Threat Intelligence Bulletin: 09/11/2020 - 09/17/2020

Evilginx2: Phishing toolkit designed for MFA bypass gets an update

Evilginx2 is an open source tool available on Github designed for acting as a man-in-the-middle webserver to phish for credentials, OTP/MFA tokens and session cookies from victims. The tool has been designed for ease of configuration, which makes it easy for unskilled threat actors to set up phishing pages targeting popular brands and companies. On September 14th, 2020, Evilginx2 received its first update in over a year and a half, bringing fresh eyes and attention to the tool. The latest updates provide cybercriminals who use Evilginx2 to create customized lure pages, proxy support, IP blacklisting and custom URL support.There is evidence of actors advertising phishing pages on Evilginx2 Github in exchange for money. Alpha Team assesses it is probable that Evilginx2 has and will be used more for malicious intent.

Recommendations

• Where possible, use conditional or risk based access policies to restrict MFA authentication to specific geo-locations
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Always verify the sender of suspicious or unexpected emails and messages
• Never download attachments from unknown senders or suspicious emails
• Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
• Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

Unlike other phishing kits which phish for MFA or OTP codes and exfiltrate to Telegram, email or log files, Evilginx2 proxies the session via the attacker controlled website back to the victim. This means that data sent to and from the victim's browser is intercepted. It also means that the victim is presented with the actual target site, not an HTML template or cloned version of the target page.

Figure 1. Evilginx2 main menu

The tool is designed to be simple to deploy and can be done in only a few minutes. The threat actor supplies a domain and IP address they control to be used for the attack. From there, they select a target brand from templates to generate a “lure”, which provides the threat actor with a unique URL they can then send to their target, as well as a valid TLS certificate via LetsEncrypt.

Figure 2. A Protonmail lure being generated for their target.

If a victim accesses the attacker’s unique URL, Evilginx presents a proxied version of the desired website. This allows the attacker to log sensitive information such as credentials and session cookies.

Figure 3. Protonmail phishing pages presented by Evilginx2

Figure 4. Victim information logged to the console

Once a victim has entered their credentials and MFA token, the session cookies can be retrieved by the threat actor and used to gain access to the victims account without needing to perform any additional verification.

Phishing pages for use by Evilginx2 are dictated by the presence of configuration files called “phishlets”. Phishlets specify configuration items such as the target site to be proxied and what forms and cookies should be logged. It has seen a healthy adoption from users as evidenced by the many contributors and available repositories which contain additional “phishlets”, with dozens available on Github and more for sale on other platforms.

It is worth noting that despite the author's instructions that this tool is for use by professional penetration testers, users routinely post on the issues tab request for phishlets in exchange for compensation. ZeroFOX Alpha Team assesses that it is probable these messages are threat actors and spammers who are looking for phishlets to carry out attacks using Evilginx2.

Figure 5. Threat actors requesting assistance or discussing use of the tool.

Evilginx2 has begun to adopt additional features which are commonly found in paid-for phishing kits to evade detection by conventional anti-phishing techniques such as web crawlers or scanners. This, along with the capability to quickly adapt and create phishlets to suit the needs of the threat actor Alpha Team believe it is probable that Evilginx2 will see increasing popularity for malicious use.

Breaking News: 2020-09-11 - 2020-09-17

Zeppelin Ransomware Returns with New Trojan on Board

Security researchers at Juniper Threatlab have spotted a wave of attacks in August making use of a new trojan downloader. These have similar functionalities as the initial Zeppelin ransomware that was observed in late 2019. Zeppelin is a variant of the Delphi-based ransomware-as-a-service (RaaS) family, initially known as Vega or VegaLocker. The attack stems from phishing emails with Microsoft Word attachments that have malicious macros on board. Once a user enables macros, the infection process starts. In the latest campaign, snippets of Visual Basic scripts are hidden among garbage text behind various images. The malicious macros parse and extract these scripts, and write them to a file. A second macro then looks for the specific string inside the document text and uses it to execute the trojan downloader that downloads the Zeppelin ransomware onto a victim’s machine. The binary sleeps for 26 seconds in an attempt to out-wait dynamic analysis in an automated sandbox and then runs the ransomware executable. The Zeppelin executable checks the computer’s language settings and geolocation of the IP address of the potential victim to avoid infecting computers in Russia, Belarus, Kazakhstan, and Ukraine.

