile, for allegedly enabling the theft of $8.7 million worth of crypto in a series of SIM-swap attacks. In July 2017, the hackers allegedly targeted Middleton’s cryptocurrency account via his T-Mobile account. The accounts contained $8.7 million in cryptocurrency, which the hackers transferred to accounts owned and controlled by them. Middleton claimed that T-Mobile has repeatedly failed to prevent these SIM swaps and protect his information, while the company has continued to provide hackers with unauthorized access to Middleton’s account and personal information. He has sought a declaratory judgment in their favor, an award for damages, an award for costs and fees, prejudgment interest, and other relief as determined by the court. T-Mobile has declined to comment on the litigation.

See the full report here: https://nypost.com/2020/08/08/cryptocurrency-fraud-reginald-middleton-sues-t-mobile-for-phone-hack/

Windows security bug could let hackers hijack your printer - TechRadar

Security researchers warn Windows users of a recently patched security bug tracked as CVE-2020-1048 after they were able to bypass recent patches to exploit the flaw that could allow hackers to take over a private network after hijacking individual printing devices. The flaw affects Windows Print Spooler, the service that manages the printing process, giving third-parties admin privileges that could be exploited to run malware. The researchers could take advantage of CVE-2020-1048 by crafting malicious files that are parsed by Windows Print Spooler, including .SHD (Shadow) files that contain metadata for print jobs such as the ID of the system user, and SPL (Spool) files that contain the data that is due to be printed. Users are advised to avoid downloading any initial Microsoft patches for CVE-2020-1048 as Microsoft has stated that it will fix the flaw in its upcoming security update.

See the full report here: https://www.techradar.com/news/windows-security-bug-could-let-hackers-hijack-your-printer

ProctorU confirms data breach after database leaked online

ProctorU, an online exam proctoring solution, has confirmed a data breach after a threat actor published a stolen database of user records for nearly 444,000 registered individuals on a hacker forum. The database samples posted by the threat actor contains email addresses, full names, addresses, phone numbers, hashed passwords, the affiliated organization, and other information. Some of the university and college email addresses contained in this database include North Virginia Community College, UCLA, Princeton, University of Texas, Harvard, Yale, Syracuse University, Columbia, UC Davis, and many more. The database also contains emails for members of the U.S. military. ProctorU stated that the exposed records were from 2014 and are investigating the incident further.

See the full report here: https://www.bleepingcomputer.com/news/security/proctoru-confirms-data-breach-after-database-leaked-online/

Chinese hackers targeting US election infrastructure, White House adviser warns - New York Post

U.S. National Security Adviser Robert O’Brien claimed on Sunday that Chinese hackers have been targeting U.S. election infrastructure ahead of the 2020 presidential election. He said that the hackers have engaged in cyberattacks and targeted U.S. government websites but did not specify what damage the cyberattacks had caused. His comments on CBS New's Face the Nation come in the wake of a U.S. counterintelligence assessment that China preferred President Donald Trump to lose his re-election bid. China has denied the U.S. government claims of hacking U.S. companies, politicians, or government agencies. -political

See the full report here: https://nypost.com/2020/08/09/chinese-hackers-threaten-us-election-infrastructure-wh-adviser/

Spying on satellite internet comms with a $300 listening station

Satellite internet communications are susceptible to eavesdropping and signal interception. Attackers could use a basic home-television gear to spy on the internet traffic for high-value targets, according to researchers from Oxford University. The researchers explained that an attacker could spy on specific satellites, whose locations are public, by pointing them with basic home-television consumer equipment, and could use software like EPS Pro to discover internet feeds. Once the attacker has identified a satellite internet connection he can record it and then parse it for valuable information. Attackers could also collect information even when the traffic is encrypted. The analysis of DNS could reveal the user’s Internet browsing history while the analysis of TLS certificates could allow fingerprinting the servers the user connected. The FBI is monitoring the potential for cyber threat actors to target maritime and aerospace critical infrastructure.

See the full report here: https://securityaffairs.co/wordpress/106952/breaking-news/satellite-internet-comms-eavesdropping.html

FBI says an Iranian hacking group is attacking F5 networking devices

A group of elite hackers associated with the Iranian government has been detected attacking the US private and government sector, according to a security alert sent by the FBI last week. The group is tracked as Fox Kitten, aka Parasite, provide an initial beachead to other Iranian hacking groups such as APT33 (Shamoon), Oilrig (APT34), or Chafer. They primarily operate by attacking high-end and expensive network equipment using exploits for recently disclosed vulnerabilities, before companies had enough time to patch devices. Due to the nature of the devices they attack, targets primarily include large private corporations and government networks. Once they gain access to a device, they install a web shell or backdoor, transforming the equipment into a gateway into the hacked network. Fox Kitten also upgraded its attack arsenal to include an exploit for CVE-2020-5902. FBI officials also warn that this group isn't targeting any particular sector, and any company running a BIG-IP device is likely to be targeted. US companies are asked to patch their on-premise BIG-IP devices to prevent successful intrusions and to deploy countermeasures and detection rules.

