Threat Intelligence Bulletin: 10/09/2020

Patch Tuesday 10/14/2020 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Microsoft's Patch Tuesday update for October 2020 contained 88 vulnerabilities in total, with:

1 vulnerability rated as Critical
65 vulnerabilities rated as High
22 vulnerabilities rated as Medium

Note: Total includes 1 October 2020 Adobe Flash Security Advisory

Critical vulnerabilities

The most notable critical-rated vulnerabilities is tracked as CVE-2020-16898.

CVE-2020-16898, AKA BadNeighbor

CVE-2020-16898 is a remote code execution vulnerability that exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client. To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer.

The following products are affected by CVE-2020-16898:

Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server, version 1903 (Server Core installation)
Windows Server, version 1909 (Server Core installation)
Windows Server, version 2004 (Server Core installation)

The proof-of-concept to exploit this vulnerability is available. Microsoft’s latest security update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets. McAfee has a blog post detailing their findings.

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-16947, CVE-2020-16899, CVE-2020-16907, CVE-2020-16913 and CVE-2020-16896, and CVE-2020-16952

CVE-2020-16947

CVE-2020-16947 is a remote code execution vulnerability that exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file. This vulnerability affects the following Microsoft products:

Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2019 for 64-bit editions
Microsoft Outlook 2016 (32-bit edition)
Microsoft Outlook 2016 (64-bit edition)

Microsoft’s latest security update addresses the vulnerability by correcting how Outlook handles objects in memory.

CVE-2020-16899

CVE-2020-16899 is a denial of service vulnerability that exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could cause a target system to stop responding. To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer. The vulnerability would not allow an attacker to execute code or to elevate user rights directly. This vulnerability affects the following Microsoft products:

Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server, version 1903 (Server Core installation)
Windows Server, version 1909 (Server Core installation)
Windows Server, version 2004 (Server Core installation)

CVE-2020-16952

CVE-2020-16952 is a remote code execution vulnerability that exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. This vulnerability affects the following Microsoft products:

Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft SharePoint Server 2019

The proof-of-concept of this vulnerability is available. Microsoft’s latest security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.

CVE-2020-16907

CVE-2020-16907 is an elevation of privilege vulnerability that exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. This vulnerability affects the following Microsoft products:

Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server, version 1903 (Server Core installation)
Windows Server, version 1909 (Server Core installation)
Windows Server, version 2004 (Server Core installation)

Microsoft’s latest security update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.

CVE-2020-16913

CVE-2020-16913 is an elevation of privilege vulnerability that exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. This vulnerability affects the following Microsoft products:

Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server, version 1903 (Server Core installation)
Windows Server, version 1909 (Server Core installation)
Windows Server, version 2004 (Server Core installation)

Microsoft’s latest security update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.

CVE-2020-16896

CVE-2020-16896 is an information disclosure vulnerability that exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would need to run a specially crafted application against a server which provides Remote Desktop Protocol (RDP) services. This vulnerability affects the following Microsoft products:

Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server, version 1903 (Server Core installation)
Windows Server, version 1909 (Server Core installation)
Windows Server, version 2004 (Server Core installation)

Microsoft’s latest security update addresses the vulnerability by correcting how RDP handles connection requests.

Other Microsoft Vulnerabilities

Other notable Microsoft vulnerabilities are remote code execution vulnerabilities tracked as CVE-2020-16951, CVE-2020-16923, CVE-2020-16911, CVE-2020-16891and CVE-2020-16967 impacting Microsoft SharePoint, Microsoft Graphics Components, GDI+, Windows Hyper-V and Windows Camera Codec Pack. CVE-2020-16915 is a memory corruption vulnerability impacting Windows Media Foundation. CVE-2020-16922 is another interesting bug that could potentially be used to spoof verification of trust for a potentially malicious file. It impacts Windows operating systems and servers.

The latest Microsoft Security Update did not contain any zero-days and, as of now. There are proof-of-concepts available for CVE-2020-16898 and CVE-2020-16952. At the time of reporting there is no evidence of it being actively exploited.

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Kr3pto Phishing Kits used in campaign targeting US, UK Financial Institutions

ZeroFOX Alpha Team has recently been tracking the activity of a threat actor known by the alias of “Kr3pto”, who provides services such as authoring, selling and distribution of phishing kits. Kr3pto facilitates the selling of their kits, phished credentials and fullz through Telegram. Multiple kits authored by Kr3pto are being used in an ongoing campaign targeting UK financial institutions and their customers, with Alpha Team obtaining multiple copies of these kits, disrupting hundreds of domains used for the attack and collecting thousands of compromised credentials. Alpha Team assesses with HIGH confidence that Kr3pto will continue to build kits and maintain their presence as a reliable vendor for stolen credentials and financial information on Telegram.

Recommendations

Consider enabling ZeroFOX domain security rules for keywords related to your brand, in order to detect imposter domains. Reach out to [email protected] for assistance if needed
Consider enabling ZeroFOX cyber attack chatter rules to search for terms related to your organization on the dark web and covert communication channels, such as Telegram
If ZeroFOX provides your organization with credentials that were downloaded from vulnerable kits, consider resetting passwords of all victims to prevent account takeover

Details

Phishing kits are pre-packaged scripts and code using standard web app directory structures containing Javascript, CSS and static images stored in separate directories. PHP is used to direct data control flows on the backend server, while jQuery and Javascript are used for dynamic content rendering in the frontend. These kits are designed for ease of use to allow unskilled threat actors to quickly create a phishing site designed to obtain victim credentials, credit card details or other sensitive information.

