Threat Intelligence Bulletin: 01/15/2021 - 01/21/2021

Breach Disclosure: Jobandtalent

Jobandtalent, a digital temp staffing agency, experienced a data breach in February 2018. This breach exposed data for 11 million user accounts, including email addresses, names, IP Addresses, passwords (SHA-1 hashes) and was advertised on popular hacking sites for users to download.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

In early February 2018, the hacker group known as "GnosticPlayers" were able to compromise Jobandtalent and posted the data for sale on the now defunct dark web marketplace, Dream Market for ฿0.4669. This data was later made available in 2019 on other hacking forums, such as RaidForums for users to download for a few credits.

GnosticPlayers were responsible for many breaches in recent years, and alongside the Jobandtalent breach, they also listed Legendas.tv, Onebip, StoryBird, StreetEasy, GfyCat, ClassPass, and Pizap.

Figure 1: Breach advertisement on RaidForums

Breach Disclosure: Romwe

On December 30 2020, Hong Kong-based retailer Romwe disclosed a data breach to its customers. According to the company, they discovered the breach in September 2020 which occurred sometime in July 2018. The data was being sold and mentioned being sold on RaidForums in December 2020. The breach contains approximately 20 million rows of names, phone numbers, email addresses, IP addresses, geographic locations and salted SHA-1 password hashes.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance

• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On December 31 2020, Yahoo posted an article detailing the breach. According to Romwe, no credit or debit card information was stolen.

Although the disclosure came out in December 2020, RaidForums, a cybercriminal forum that has vendors who buy, sell and trade data breaches, had a number of posts in November advertising the sale of the database.

Figure 1: RaidForums Post

According to chatter on RaidForums, Romwe generated passwords for their users during account sign-up, and many users did not change their passwords after account creation. This has not been validated by ZeroFOX Alpha Team.

Breach Disclosure: Nitro Software

Nitro Software, the company behind the popular software Nitro PDF experienced a data breach in October 2020. The breach includes user and document databases, as well as 1TB of documents. The breached data has been offered for sale on the dark web via a private auction, and contains email addresses, names, company information and bcrypt hashed passwords.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Nitro Software issued a statement on October 21st 2020, stating the company had been affected by a "low impact security incident", claiming no customer data was impacted. However, the data for sale is listed as containing:

• Email address
• Full name
• Title,
• Company
• bcrypt hashed password

The breach impacted multiple customers of the service including organisations such as Apple, Microsoft, and Google, and was listed with a starting price of $80,000. The user database within the breached data for sale is reported to contain over 70 million user records.

Figure 1: Sample of the database dump

The breached data is not currently available via popular hacking forums dedicated to sharing data breaches, however activity and discussion around the breach shows users are actively attempting to contain copies of the breached data.

Figure 2: Users of popular hacking forum asking for copy of the breached data

Breaking News: 2021-01-15 - 2021-01-21

Google to kill Chrome Sync feature in third-party browsers - BleepingComputer

Google will block third-party Chromium web browsers from using private Google APIs after discovering that they were able to integrate Google features, such as Chrome sync and Click to Call. The company will limit 3rd party Chromium browsers from accessing private Chrome APIs starting with March 15, 2021.

See the full report here: https://www.bleepingcomputer.com/news/google/google-to-kill-chrome-sync-feature-in-third-party-browsers/

Hackers leaked altered Pfizer data to sabotage trust in vaccines - BleepingComputer

The European Medicines Agency (EMA) disclosed that the ongoing investigation of the cyberattack has revealed some of the stolen Pfizer/BioNTech vaccine candidate data. The leaked data was doctored by threat actors before being published online with the end goal of undermining the public's trust in COVID-19 vaccines. The leaked data included internal/confidential email correspondence dating from November, relating to evaluation processes for COVID-19 vaccines.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-leaked-altered-pfizer-data-to-sabotage-trust-in-vaccines/

Joker's Stash, the internet's largest carding forum, is shutting down

Joker's Stash has announced via messages posted on various underground cybercrime forums that it plans to shut down on February 15, 2021. Joker's Stash is the internet's largest marketplace for buying & selling stolen card data and has been operating since October 7, 2014. The site's administrator said they intend to wipe all servers and backups when they shut their operations next month.

See the full report here: https://www.zdnet.com/article/jokers-stash-the-internets-largest-carding-forum-is-shutting-down/

Scotland environmental regulator hit by ‘ongoing’ ransomware attack - BleepingComputer

The Scottish Environment Protection Agency (SEPA) disclosed that some of its contact center, internal systems, processes, and internal communications were impacted in a ransomware attack that took place on Christmas Eve. While SEPA didn't attribute the attack to any specific ransomware operation, the Conti ransomware gang claims the attack and has published 7% of the stolen data on its leak site. SEPA is currently working on eradication, remediation, and recovery tasks.

See the full report here: https://www.bleepingcomputer.com/news/security/scotland-environmental-regulator-hit-by-ongoing-ransomware-attack/

Pro-Trump 'Enemies of the People' doxing site is still active - BleepingComputer

The FBI alerted that Enemies of the People, the website inciting violence against U.S. officials who refused to support the President's claims to voter fraud, is still active and continues to expose personal details from more individuals. According to the agency, the Iranian actors are behind the website. However, on January 3, the admins of Enemies of the People revived it with a message denying a connection to Iran and calling the theory a distraction from the government agencies.

