Hidden Droppers used Against E-Commerce Sites and Other News

Malicious PHP Concealed in JPEGs used in E-Commerce Attacks

A wave of attacks against Latin American e-commerce site has been identified to be utilizing novel obfuscation techniques. Malicious PHP code is embedded within the EXIF header of a JPEG file, and uploaded to a target website. If this website uses PHP to parse the uploaded image, this code will be executed. This has been used successfully by attackers to run droppers of additional malware on these targeted sites.

Recommendations

Ensure defensive systems are up to date with the latest detection.
Enable multi-factor authentication on accounts whenever possible.
Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed

Details

Researchers at Trustwave have identified a wave of attacks utilizing an interesting Steganographic technique in order to inject malicioys PHP code into JPEG EXIF file headers, and upload malware onto otherwise benign websites. If a website offers functionality to upload images, and parses these files using PHP, the function that parses EXIF metadata can be abused in order to parse embedded malicious code. This is extremely common in pre-packaged website tools, providing attackers with a huge number of potential targets.

In this case, a dropper file was hidden in the EXIF metadata of a JPEG file. When executed, a webshell is downloaded from an external host. This allows for a small file size to be maintained for the JPEG file, which is less likely to cause suspicion. This technique was observed to be used in attacks against Latin American e-commerce sites. As card-not-present fraud continues to rise, it is likely that attacks against online shopping sites will remain popular.

Breaking News - 07.29.2019

Prolific Dark Web Drug Seller Arrested

Richard Castro, of Florida, has been arrested and forced to forfit over 4 million US dollars in cryptocurrenncy after being caught by a US Department of Justice Sting Operation. The 36-year old man, known as Chemsusa, Chems_usa, and Jagger109, is charged with trading synthetic opioids including carfentanil, fentanyl, and phenyl fentanyl. Castro sold these drugs on markets like Dream Market and AlphaBay, but was caught after moving his business off the dark web.

See the full report here: https://www.zdnet.com/article/dark-web-drug-kingpin-charged-forced-to-forfeit-4-million-in-bitcoin/

Jessica Alba's Twitter Account Hacked

Jessica Alba's official Twitter account was hacked over the weekend, and used to post a barrage of racist and homophobic messages. Oddly, many of the tweets requested that rapper YNW Melly be released from jail, where he is currently being held during the trial for the murder of two of the rapper's former friends.

See the full report here: https://securityaffairs.co/wordpress/89014/hacking/jessica-alba-hacked-twitter.html

Louisiana Declares State of Emergency After String of Attacks

After a series of public schools fell victim to ransomware attacks, Louisiana declared a state of emergency. These attacks knocked out IT systems, as well as the office phone system, and all data on Monroe school district's servers.

See the full report here: https://threatpost.com/louisiana-gov-declares-emergency-after-cyberattacks-plague-schools/146713/