Threat actors such as Kr3pto provide the cybercrime ecosystem with their skills as kit authors and sell kits through specially designed marketplaces and through negotiation which takes place on Telegram.

Figure 1: Kr3pto sells his pre-made kits and offers to make new ones by request

Figure 2: Patrons of Kr3pto’s Shop use Telegram to Purchase Stolen Credentials and Financial Data

As of October 2020, Kr3pto is actively selling kits targeting multiple banks and financial institutions in the US and UK. In the beginning of October, Alpha Team tracked a large-scale phishing campaign against 2 large UK institutions, targeting customers from those institutions. Alpha Team downloaded dozens of kits used during this campaign and reverse engineered them to provide insight into how Kr3pto kits operate.

These kits contain an administration panel which the threat actor operating the deployment can use to direct the victim through the phishing workflow. These kits are referred to as “puppeteer kits”, as the operator effectively “pulls the strings” in order to extract information from the potential victim including credentials, credit card details and even SMS and OTP tokens.

Figure 3: Admin panel for Kr3pto kits

After reverse engineering the Kr3pto kits, Alpha Team identified vulnerabilities within these deployments that allowed unauthenticated download of victim data, which we subsequently provide to affected customers.

Figure 4: Victim panel for Kr3pto kits

Over the course of the campaign, Alpha Team collected over 1,000 phishing domains, dozens of kits and over 10,000 victim credentials. Alpha Team subsequently collected, analyzed and escalated this information to the affected customers.

Alpha Team assesses with HIGH confidence that Kr3pto will continue building phishing kits for customers. He has expressed that he can build kits on demand. His shop, which is an invite only channel, has over 1,300 members. This could be due to his inventory of kits, fullz and compromised credentials.

Breaking News: 2020-10-09 - 2020-10-15

240+ Android apps caught showing out-of-context ads

Google has recently removed more than 240 Android applications from the official Play Store for showing out-of-context ads and breaking a newly introduced Google policy against this type of intrusive advertising. Out-of-context ads (also known as out-of-app ads) are mobile ads that are shown outside an app's normal container. They can appear as pop-ups or as full-screen ads. According to the ad fraud detection firm White Ops, most of the apps were gaming-related, cloned from legitimate apps, which included a malicious component known as "com.timuz.a" that was responsible for showing the misleading, out-of-context ads.

See the full report here: https://www.zdnet.com/article/240-android-apps-caught-showing-out-of-context-ads/

Amazon Prime Day Spurs Spike in Phishing, Fraud Attacks

Cybercriminals are tapping into Amazon’s annual discount shopping campaign for subscribers, Prime Day, with researchers warning of a recent spike in phishing and malicious websites that are fraudulently using the Amazon brand. Researchers have analyzed millions of web pages to track the number of new phishing and fraudulent sites using the Amazon brand and logos. The research shows that threat actors are taking advantage of both Amazon features and consumer behaviors to try to lure online shoppers to fraudulent sites and steal their credentials, financial information, and other sensitive data. Shoppers are advised to be aware of cybercriminals and shop directly from the source.

See the full report here: https://threatpost.com/amazon-prime-day-spurs-spike-in-phishing-fraud-attacks/159960/

Waterbear malware used in attack wave against government agencies

Researchers have spotted a fresh Waterbear campaign in which Taiwanese government agencies have been targeted in sophisticated attacks. The attackers stole credentials from compromised endpoints from their past attacks, and leveraged this to access the victim's internal network and covertly establish a connection to the group's command-and-control (C2) server. A vulnerability in the DLP tool was then used to perform DLL hijacking. As the software failed to verify the integrity of DLLs it was loading, the malicious file was launched with a high level of privilege. This DLL then injected shellcode into various Windows system services, allowing the Waterbear loader to deploy additional malicious packages. The loader used a technique called “Heaven’s Gate”, which is used to trick Microsoft Windows operating systems into executing 64-bit code, even when declared as a 32-bit process. This, in turn, can be used to bypass security engines and to inject shellcode.

See the full report here: https://www.zdnet.com/article/waterbear-malware-used-in-attack-wave-against-government-agencies/

Microsoft Azure Flaws Open Admin Servers to Takeover

Researchers have disclosed two flaws in Microsoft’s Azure web hosting application service, App Services, which if exploited could enable an attacker to take over administrative servers. Azure App Services is an HTTP-based service for hosting web applications and is available in both Microsoft Azure Cloud and on-premise installations. The two vulnerabilities in the cloud service specifically affect Linux servers, and these do not have CVE assignments. When these two vulnerabilities combined, it enables any attacker with the ability to forge post requests (SSRF) or remote code execution on an Azure App Service to take over the Azure App Service administration server. Both flaws were discovered three months ago and reported to Microsoft. Microsoft has since issued a fix.

