zerofox logo
Advisories

Threat Intelligence Bulletin: 08/14/2020 - 08/20/2020

|by Alpha Team

banner image

Alpha Team Threat Update: Prolific Vishing Campaign Targeting New Employees

ZeroFOX Alpha Team has been assisting industry and threat-sharing partners in tracking a large scale vishing campaign targeting financial institutions, cryptocurrency exchanges, telecommunication companies, and single-sign-on (SSO) providers. The actors target new employees to a company and do an extensive amount of research on the employees and the company to build a convincing persona of an IT contractor working with the victim company. The actors call the victims using this information to serve a phishing site that is tailored for the company, including the company’s SSO portal. Once the victim logs into the phishing portal, the actors set up persistence via additional 2Factor (2FA) devices and then attempt to access VPN software to gain access to internal dashboards. The threat sharing group and Alpha Team assesses that it is probable that these actors and Tactics, Techniques & Procedures (TTPs) were used in the recent hacks on Twitter, resulting in an internal administrative panel being abused to take over high profile Twitter accounts.

Recommendations

  • Setup domain monitoring for your company and include your SSO provider (if applicable) to the search terms
  • If a domain is found, and it is registered via Namecheap or Shinjiru, escalate immediately for a takedown to the ZeroFOX Team
  • Setup impersonation monitoring on LinkedIn for your company to find profiles that are claiming to work for your organization, but are fake
  • Setup ZeroFOX Threat Feed to block any domains that match the TTPs of this actor, even if they may not be live, as these are only turned on when used for an attack
  • Monitor for additional 2-Factor Authentication applications via your SSO provider on any user, especially if it is not a company-approved application
  • Ensure corporate policies dictate to only do IT support calls via approved company video or call conferencing software, and never over the phone
  • Setup client-side certificates for endpoints who connect to corporate VPN assets

Details

Vishing, or voice phishing, is a technique where an attacker calls a victim and performs a phishing attack over the phone. The harvesting of victim data can be achieved in different ways, such as the victim surrendering personal details over the phone, but vishing is also an effective way to get the user to visit a malicious website using pretext and social engineering.

ZeroFOX Alpha Team has been assisting industry and threat-sharing partners with an investigation into a large-scale and effective vishing campaign targeting a number of industries. The group has determined that it is probable that these actors and TTPs were used in the recent hacks on Twitter, resulting in an internal administrative panel being abused to take over high profile Twitter accounts.

TTPs

The TTPs of this group involves monitoring for new employees in their list of target industries The industries are as follows:

  • Financial institutions and cryptocurrency exchanges linked to high net-worth cryptocurrency influencers
  • Telecommunication and mobile companies
  • SSO Providers
  • Social and digital platforms and code sharing websites

Alpha Team assesses that it is almost certain the actors target these types of industries for account takeover purposes, especially if they can use internal tools or panels to perform these account takeovers.

The actors use Open Source Intelligence (OSINT) via social networks, company listings and announcements to find these employees, as well as collect information about the tools and software the target company uses. For example, if a company has an IT Administrator that lists “Active Directory, Microsoft Teams” within their job profile on social networks, the actors will use this OSINT to build a voice script when interacting with targets in that company. In some cases, actors have registered LinkedIn profiles to connect with employees to gain access to people, information, and announcements directly from the employees.

Figure 1

Figure 1: Fake Profile interacting with new employee, image shared to Alpha Team by partner

The actors will then register a domain using a combination of deceptive keywords and deceptive brands within the domain. The deceptive brand could include the target company or the target company’s SSO provider. The deceptive keywords we’ve seen so far include the following, but are not limited to:

  • ticket
  • update
  • vpn
  • employee
  • support
  • assist
  • okta
  • login
  • sso

The keywords can be plural (such as tickets), as well as contain hyphens (ticket-). Of observed domains, almost all had TLS certificates, typically Let’s Encrypt. The observed domains have mostly been registered with Namecheap and Shinjiru, possibly since they can accept cryptocurrency as payment.

Once a phone call is established with the target victim, the actors use pretext built from their OSINT research to gain the trust of the victim. They pose as a member of the IT team, and instruct them that they are working on a ticket associated with VPN or SSO access. The actor then directs the victim to the phishing site, which is turned “on” only for the attack. This means that they stage domains and pages ahead of the attack, then turn the websites off to avoid being banned from the registrar, or being added to a blacklist. Due to the nature of the domain ecosystem, it is difficult for defenders to determine which domains belong to this actor group, especially with parked pages and search engine optimization from registrars creating these domains in their zone files before they are even bought.

Victims then visit the website, input their credentials, and then their 2FA code, which is replayed to the actors who then login separately to the SSO provider. Once connected, the actors can stage persistence via adding secondary 2FA devices, as well as use the SSO access for a VPN connection to access internal portals and tools.

Alpha Team assesses that these compromises are intended for long term access, so the actors finish the ticket call and then maintain access for some time afterward. They then broker this access and sell it to members of account takeover communities, whether to steal cryptocurrency or for bragging rights.

