Threat Intelligence Bulletin: 11/20/2020 - 11/26/2020

APWG Phishing Attack Trends for Q3 2020

The Anti-Phishing Work Group (APWG) has published their phishing trend findings for Q3 of 2020. The contents of this report show a continuing increase in phishing attacks and Business Email Compromise attacks across multiple verticals. Phishing is a type of criminal activity employing both social engineering and technical subterfuge to steal consumers’ personal information and financial data. Social engineering schemes prey on unwary victims by fooling them into believing they are dealing with a trusted, legitimate party, such as by using deceptive email addresses and email messages. APWG’s report goes into detail on these subjects as well as providing statistics on trend data observed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Always verify the sender of suspicious or unexpected emails and messages
• Never download attachments from unknown senders or suspicious emails
• Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
• Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

APWG’s report reveals a rise in phishing since March of 2020. And in August and September of 2020, more than 200,000 phishing sites were reported per month to APWG, with more that 500 brands being targeted each month in the quarter.

Figure 1: Excerpt showing an upwards trend of reported phishing for Q3

Phishing targeting users of webmail and Software-as-a-Service (SaaS) was found to be the biggest target of phishing, with over 30 percent of all attacks. Financial Services were the target of 19.2 percent of attacks, and payment processing systems such as PayPal were targets of 13.4 percent of attacks. Phishing targeting social media was 12.6 percent of attacks, primarily driven by phishing against brands such as Facebook and WhatsApp.

Figure 2: An example of a typical WhatsApp “fake invite” phishing page

Business Email Compromise (BEC) attacks that focus on key personnel within targeted enterprises, continues to be one of the most popular types of attack, as well as being one of the most damaging. BEC attacks that sought wire transfers from victim companies sought an average of $48,000. Also, scammers requested funds in the form of gift cards in 71 percent of BEC attacks, which are easier to cash out. During the third quarter of 2020, the average amount of gift cards requested by BEC attackers was $1,205. Additionally, around 16.3 percent of BEC attacks involved specially crafted domain names registered by the scammers, that they used to send email to their intended victims.

Figure 3: An example of a typical BEC email asking for gift cards

Phishers are also deploying encryption to fool users into thinking that phishing sites are legitimate and safe. In the third quarter of 2020, 80 percent of phishing sites had SSL encryption enabled. Most SSL certificates used by phishers were Domain-Validated ('DV'), which is the weakest form of certificate validation. Around 91.3 percent were DV, while 8.6 percent were OV (Organization Validation) certs, and just 0.1% were Extended Validation (EV).

The full report from APWG can be found here.

Breaking News: 2020-11-20 - 2020-11-26

Good Heavens! 10M Impacted in Pray.com Data Exposure

The Christian faith app Pray[.]com has leaked private data for up to 10 million people. The app offers “daily prayer and Bible stories to inspire, educate, and help you sleep” on a subscription basis. vpnMentor analysts found several open, publicly accessible cloud databases (Amazon Web Services S3 buckets) belonging to Pray[.]com, containing 1.9 million files – about 262 GB worth of data. Most of this was internal information, but one of the buckets with 80,000 files contained various personal identifiable information (PII) for tens of millions of people – and not just from Pray[.]com users. These included photos uploaded by the app’s users, including those of minors. These files contained lists of the church’s attendees, with information for each churchgoer that included names, home and email addresses, phone numbers, and marital status. The donations were also logged in the bucket, along with the donation amount, the donor’s PII, and Pray[.]com’s fee for processing the donation.

See the full report here: https://threatpost.com/10m-impacted-pray-com-data-exposure/161459/

Drupal sites vulnerable to double-extension attacks

The team behind the Drupal content management system (CMS) has released security updates to patch a critical vulnerability that is easy to exploit and can grant attackers full control over vulnerable sites. Tracked as CVE-2020-13671, the vulnerability is simple to exploit and relies on the "double extension" trick. Attackers can add a second extension to a malicious file, upload it on a Drupal site through open upload fields, and have the malicious executed. Drupal devs said the vulnerability resides in the fact that the Drupal CMS does not sanitize "certain" file names, allowing some malicious files to slip through. This can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. Security updates were released for the Drupal 7, 8, and 9 versions to correct the file upload sanitization procedures.