See the full report here: https://threatpost.com/microsoft-azure-flaws-servers-takeover/159965/

QNAP fixes critical flaws that could lead to device takeover - BleepingComputer

QNAP has addressed two critical security vulnerabilities in the Helpdesk app that could enable potential attackers to take over unpatched QNAP network-attached storage (NAS) devices. Helpdesk is the built-in app that comes with QNAP's NAS devices and allows admins to submit help requests to the QNAP support team over the Internet. The app also comes with a remote support feature that allows remotely connecting to the device with the owner's permission. The vulnerabilities are tracked as CVE-2020-2506 and CVE-2020-2507. They are both improper access control vulnerabilities that could allow attackers to obtain control of a QNAP device if successfully exploited. QNAP has fixed these security flaws in Helpdesk 3.0.3 and later and has urged customers to update the app to the latest available version as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-fixes-critical-flaws-that-could-lead-to-device-takeover/

US Seizes Domain Names Used in Iranian Disinformation Campaign

Department of Justice reported that the United States had seized 92 domain names that Iran's Islamic Revolutionary Guard Corps (IRGC) used in a global disinformation campaign. Four of the domains claimed to be legitimate news outlets but were controlled by the IRGC, which targeted the US with Iranian propaganda to influence domestic and foreign policy. These domain names included "newsstand7[.]com," "usjournal[.]net," "usjournal[.]us," and "twtoday[.]net", which were seized as they violated the Foreign Agents Registration Act (FARA). The remaining 88 websites were used to spread Iranian propaganda around the world and targeted audiences in Western Europe, the Middle East, and Southeast Asia. These also were disguised to appear as genuine news websites while being used by the IRGC to spread disinformation intended to benefit the Iranian government.

See the full report here: https://www.darkreading.com/threat-intelligence/us-seizes-domain-names-used-in-iranian-disinformation-campaign/d/d-id/1339122

MontysThree threat actor targets Russian industrial organizations

A previously unknown threat actor, tracked as MontysThree, composed of Russian speaking members targets Russian industrial organizations. According to Kaspersky Lab researchers, the group used a toolset dubbed MT3 in highly targeted attacks with cyber espionage purposes. The malware used by MontysThree actor has a modular structure, experts analyzed four modules written in C++, the loader, the kernel, HttpTransport, and LinkUpdate. The malware allows operators to search for specific Microsoft Office and Adobe Acrobat documents and steal them, capture screenshots, and collect information on the compromised machine. The malware can store stolen data on major cloud services, including Google, Microsoft, and Dropbox, this is a common technique to hide the malicious traffic. The presence of many artifacts in the code of the malware suggests that its developers are Russian-speaking coders and that it is targeting Cyrillic Windows versions.

See the full report here: https://securityaffairs.co/wordpress/109242/apt/montysthree-threat-actors.html?utm_source=rss&utm_medium=rss&utm_campaign=montysthree-threat-actors

Sam's Club resets passwords after thousands of logins posted online

Sam's Club has reset passwords for thousands of customers after their account details were posted online. In an email sent to Sam's Club members, the Walmart-owned company has started sending the automated password reset emails and security notifications to customers. It comes after over 14,600 email addresses and plain-text passwords associated with Sam's Club's online store were dumped on Pastebin, a text sharing site, on Saturday. According to the company, the validated usernames and passwords on this list were on other lists posted on the darknet previously, indicating that they had come from previous breaches. The password dump was automatically submitted to the Have I Been Pwned database, where users can check to see if their details appear.

See the full report here: http://www.zdnet.com/article/sams-club-resets-passwords-after-thousands-of-logins-posted-online/

Wormable Apple iCloud Bug Allows Automatic Photo Theft

A group of ethical hackers cracked open Apple’s infrastructure and systems and, over three months, discovered 55 vulnerabilities, many of which would have given attackers complete control over customer and employee applications. Of the 55 vulnerabilities discovered, 11 were rated with critical severity, 29 with high severity, 13 with medium severity, and two with low severity. A critical, wormable iCloud bug is a cross-site scripting (XSS) issue that would allow attackers to automatically steal all of a victim’s documents, photos, videos, and more. Apple responded quickly to the bug reports, fixing the majority of them.

See the full report here: https://threatpost.com/3-month-apple-hack-vulnerabilities-critical/159988/

Software AG IT giant hit with $23 million ransom by Clop ransomware - BleepingComputer

The Clop ransomware gang hit the network of German enterprise software giant Software AG last Saturday, asking for a ransom of $23 million after stealing employee information and company documents. According to the investigation, the IT infrastructure of the company was targeted on October 3, 2020, that affected only the internal networks. The Clop ransomware's leak site revealed that the attackers were able to steal information on employees' passports, health bills, and emails, also publishing a screenshot with a folder tree containing additional info potentially stolen from Software AG. The threat actors threatened to publish the entire batch of roughly 1 TB of data if the ransom is not paid. While services to its customers, including its cloud-based services, remain unaffected, the company is in the process of restoring its systems and data in order to resume orderly operation.

See the full report here: https://www.bleepingcomputer.com/news/security/software-ag-it-giant-hit-with-23-million-ransom-by-clop-ransomware/

Document-signing service Docsketch discloses security breach

Electronic document-signing service Docsketch is notifying its customers about a security breach that took place over the past summer. In an email sent to customers, the company said that an unauthorized third-party gained access to a copy of its database in early August this year that contained a snapshot of the Docsketch service dated July 9, 2020. This database contained contact information and form fields related to documents filled out by users and users' recipients. The firm said the intruder(s) did not access the documents themselves, but they could read what information users filed inside the documents such as names, signatures, personal data, and even payment card details, where required. The database also contained login information, user contacts (persons asked to fill in documents), and passwords. However, the password strings were salted and hashed. The firm has already secured its system and updated its infrastructure following the August intrusion.