Conclusion

This style of vishing is effective due to the assumption that a 2FA code can help prevent phishing attacks. If the attack focuses specifically around spear-phishing, where a singular victim is targeted, then 2FA is just as effective as usernames and passwords. A defense-in-depth approach involving training & education, monitoring and pre-emptive blocking of problem domains, SSO auditing, and employing role-based access best practices for internal panels will help mitigate most of the TTPs of this group.

Breach Disclosure: Utah Gun Exchange

A popular gun exchange website, Utah Gun Exchange, was involved in a breach in July 2020 exposing around 235,000 email addresses. Also included in this breach was usernames, IP addresses, genders and password hashes. Utah Gun Exchange acknowledged in their statement that "...criminals exploited a website vulnerability to gain access to certain data", however, it is not known what vulnerability was exploited or how at this time.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Luckily for users of the Utah Gun Exchange website, all financial data and transactions were handled through PayPal, preventing any financial data of customers ending up in the breach. With that, Utah Gun Exchange mentioned that most of the consumer information accessed is information that is already publicly available when an advertisement is posted, including names, email addresses, and phone numbers.

In addition to the Utah Gun Exchange directly, there were nearly 46,000 users from the company's UGETube video website also included in the breached data. However, many of the users appear to be spam accounts. Also included in the breach was 25,000 from Utah-based Deep Jungle Kratom, a herbal supplement company, and 16,000 users from the "Muley Freak" website, which sells hunting gear. There are claims by the hacker that all of these sites are related to the Utah Gun Exchange, which could indicate a more targeted attack against them specifically, however, Utah Gun Exchange dismisses those claims, and said that they are not related.

Figure 1: Breach data for Utah Gun Exchange posting on RaidForums

Breach Disclosure: Sonicbids

Back in May of 2020, the online social music platform Sonicbids disclosed a breach that impacted around 752,000 users. This breach was stated to have occurred on December 29, 2019 through their investigation into this incident.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On May 17, 2020, Sonicbids learned that some user accounts were publicly accesible as a result of a data privacy event involving a third-party cloud hosting service. The breached data included names, usernames, email addresses, and PBKDF2 password hashes for users of the platform.

The hacking group, ShinyHunters, posted this database for sale on the popular hacking forum, RaidForums back in May 15, 2020 with a date matching when Sonicbids claimed to have been compromised.

Figure 1: Database listing on RaidForums advertisting the breach data##

Breach Disclosure: Catho

ShinyHunters continues their spree of uploading compromised data to popular hacking forums. In March 2020, the Brazilian recruitment website, Catho, was compromised alongside 20 other breached sites and had their data listed on various marketplaces. Catho had around 11 million records exposed, with names, usernames, and plain text passwords exposed in the data.

Recommendations

  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On July 15, 2020 the hacking group ShinyHunters uploaded the Catho breach containing the 11,000,000 records to the popular hacking forum, RaidForums. Unfortunately for users of the Catho service, the passwords were stored in plaintext, and the data uploaded by ShinyHunters contained these plaintext passwords for attackers to subsequently use in future attacks.

Figure 1: Marketplace listing for Catho breach data

Breaking News: 2020-08-14 - 2020-08-20

CactusPete APT Hones Toolset, Resurfaces with New Espionage Targets

The China-based APT known as CactusPete has returned with a new campaign aimed at military and financial targets in Eastern Europe. The group also used a fresh variant of the Bisonal backdoor, which allows the attackers to steal information, execute code on target machines and perform lateral movement inside a network. The backdoor was likely delivered to targets via spear-phishing emails with attachments containing exploits for known vulnerabilities. Once the malware executes, it connects to a hard-coded command-and-control server (C2) using unmodified HTTP-based protocol. After successful connection, the malware harvests various machine-fingerprint information, such as hostname, IP and MAC address; Windows version; and the time set on the infected host, and sends it on. The group continues to push various custom Mimikatz variants and keyloggers for credential harvesting purposes, along with privilege-escalation malware. The recent campaigns in 2020 show that the group has shifted towards other Asian and Eastern European organizations.

See the full report here: https://threatpost.com/cactuspete-apt-toolset-respionage-targets/158350/

High-Severity TinyMCE Cross-Site Scripting Flaw Fixed

A high-severity flaw has been disclosed in TinyMCE, an open-source text editor used in the content management systems (CMS) of websites. Researchers discovered a built-in cross-site scripting (XSS) flaw in TinyMCE, due to content not being correctly sanitized before being loaded into the editor. It could be exploited remotely by attackers to gain administrative privileges to websites. Tracked as CVE-2020-12648, the vulnerability allows attackers to bypass sanitization measures via specially crafted HTML tags. They can inject an tag with arbitrary values (src and onerror) into the editor via the clipboard or APIs. The flaw exists in version 5.2.0 and earlier of the TinyMCE application. Users are urged to update to the most recent version of the application.