See the full report here: https://www.zdnet.com/article/drupal-sites-vulnerable-to-double-extension-attacks/

New Grelos Skimmer Variants Siphon Credit Card Data

Researchers have uncovered new variants of the point-of-sale Grelos skimmer malware that are targeting the payment-card data of online retail shoppers on dozens of compromised websites. The new variants of the skimmer feature a loader stage and a skimmer stage, both of which are base64 encoded five times over. The Grelos variant also used WebSockets for skimming. Researchers noticed a unique cookie, which was connected to three additional skimming domains and several victim domains. These skimming domains, which included facebookapimanager[.]com and googleapimanager[.]com, contained a more recent variant of the Grelos variant. This skimmer has a similar base64 encoded loader stage, except this loader stage is only under one layer of encoding, with a duplicate of the encoded script tag below it (without encoding). The skimmer code included a “translate” function with various phrases used by the fake HTML payment form that it creates after it compromises a website. When a shopper visits a compromised website, they are presented with a fake payment form containing phrases. When they upload their payment card information, that data is exfiltrated by the skimmer via a function that stringifies the stolen data, along with the site_id, sid, and ip.

See the full report here: https://threatpost.com/grelos-skimmer-variants-credit-card/161439/

Microsoft releases patching guidance for Kerberos security bug - BleepingComputer

Microsoft has released additional details on how to fully mitigate a security feature bypass vulnerability in Kerberos KDC (Key Distribution Center) patched during this month's Patch Tuesday. The remotely exploitable security bug tracked as CVE-2020-17049 exists in the way KDC decides if service tickets can be used for delegation via Kerberos Constrained Delegation. Kerberos is the default authentication protocol for domain connected devices running Windows 2000 or later. Kerberos KDC is a feature that manages service tickets used for encrypting messages between network servers and clients. In order to fully mitigate this vulnerability, admins need to deploy security updates to all DCs (Domain Controllers) and RODCs (Read-Only Domain Controllers) in the forest, along with additional response steps.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-patching-guidance-for-kerberos-security-bug/

LightBot: TrickBot’s new reconnaissance malware for high-value targets - BleepingComputer

The TrickBot gang has released a new lightweight reconnaissance tool used to scope out an infected victim's network for high-value targets. LightBot phishing emails pretend to be from human resources or the legal department about a customer complaint or the termination of the recipient's employment. They contain links to a document on https://drive.google.com, which when clicked redirects to a Google Docs page that states "Previewing is disabled" and prompts the user to download the file instead. The downloaded file later launches the LightBot PowerShell script on the compromised system. This PowerShell script is a lightweight reconnaissance tool that gathers information about a victim's network to determine if they are high-value and should be targeted in further attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/lightbot-trickbot-s-new-reconnaissance-malware-for-high-value-targets/

FBI warns of increasing Ragnar Locker ransomware activity - BleepingComputer

The U.S. Federal Bureau of Investigation (FBI) Cyber Division has warned private industry partners of increased Ragnar Locker ransomware activity following a confirmed attack from April 2020. The FBI first observed the ransomware in April 2020, when unknown actors used it to encrypt a large corporation’s files for an approximately $11 million ransom and threatened to release 10 TB of sensitive company data. Since then, Ragnar Locker has been deployed against an increasing list of victims, including cloud service providers, communication, construction, travel, and enterprise software companies. The flash alert was issued to partners by the FBI yesterday was coordinated with DHS-CISA and it provides security professionals and system admins with indicators of compromise to guard against the persistent malicious actions of this ransomware gang.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-increasing-ragnar-locker-ransomware-activity/

Joe Biden's 'Vote Joe' website defaced by Turkish Hackers - BleepingComputer

Joe Biden's Presidential campaign website Vote Joe had been hacked and defaced by Turkish threat actors. As per the note left by the hackers on the hacked site, RootAyyildiz has claimed responsibility for the hack. Alongside, there is also mention of other usernames and aliases such as "MarbeyliWerom", "b4rbarøssa", "oneshot", and "Turkish And Muslim Defacer". An English translation of the message on the hacked site explicitly states that the hackers behind the breach are not a group, despite multiple aliases listed in the note. The security flaw is still unknown that led to the defacement of the site.