See the full report here: https://www.zdnet.com/article/document-signing-service-docsketch-discloses-security-breach/

Latest Version of MalLocker Android Ransomware Packs New Tricks

Security researchers at Microsoft have spotted a dangerous new version of MalLocker, a constantly evolving Android ransomware family that has been floating around in the wild since at least 2014. MalLocker is being distributed via arbitrary websites and online forums or hidden in popular apps and video players for mobile devices. The new variant does not actually encrypt data on infected devices, instead it attempts to prevent users from using an infected device by displaying a ransom note over every window. Regardless of what button the user clicks, the ransom note remains on top of all other windows. The new variant abuses two functions that are present in recent versions of Android to achieve persistence. First, it sets its notification as a very important notification requiring immediate user attention. Second, the malware is designed to ensure that this notification is always displayed when the user tries to do other activities or performs other functions. It does this by using a callback to know when a user might have completed a specific action so it can promptly display the ransom note. In addition, the new version also incorporates an open-source machine-learning module that lets it know an infected device's screen size so the ransom note can be automatically resized and cropped to fit it without distortion. Microsoft stated that users with infected devices can try rebooting the system in safe mode and then uninstalling the malware.

See the full report here: https://www.darkreading.com/mobile/latest-version-of-mallocker-android-ransomware-packs-new-tricks/d/d-id/1339144

Fitbit Spyware Steals Personal Data via Watch Face

Security researchers at Immersive Labs built a malicious spyware watch face by taking advantage of lax Fitbit privacy controls. A wide-open app-building API would allow an attacker to build a malicious application that could access Fitbit user data, and send it to any server. It could send device type, location, and user information including gender, age, height, heart rate, weight, and calendar information. Since all of this information was available via the Fitbit application developer API, the researchers created a malicious watch face, which was then made available through the Fitbit Gallery to appear legitimate. Using a dashboard used by development teams to preview apps, the researchers submitted the spyware and soon had their URL at https://gallery[.]fitbit.com/details/,”. When the link was clicked on any mobile device, it opened inside the Fitbit app with all thumbnails perfectly rendered as if it were a legitimate app. It was also found that Fitbit’s fetch API allows the use of HTTP to internal IP ranges, which can be abused to turn the malicious watch face into a primitive network scanner. The issue was reported to Fitbit and the issue was fixed since then.

See the full report here: https://threatpost.com/fitbit-personal-data-watch-face/160003/

Tyler Technologies paid ransomware gang for decryption key - BleepingComputer

On September 23rd, Tyler Technologies suffered a cyberattack by the RansomExx ransomware operators, who were also behind recent attacks on Konica Minolta and IPG Photonics. In response to the attack, Tyler Technologies immediately disconnected portions of their network to contain the ransomware's spread and limit their clients' exposure. According to a source, Tyler Technologies paid the ransom demand to recover encrypted data. However, Tyler Technologies did not dispute the ransom payment but told that they could not disclose any further information at this time.

See the full report here: https://www.bleepingcomputer.com/news/security/tyler-technologies-paid-ransomware-gang-for-decryption-key/

Largest cruise line operator Carnival confirms ransomware data theft - BleepingComputer

In a 10-Q form filed with the U.S. Securities and Exchange Commission (SEC), Carnival Corporation confirms the leak of personal information of customers, employees, and ship crews stolen during a ransomware attack that took place on August 15, 2020. The discovery was made during an investigation led by a major cybersecurity firm hired by Carnival following the August 15 incident. The company has also notified data regulators and relevant law enforcement agencies. Carnival Corporation also stated that there is currently no indication of any misuse of the stolen information. Cybersecurity intelligence firm Bad Packets discovered several potential points of initial compromise that the ransomware attackers might have used as an entry point into Carnival's network. However, Carnival did not disclose if any of its servers were compromised during the August 2020 incident.

See the full report here: https://www.bleepingcomputer.com/news/security/largest-cruise-line-operator-carnival-confirms-ransomware-data-theft/

Children and parent info exposed in Georgia DHS data breach

Georgia Department of Human Services (DHS) has reported a security breach that took place over the spring. Georgia DHS officials said that between May 3, 2020, and May 15, 2020, hackers gained access to several employee email accounts that contained personal and health information of children and adults involved in Child Protective Services (CPS) cases of the DHS Division of Family & Children Services (DFCS). Exposed information may have included the full name of children and household members, relationship to the child receiving services, county of residence, DFCS case number, DFCS identification numbers, date of birth, age, number of times contacted by DFCS, an identifier of whether face-to-face contact was medically appropriate, phone numbers, email addresses, social security number, Medicaid identification number, Medicaid medical insurance identification number, medical provider name, and appointment dates. Additionally, for 12 individuals, psychological reports, counseling notes, medical diagnoses, and substance abuse information was also included. Georgia DHS confirmed that bank account information was not included, except for one individual. The agency is currently in the process of notifying all impacted individuals.

See the full report here: https://www.zdnet.com/article/children-and-parent-info-exposed-in-georgia-dhs-data-breach/

Critical Zerologon Flaw Exploited in TA505 Attacks

In a new campaign, attackers are exploiting the critical Zerologon vulnerability (CVE-2020-1472) with software update lures that connect with known TA505, a Russian-speaking threat group, command-and-control infrastructure, Microsoft reports. CVE-2020-1472 exists when an attacker creates a vulnerable Netlogon secure channel connection to a domain controller using MS-NRPC. With this, they don't need to authenticate to elevate privileges and become an admin. The campaign is distributing fake software updates that lead to UAC bypass and using wscript[.]exe to run malicious code. According to Microsoft, to exploit this vulnerability, the attackers abuse MSBuild[.]exe to compile Mimikatz updated with built-in Microsoft functionality.