See the full report here: https://threatpost.com/high-severity-tinymce-cross-site-scripting-flaw-fixed/158306/

In one click: Amazon Alexa could be exploited for theft of voice history, PII, skill tampering

Checkpoint researchers have discovered issues in Amazon's Alexa voice assistant that could be exploited to hand over user data due to security vulnerabilities in the service's subdomains. While examining the Alexa mobile app, researchers found an SSL mechanism that prevents traffic inspection. The app's misconfiguration of CORS policy allowed Ajax requests to be sent from Amazon subdomains. If a subdomain is found as vulnerable to code injection, an XSS attack could be launched. To exploit this vulnerability, a victim just needs to click on a malicious link. The victim is then routed to a domain via phishing, for example, could be subject to code injection and the theft of their Amazon-related cookies. The cookies are then used to send an Ajax request to the Amazon skill store, of which the request would send back a list of all skills installed in the victim's Amazon Alexa account. Attackers can also acquire CSRF tokens and use them to remove or add new skills. Amazon has fixed the security issues.

See the full report here: https://www.zdnet.com/article/in-one-click-amazon-alexa-could-be-exploited-for-theft-of-voice-history-pii-skill-tampering/

CISA Warns of Phishing Campaign with Loan-Relief Lure

Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about an in-progress phishing campaign using the Small Business Administration (SBA) COVID-19 loan-relief program as bait. An unknown malicious actor has spoofed the SBA's loan-relief page and used the fake site to steal credentials and carry out other malicious actions. The phishing emails addressed to various federal civilian executive branch recipients as well as those in state, local, tribal, and territorial government. CISA has recommended keeping anti-malware and systems software up to date, and reminding employees to be careful about clicking on links in email messages.

See the full report here: https://www.darkreading.com/attacks-breaches/cisa-warns-of-phishing-campaign-with-loan-relief-lure/d/d-id/1338669

Hacker leaks data for U.S. gun exchange site on cybercrime forum - BleepingComputer

A threat actor has released the databases of Utah-based gun exchange, hunting, and kratom sites for free on a cybercrime forum that claimed to contain 195000 user records for the utahgunexchange[.]com, 45000 records for their video site, 15000 records from the hunting site muleyfreak[.]com, and 24000 user records from the Kratom site deepjunglekratom[.]com. All of these sites are based out of Utah, USA, and samples of the databases shared shows that each database was hosted on the same Amazon AWS server. The latest date on user records in each database is July 16th, which indicates that is when the data was stolen. The exposed data is different on each site, but consists of email addresses, login names, and hashed passwords. It is recommended that the users of these sites change their password immediately.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-leaks-data-for-us-gun-exchange-site-on-cybercrime-forum/

FBI and NSA joint report details APT28’s Linux malware Drovorub

The FBI and NSA have published a joint security alert containing technical details about a new piece of Linux malware dubbed Drovorub, allegedly employed by Russia-linked the APT28 group. Drovorub is a modular malware that includes the implant, a kernel module rootkit, a file transfer tool, a port-forwarding module, and a command-and-control (C2) server. When deployed on a victim machine, the Drovorub implant provides the capability for direct communications with actor controlled C2 infrastructure, file download, and upload capabilities, execution of arbitrary commands as root and port forwarding of network traffic to other hosts on the network. Drovorub could allow state-sponsored hackers to carry out activities, such as stealing files, establishing backdoor access, remote controlling the target’s computer. The malware implements a sophisticated evasion technique, it leverages advanced rootkit capabilities to remain under the radar. The government agencies recommend that US organizations upgrade any Linux system to a version running kernel version 3.7 or later to prevents Drovorub’s rootkit infections.

See the full report here: https://securityaffairs.co/wordpress/107112/malware/apt28-drovorub-linux-malware.html?utm_source=rss&utm_medium=rss&utm_campaign=apt28-drovorub-linux-malware

SANS shares details on attack that led to their data breach - BleepingComputer

On August 11th, SANS disclosed that they had suffered a data breach after one of their employees fell for a phishing attack that caused 513 emails to be forwarded to attackers. SANS has now shared the indicators of compromise for a recent phishing attack that led to a data breach. According to SANS, the initial attack started with a phishing email pretending to be a file named "Copy of July Bonus 24JUL2020.xls" shared by a SANS SharePoint service. The malicious email prompted the user to click on the 'Open' button to access the file. When clicked on, the button opens the default browser with a URL which prompts the user to enter their Office 365 credentials. When doing so, a Microsoft Office OAuth addon named 'Enable4Excel' gets installed. Once the malicious Office 365 app was installed, it creates a forwarding rule named 'Anti Spam Rule' that monitored for specific keywords. If a matching keyword was found in an email, the email gets forwarded to an external address.