See the full report here: https://www.zdnet.com/article/fbi-says-an-iranian-hacking-group-is-attacking-f5-networking-devices/

Office 365 will let you manage phishing simulation emails

Microsoft is adding support for allowing emails containing malicious URLs or attachments to reach the mailboxes of end-users to make it easier to run phishing training sessions or simulations. Office 365 Advanced Threat Protection (ATP) also provides users with an Attack Simulator tool allowing global or security admins to run spear phishing, password spray, and brute force (dictionary) attacks within their organizations. Microsoft plans to roll out the Tenant Allow/Block list portal during Q3 2020 and to make it generally available to all customers with an APT plan in all Office 365 environments.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-will-let-you-manage-phishing-simulation-emails/

vBulletin fixes ridiculously easy to exploit zero-day RCE bug

A security researcher has disclosed a new zero-day vBulletin exploit that bypasses the patch issued in 2019 for CVE-2019-16759 vulnerability. This exploit is easy to use and allows anyone to remotely execute commands using a single one-line command that sends a POST request to a vBulletin server. The company has released a patch that disables the PHP module in vBulletin to mitigate the vulnerability. Sites running older versions of vBulletin need to be upgraded to vBulletin 5.6.2 as soon as possible. vBulletin states that this module will be removed entirely in version 5.6.4.

See the full report here: https://www.bleepingcomputer.com/news/security/vbulletin-fixes-ridiculously-easy-to-exploit-zero-day-rce-bug/

Avaddon ransomware launches data leak site to extort victims - BleepingComputer

Avaddon ransomware has launched a data leak site to publish the stolen data of victims who do not pay their ransom demand. These shaming sites are designed to scare victims into paying the ransomware under threat that their files will be leaked to the public. If publicly released, this data could expose financial information, personal information of employees, and client data, which leads to a data breach. Currently, there is only one entry on their site, where a leak 3.5MB of documents stolen from a construction company has been published.

See the full report here: https://www.bleepingcomputer.com/news/security/avaddon-ransomware-launches-data-leak-site-to-extort-victims/

Google Chrome Browser Bug Exposes Billions of Users to Data Theft

Google’s Chromium-based browsers contain a security flaw that could allow attackers to bypass the Content Security Policy (CSP) on websites to steal data and execute rogue code. Tracked as CVE-2020-6519, the bug is found in Chrome, Opera and Edge, on Windows, Mac, and Android, potentially affecting billions of web users. Chrome versions 73 through 83 are affected. To exploit this vulnerability, an attacker first needs to gain access to the webserver to be able to modify the JavaScript code it uses. The attacker could then add a frame-src or child-src directive in the JavaScript to allow the injected code to load and execute it, bypassing the CSP enforcement and thus bypassing the site’s policy. Google has patched the issue and users are advised to update their browsers to the latest versions to avoid falling victim to an exploit.

See the full report here: https://threatpost.com/google-chrome-bug-data-theft/158217/

Upgraded Agent Tesla malware steals passwords from browsers, VPNs

Agent Tesla remote access Trojan's new variants are upgraded with modules to steal credentials from applications, including popular web browsers, VPN software, as well as FTP and email clients. According to security researchers, the malware can extract credentials from the registry as well as related configuration or support files. Google Chrome, Chromium, Safari, Brave, FileZilla, Mozilla Firefox, Mozilla Thunderbird, OpenVPN, and Outlook are a few samples of the apps targeted by the latest Agent Tesla RAT variants. Once Agent Tesla harvests credentials and app config data, it will deliver it to its command-and-control (C2) server via FTP or STMP using credentials bundled within its internal configuration. Researchers also noted that the current variants will often drop or retrieve secondary executables to inject into, or they will attempt to inject into known (and vulnerable) binaries already present on targeted hosts.

See the full report here: https://www.bleepingcomputer.com/news/security/upgraded-agent-tesla-malware-steals-passwords-from-browsers-vpns/

Michigan State University discloses credit card theft incident

Michigan State University (MSU) has disclosed the data breach of its online store shop[.]msu[.]edu. The exposed information included names, addresses, and credit card numbers of about 2,600 customers. The University stated that no Social Security numbers were stolen. The attackers were able to inject malicious scripts designed to harvest and exfiltrate customers' payment cards after exploiting a vulnerability between October 19, 2019, and June 26, 2020. MSU is notifying the potentially affected customers of the data breach and is offering all of them free identity protection and credit monitoring. The University's' security team has addressed the site vulnerability and is currently working with law enforcement as part of an ongoing investigation.