See the full report here: https://www.darkreading.com/threat-intelligence/critical-zerologon-flaw-exploited-in-ta505-attacks/d/d-id/1339141

Spotless hit by ransomware attack - Security - iTnews

Spotless Group, a high-profile Australian company, has been hit by a ransomware attack. The Spotless Group is an outsourced provider of services, such as asset maintenance and management, cleaning, laundry, facilities management, and physical site security. The company has restricted access to some of its servers and has notified the Australian Cyber Security Centre (ACSC) following the cyberattack. The spokesperson said that it was unclear which of Spotless’ servers had been targeted by the attackers, although its public-facing website remains online. However, Spotless managed to provide uninterrupted services to its customers.

See the full report here: https://www.itnews.com.au/news/spotless-hit-by-ransomware-attack-554554

Underestimating the FONIX – Ransomware as a Service could be an error

First observed in July 2020, FONIX is a new ransomware-as-a-service (RaaS) tool created by an unnamed threat actor. The actors behind FONIX appeared to be primarily focused on binary crypters/packers before the release of the RaaS. Their products were advertised on various cybercrime forums, as well as paste-based advertisements on the Dark Web. FONIX can be delivered in any manner affiliates choose. The FONIX ransomware only targets Windows systems, once delivered, by default it encrypts all file types, excluding critical Windows OS files using a combination of AES, Salsa20, ChaCha, and RSA algorithms. Encrypted files are appended with the XONIF extension, and a ransom note is displayed as the desktop background. Currently, FONIX does not appear to be threatening victims with additional consequences such as public data exposure or DDoS attacks.

See the full report here: https://securityaffairs.co/wordpress/109369/cyber-crime/fonix-raas.html

Hacker groups chain VPN and Windows bugs to attack US government networks

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have warned of the ongoing cyberattacks emanating from VPN and Windows bugs, targeting federal and state, local, tribal, and territorial (SLTT) government networks. According to the joint alert, the observed attacks combined two security flaws, CVE-2018-13379, a vulnerability in the Fortinet FortiOS Secure Socket Layer (SSL) VPN, and CVE-2020-1472, a vulnerability in Netlogon, the protocol used by Windows workstations to authenticate against a Windows Server running as a domain controller. These two vulnerabilities are combined to hijack Fortinet servers and then pivot and take over internal networks using Zerologon. CISA and the FBI recommended that entities in both the private and public US sector update systems patch the two bugs as soon as possible to avoid future attacks.

See the full report here: https://www.zdnet.com/article/hacker-groups-chain-vpn-and-windows-bugs-to-attack-us-government-networks/

Hackers target 20 Israeli digital currency execs in multiple failed attacks - CoinGeek

Hackers have attacked over 20 executives in Israeli digital currency companies and reportedly took over the phones of their victims. Further, the attackers accessed the victims' social media, email accounts, and reached out to the victims’ contacts in an attempt to lure them to send digital currencies to the hackers' wallets. The attack was carried out by a sophisticated team of hackers that may have been state-sponsored, Israeli newspaper Hareetz reported. The earliest known incident was of an unnamed executive whose Telegram account was taken over by the hackers. The issue is under investigation. However, claims are that the hackers didn’t receive any digital currencies from their victims.

See the full report here: https://coingeek.com/hackers-target-20-israeli-digital-currency-execs-in-multiple-failed-attacks/

Massachusetts school district shut down by ransomware attack

The Springfield Public Schools district in Massachusetts suffered a ransomware attack that has caused the closure of schools while they investigate the cyberattack. Due to the COVID-19 pandemic, the school district opened in a remote learning model, with a planned transition to hybrid learning towards the end of October. The district announced the incident on Facebook, Twitter, and with calls to parents. The students were also informed about the cyberattack and directed to shut down the school devices to contain the spread of ransomware infection. Currently, the school is investigating the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/massachusetts-school-district-shut-down-by-ransomware-attack/

Amazon Prime Day shoppers targeted with malware and phishing campaigns - SiliconANGLE News

Hackers are actively targeting Amazon.com Inc.’s annual Amazon Prime Day with emails and SMS text messages that offer fake deals to trick users into downloading malware or to “phish” their Amazon accounts by appearing to be someone the account owner knows. Bolster Inc. and Check Point Software Technologies Ltd. have warned of an alarming increase in the number of registered domains related to Amazon that are malicious. Shoppers are advised to stay alert to avoid giving up their personal information or buying products on fraudulent sites for things they will never receive.

See the full report here: https://siliconangle.com/2020/10/12/amazon-prime-day-shoppers-targeted-malware-phishing-campaigns/

Ransomware operators now outsource network access exploits to speed up attacks

Accenture's Cyber Threat Intelligence (CTI) team has released new research on emerging cybersecurity trends, including an investigation into the nature of relationships between ransomware operators and exploit sellers. Network access sellers typically develop an initial vulnerability and then sell their work in underground forums for anywhere between $300 and $10,000. The majority of network access offerings in the underground will include the target by industry and the type of access, ranging from Citrix to Remote Desktop Protocol (RDP), and may also document the number of machines detected on the network. As of September this year, Accenture has tracked over 25 persistent network access sellers. Many of the sellers are active on the same underground forums haunted by ransomware groups, including Maze, NetWalker, Sodinokibi, Lockbit, and Avaddon.