See the full report here: https://www.bleepingcomputer.com/news/security/sans-shares-details-on-attack-that-led-to-their-data-breach/

Emotet malware strikes U.S. businesses with COVID-19 spam - BleepingComputer

The Emotet malware has begun to spam COVID-19 related emails to U.S. businesses after not being active for most of the USA pandemic. In a new spam email, Emotet has been sending out a stolen email that pretends to be from the 'California Fire Mechanics' sending a 'May COVID-19 update'. The email pretends to be created from an iOS device and requires users to click on 'Enable Content' to view it properly. Once a user clicks on the 'Enable Content' button, a PowerShell command will be executed that downloads the Emotet malware executable from one of three to four sites. When downloaded, Emotet will be saved to the '%UserProfile%' folder and named as a three-digit number, such as 498[.]exe. Once executed, a victim's computer will become part of the malware bot operation and spam out the further malicious email. Ultimately, Emotet will download and install other malware such as Qbot or TrickBot, which will be used to steal your data, passwords, and potentially lead to ransomware deployment.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-strikes-us-businesses-with-covid-19-spam/

Mac malware spreads through Xcode projects, abuses WebKit, Data Vault vulnerabilities

Xcode projects are being exploited by XCSSET malware family to spread a form of Mac malware specializing in the compromise of Safari and other browsers, leading to a rabbit hole of malicious payloads. Researchers also discovered two zero-day vulnerabilities in Xcode Developers project. While it is not yet clear how XCSSET worms its way into Xcode projects, Trend Micro says that once embedded, the malware then runs when a project is built. Several impacted developers have shared their projects on GitHub, which the researchers say could result in supply chain-like attacks for users who rely on these repositories as dependencies in their own projects.

See the full report here: https://www.zdnet.com/article/mac-malware-spreads-through-xcode-projects-abuses-previously-unknown-vulnerabilities/

Critical Flaws in WordPress Quiz Plugin Allow Site Takeover

The plugin, Quiz and Survey Master, designed to add quizzes and surveys to WordPress websites has patched two critical vulnerabilities. It is actively installed on over 30,000 websites. The flaws can be exploited by remote, unauthenticated attackers to launch varying attacks, including fully taking over vulnerable websites. The two vulnerabilities stemmed from a feature in the plugin that enables site owners to implement file uploads as a response type for a quiz or survey. The company patched these vulnerabilities and users are recommended updating to version 7.0.1.

See the full report here: https://threatpost.com/critical-flaws-wordpress-quiz-plugin-site-takeover/158379/

Windows Defender deletes Citrix components mislabeled as malware - BleepingComputer

Citrix released an advisory about troublesome Windows Defender definition updates that break Delivery Controllers and Cloud Connectors running Microsoft’s antivirus. The problem started with Windows Defender definition 1.321.1319.0, wherein it erroneously detected and quarantined the main and secondary Citrix broker services (BrokerService.exe and HighAvailabilityService.exe) responsible for tracking current user connections/sessions as information-stealing malware Agent Tesla. Microsoft pushed Antivirus definition 1.321.1341.0 that corrected the issue. Citrix recommended admins impacted by this to clear the current cache and trigger an update by using a batch script with the commands running as admin.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-defender-deletes-citrix-components-mislabeled-as-malware/

U.S. spirits and wine giant hit by cyberattack, 1TB of data stolen - BleepingComputer

Brown-Forman, one of the largest U.S. companies in the spirits and wine business, experienced a cyber attack. Sodinokibi (REvil) ransomware operators announced on Friday that they had compromised Brown-Forman's computer network and spent more than a month examining user services, cloud data storage, and general structure. The attackers claim they stole 1TB of data that includes confidential information about employees, company agreements, contracts, financial statements, and internal correspondence. The company confirmed that some sensitive information including employee data was affected in the attack and they are working with law enforcement, as well as world-class third-party data security experts to mitigate and resolve the situation at the earliest.

See the full report here: https://www.bleepingcomputer.com/news/security/us-spirits-and-wine-giant-hit-by-cyberattack-1tb-of-data-stolen/

Hackers targeted thousands of CRA, government service accounts in ‘credential stuffing’ attacks - Global News

The federal government has revealed that the Canada Revenue Agency (CRA) was recently hit by two cyberattacks, compromising thousands of accounts linked to the agency's services. The attacks targeted the GCKey service, used by some 30 federal departments and Canada Revenue Agency accounts, the Treasury Board of Canada Secretariat explained in a press release. On August 14, 2020, the agency confirmed that about 5,500 accounts had been affected by the separate attacks but that the breaches are now contained. An investigation has been initiated by the government and the federal police to determine whether there were any breaches of privacy and whether the information was obtained from these accounts.

See the full report here: https://globalnews.ca/news/7278345/canada-hackers-credential-stuffing-attack/

Researchers find Amazon Alexa flaw exposing personal data to hacking - The Star Online

Researchers have identified an exploit in Amazon’s Alexa voice platform that could have given attackers access to users’ personal information, speech histories, and Amazon accounts. Once the personal data was obtained, a hacker could pose as a legitimate user, delete an installed skill, and substitute it with a doctored version containing malicious code. In turn, once the contaminated program is activated, a hacker could obtain sensitive user data by eavesdropping on conversations. Such information could involve financial transactions, health details, or exchanges of a personal nature a user may engage in through Amazon inquiries. An attacker could create a legitimate-looking link to a site used for tracking Amazon packages. An unsuspecting user clicking on the link will provide an entranceway for the hacker to swap installed skills with malicious ones. Amazon is working to close off these vulnerabilities on Amazon/Alexa subdomains.