See the full report here: https://threatpost.com/zeppelin-ransomware-returns-trojan/159092/

SoftServe hit by ransomware, Windows customization tool exploited - BleepingComputer

Ukrainian software developer and IT services provider SoftServe suffered a ransomware attack on September 1st that may have led to the theft of customers' source code. SoftServe confirmed the attack and took measures to isolate some segments of the network and, restrict communication with client networks. The news about a cyberattack on SoftServe first began circulating on the 'Telegram DС8044 Kyiv Info' channel, where an alleged message sent by the company to employees was shared. In a later post, links to source code repositories that were allegedly stolen during this attack, were shared. These zip files claim to contain projects for Toyota, Panasonic, IBM, Cisco, ADT, WorldPay, and more. According to the SoftService incident report, the attackers exploited a DLL hijacking vulnerability in the legitimate Rainmeter application to deploy their ransomware. Rainmeter is a legitimate Windows customization tool that loads a Rainmeter[.]dll when launched. During the attack, the threat actors replaced the legitimate Rainmeter[.]dll with a malicious version compiled from the source code to deploy the ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/softserve-hit-by-ransomware-windows-customization-tool-exploited/

Hackers are fighting a war over 300K vulnerable WordPress sites - BleepingComputer

Attackers who are actively exploiting a critical remote code execution flaw affecting over 600,000 of WordPress sites running vulnerable File Manager plugin versions have also been seen protecting the sites they compromise from other threat actors' attacks. The critical vulnerability allows unauthenticated attackers to upload malicious PHP files and execute arbitrary code following successful exploitation. Researchers have spotted more than 1.7 million sites being probed by threat actors between September 1st and September 3rd. File Manager's dev team addressed the flaw with the release of File Manager 6.9.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-are-fighting-a-war-over-300k-vulnerable-wordpress-sites/

Razer Gaming Fans Caught Up in Data Leak

A cloud misconfiguration at the gaming-gear merchant, Razer, potentially exposed 100,000 customers to phishing and fraud. Security consultant Bob Diachenko detected a misconfigured Elasticsearch cloud cluster that exposed a segment of Razer’s infrastructure to the public internet. It contained a raft of information of use to cybercriminals, including full name, email, phone number, customer internal ID, order number, order details, billing, and shipping address. The company has resolved the issue and secured the cloud instance.

See the full report here: https://threatpost.com/razer-gaming-fans-data-leak/159147/

New CDRThief malware steals VoIP metadata from Linux softswitches - BleepingComputer

Malware researchers discovered a new threat, named CDRThief targeting a particular Linux VoIP platform, namely Linknat VOS2009/3000 softswitches. A softswitch is a software solution acting as a VoIP server that manages traffic (audio/video/text) in a telecommunication network. It is a central element that ensures a connection between both internal and external lines. CDRThief’s purpose is to compromise VOS2009/3000 softswitches and steal call metadata from internal MySQL databases, such as IP addresses of the callers, phone numbers, start time and duration of the call, its route, and type. On analyzing the malware, researchers found that it attempted to obfuscate malicious functionality using the Corrected Block TEA (XXTEA) cipher and then running Base64 encoding on suspicious-looking links. The malware delivers the stolen data to a command and control (C2) server using JSON over HTTP after compressing and encrypting it with a hardcoded RSA-1024 public key. Based on current observations from the analysis, CDRThief may be used for cyber espionage operations or VoIP fraud.