See the full report here: https://www.bleepingcomputer.com/news/security/joe-bidens-vote-joe-website-defaced-by-turkish-hackers/

Windows 10 Defrag TRIM bug still not fixed after six months - BleepingComputer

Microsoft Windows 10 2004, May 2020 Update, contains two bugs causing SSD drives to be defragged too often and for the TRIM operation to be attempted on non-SSD drives. The first bug prevented the Windows 10 Automatic Maintenance feature from remembering when a drive was last optimized when the operating system was restarted. The forgetting of the previous optimization date would cause drives, including SSD drives, to be defragged on every computer reboot. In September, Microsoft released the "2020-08 Cumulative Update Preview for Windows 10 Version 2004 (KB4571744)" update, which fixed the Automatic Maintenance bug causing SSD to be defragged too often. The second bug caused the Windows 10 defrag feature, Optimize Drives, to attempt to TRIM non-SSD drives. While this would not damage the drive, it does generate errors in the event log. Microsoft is yet to fix these bugs.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-defrag-trim-bug-still-not-fixed-after-six-months/

Manchester United football club discloses security breach

Cybercriminals have targetted Premier League giants Manchester United's IT systems in sophisticated hacking operations. The club has taken swift action to contain the attack and is currently working with expert advisers to investigate the incident and minimize the ongoing IT disruption. However, the officials couldn't confirm if the breach allowed the intruders to access data associated with fans or store customers. While the club remained tight-lipped about what hackers managed to access, they said the attack didn't impact its primary media channels, such as its website and mobile apps. Manchester United is the second major UK club to disclose a security breach.

See the full report here: https://www.zdnet.com/article/manchester-united-football-club-discloses-security-breach/

Australian online data breach may affect thousands of NZers - RNZ

New Zealand cybersecurity watchdog Cert has warned the users of Nitro PDF software after the email addresses and hashed passwords of nearly 2.6 million Australian users were published online. Cert has contacted the impacted individuals and also warns that the other New Zealanders with email addresses ending in .com may be affected too. Nitro PDF users are urged to change their passwords immediately and practice healthy password rules.

See the full report here: https://www.rnz.co.nz/news/national/431208/australian-online-data-breach-may-affect-thousands-of-nzers

Hacker posts exploits for over 49,000 vulnerable Fortinet VPNs - BleepingComputer

A threat actor has posted a list of one-line exploits to steal VPN credentials from almost 50,000 Fortinet VPN devices. The targeted vulnerability is CVE-2018-13379, a path traversal flaw impacting a large number of unpatched Fortinet FortiOS SSL VPN devices. By exploiting this security flaw, unauthorized remote attackers can access system files via specially crafted HTTP requests. The exploit posted by the hacker lets attackers access the sslvpn_websession files from Fortinet VPNs to steal login credentials. These stolen credentials could then be used to compromise a network and deploy ransomware. Although the bug was publicly disclosed over a year ago, researchers have spotted around 50,000 targets, including government domains from around the globe and those belonging to well-known banks and finance companies that can still be targeted by attackers. Network administrators and security professionals are therefore encouraged to patch this severe vulnerability immediately.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-posts-exploits-for-over-49-000-vulnerable-fortinet-vpns/

Botnets have been silently mass-scanning the internet for unsecured ENV files

According to security firm Greynoise, more than 2,800 different IP addresses have been scanning the internet for ENV files that have been accidentally uploaded and left exposed on web servers, over the past three years, with more than 1,100 scanners being active over the past month. ENV files, or environment files, are a type of configuration files that are usually used by development tools and frameworks like Docker, Node.js, Symfony, and Django use ENV files to store environment variables, such as API tokens, passwords, and database logins. If an attacker can access these private API keys, they can be used to carry out various cyberattacks. Developers are advised to check if their apps' ENV files are accessible online and secure the exposed ENV files, and also change all tokens and passwords of the exposed files.

See the full report here: https://www.zdnet.com/article/botnets-have-been-silently-mass-scanning-the-internet-for-unsecured-env-files/

Korean Retailer 'E-Land' Suffers Ransomware Attack—Almost Half of its Operations Face Shut Down! - Tech Times

A South Korean fashion and retail company, E-Land, has suffered a ransomware attack impacting almost half of the company's entire operations in the South Korean peninsula. According to the Korea Times, the company publicly disclosed that it suffered an attack last Sunday, November 22, and immediately shut down its operations. Currently, there is no news regarding when it would reopen the shutdown businesses of the company. E-Land is currently investigating the issue to determine the nature and scope of the attack.