See the full report here: https://www.thestar.com.my/tech/tech-news/2020/08/16/researchers-find-amazon-alexa-flaw-exposing-personal-data-to-hacking

PoC exploit code for two Apache Struts 2 flaws available online

Security researchers have discovered a PoC code and exploit available on GitHub that can be used to trigger security vulnerabilities in Apache Struts 2. The Proof-of-concept exploit code released last week can trigger CVE-2019-0230 and CVE-2019-0233 vulnerabilities, which are classified as remote code execution and denial-of-service issues, impacting Apache Struts versions 2.0.0 through 2.5.20. Both vulnerabilities were addressed by the Apache team in November 2019. Users are recommended to upgrade outdated installs and verify no unauthorized system modifications have occurred on the system.

See the full report here: https://securityaffairs.co/wordpress/107173/hacking/poc-code-exploit-apache-struts-2-flaws.html?utm_source=rss&utm_medium=rss&utm_campaign=poc-code-exploit-apache-struts-2-flaws

New Microsoft Edge features will save you money when shopping online - BleepingComputer

Microsoft has started testing two new features designed to help save money when making purchases on retail stores. Both of these features, a price comparison tool, and a coupon autofill, are currently a work in progress with only basic functionality enabled in Microsoft Edge Dev and Canary builds. The price comparison feature internally titled as MsCollectionsPriceComparison, only works on certain retailers, including Amazon, BestBuy, Newegg, Walmart, and Target. The autofill coupons feature, titled Show coupons as autofill suggestions, will display available for coupons when at site's checkout page and if they have a promo code field when enabled.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-microsoft-edge-features-will-save-you-money-when-shopping-online/

Hackers hit Momentum Metropolitan - Business Insider South Africa

Momentum Metropolitan, a South African based financial services group, is notifying its customers of a data breach at one of its subsidiaries. The company stated that the exposed information contained administrative and financial data that is not expected to prejudice any stakeholders of the company. Momentum Metropolitan's investigations have revealed that the hackers did not steal client information. Currently, the company is working to ensure that service to clients remains unaffected. -East/Africa

See the full report here: https://www.businessinsider.co.za/hackers-hit-momentum-metropolitan-but-clients-shouldnt-be-affected-2020-8

Business technology giant Konica Minolta hit by new ransomware - BleepingComputer

Konica Minolta, a Japanese multinational technology company, suffered a ransomware attack at the end of July, impacting its services for almost a week. On July 30th, 2020, customers began reporting that Konica Minolta's product supply and support site was not accessible and was displaying the outage message. The site remained down for almost a week, and customers stated that they could not get a straight answer as to what was causing the outage. According to BleepingComputer, the ransom note belongs to a relatively new ransomware called RansomEXX. RansomEXX is human-operated, which involves threat actors compromising a network and spreading to other devices until they gain administrator credentials. Once admin rights and access to the Windows domain controller are gained, the threat actors deploy the ransomware on the network and encrypt all of its devices.

See the full report here: https://www.bleepingcomputer.com/news/security/business-technology-giant-konica-minolta-hit-by-new-ransomware/

US Army report says many North Korean hackers operate from abroad

US Army report named North Korean Tactics, says many North Korean hackers operate from abroad. The US Army said that most of the electronic warfare and cyberspace warfare operations take place within the Cyber Warfare Guidance Unit, more commonly known as Bureau 121. Bureau 121 is a division of the Reconnaissance General Bureau, a North Korean intelligence agency that is part of the National Defence Commission. US Army officials say that Bureau 121 consists of four main sub-divisions, with three dedicated to cyber-warfare, and one to electronic warfare and they are loosely organized, with many of their members being allowed to travel and operate from abroad, in countries such as Belarus, China, India, Malaysia, and Russia.

See the full report here: https://www.zdnet.com/article/us-army-report-says-many-north-korean-hackers-operate-from-abroad/

Google Chrome will warn users when submitting insecure forms

Starting with version 86, Google Chrome will warn users when submitting insecure forms that deliver information via HTTP connections on HTTPS websites. These forms, also known as mixed forms, are both privacy and security risks for users since they can allow attackers to read or modify the submitted data. The browser will automatically disable auto-filling of mixed forms but with an exception when it comes to forms used as login prompts. It will also warn users when they start filling out insecure forms using a red-colored text displayed below the mixed form. Google is also planning to fully block mixed content downloads from sites to protect Chrome 86 users from man-in-the-middle (MiTM) attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-will-warn-users-when-submitting-insecure-forms/