See the full report here: https://www.bleepingcomputer.com/news/security/new-cdrthief-malware-steals-voip-metadata-from-linux-softswitches/

Office 365 phishing runs real-time check of stolen domain logins - BleepingComputer

Security researchers at Armorblox investigating phishing attacks encountered a less common technique in spear-phishing aimed at a senior executive at a top American company. The code behind the phishing page made sure that the threat actor got the right credentials for the company Active Directory and performed redirects to hide the attempt. The attack started with an email delivered at the end of business hours, with a subject and attachment referring to an internal financial report. Opening the attachment launches a web page that looks like the legitimate Office 365 login page filled the right AD username. Researchers noticed that the hackers verified the credentials immediately after getting them using Office 365 APIs. The attackers used the Amazon Simple Email Service to send out the phishing message, registered the domain for the phishing page at Alibaba with a domain registrar in Singapore, and hosted the website at a datacenter in Provo, Utah, operated by a provider in India (UnifiedLayer). Using Amazon SES to deliver the email kept spam alarms silent since the service supports DKIM/SPF, increasing the reputation of the message.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-phishing-runs-real-time-check-of-stolen-domain-logins/

Microsoft: Windows 10 1903 support ending in December 2020 - BleepingComputer

Microsoft reminded users that Windows 10 version 1903 (also known as the Windows 10 May 2019 Update) is reaching the end of service on December 8, 2020, in an official announcement published on the Microsoft Lifecycle Policy site. The company stated that this end of support deadline applies to all Windows 10 1903 editions. Customers who contact Microsoft Support after this date will be directed to update their device to the latest version of Windows 10 to remain supported. At the moment, customers still running Windows 10 versions 1903 and 1909 on their devices can upgrade to Windows 10 version 2004 by manually seeking to 'Check for updates' via Windows Update. Microsoft is also increasing the number of Windows devices approaching the end of service selected to automatically update to Windows 10 2004.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-10-1903-support-ending-in-december-2020/

Porn site users targeted with malicious ads redirecting to exploit kits, malware

A cybercrime group named Malsmoke has been busy over the past months, placing malicious ads on adult-themed websites to redirect users to exploit kits and infect them with malware. The role of the group's malicious ads was to use JavaScript trickery and redirect users from the adult portal to a malicious site that was hosting an exploit kit. The exploit kits would then use vulnerabilities in Adobe Flash Player or Internet Explorer to install malware on the user's computers, with the most common payloads being Smoke Loader, Raccoon Stealer, and ZLoader. The group has managed to sneak malicious ads (malverts) on xHamster, one of the biggest adult video portals, and one of the biggest sites on the internet, with billions of visitors each month.

See the full report here: https://www.zdnet.com/article/porn-site-users-targeted-with-malicious-ads-redirecting-to-exploit-kits-malware/

Palo Alto Networks fixes critical flaw in PAN-OS firewall software - BleepingComputer

Palo Alto Networks has fixed a new critical vulnerability affecting multiple versions of PAN-OS, the operating system affecting its next-generation firewalls. The vulnerability is tracked as CVE-2020-2040 and has a severity score of 9.8 out of 10 and requires no user interaction. An unauthenticated attacker can exploit it by sending a malicious request to specific interfaces. The flaw affects versions 8.1 (before 8.1.15), 9.0 (before 9.0.9), and 9.1 (before 9.1.3) where the Captive Portal or the Multi-Factor Authentication is enabled. Users are advised to update to the latest version of the product. If upgrading to the latest PAN-OS is not possible, it is advised to enable signatures in content update version 8317.

See the full report here: https://www.bleepingcomputer.com/news/security/palo-alto-networks-fixes-critical-flaw-in-pan-os-firewall-software/

IT staffing firm Artech says ransomware attack led to data breach - BleepingComputer

Artech Information Systems, one of the largest US IT staffing companies, has disclosed a data breach caused by a ransomware attack that affected some of its systems during early January 2020. The REvil ransomware group is suspected to be behind the attack as they claim to have stolen files from the company’s servers. In January 2020, the group also posted a part of the stolen data on a dark web marketplace. Around June 25, 2020, when the company completed the attack investigation, it was able to determine the individuals who had their information impacted during the ransomware attack. The investigation determined that at the time of the incident the involved files may have contained information including name, Social Security number, medical information, health insurance information, financial information, payment card information, driver’s license/state identification number, government-issued identification number, passport number, visa number, electronic/digital signature, username, and password information. Artech has urged the affected individuals to monitor their account statements for suspicious activity and to be vigilant against fraud and identity theft attempts. The company also provided free credit monitoring and identity protection services through Kroll.