See the full report here: https://www.zdnet.com/article/ransomware-operators-buy-network-access-from-the-underground-to-speed-up-infection/

Einstein Health Network employee email hack exposes 1,821 patients' info: 4 details - Becker's Hospital Review

Philadelphia-based Einstein Healthcare Network reported that some of their protected health information has potentially been accessed by unauthorized individuals who gained access to certain employee email accounts. The incident affected 1,821 patients' information. The security breach was detected on August 10, 2020. The investigation revealed that the attacker gained access to email accounts between August 5 and August 17, 2020. A review of the compromised email accounts revealed they contained patients’ names, dates of birth, medical record or patient account numbers, treatment, or clinical information, such as diagnoses, medications, providers, types of treatment, or treatment locations. Some patients also had their health insurance information and Social Security number exposed. Einstein Healthcare Network has re-trained employees on how to identify and avoid suspicious emails, and adequate steps have been taken to improve the security of its email environment.

See the full report here: https://www.beckershospitalreview.com/cybersecurity/einstein-health-network-employee-email-hack-exposes-1-821-patients-info-4-details.html

Watchdog urges more action to protect planes from hackers - Associated Press

A government watchdog agency reported on Friday that the Federal regulators have not taken adequate steps to protect computer systems on airliners from hackers. The agency said the Federal Aviation Administration has not developed a training program for cybersecurity or test airplane computer systems that could be vulnerable to attack. The Government Accountability Office recommends the FAA to conduct a risk assessment and train inspectors to judge the security of avionics systems. They said that the FAA should also enact guidance that includes independent testing of cybersecurity on new airplane designs. In response, the FAA said that they agreed with most of the watchdog agency’s recommendations and has started addressing cybersecurity risks to planes since 2005 using the standards that were created with the help of the aviation industry.

See the full report here: https://apnews.com/article/hacking-archive-2efc9c96061f671d4c91a7ad33cb694d

Researchers found alleged sensitive documents of NATO and Turkey

Researchers from Cyble found a post shared by an unknown threat actor that goes online with the moniker Spectre123, where he has allegedly leaked the sensitive documents of NATO and Havelsan (Turkish Military/defense manufacturer). The leaked sensitive documents include Statement of Work files, proposals, contracts, 3d designs, resumes, excel sheets containing raw materials information, and financial statements. The availability of sensitive documents could allow threat actors to gather intelligence on potential targets and use the leaked information to carry out spear-phishing campaigns.

See the full report here: https://securityaffairs.co/wordpress/109386/breaking-news/nato-turkey-data-leak.html

Microsoft partnered with other security firms to takedown TrickBot botnet

Microsoft’s Defender team, FS-ISAC, ESET, Lumen’s Black Lotus Labs, NTT, and Broadcom’s cyber-security division Symantec joined forces to announce a coordinated effort to take down the command and control infrastructure of the infamous TrickBot botnet. Internet service providers (ISPs) and computer emergency readiness teams (CERTs) around the world also supported the operation by notifying all infected users. The TrickBot botnet was considered by security experts one of the biggest botnets and had infected more than one million devices at the time of its takedown. The security firms have collected more than 125,000 TrickBot malware samples and mapped the command and control infrastructure. The information gathered by the security firm was used by Microsoft to receive a warrant to takedown the TrickBot servers. Microsoft Digital Crime Unit pointed represents a new legal approach for the takedown that includes copyright claims against Trickbot’s operators that have illegally used the software code of the IT giant.

See the full report here: https://securityaffairs.co/wordpress/109411/malware/trickbot-botnet-takedown.html

Leading Law firm Seyfarth Shaw discloses ransomware attack

International law firm Seyfarth Shaw announced it was the victim of a ransomware attack. According to the company, the attack took place on October 10, 2020. The law firm did not disclose details about the attack. It is not clear the family of ransomware that hit the company and the extent of the security incident. The company states that its monitoring systems caught the unauthorized activity and quickly stopped the spread. The firm confirmed that many of its systems were encrypted, and it is not aware of unauthorized access to its client or firm data. The company notified law enforcement and supporting the investigation conducted by the FBI.

See the full report here: https://securityaffairs.co/wordpress/109435/malware/seyfarth-shaw-ransomware-attack.html

Lemon Duck Cryptocurrency-Mining Botnet Activity Spikes

Security researchers are warning of a recent upsurge in the activity of the Lemon Duck cryptocurrency-mining botnet targeting victims’ computer resources to mine the Monero virtual currency. While the botnet has been active since at least the end of December 2018, researchers observed an increase in DNS requests connected with its command-and-control (C2) and mining servers since the end of August, in a slew of attacks centered on Asia. The recent attacks include less-documented modules loaded by the main PowerShell component, including a Linux branch and a module allowing further spread by sending emails to victims with COVID-19 lures. After the initial infection, a PowerShell loading script is downloaded, which disables Windows Defender real-time detection and put powershell.exe on the list of processes excluded from scanning. If the script is running with administrative privileges, the payload is downloaded and run using the Invoke-Expression cmdlet. If not, it leverages existing system executables to launch the next stage. The executable modules are then downloaded and driven by the main module, communicates with the C2 server over HTTP.