Microsoft outlines its IE, legacy Edge phase-out timetable

Beginning August 17, 2021, Microsoft 365 apps and services will no longer support Internet Explorer 11 (IE 11). After November 30, 2020, Microsoft Teams will no longer support IE11 and After March 9, 2021, Microsoft will no longer provide any security updates for the legacy Edge desktop app. As of these dates, Microsoft users will have a degraded experience or will be unable to connect to Microsoft 365apps and services on IE 11. The company noted that customers' who own legacy IE11 apps and investments will continue to work, but access to Microsoft 365 apps and services won't work with IE11 after next August. Microsoft started to roll out the new Edge, a k a Chromium-based Edge via Windows Update to those running Windows 10 1803 or more recent starting in June 2020. Microsoft said starting with Windows 10 20H2 Chromium-based Edge will come bundled with Windows 10. It includes support for IE11 via Internet Explorer mode. Once a user installs it via Windows Update and/or gets an update for a manually-installed version, later it cannot be uninstalled from Windows 10

See the full report here: https://www.zdnet.com/article/microsoft-outlines-its-ie-legacy-edge-phase-out-timetable/

Critical Jenkins Server Vulnerability Could Leak Sensitive Information

A critical vulnerability tracked as CVE-2019-17638, discovered in Jenkins server software. Jenkins is the most popular open-source automation server, maintained by CloudBees and the Jenkins community. It has hundreds of thousands of active installations worldwide with more than 1 million users. The vulnerability has a CVSS rating of 9.4 and impacts Eclipse Jetty versions 9.4.27.v20200227 to 9.4.29.v20200521, which may allow unauthenticated attackers to obtain HTTP response headers that may include sensitive data intended for another user. Jenkins bundles Winstone-Jetty, a wrapper around Jetty, to act as HTTP and servlet server when started using java -jar jenkins.war. Jetty 9.4.30.v20200611 addresses the vulnerability, while the Jenkins software has fixed the flaw in Jenkins 2.243 and Jenkins LTS 2.235.5. Jenkins users are recommended to update their software to the latest version to mitigate the flaw.

See the full report here: https://thehackernews.com/2020/08/jenkins-server-vulnerability.html

Gym app management platform exposed info of thousands of users

Hackers could hijack user accounts in dozens of fitness and gym mobile applications, even where the two-factor authentication (2FA) mechanism was active. The common ground for all the apps is Fizikal, a management platform from Israel for gyms and sports clubs that allows customers to handle their subscription and class registration. Several vulnerabilities affecting the Fizikal platform could be chained to bypass security checks, enumerate users, bruteforce the one-time password (OTP) for logging in, and get access to a user's account. There are close to 70 Fizikal apps in Google Play Store's health and fitness section, many of them added over the past few days. Some of the older apps have upwards of 5,000 downloads and together account for at least 240,000 active installations. Hijacking an app account for an app that relies on Fizikal management platform not only allowed an attacker to lock the user out or cancel their subscription but also granted access to personally identifiable information such as phone number, full name, date of birth, email address, postal address, ID number. Fizikal has fixed the issue.

See the full report here: https://www.bleepingcomputer.com/news/security/gym-app-management-platform-exposed-info-of-thousands-of-users/

A flaw in Concrete5 CMS could have allowed website takeover

A recently addressed remote code execution (RCE) flaw in the Concrete5 CMS exposed numerous websites to attacks. Concrete5 is an open-source content management system (CMS) designed for ease of use, for users with a minimum of technical skills. It allows users to edit site content directly from the page. The vulnerability affects the Concrete5 version 8.5.2. It could be exploited by an attacker to inject a reverse shellcode into vulnerable web servers allowing him to take full control of them. The experts pointed out that the flaw could have been exploited to add PHP extension in the list of allowed extensions and then upload the file. The attacker needs administrative permissions to access the ‘Allow File types’ feature and include the PHP file type in the list of allowed extensions. Then the attacker can upload potentially malicious code onto the server and then execute arbitrary commands. The vulnerability is fixed and Concrete5 users are recommended to update to version 8.5.4.

See the full report here: https://securityaffairs.co/wordpress/107294/security/concrete5-cms-rce.html?utm_source=rss&utm_medium=rss&utm_campaign=concrete5-cms-rce

Some email clients are vulnerable to attacks via 'mailto' links

A lesser-known technology known as "mailto" links can be abused to launch attacks on the users of email desktop clients. According to academics from two German universities, the new attacks can be used to secretly steal local files and have them emailed as attachments to attackers. The vulnerability lies in how email clients implemented RFC 6068, the technical standard that describes the 'mailto' URI scheme. Mailto refers to special types of links supported by web browsers or email clients, when clicked, open a new email compose/reply window rather than a new web page. Researchers found email client apps that support the mailto standard with unusual parameters that allow for attacks on their users. According to researchers, the attackers can send emails containing booby-trapped mailto links or place booby-trapped mailto links on websites that, when clicked, could surreptitiously append sensitive files to the email window. If the user composing the email does not spot the file attachment, attackers could receive sensitive files from the user's system, such as encryption (PGP) keys, SSH keys, config files, cryptocurrency wallet files, password stores, or important business documents as long as they are stored at file paths known by an attacker. The research team reported the issues to the development teams and issues were patched.