See the full report here: https://www.bleepingcomputer.com/news/security/it-staffing-firm-artech-says-ransomware-attack-led-to-data-breach/

Development Bank of Seychelles hit by ransomware attack - BleepingComputer

According to the press release published by the Central Bank of Seychelles (CBS), the Development Bank of Seychelles (DBS) reported the ransomware attack on September 9, 2020. Since then, CBS has been engaging with DBS to establish the exact nature and circumstances of the incident and closely monitor the developments, including the possible impact on DBS operations. CBS engagement will also endeavor to identify areas of vulnerability that could have led to the ransomware attack. While it is not yet known if the attackers have stolen data before encrypting the bank's systems, there is a high chance that it happened depending on the ransomware strain that was used in the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/development-bank-of-seychelles-hit-by-ransomware-attack/

Ransomware Hits US District Court in Louisiana

The Fourth District Court of Louisiana has been hit with ransomware, and the attackers have published internal documents from the court on the Dark Web to prove their capabilities. The attack, attributed to and claimed by the "Conti" malware group, has knocked the court's website offline, along with that of the Louisiana Supreme Court.

See the full report here: https://www.darkreading.com/attacks-breaches/ransomware-hits-us-district-court-in-louisiana/d/d-id/1338899

APT28 Mounts Rapid, Large-Scale Theft of Office 365 Logins

The Russia-linked threat group known as APT28 is harvesting credentials for Microsoft’s cloud offering and targeting mainly election-related organizations. The threat group has changed up its tactics to include Office 365 password-cracking and credential-harvesting. Microsoft researchers have tied APT28 (a.k.a. Strontium, Sofacy, or Fancy Bear) to this newly uncovered pattern of O365 activity, which began in April and is ongoing. The attacks have been aimed mainly at U.S. and U.K. organizations directly involved in political elections. The APT often works to obtain valid credentials to mount espionage campaigns or move laterally through networks. Strontium has adapted a tooling technique that routes its authentication attempts through a pool of approximately 1,100 IPs, the majority associated with the Tor anonymizing service to obfuscate its activity, evade tracking, and avoid attribution. The organizations targeted by the tooling running in this mode typically see approximately four authentication attempts per hour per targeted account for several days or weeks, with nearly every attempt originating from a different IP address.

See the full report here: https://threatpost.com/apt28-theft-office365-logins/159195/

Researcher kept a major Bitcoin bug secret for two years to prevent attacks

In 2018, a security researcher Braydon Fuller discovered a critical Inventory Out-of-Memory Denial-of-Service (INVDoS) vulnerability in Bitcoin Core, the software that powers the Bitcoin blockchain. By exploiting the flaw, an attacker could create malformed Bitcoin transactions that, when processed by Bitcoin blockchain nodes, would lead to uncontrolled consumption of the server's memory resources, which would eventually crash impacted systems. But after reporting the issue and having it patched, the researcher opted to keep details private to avoid hackers exploiting the issue. However, the same bug tracked as CVE-2018-17145 was re-discovered by another security researcher Javed Khan while hunting bugs in the Decred cryptocurrency. Khan reported the bug to the Decred bug bounty program and was eventually disclosed to the world last month.