See the full report here: https://www.bleepingcomputer.com/news/security/michigan-state-university-discloses-credit-card-theft-incident/

Flaws in ‘Find My Mobile’ exposed Samsung phones to hack

A security researcher at Char49 has discovered multiple vulnerabilities in Samsung’s Find My Mobile that could have been chained to perform various malicious activities on Samsung Galaxy Phones. The Find My Mobile feature allows owners of Samsung devices to find their lost phones, it also allows them to remotely lock a device, block access to Samsung Pay, and completely wipe the content of the device. The four vulnerabilities found in Find My Mobile components could have been exploited by a rogue app installed on the device that requires access to the device’s SD card. The access allows the app to trigger the first vulnerability in the attack chain, then create a file used by the attacker to intercept communications with backend servers. The successful exploitation of the flaw would have allowed a malicious app to perform the same actions allowed by the Find My Mobile app, including force a factory reset, wipe data, locate the device, access to phone calls and messages, and lock and unlock the phone. The exploit chain works on unpatched Samsung Galaxy S7, S8, and S9+ devices. Samsung addressed them in October 2019.

See the full report here: https://securityaffairs.co/wordpress/107010/breaking-news/samsung-find-my-mobile-flaws.html

Microsoft August 2020 Patch Tuesday fixes 120 vulnerabilities, two zero-days

Microsoft has rolled out the August 2020 Patch Tuesday security updates. The company has patched 120 vulnerabilities across 13 different products, from Edge to Windows, and from SQL Server to the .NET Framework. Of these vulnerabilities, 17 are classified as critical and 103 as important. According to Microsoft, two of the vulnerabilities are actively being used in attacks. Tracked as CVE-2020-1464, allows attackers to spoof other companies when digitally signing an executable, and CVE-2020-1380, a remote code execution vulnerability in Internet Explorer. Users are recommended to install security updates as soon as possible.

See the full report here: https://www.zdnet.com/article/microsoft-august-2020-patch-tuesday-fixes-120-vulnerabilities-two-zero-days/

SAP updates security note for critical RECON vulnerability

SAP released its security patches for August, alerting of new critical and high-severity vulnerabilities in several of its products, mostly NetWeaver Application Server (AS). SAP has also updated its security note for the maximum severity RECON vulnerability with a related bug that could enable an unauthenticated attacker to access various folders in the directory structure. Tracked as CVE-2020-6286, affects the LM configuration wizard in SAP NetWeaver AS Java. It stems from insufficient input path validation of a specific parameter in the web service of the product. Users are recommended to apply the patch at the earliest.

See the full report here: https://www.bleepingcomputer.com/news/security/sap-updates-security-note-for-critical-recon-vulnerability/

Adobe fixes critical code execution bugs in Acrobat and Reader

Adobe has released security updates for Adobe Acrobat, Reader, and Lightroom that fix a total of twenty-six vulnerabilities in the three programs. Out of 25 vulnerabilities in Adobe Acrobat and Reader, 11 are classified as 'Critical' as they could allow remote code execution or the bypassing of security features. Users should install the latest versions of Adobe Acrobat and Reader to resolve these vulnerabilities. Adobe also has released a security update for Adobe Lightroom that fixes a DLL hijacking vulnerability that would allow an attacker to execute commands with elevated privileges. Users should install Lightroom Classic 9.3 to fix the vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-code-execution-bugs-in-acrobat-and-reader/

SANS infosec training org suffers data breach after phishing attack

The SANS cybersecurity training organization has suffered a data breach after one of their employees fell victim to a phishing attack. According to SANS Institute, the compromise was discovered on August 6th as part of a review of their organization's email configuration. The threat actor exfiltrated 513 emails, with approximately 28,000 records of personal information (PII) for SANS members, by configuring a forwarder rule. The breached information does not include passwords or financial information such as credit cards, does include email addresses, full names, phone numbers, work titles, company names, and physical addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/sans-infosec-training-org-suffers-data-breach-after-phishing-attack/

Citrix warns of patch-ASAP-grade bugs in its working-from-home products, just as we're all working from home

Citrix released patches for new security vulnerabilities tracked as CVE-2020-8208, CVE-2020-8209, CVE-2020-8210, CVE-2020-8211, and CVE-2020-8212 affecting its Citrix Endpoint Management (CEM), also known as XenMobile, a product made for enterprises to help companies manage and secure their employees mobile devices remotely. These vulnerabilities affect on-premise instances of XenMobile servers and could collectively allow unauthenticated attackers to gain administrative privileges on affected servers. The company has not yet revealed technical details of the vulnerabilities but has already pre-notified several major CERTs around the world and its customers on July 23. Citrix advised its users to apply the patches at the earliest.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/08/12/citrix_endpoint_management_critical_bug/

U.S. stock broker regulator FINRA warns of copycat phishing site - BleepingComputer