See the full report here: https://www.zdnet.com/article/some-email-clients-are-vulnerable-to-attacks-via-mailto-links/

Ritz London suspects data breach, fraudsters pose as staff in credit card data scam - ZDNet

The Ritz Hotel in London has launched an investigation into a data breach in which scammers may have posed as staff members to steal credit card data. The company said that on August 12, it was made aware of a potential data breach within their food and beverage reservation system and may have led to the compromise of some of their clients' personal data. According to the hotel, the leaked data may have been used in a social engineering scam designed to steal more valuable financial information. The fraudsters pretending to be Ritz employees, used call ID spoofing to appear to be from the hotel. Information in hand, the scam artist then tried to make several transactions exceeding £1000 from retailer Argos. It is not known how widespread this scam is or how many people have been targeted. The Ritz hotel has emailed customers emphasizing that staff will not call them after a reservation is made. An investigation has been launched to identify the cause of the breach.

See the full report here: https://www.zdnet.com/article/ritz-london-struck-by-data-breach-fraudsters-pose-as-staff-in-credit-card-data-scam/

Cruise line operator Carnival Corporation suffers a ransomware attack

Cruise line operator Carnival Corporation, a British-American cruise operator, has disclosed that one of their brands was hit with a ransomware attack over the past weekend. On August 15, 2020, The company detected a ransomware attack that accessed and encrypted a portion of one brand’s information technology systems. The unauthorized access also included the download of certain data files. The Carnival IT staff confirmed that the ransomware operators may have stolen personal data of guests and employees. The exposed guests’ personal information included name, address, Social Security number, government identification number, such as passport number or driver’s license number, and health-related information. For some clients, credit card and financial account information might have been exposed. The company has implemented a series of containment and remediation measures to respond to the incident and reinforce the security of its information technology systems.

See the full report here: https://securityaffairs.co/wordpress/107263/cyber-crime/carnival-corporation-ransomware-attack.html?utm_source=rss&utm_medium=rss&utm_campaign=carnival-corporation-ransomware-attack

IcedID Trojan Rebooted with New Evasive Tactics

Security researchers from Juniper Networks have discovered a new phishing campaign that uses documents trojanized by the widely used banking trojan IcedID to infect victims. IcedID was first discovered in 2017 as a trojan targeting banks, payment card providers, mobile services providers, payroll, web mail and e-commerce sites. Attackers initiate the attack by sending phishing emails, which claim to include an invoice, to potential victims. They purport to be from the accounting department, with a password-protected ZIP file attached. This password protection allows the file to evade anti-malware solutions. The password is included in the email body for victims to find and use to open the file. On opening the attachment, the campaign launches a three-stage attack to unleash the trojan.

See the full report here: https://threatpost.com/icedid-trojan-rebooted-evasive-tactics/158425/

AWS Cryptojacking Worm Spreads Through the Cloud

A crypto-mining worm from the group known as TeamTNT is spreading through the Amazon Web Services (AWS) cloud and collecting credentials. According to Cado Security, once the logins are harvested, the malware logs in and deploys a number of openly available malware and offensive security tools, including the XMRig mining tool to mine Monero cryptocurrency. The attack leverages the way AWS stores credentials in an unencrypted file at ~/.aws/credentials and additional configuration details in a file at ~/.aws/config. TeamTNT has been prolific and was spotted originally earlier in the year, targeting Docker containers. To thwart such attacks, businesses should identify which systems are storing AWS credential files and delete them if they aren’t needed. Also, review network traffic for any connections to mining pools or those sending the AWS credentials file over HTTP.

See the full report here: https://threatpost.com/aws-cryptojacking-worm-cloud/158427/

Second-largest memory chip maker SK Hynix hit by Windows ransomware - iTWire

Maze ransomware group has allegedly targeted the world's second-largest memory chip maker, SK Hynix. The hackers have released a bunch of screenshots of the documents which appear to be from Hynix, on their site. The compromised information includes legal documents, contract forms, annual registrations, files relating to anti-trust actions, communications with Apple, and accounting statements. The company has not confirmed the breach yet.

See the full report here: https://www.itwire.com/security/second-largest-memory-chip-maker-sk-hynix-hit-by-windows-ransomware.html

FritzFrog cryptocurrency P2P botnet targets Linux servers over SSH

Security researchers have spotted a new sophisticated peer-to-peer (P2P) botnet, dubbed FritzFrog, that has been actively targeting SSH servers since January 2020. The bot is written in Golang and implements wormable capabilities that target government, education, and finance sectors. The FritzFrog is a modular, multi-threaded, and file-less botnet that outstands for the use of a proprietary and fileless P2P implementation written from scratch. FritzFrog is fileless, meaning it assembles and executes payloads directly into the memory of the infected system. The botnet’s P2P communication is encrypted using AES for symmetric encryption and the Diffie-Hellman protocol for key exchange. Once the botnet has identified a new potential target, the malicious code attempts to gain access with brute-force attacks and then to infect the accessed machine with malicious payloads. It establishes a backdoor on the infected systems to achieve continued access. To remain under the radar, the malware process runs under the names ifconfig and nginx. It then listens on port 1234 waiting for commands. The commands are transmitted to the malware through a series of hoops to avoid detection. The malware runs a separate process, named “libexec,” that allows operators to mine Monero coins.