See the full report here: https://www.zdnet.com/article/researcher-kept-a-major-bitcoin-bug-secret-for-two-years-to-prevent-attacks/

Fairfax County schools hit by Maze ransomware, student data leaked - BleepingComputer

Fairfax County Public Schools (FCPS) was recently hit by ransomware according to an official statement published on Friday evening. FCPS did not reveal the identity of the ransomware operators who encrypted their systems. However, the attack on FCPS was already claimed by the Maze ransomware operators who have leaked 2% (an archive of roughly 100MB) of what they claim to be data stolen from the Virginia school division's servers. The data leaked by Maze contains information on some of the school district's students and administrative documents. FCPS is currently investigating the issue with the help of external security experts and is also working to get the affected systems back online and determine the full scope of the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/fairfax-county-schools-hit-by-maze-ransomware-student-data-leaked/

Office 365 will let users view their quarantined phishing messages - BleepingComputer

Microsoft plans to allow Office 365 users to view and request the release of phishing messages automatically quarantined by the Exchange Online Protection (EOP) filtering stack. This new feature can enable end-users to reclaim e-mails that have been automatically quarantined, marked as phishing or spam messages by the Exchange Online Protection (EOP) filtering stack. Microsoft aims to roll out the new Office 365 ATP Request Release workflow this month and to make it generally available to all customers with an Advanced Threat Protection plan in all Office 365 environments.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/office-365-will-let-users-view-their-quarantined-phishing-messages/

Zoom adds two-factor authentication (2FA) support to all accounts - BleepingComputer

Zoom has added two-factor authentication (2FA) support to all user accounts to secure them against security breaches and identity theft. Zoom accounts secured using 2FA will require users to enter a one-time code from a mobile authenticator app or received via SMS or phone call, in addition to the account's password, before allowing them to sign in to their Zoom web portal, desktop client, mobile app, or Zoom Room. Zoom stated that users now have the option to use authentication apps that support Time-Based One-Time Password (TOTP) protocol (such as Google Authenticator, Microsoft Authenticator, and FreeOTP), or have Zoom send a code via SMS or phone call, as the second factor of the account authentication process.

See the full report here: https://www.bleepingcomputer.com/news/security/zoom-adds-two-factor-authentication-2fa-support-to-all-accounts/

Security researchers expose vulnerabilities on Marriott, BA and EasyJet websites - DIGIT.FYI

New security research has revealed hundreds of critical data security vulnerabilities on the websites of travel firms including Marriott, British Airways, and EasyJet. The experts have found 497 vulnerabilities on Marriot owned websites alone, including 18 critical and 96 high-impact vulnerabilities. EasyJet had 222 vulnerabilities and 115 potential vulnerabilities, including 12 critical ones, on British Airways' websites. All three firms have already had breaches affecting nearly 350 million customers, which has resulted in hundreds of millions in proposed fines from regulators.

See the full report here: https://digit.fyi/security-vulnerabilities-marriott-british-airways-easyjet-websites/

Leaky server exposes users of dating site network

Security researchers at vpnMentor discovered an unprotected elasticsearch database online that leaked the personal details of hundreds of thousands of users of online dating sites. According to the researchers, the exposed database stored copies of push notifications that various online sites were sending to their users via Mailfire's push notification service. The leaky database stored more than 882 GB of log files on push notifications sent via Mailfire's service, with the logs being updated in real-time, as new notifications were being sent out. The log files contained details for 66 million individual notifications, belonging to more than 70 websites, sent over the previous 96 hours, with personal details for hundreds of thousands of users. The exposed data included users' names, age, gender information, email addresses, general geographical locations, and IP addresses. The database was successfully taken offline on September 3.

See the full report here: https://www.zdnet.com/article/leaky-server-exposes-users-of-dating-site-network/

New BlindSide attack uses speculative execution to bypass ASLR

Academics have developed a new technique for attacking secure computer systems by abusing speculative execution, a CPU mechanism that's normally used for performance optimizations. The technique, named BlindSide, can be used to craft exploits that bypass ASLR (Address Space Layout Randomization) on modern operating systems. The new attack works regardless of architecture, on both Intel and AMD CPUs. If an attacker knows where an app executes its code inside the memory, a hacker can fine-tune exploits that attack particular applications and steal sensitive information. To bypass ASLR, an attacker typically needs to find an "information leak" type of vulnerability that leaks memory locations; or the attacker can probe the memory until they find the proper location where another app runs and then modify their code to target that memory address space.