See the full report here: https://threatpost.com/lemon-duck-cryptocurrency-botnet/160046/

London Borough of Hackney suffers ‘serious’ cyberattack

London's Hackney Council has been hit by a cyberattack affecting its services and IT systems. Officials are working with the National Cyber Security Centre, external experts, and the Ministry of Housing, Communities, and Local Government to investigate the hack and understand the impact of the incident. The residents may encounter difficulties accessing online services, such as payment systems and One Account. Experts suspect that the incident could be a ransom attack.

See the full report here: https://www.bleepingcomputer.com/news/security/london-borough-of-hackney-suffers-serious-cyberattack/

Mozilla releases Firefox 81.0.2 to fix Twitter errors

Mozilla has released Firefox 81.0.2 to the Stable desktop channel for Windows, macOS, Linux, and Android. Firefox 81.0.2 fixes a known issue affecting a large number of Firefox users that caused the web browser to display blank pages or errors instead of loading Twitter pages on both desktop and mobile devices. Though Mozilla has not shared the Firefox versions impacted by this problem, according to users, the Twitter loading errors started to appear after updating to Firefox 81.0 last month. Users can update to Firefox 81.0.2 by going to Options -> Help -> About Firefox, and the browser will automatically check for the new update and install it when available. For users who can't update to the latest version of Firefox immediately, Mozilla has also provided workaround procedures.

See the full report here: https://www.bleepingcomputer.com/news/software/mozilla-releases-firefox-8102-to-fix-twitter-errors/

For Foxit's sake: Windows and Mac users alike urged to patch PhantomPDF over use-after-free vulns

CISA has published a threat report counting four vulnerabilities affecting Foxit's popular PhantomPDF reader. PhantomPDF is a PDF software application for both businesses and personal users. According to the report, one of the vulnerabilities could expose the application to Use-After-Free flaw and crash when executing JavaScript in certain AcroForm. This occurs due to the use of Opt object after it has been deleted by calling Field::ClearItems while executing Field::DeleteOptions method. The vulnerabilities are rated as critical and have a CVSSv3 score of 9.8. Foxit has addressed these issues and advised its users to update their installations to the latest version.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/10/13/foxit_phantompdf_vulns_update/

Adobe fixes critical security vulnerability in Flash Player

Adobe has released a security update to address a critical remote code execution vulnerability in Adobe Flash Player. The vulnerability is tracked as CVE-2020-9746 and could be exploited by inserting malicious strings in HTTP responses when users visit a website. If exploited, the vulnerability could lead to a crash, allowing the attacker to execute commands on a visitor's computer remotely. These commands would be executed under the security context of the user and would not have administrator privileges. Adobe has fixed the issue in Flash Player 32.0.0.445. Users are advised to install the latest fixed version as soon as possible to prevent attacks emanating from CVE-2020-9746.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-security-vulnerability-in-flash-player/

Windows 10 now blocks some third-party drivers from installing

Microsoft Windows 10 and Windows Server users will be blocked from installing incorrectly formatted third-party drivers after deploying October cumulative updates. Starting with the October 2020 updates, catalogs files must be signed per section 11.6 of describing DER-encoding for SET OF members in X.690. Users who encounter the errors, 'Windows can’t verify the publisher of this driver software' when installing a third-party driver, and 'No signature was present in the subject' when attempting to view the signature properties using Windows Explorer are advised to ask their driver vendor or device manufacturer (OEM) for an updated and correctly signed driver.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-now-blocks-some-third-party-drivers-from-installing/

Cybercriminals Steal Nearly 1TB of Data from Miami-Based International Tech Firm

Databases of sensitive, financial, and personally identifiable information and documents from Intcomex, a Miami-based tech firm, were leaked on a Russian-language hacker forum after a ransomware attack. Hackers stole nearly a terabyte of data including full credit-card information, scans of sensitive documents such as passports, bank statements, and financial documents, and even customer databases. The intrusion occurred on September 14 and September 20, when hackers dumped it in two parts on the forum. The company has confirmed the incident and are taking decisive steps to address the situation and protect the systems.

See the full report here: https://threatpost.com/cybercriminals-steal-data-miami-tech-firm/160073/

FIN11 hackers jump into the ransomware money-making scheme - BleepingComputer

FIN11, a financially-motivated hacker group has adapted malicious email campaigns to transition to ransomware as the main monetization method. The group has been active since 2016 and runs high-volume operations primarily in North America and Europe. Security researchers at FireEye’s Mandiant detected that the FIN11 targeted its victims with malicious emails distributing a malware downloader they track as FRIENDSPEAK. The malware then downloads MIXLABEL, a different malware believed to be specific to FIN11. The campaigns from September use modified macros in Office documents and also geofencing techniques. Based on their analysis, researchers speculate that FIN11 operates from the Commonwealth of Independent States (CIS - former Soviet Union countries).

See the full report here: https://www.bleepingcomputer.com/news/security/fin11-hackers-jump-into-the-ransomware-money-making-scheme/

US Cyber Command: Patch Windows 'Bad Neighbor' TCP/IP bug now - BleepingComputer

US Cyber Command has warned the Microsoft customers to immediately patch their systems against the critical and remotely exploitable CVE-2020-16898 vulnerability addressed during this month's Patch Tuesday. Microsoft states that the bug, also known as Bad Neighbor, is a remote code execution vulnerability in the Windows TCP/IP stack that can also trigger a denial of service, leading to a Blue Screen of Death (BSoD). Any unauthenticated attacker with a maliciously crafted ICMPv6 Router Advertisement packets can exploit this vulnerability. The flaw impacts both client (Windows 10 versions 1709 up to 2004) and server (Windows Server version 1903 up to 2004 and Windows Server 2019) platforms, making it critical for all modern Windows environments. Microsoft says the security firm Sophos has also been able to produce a denial-of-service, which causes a BSOD on any vulnerable device.