See the full report here: https://securityaffairs.co/wordpress/107322/malware/fritzfrog-p2p-botnet.html?utm_source=rss&utm_medium=rss&utm_campaign=fritzfrog-p2p-botnet

Microsoft issues out of band KB4578013 Windows security update - BleepingComputer

Microsoft has issued an emergency out of band Windows security update designed to address privilege escalation bugs found to impact the Windows Remote Access service. The security issues tracked as CVE-2020-1530 and CVE-2020-1537 could allow attackers to gain elevated privileges after successful exploitation. For the vulnerabilities to be exploited, attackers would first need to code execution privileges on victims' devices to run a specially crafted application. The KB4578013 security update fixes two Windows Remote Access elevation of privilege vulnerabilities affecting all supported versions of Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2. Customers running Windows 8.1 or Server 2012 R2 should install the update as soon as possible to be protected from attacks that could exploit this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-issues-out-of-band-kb4578013-windows-security-update/

Experian South Africa discloses data breach impacting 24 million customers - ZDNet

Experian, a consumer credit reporting agency, has disclosed its data breach exposing the personal information of 24 million South Africans and 793,749 business entities to a suspected fraudster. The breach was reported to local authorities, which were able to track down the individual behind the incident, and data was deleted before been used for fraudulent purposes. According to Experian, only personal information was exposed in the incident, and no financial or credit-related information was exposed.

See the full report here: https://www.zdnet.com/article/experian-south-africa-discloses-data-breach-impacting-24-million-customers/

Gun exchange site confirms data breach after database posted online

A hacker has released the databases of Utah-based gun exchange, hunting, and kratom sites for free on a cybercrime forum. On August 10th, a threat actor posted databases that they claim contain 195,000 user records for the utahgunexchange[.]com, 45,000 records for their video site, 15,000 records from the hunting site muleyfreak[.]com, and 24,000 user records from the Kratom site deepjunglekratom[.]com. The exposed data is different on each site, but consists of email addresses, login names, and hashed passwords. All of these sites are based out of Utah, USA, and was hosted on the same Amazon AWS server. The latest data on user records in each database is July 16th. UGE mentions that no financial information, including PayPal and credit card information, was exposed during this attack. Users are advised to change reset their passwords on these sites.

See the full report here: https://www.bleepingcomputer.com/news/security/gun-exchange-site-confirms-data-breach-after-database-posted-online/

Lucifer cryptomining DDoS malware now targets Linux systems - BleepingComputer

A hybrid DDoS botnet dubbed "Lucifer" that is known for turning vulnerable Windows devices into Monero cryptomining bots, is now also scanning for and infecting Linux systems. Besides adding Linux targeting support, Lucifer's creators have also expanded the Windows version's capabilities to steal credentials and escalate privileges using the Mimikatz post-exploitation tool. The malware was first spotted in May and was deploying an XMRig miner on Windows computers infected using weaponized exploits targeting high and critical severity vulnerabilities or by brute-forcing machines with TCP ports 135 (RPC) and 1433 (MSSQL) open. The new Linux version comes with capabilities similar to the Windows counterpart, including modules designed for cryptojacking and for launching TCP, UCP, and ICMP-based flooding attacks. Furthermore, Lucifer-infected Linux devices can also be used in HTTP-based DDoS attacks, including HTTP GET and POST-floods and HTTP CC DDoS attacks. By adding support for additional platforms, Lucifer's authors are expanding the total number of devices controlled by their botnet, which in turn translates into a lot more cryptocurrency mined by the botnet in future.

See the full report here: https://www.bleepingcomputer.com/news/security/lucifer-cryptomining-ddos-malware-now-targets-linux-systems/

US govt exposes new North Korean BLINDINGCAN backdoor malware - BleepingComputer

U.S. government agencies have published a malware analysis report exposing information on a remote access trojan (RAT) malware used by North Korean hackers in attacks targeting government contractors. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) identified this malware as BLINDINGCAN. The trojan was attributed by the two agencies to the North Korean government-sponsored hacking group tracked as HIDDEN COBRA. The RAT comes with built-in functions for remote operations that provide various capabilities on a victim’s system. CISA received four Microsoft Word Open Extensible Markup Language (XML) documents (.docx) and two Dynamic-Link Libraries (DLLs). Upon analysis, the .docx files attempt to connect to external domains for a download. A 32-bit and a 64-bit DLL were submitted that install a 32-bit and a 64-bit DLL named 'iconcache.db' respectively. The DLL 'iconcache.db' unpacks and executes a variant of Hidden Cobra RAT. The BLINDINGCAN malware can also remove itself from compromised systems and clean its traces to avoid detection.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-exposes-new-north-korean-blindingcan-backdoor-malware/

Tags: weekly bulletin, all industries, global