See the full report here: https://www.zdnet.com/article/new-blindside-attack-uses-speculative-execution-to-bypass-aslr/

US govt: China-sponsored hackers targeting Exchange, Citrix, F5 flaws - BleepingComputer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) has issued an advisory, warning that Chinese MSS-affiliated hackers are attacking US government agencies and private companies by exploiting vulnerabilities in Microsoft Exchange, Citrix, Pulse, and F5 devices and servers. The most notable vulnerabilities CISA has seen targeted by Chinese MSS-affiliated actors are CVE-2020-5902, CVE-2019-19781, CVE-2019-11510, and CVE-2020-0688. Once a network is compromised, the hackers download a variety of tools such as Cobalt Strike, China Chopper Web Shell, Mimikatz, and many more that allow them to gain further access to computers on the network. CISA and the FBI have advised that all organizations perform routine audits of their infrastructure and implement a robust patch management strategy to protect against these types of attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-china-sponsored-hackers-targeting-exchange-citrix-f5-flaws/

Staples discloses data breach exposing customer info - BleepingComputer

Staples, a company selling office supplies and related products, has disclosed a data breach. The company has notified the affected customers that data related to their orders have been accessed without authorization. The office retail giant is yet to determine what exactly got accessed but it could contain what Staples classified as "non-sensitive customer order data", including names, addresses, email addresses, phone numbers, last four credit card digits, and details about the orders (delivery, cost, product). However, the exposed details can still serve malicious purposes in email or phone call scams.

See the full report here: https://www.bleepingcomputer.com/news/security/staples-discloses-data-breach-exposing-customer-info/

UK government releases toolkit to easily disclose vulnerabilities - BleepingComputer

The National Cyber Security Centre (NCSC) in the U.K. has released a guideline named The Vulnerability Disclosure Toolkit to help companies implement a vulnerability disclosure process. The document published by the U.K. NCSC is not a rule book for easier vulnerability disclosure but provides essential information for a better process or for implementing it. It is organized in three main sections describing what can be done to direct external vulnerability information to the right person and the report follows a clear standard that defines an agreed framework for closing it. The release of the toolkit is the preamble for embedding vulnerability reporting into U.K.’s legislative frameworks. The government is currently preparing laws that require smart device makers to make available a public contact for a vulnerability disclosure policy.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-government-releases-toolkit-to-easily-disclose-vulnerabilities/

Department of Veteran Affairs discloses breach impacting 46,000 veterans

The Department of Veterans Affairs (VA) has disclosed a security breach during which the personal information of around 46,000 veterans was obtained by a malicious third-party. According to VA, the hackers used social engineering techniques and exploited the authentication protocol to gain access to the FSC app and diverted the payments intended for healthcare providers for the­ medical treatment of US veterans. VA believes that the hackers might have also accessed veteran records, including Social Security numbers. The department is investigating the incident. The FSC is alerting the affected individuals and offering access to credit monitoring services to those whose social security numbers may have been compromised.

See the full report here: https://www.zdnet.com/article/department-of-veteran-affairs-discloses-breach-impacting-46000-veterans/

Magento stores hit by largest automated hacking attack since 2015 - BleepingComputer

More than 2,000 Magento online stores have been hacked over the weekend. Adobe Magento is a popular eCommerce platform that allows web sites to quickly create an online store to sell their products and accept credit cards. Of the hacked stores, the majority were Magento version 1.x, which no longer receives security updates since June 2020 when it reached the end of support. The hackers breached the sites and planted malicious scripts inside the stores' source code, which logged payment card details that shoppers entered inside checkout forms. A threat actor named "z3r0day" was selling exploits for a zero-day and two recently patched vulnerabilities in Magento 1 for $5,000 on hacker forums. All Magento users are advised to upgrade to the Magento 2.x branch to avoid future attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/magento-stores-hit-by-largest-automated-hacking-attack-since-2015/