See the full report here: https://www.techtimes.com/articles/254405/20201122/korean-retailer-e-land-suffers-ransomware-attack—almost-half-operations-face.htm

Microsoft remove malicious Edge extensions from the Store pretending to be NordVPN, TunnelBear, more - - MSPoweruser

Microsoft has removed extensions including NordVPN, Adguard VPN, TunnelBear VPN, The Great Suspender, and Floating Player – Picture-in-Picture Mode from its Addons store after few Edge users reported that they were being redirected to a website oksearch[.]org/xa2/click[.]html and from there to a variety of other websites such as Amazon or Zoom when they performed a Google Search. Malware writers are trying to target the “app gap” in the Edge extension store by filling it with fake apps. Edge users can install extensions directly from Google’s extension store. If people were using any of the malicious extensions installed directly from the Microsoft Edge Addon store, Microsoft suggests removing them from edge://extensions.

See the full report here: https://mspoweruser.com/microsoft-malicious-edge-extensions-from-the-store-nordvpn-tunnelbear/

Over 300K Spotify accounts hacked in credential stuffing attack - BleepingComputer

VPNMentor has released a report concerning a database exposed on the Internet that contained 300 million username and password combinations used in credential stuffing attacks against Spotify. According to VPNMentor, each of the leaked records includes a login name (email address), a password, and whether the credentials could successfully login to a Spotify account. It is still unknown how the threat actors collected 300 million records, but it is likely through data breaches or large "collections" of credentials that are commonly released by threat actors for free. The researchers believe that the 300 million records listed in the database allowed the attackers to breach nearly 300,000 to 350,000 Spotify accounts. VPNMentor contacted Spotify on July 9th, 2020, about the exposed database and its threat to accounts, and Spotify immediately initiated a ‘rolling reset’ of passwords for all impacted users.

See the full report here: https://www.bleepingcomputer.com/news/security/over-300k-spotify-accounts-hacked-in-credential-stuffing-attack/

TA416 APT Rebounds With New PlugX Malware Variant

The TA416 advanced persistent threat (APT) actor is back with a new Golang variant of its PlugX malware loader. The PlugX remote access tool (RAT) has been previously used in attacks aimed at government institutions and allows remote users to perform data theft or take control of the affected systems without permission or authorization. TA416, which is also known as “Mustang Panda” and “RedDelta,” was spotted in recent campaigns targeting entities associated with diplomatic relations between the Vatican and the Chinese Communist Party. Upon closer investigation, researchers have identified two RAR archives that serve as PlugX malware droppers. One of these files was found to be a self-extracting RAR archive. Once the RAR archive is extracted four files are installed on the host and the portable executable (PE) Adobelm.exe is executed. Adobelm.exe is a legitimate Adobe executable that is used for the dynamic link library (DLL) side-loading of hex.dll. It calls an export function of hex.dll, called CEFProcessForkHandlerEx. These files serve as loaders and decryptors of encrypted PlugX malware payloads. Both identified RAR archives were found to drop the same encrypted PlugX malware file and Golang loader samples. Despite the file type of the PlugX loader changing, the functionality remains largely the same. The file reads, loads, decrypts, and executes the PlugX malware payload. The PlugX malware then ultimately calls out to the command and control (C2) server IP, 45.248.87[.]162.

See the full report here: https://threatpost.com/ta416-apt-plugx-malware-variant/161505/

Fake Minecraft mods swamp over 1M Android devices with ads - BleepingComputer

Fraudsters bypassed Google's protections for the official Play Android store and published more than 20 fake modpacks for the popular game Minecraft. The apps are empty shells designed to lure kids and teenagers that want to modify their gameplay. They do not deliver any malware but once installed, they hinder the normal use of the phone. Once installed, the fake modpacks display full-screen advertisements aggressively. Depending on the commands received from the server, the apps could also open Google Play, Facebook, or play YouTube videos, putting more money into the operator’s pockets with each ad display. Security researchers at Kaspersky detected this operation in July and found that the most successful of the fake modpacks had more than one million installations. After multiple complaints from the users, the fraudulent apps including, Zone Modding Minecraft, Textures for Minecraft ACPE, Seeded for Minecraft ACPE, Mods for Minecraft ACPE, Darcy Minecraft Mod, and many more have been removed from Google Play. Impacted Minecraft players are advised to remove the malicious apps from the Apps menu under device Settings and should be careful about installing modifications packages for the game from unofficial stores.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-minecraft-mods-swamp-over-1m-android-devices-with-ads/