The U.S. Financial Industry Regulatory Authority (FINRA) is warning its members of a copycat site finnra[.]org that is impersonating them and potentially being used in phishing attacks. FINRA is a not-for-profit organization authorized by the U.S. government to regulate brokers trading in equities, corporate bonds, securities futures, and options. This fake site contains a registration form that could be used to collect sensitive information and could be further used in targeted phishing attacks against FINRA members. BleepingComputer was not able to find any phishing emails related to the finnra[.]org domain but were able to find another hostname named x32team[.]website that also resolves to the same IP address. Users are requested to stay vigilant and if any emails received from finnra[.]org, should immediately delete them. -Profit

See the full report here: https://www.bleepingcomputer.com/news/security/us-stock-broker-regulator-finra-warns-of-copycat-phishing-site/

Windows, IE11 zero-day vulnerabilities chained in targeted attack

An advanced threat actor exploited one of the two zero-day vulnerabilities that Microsoft patched on August 11, 2020, in a targeted attack earlier this year. The adversary chained two flaws in Windows, both unknown at the time of the attack, in an attempt to achieve remote code execution and increase their privileges on a compromised machine. The attack took place in May and targeted a South Korean company. Dubbed “Operation PowerFall,” the attack relied on a remote code execution (RCE) vulnerability in Internet Explorer 11, now tracked as CVE-2020-1380, and a flaw in Windows GDI Print/Print Spooler API allowing privilege escalation, now identified as CVE-2020-0986. After getting remote access to the target machine, the threat actor used a module that created a file named “ok.exe,” which leverages CVE-2020-0986 to run malicious code with elevated privileges. ZDI published an advisory on May 19, 2020, and the issue was exploited the very next day by the actors behind Operation PowerFall.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-ie11-zero-day-vulnerabilities-chained-in-targeted-attack/

Dharma ransomware created a hacking toolkit to make cybercrime easy

The Dharma Ransomware-as-a-Service (RaaS) operation makes it easy for a wannabe cyber-criminal to get into the ransomware business by offering a toolkit that does almost everything for them. Known as Toolbelt, a PowerShell script when run, allows the attacker to download and execute a variety of tools from a mapped Remote Desktop shared folder, which indicates the toolkit is part of larger package distribution. The tool can execute 62 tasks and allows the affiliate to spread laterally through a network, harvest passwords, steal RDP passwords, and deploy the ransomware. It requires the affiliate's Remote Desktop share to be properly set up and accessible for the commands to be executed properly. For an inexperienced hacker, this toolkit contains all of the programs that the affiliate needs to steal passwords, spread to other machines on a network, and ultimately deploy the ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/dharma-ransomware-created-a-hacking-toolkit-to-make-cybercrime-easy/

Re­VoL­TE attack can decrypt 4G (LTE) calls to eavesdrop on conversations

A team of academics has reported a vulnerability, named ReVoLTE, in the Voice over LTE (VoLTE) protocol that can be used to break the encryption on 4G voice calls. VoLTE is one of the protocols that handle voice communications on 4G networks. By default, the VoLTE standard supports encrypted calls. For each call, mobile operators must select an encryption key called a stream cipher to secure the call. Normally, the stream cipher should be unique for each call. Some mobile operators often use the same encryption key to secure multiple 4G voice calls that take place via the same base station (mobile cell tower). Attackers can leverage this to record a conversation between two 4G users using a vulnerable mobile tower and decrypt it. To achieve this the attacker has to place the call from the same vulnerable base station, in order to have its own call encrypted with the same/predictable encryption key. The GSMA has issued updates for the 4G protocol implementation to address and prevent ReVoLTE attacks.

See the full report here: https://www.zdnet.com/article/re-vol-te-attack-can-decrypt-4g-lte-calls-to-eavesdrop-on-conversations/

RedCurl cybercrime group has hacked companies for three years

Security researchers have uncovered a new Russian-based hacking group that they claim has been focusing on the past three years on corporate espionage, targeting companies across the world to steal documents that contain commercial secrets and employee personal data. Cyber-security firm Group-IB has named them RedCurl and identified 26 RedCurl attacks, carried out against 14 organizations since 2018. The group relies on spear-phishing for initial access. The email content is carefully drafted, displaying the targeted company's address and logo, while the sender address features the company's domain name. The emails included links to malware-laced files that victims had to download. Once victims ran the content of the boobytrapped archives, they got infected with a collection of PowerShell-based trojans. The trojans allowed RedCurl operators access to basic operations, such as searching systems, downloading other malware, or uploading stolen files to remote servers. Victims were targeted across countries and industry sectors, including construction companies, retailers, travel agencies, insurance companies, banks, and law and consulting firms from countries like Russia, Ukraine, Canada, Germany, Norway, and the UK.

See the full report here: https://www.zdnet.com/article/redcurl-cybercrime-group-has-hacked-companies-for-three-years/