Billions of devices vulnerable to new 'BLESA' Bluetooth security flaw

A new security flaw dubbed BLESA (Bluetooth Low Energy Spoofing Attack) impacts devices running the Bluetooth Low Energy (BLE) protocol, including billions of smartphones, tablets, laptops, and IoT devices. Academics from Purdue University investigated the "reconnection" process that takes place after two BLE devices (the client and server) have authenticated each other during the pairing operation and found that the official BLE specification didn't contain strong-enough language to describe the reconnection process. As a result, two systemic issues, the authentication during the device reconnection is optional instead of mandatory and the authentication can potentially be circumvented if the user's device fails to enforce the IoT device to authenticate the communicated data, occur in the BLE software implementations, down the software supply chain. These two issues can allow a BLESA attack, during which a nearby attacker bypasses reconnection verifications and sends spoofed data to a BLE device with incorrect information, and induce human operators and automated processes into making erroneous decisions. The impacted devices are yet to receive patches.

See the full report here: https://www.zdnet.com/article/billions-of-devices-vulnerable-to-new-blesa-bluetooth-security-flaw/

Windows 10 ‘Finger’ command can be abused to download or steal files - BleepingComputer

A security researcher has discovered that Microsoft Windows TCPIP Finger command can also function as a file downloader and a makeshift command and control server that can serve for sending commands and exfiltrating data. The latest addition is finger[.]exe, a command that ships with Windows retrieve information about users on remote computers running the Finger service or daemon. Communication is carried via the Name/Finger network communication protocol. The C2 commands can be masked as finger queries that fetch files and exfiltrate data without Windows Defender detecting the anomalous activity. An attacker with sufficient privileges can bypass the restriction by using Windows NetSh Portproxy, which acts as a port redirector for the TCP protocol. This method would allow getting past firewall rules and communicate with servers over the unrestricted ports for HTTP(S). This way, Portproxy queries are delivered to the local machine IP and then forwarded to the specified C2 host. Using finger[.]exe to download files also has limitations but encoding them with Base64 aids to evade detection.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/

New MrbMiner malware has infected thousands of MSSQL databases - ZDNet

A new malware gang dubbed MrbMiner has been hacking into Microsoft SQL Servers (MSSQL) and installing a crypto-miner. According to the researchers at Tencent, the botnet has exclusively spread by scanning the internet for MSSQL servers and then performing brute-force attacks by repeatedly trying the admin account with various weak passwords. Once the attackers gain access to a system, they download an initial assm.exe file, which they use to establish a (re)boot persistence mechanism and to add a backdoor account for future access. The hackers then connect to the command and control server and download an app that mines the Monero (XMR) cryptocurrency by abusing local server resources and generating XMR coins into accounts controlled by the attackers.

See the full report here: https://www.zdnet.com/article/new-mrbminer-malware-has-infected-thousands-of-mssql-databases/

Windows Zerologon PoC exploits allow domain takeover. Patch Now! - BleepingComputer

Security researchers have released Proof-of-concept (PoC) exploit code for a Windows flaw, dubbed Zerologon that stems from the Netlogon Remote Protocol, available on Windows domain controllers, which is used for various tasks related to the user and machine authentication. The vulnerability tracked as CVE-2020-1472 is a privilege-escalation glitch with a CVSS score of 10, making it critical in severity. The flaw was addressed in Microsoft’s August 2020 security updates. However, this week at least four public PoC exploits for the flaw were released on Github, and on Friday, the security researchers who discovered the flaw published technical details of the vulnerability. If attackers are able to exploit the flaw, they can impersonate the identity of any machine on a network when attempting to authenticate to the Domain Controller, enabling further attacks, including the complete takeover of a Windows domain. It is strongly advised that Windows administrators deploy the first stage of the patch on their Active Directory Domain controller to protect their network.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-zerologon-poc-exploits-allow-domain-takeover-patch-now/