FBI warns of recently registered domains spoofing its sites - BleepingComputer

The U.S. Federal Bureau of Investigation (FBI) has issued a warning to the general public informing about the risks behind recently registered FBI-related domains that spoof some of the federal law enforcement agency's official websites. The lookalike domains can be used to create spoofed emails that would allow attackers to persuade their victims to click and open malicious links and websites. Additionally, "members of the public could unknowingly visit spoofed domains while seeking information regarding the FBI's mission, services, or news coverage," the FBI adds. The FBI urges all members of the American public to critically evaluate the websites they visit, and the messages sent to their personal and business email accounts, to seek out reliable and verified FBI information. The agency has also provided a list of recommendations to help the public recognize and avoid spoofed FBI-related Internet domains.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-recently-registered-domains-spoofing-its-sites/

Researchers hack Tesla Model X using key fob vulnerabilities - BleepingComputer

A Belgian security researcher has discovered a method to overwrite and hijack the firmware of Tesla Model X key fobs, allowing him to steal any car that isn't running on the latest software update. The flaw can be exploited using an electronic control unit (ECU) salvaged from an older Model X vehicle, which can be easily acquired online on sites like eBay or any stores or forums selling used Tesla car parts. Attackers can modify the older ECU to trick a victim's key fob into believing the ECU belonged to its paired vehicle and then push a malicious firmware update to the key fob via the BLE (Bluetooth Low Energy) protocol. The security researcher discovered the bug earlier this summer and reported it to Tesla's security team in mid-August. The researcher has published his findings after Tesla began rolling out an over-the-air software update to all its Model X cars.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-hack-tesla-model-x-using-key-fob-vulnerabilities/

VMware discloses critical zero-day vulnerability in Workspace One - BleepingComputer

VMware has released temporary workarounds to address a critical vulnerability in its products that could be exploited by an attacker to take control of an affected system. Tracked as CVE-2020-4006, the command injection vulnerability could allow a malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account to execute commands with unrestricted privileges on the underlying operating system. The yet to patch security flaw has a CVSS score of 9.1 out of 10 and impacts VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. VMware said the workaround applies only to the administrative configurator service hosted on port 8443.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-discloses-critical-zero-day-vulnerability-in-workspace-one/

New WAPDropper malware stealthily subscribes you to premium services - BleepingComputer

Check Point researchers have warned of a new malware family named WAPDropper, which is targeting mobile phone users to subscribe them silently to legitimate premium-rate services. The malware is a multi-function dropper that can deliver second-stage malware and uses a machine learning solution to bypass image-based CAPTCHA challenges. In a recent campaign, the operators of WAPDropper use a common tactic, integrating the malware in apps supplied by unofficial stores. Once on the victim device, the malware reaches out to the command and control (C2) server to get the premium dialer. A webview component is initiated to load the landing pages for the premium services and complete the subscription. Since WAPDropper is distributed via unofficial Android stores, users are highly recommended to avoid these marketplaces to reduce the risk of compromise.

See the full report here: https://www.bleepingcomputer.com/news/security/new-wapdropper-malware-stealthily-subscribes-you-to-premium-services/

TrickBot malware uses obfuscated Windows batch script to evade detection - BleepingComputer

Researchers have analyzed the 100th release of Trickbot malware, which comes well-equipped with new and advanced evasive capabilities. One such capability is its use of an obfuscated batch script launcher to jumpstart malicious executables. TrickBot is commonly installed via malicious phishing emails or other malware. When installed, TrickBot will quietly run on a victim's computer while it downloads other modules to perform different tasks. It is known to finish an attack by giving access to threat actors who deploy either the Ryuk or Conti ransomware on the compromised network. The latest build uses an obfuscated batch script to launch the malware. The executed payload performs a wide range of malicious activity, including stealing a domain's Active Directory Services database, spreading laterally on a network, screen locking, stealing cookies and browser passwords, and stealing OpenSSH keys.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-malware-uses-obfuscated-windows-batch-script-to-evade-detection/

Blackrota Golang Backdoor Packs Heavy Obfuscation Punch

Security researchers have discovered a new backdoor, named Blackrota, written in the Go programming language (Golang). The backdoor was first uncovered in a honeypot owned by the researchers, attempting to exploit an unauthorized-access vulnerability in the Docker Remote API. The Blackrota backdoor is currently only available for Linux, in Executable and Linkable Format (ELF) file format, and supports both x86/x86-64 CPU architectures. The malware uses gobfuscate, an open-source tool for Go code, to obfuscate the source code before compiling. It hides various elements of Go source code with random character substitutions, including the package names, global variable names, function names, type names, and method names. The high-level obfuscation method used by the Blackrota makes the malware extremely difficult to analyze.