See the full report here: https://www.bleepingcomputer.com/news/security/us-cyber-command-patch-windows-bad-neighbor-tcp-ip-bug-now/

Canva design platform actively abused in credentials phishing - BleepingComputer

Free graphics design website Canva is being abused by threat actors to create and host intricate phishing landing pages. Canva is a graphic design platform that lets users create posters, letterheads, holiday cards, and other digital media that can then be downloaded as an image shared as HTML with clickable links or printed. As part of its service, designers can generate shareable URLs so that friends and colleagues can view their work on canva[.]com. Cybersecurity firm Cofense discovered a phishing campaign that pretends to be a SharePoint eFax delivery notification. This notification contains a link to a phishing landing page hosted on canva[.]com. When a victim clicks on the link, they will be brought to a Canva-designed intermediary HTML page hosted on Canva[.]com where they are prompted to log in to see the document. Any login credentials victim enters into this page will be stolen by the attackers.

See the full report here: https://www.bleepingcomputer.com/news/security/canva-design-platform-actively-abused-in-credentials-phishing/

Barnes & Noble hit by cyberattack that may have exposed customer data

Barnes & Noble has disclosed that they were a victim of a cyberattack that may have exposed customers' data. In an email sent to customers, the company informed that they suffered a cyberattack on October 10th, 2020. Following the attack, threat actors gained access to corporate systems utilized by the company. Barnes & Noble admitted that email addresses, billing addresses, shipping addresses, and transaction history related to the books and other products were on the impacted servers. However, the firm stated that no payment details have been exposed but are unsure at this time if the hackers accessed other personal information.

See the full report here: https://www.bleepingcomputer.com/news/security/barnes-and-noble-hit-by-cyberattack-that-may-have-exposed-customer-data/

Online proctor service ProctorTrack disables service after hack

The online proctoring service ProctorTrack has disabled access to their service after its parent company was hacked. ProctorTrack is one such solution by Verificient that is used by numerous universities. Since yesterday, students began receiving emails sent by the hacker from the Verificient Support account. This email contained racial accusations and falsely stated that the company and ProctorTrack were ceasing operations. Further, the hackers defaced the company's website to display the video for Rick Astley's "Never Gonna Give You Up." Soon after, Verificient disabled their ProctorTrack service yesterday at 4 pm EST. In addition to this hack, the source code for various Verificient apps was leaked last week on Twitter and Telegram.

See the full report here: https://www.bleepingcomputer.com/news/security/online-proctor-service-proctortrack-disables-service-after-hack/

Google researcher found BleedingTooth flaws in Linux Bluetooth

A Google security researcher has found Bluetooth vulnerabilities, referred to as BleedingTooth, in the Linux kernel that could be exploited by attackers to run arbitrary code or access sensitive information. The BleedingTooth flaws Tracked as CVE-2020-12351, CVE-2020-12352, and CVE-2020-24490. The high severity vulnerability, CVE-2020-12351 is a heap-based type confusion flaw that allows a remote attacker within the Bluetooth range of the victim can trigger the vulnerability by sending a malicious l2cap packet, which can lead to denial of service or even execution of arbitrary code with kernel privileges, without user interaction. The second issue, CVE-2020-12352 is a stack-based information leak and impacts Linux kernel 3.6 and higher. CVE-2020-24490 is a heap-based buffer overflow that resides in net/bluetooth/hci_event.c. and affects Linux kernel 4.19 and higher. An exploit with a video proof-of-concept is released.

See the full report here: https://securityaffairs.co/wordpress/109500/hacking/bluetooth-bleedingtooth-vulnerabilities.html?utm_source=rss&utm_medium=rss&utm_campaign=bluetooth-bleedingtooth-vulnerabilities

Microsoft is forcibly installing Office PWAs in Windows 10

Over the past week, Microsoft has been conducting a test where they are installing Word, Excel, PowerPoint, and Outlooks PWAs (progressive web app) into Microsoft Edge and registering them with Windows 10 without asking permission from the user. A PWA is an application designed to deliver via the web without installing executables on the computer. When launched, PWAs will open a minimalistic browser Windows and visit the web application's associated URL. It appears to be an A/B test, with only some users receiving the new PWAs. Those who do not wish to have these PWAs installed can uninstall them directly in Microsoft Edge through the edge://apps URL or via the Programs and Features Settings page.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-is-forcibly-installing-office-pwas-in-windows-10/

Iranian hackers restart attacks on universities as the new school year begins - ZDNet

A group of Iranian hackers with a history of attacking academic institutions have come back to life to launch a new series of phishing campaigns. The attacks are timed to coincide with the start of the new academic years when both students and university staff are expected to be active on university portals. The attacks consisted of phishing emails sent to victims with links to a website posing as the university portal or an associated app, such as the university library. According to Malwarebytes, the attacks are linked to the Silent Librarian group and hosted some of their phishing sites on Iranian servers.

See the full report here: https://www.zdnet.com/article/iranian-hackers-restart-attacks-on-universities-as-the-new-school-year-begins/