New Windows 10 updates are force installing Microsoft Edge

The latest Windows 10 updates appear to be forcibly installing Microsoft Edge onto user devices. The two new updates will install the latest version of Microsoft Edge and remove the old version. The download is identified in Windows Update as, "2020-08 Microsoft Edge Update for Windows 10 version 2004 (KB4576754)", and affects Windows 10 versions 1809, 1903, 1909, and 2004. A second update named KB4576753 is exclusively for Windows 10 1803 and will also install the new Microsoft Edge. While Microsoft says that users cannot remove the new Microsoft Edge installed via the above update, but it can be uninstalled using command line functions.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-windows-10-updates-are-force-installing-microsoft-edge/

Adobe releases out-of-band security update for Adobe Media Encoder

Adobe has released an out-of-band security update for Adobe Media Encoder that addresses three Information Disclosure security vulnerabilities. These flaws could allow attackers to access sensitive information. Adobe advises customers to update the vulnerable apps to the latest versions (Media Encoder 14.4) to patch the vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-releases-out-of-band-security-update-for-adobe-media-encoder/

h2c Smuggling: A New 'Devastating' Kind of HTTP Request Smuggling

A researcher from Bishop Fox, a cybersecurity company, introduced a new form of HTTP request smuggling attack called H2c smuggling. H2c is an established shorthand for HTTP / 2, triggered by the upgrade header in HTTP / 1.1 sent over cleartext. In an H2c smuggling attack, an attacker can use H2c to send requests to an intermediate server (proxy server), which then bypasses access control mechanisms to the server. The H2c smuggling attack does not directly affect consumers, but with its help attackers can gain unauthorized access to their data or perform actions using their accounts. The widespread vulnerability can impact any proxy including API and payments.

See the full report here: https://www.darkreading.com/edge/theedge/h2c-smuggling-a-new-devastating-kind-of-http-request-smuggling-/b/d-id/1338935

LockBit ransomware launches data leak site to double-extort victims - BleepingComputer

The LockBit ransomware gang has launched a new data leak site to be used as part of their double extortion strategy to scare victims into paying a ransom. Since the end of 2019, ransomware gangs have adopted a double extortion tactic of stealing unencrypted files before encrypting the computers on a network. The gang uses the stolen files and threat that they will be publicly released on data leak sites as leverage to get victims to pay a ransom. According to cybersecurity intelligence firm Kela, the LockBit ransomware operation posted a link yesterday on a Russian-speaking hacker forum to their new data leak site. The data leak site currently contains two victims; an automation parts manufacturer and a shipping company.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-launches-data-leak-site-to-double-extort-victims/

Fake Zoom alerts and dodgy medical freebies among COVID-cracks detected by Taiwan's CERT

Taiwan's CERT detected cyber-crooks impersonating medical authorities to attack the country's tech industry during the early stages of the COVID pandemic. One group named "Mustang Panda" impersonated Taiwan's Ministry of Health and Welfare. In June, the group sent phishing emails offering free medical supplies to businesses. The PowerPoint attached to the email contained macro files which created a backdoor connection to a malicious server. The email was in the traditional Chinese language used in Taiwan and claimed to be the National Health Commission, a name that is widely used in mainland China. Hackers also targeted video conferencing with emails that appeared to be notifications of missed Zoom meetings. These emails aimed to create a sense of urgency and panic, a key trait of many scams to get people to click the link and provide personal information. According to the CERT director, such attacks were not attempts to steal data but to disrupt access to critical data or systems.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/09/17/taiwans_cert_analsyes_covid_hacks/

Google Chrome is making it easier to reset compromised passwords

Google Chrome is adding a new feature that will make it easier for users to reset stored passwords that have been detected as compromised in data breaches. The company plans on rolling out support in for this in Chrome 86, the browsers 'Check passwords' feature that checks if any stored credentials have been compromised. This feature will not work without the support of web sites. Websites can set a well-known change-password URL using the format, '/.well-known/change-password', to allow users to quickly navigate to a page allowing them to change their password. Chrome will leverage this URL to help users easily change their weak/compromised passwords following a bulk password check. When Chrome determines that a password has been compromised in a data breach, it displays a 'Change password' button.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-is-making-it-easier-to-reset-compromised-passwords/