See the full report here: https://threatpost.com/blackrota-golang-backdoor-obfuscation/161544/

Exploitable Flaw in NPM Private IP App Lurks Everywhere, Anywhere

A team of independent security researchers has identified a flaw in private-ip, an npm module first published in 2016 that enables applications to block request forgery attacks by filtering out attempts to access private IP4 addresses and other restricted IP4 address ranges. The flaw is a Server Side Request Forgery (SSRF) vulnerability in commonly used versions of private-ip. The flaw allows malicious attackers to carry out SSRF attacks against a population of applications that may number in the hundreds of thousands or millions globally. The flaw has been fixed and organizations using private-ip version 1.0.5 or earlier are advised to upgrade to the latest version immediately to protect from future risks.

See the full report here: https://securityledger.com/2020/11/exploitable-flaw-in-npm-private-ip-app-lurks-everywhere-anywhere/

Stantinko's Linux malware now poses as an Apache web server

Stantinko has revamped its Linux malware by upgrading its trojan to pose as the legitimate Apache webserver process (httpd) to make detection harder on infected hosts. The Stantinko botnet is an adware and coin-miner botnet that is active at least since 2012, targeting Russia, Ukraine, Belarus, and Kazakhstan. The Intezer team, who spotted the upgrades in Stantinko, stated that the new version is leaner and contains fewer features than the older release. The last version of Stantinko's Linux malware was spotted back in 2017, having a version number of 1.2. But in a report released today and shared with ZDNet, Intezer Labs said that after three years, they have recently discovered a new version of Stantinko's Linux malware, having a version number of 2.17. Stantinko is using the Apache webserver process (httpd) to prevent server owners from spotting the malware at a regular visual inspection, as the Apache web server is often included by default in many Linux distros, and this process is usually running on Linux systems that Stantinko generally infects. Linux server owners and system administrators are advised to keep apps up-to-date and to use strong passwords.

See the full report here: https://www.zdnet.com/article/stantinkos-linux-malware-now-poses-as-an-apache-web-server/

Post-Breach, Peatix Data Reportedly Found on Instagram, Telegram

Peatix, an events application that connects people to various events and social-based communities, has disclosed a data breach after user account information reportedly began circulating on Instagram and Telegram. Peatix stated that on November 9, 2020, user account data had been improperly accessed. Upon further investigation, it found that user names, email addresses, salted and hashed passwords, nicknames, preferred languages, countries, and time zones had been compromised. Social media platforms such as Instagram and messaging app Telegram were used to promote stolen names, usernames, hashed passwords, and email addresses. Peatix said there is no evidence that credit card information has been compromised. Peatix urged its users to reset their passwords as an added measure of precaution and be on the lookout for suspicious correspondence requesting further personal information.

See the full report here: https://threatpost.com/breach-peatix-data-instagram-telegram/161560/

2FA bypass discovered in web hosting software cPanel

Security researchers at Digital Defense have discovered a major security flaw in cPanel, a popular software suite used by web hosting companies to manage websites for their customers. The bug allows attackers to bypass two-factor authentication (2FA) for cPanel accounts. The 2FA implementation on older cPanel & WebHost Manager (WHM) software was vulnerable to brute-force attacks that allowed threat actors to guess URL parameters and bypass 2FA — if 2FA was enabled for an account. Exploiting this bug also requires that attackers have valid credentials for a targeted account, but these can be obtained from phishing the website owner. The vendor has patched the 2FA bypass issue cPanel & WHM software 11.92.0.2, 11.90.0.17, and 11.86.0.32. Users should not disable 2FA for their cPanel accounts because of this bug, but should instead request that their web hosting providers update the cPanel installation to the latest version.

See the full report here: https://www.zdnet.com/article/2fa-bypass-discovered-in-web-hosting-software-cpanel/

Security researcher accidentally discovers Windows 7 and Windows Server 2008 zero-day

A French security researcher has discovered a zero-day vulnerability that resides in two misconfigured registry keys for the RPC Endpoint Mapper and DNSCache services that are part of all Windows installations. It impacts the Windows 7 and Windows Server 2008 R2 operating systems. An attacker that has a foothold on vulnerable systems can modify these registry keys to activate a sub-key usually employed by the Windows Performance Monitoring mechanism. "Performance" subkeys are usually employed to monitor an app's performance, and, because of their role, they also allow developers to load their own DLL files to track performance using custom tools. Both Windows 7 and Windows Server 2008 R2 have officially reached end of life (EOL), but some security updates are available for Windows 7 users through the company's ESU (Extended Support Updates) paid support program, but a patch for this issue has not been released yet.

See the full report here: https://www.zdnet.com/article/security-researcher-accidentally-discloses-windows-7-and-windows-server-2008-zero-day/

Xbox bug could have allowed hackers to link gamer tags with players' emails

Microsoft has patched a bug in the Xbox website that could have allowed threat actors to link Xbox gamer tags (usernames) to users' real email addresses. The security researcher stated that the bug was located on enforcement[.]xbox[.]com, the web portal where Xbox users go to view strikes against their Xbox profile and file appeals if they feel they have been unfairly reprimanded for their behavior on the Xbox network. After users log in to this website, the Xbox Enforcement site creates a cookie file in their browser with details about their web session, so they won't have to re-authenticate the next time they visit the site again. The cookie file contained an unencrypted Xbox user ID (XUID) field, which has the ability to expose users’ email addresses. The bug is now fixed and is deployed on the server-side.

See the full report here: https://www.zdnet.com/article/xbox-bug-could-have-allowed-hackers-to-link-gamer-tags-with-players-emails/

Critical MobileIron RCE Flaw Under Active Attack

Attackers are targeting the critical remote code-execution flaw to compromise systems in the healthcare, local government, logistics, and legal sectors, among others. The issue in question (CVE-2020-15505) is a remote code-execution flaw. It is rated 9.8 out of 10 on the CVSS severity scale, making it critical. The flaw was patched back in June, however, a proof of concept exploit became available in September. Since then, both hostile state actors and cybercriminals have attempted to exploit the flaw in the U.K., according to a new advisory by the National Cyber Security Centre (NCSC). The bug affects MobileIron Core and Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors. As of now, MobileIron has released patches to mitigate this vulnerability.

See the full report here: https://threatpost.com/critical-mobileiron-rce-flaw-attack/161600/

Baltimore County Public Schools hit by ransomware attack - BleepingComputer

Baltimore County Public Schools has been hit by a ransomware attack that led to a systemic shutdown of its network due to the number of systems impacted in the attack. The district's Chief of Staff confirmed that the attack affected the public school district's offices, website, email system, and grading system. The district also had to suspend all virtual learning and to close offices following the ransomware attack that hit its systems. BCPS technology team is working to address the situation. Depending on the ransomware gang that encrypted the school district's systems, this attack may also result in a data breach if the employee and student information has been stolen from the district's computers. The Baltimore City Public Schools district has also published an alert on its website urging students to only use school-issued devices for virtual learning.

See the full report here: https://www.bleepingcomputer.com/news/security/baltimore-county-public-schools-hit-by-ransomware-attack/

Belden networking giant's company data stolen in cyberattack - BleepingComputer

Network device manufacturer Belden has suffered a cyberattack that allowed threat actors to steal files containing information about employees and business partners. Belden is a US-based manufacturer of network connectivity devices, including routers, firewalls, switches, cabling, and connectors. Belden announced that it had taken decisive measures to investigate and address a data incident involving unauthorized access and copying of some current and former employee data, as well as limited company information regarding some business partners. The company has notified the affected users and is offering free monitoring and support services.

See the full report here: https://www.bleepingcomputer.com/news/security/belden-networking-giants-company-data-stolen-in-cyberattack/

China's Baidu Android Apps Caught Collecting Sensitive User Data

Two popular Android apps from Chinese tech giant Baidu have been removed from the Google Play Store in October after they were caught collecting sensitive user details. The two apps, Baidu Maps and Baidu Search Box—were found to collect device identifiers, such as the International Mobile Subscriber Identity (IMSI) number or MAC address, without users' knowledge, thus making them potentially trackable online. The network security firm Palo Alto Networks discovered this and notified both Baidu and Google of their findings, after which the search company pulled the apps on October 28, citing "unspecified violations." A compliant version of Baidu Search Box has been restored to the Play Store on November 19, while Baidu Maps remains unavailable until the unresolved issues highlighted by Google are fixed. A separate app named Homestyler was also found to collect private information from users' Android devices.

See the full report here: https://thehackernews.com/2020/11/baidus-android-apps-caught-collecting.html