See the full report here: https://www.bleepingcomputer.com/news/security/pro-trump-enemies-of-the-people-doxing-site-is-still-active/

Experts Uncover Malware Attacks Against Colombian Government and Companies - The Hacker News

Cybersecurity researchers uncovered an ongoing surveillance campaign, dubbed Operation Spalax, against Colombian government institutions and private companies in the energy and metallurgical industries. The campaign has been active since 2020, with the modus operandi sharing some similarities to an APT group targeting the country since at least April 2018.

See the full report here: https://thehackernews.com/2021/01/experts-uncover-malware-attacks-against.html

Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks - The Hacker News

Security researchers have discovered a series of attacks by a threat actor of Chinese origin that has targeted organizations in Russia and Hong Kong with malware, including a previously undocumented backdoor. Attributing the campaign to Winnti (or APT41), Positive Technologies dated the first attack to May 12, 2020, when the APT used LNK shortcuts to extract and run the malware payload. The shortcuts themselves contain links to pages hosted on Zeplin, a legitimate collaboration tool for designers and developers that are used to fetch the final-stage malware that, in turn, includes a shellcode loader ("svchast.exe") and a backdoor called Crosswalk ("3t54dE3r.tmp").

See the full report here: https://thehackernews.com/2021/01/researchers-disclose-undocumented.html

NSA Suggests Enterprises Use 'Designated' DNS-over-HTTPS' Resolvers

The National Security Agency urges the security teams to use designated DNS resolvers to lockdown DNS over HTTPS (DoH), effectively preventing eavesdropping, manipulation, and exfiltration of DNS traffic. While using DoH with external resolvers can work for home or mobile users and networks that do not use DNS security controls, for enterprise networks, NSA guidance recommends using only designated enterprise DNS resolvers to leverage enterprise security defenses, facilitate access to local network resources, and protect internal networks.

See the full report here: https://thehackernews.com/2021/01/nsa-suggests-enterprises-use-designated.html

Linux Mint fixes screensaver bypass discovered by two kids

The Linux Mint project has addressed a security bug that could have allowed attackers to bypass the OS screensaver and its password and access locked desktops. According to a bug report on GitHub, the vulnerability was discovered by two kids playing on their dad’s computer.

See the full report here: https://www.zdnet.com/article/linux-mint-fixes-screensaver-bypass-discovered-by-two-kids/

Windows Finger command abused by phishing to download malware - BleepingComputer

Security researchers have found a phishing campaign utilizing the Windows Finger command to download and install a malicious backdoor dubbed MineBridge on victims' devices. These phishing emails contain malicious Word documents disguised as job applicant resumes that install the MineBridge malware. Once MineBridge is loaded, the remote threat actors will gain full access to the computer and allow them to listen in via the infected device's microphone and perform other malicious activities.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-finger-command-abused-by-phishing-to-download-malware/

Apple Kills MacOS Feature Allowing Apps to Bypass Firewalls

Apple has removed a contentious macOS feature that allowed some Apple apps to bypass content filters, VPNs, and third-party firewalls. The feature, first uncovered in November in a beta release of the macOS Big Sur feature, was called “ContentFilterExclusionList” and included a list of at least 50 Apple apps – including Maps, Music, FaceTime, the App Store, and its software update service. After lots of bad press and lots of feedback/bug reports to Apple from developers, the feature has been recently removed in macOS Big Sur versions 11.2.

See the full report here: https://threatpost.com/apple-kills-macos-feature-allowing-apps-to-bypass-firewalls/163099/

Scottish Environmental Protection Agency hit by ransomware attack - SiliconANGLE News

The Scottish Environment Protection Agency suffered a ransomware attack last month that continues to cause outages and warns that ransom-demanding attackers also stole some data. Data stolen by attackers have begun to be leaked online by the Conti ransomware operation, which has claimed credit for the attack.

See the full report here: https://siliconangle.com/2021/01/17/scottish-environmental-protection-agency-hit-ransomware-attack/

Hackers leak trucker, rail worker medical records - FreightWaves

UPS and Norfolk Southern said they are looking into whether employee health data was compromised after hackers posted medical records of truck drivers and rail workers to a leak site following an apparent ransomware attack and data breach at a Virginia-based occupational health-care provider. It was not immediately clear how many UPS and Norfolk Southern personnel were affected by the leak of over 3,000 files from the occupational health provider Taylor Made Diagnostics on January 8, 2020. But FreightWaves found multiple health records for employees from both firms, in addition to many smaller trucking companies, U.S. government agencies, and defense contractors from as recently as December 2020.

See the full report here: https://www.freightwaves.com/news/hackers-leak-trucker-rail-worker-medical-records

WhatsApp Delays Controversial 'Data-Sharing' Privacy Policy Update By 3 Months

WhatsApp announced that it would delay its new privacy policy by a month, from February 8 to May 15, after facing a lot of criticism. The Facebook-owned company has clarified that the update does not expand its ability to share personal user chats or other profile information with Facebook and is instead providing further transparency about how user data is collected and shared when using the messaging app to interact with businesses.

See the full report here: https://thehackernews.com/2021/01/whatsapp-delays-controversial-data.html

DuckDuckGo surpasses 100 million daily search queries for the first time

DuckDuckGo celebrates a milestone as it reaches 100 million searches in a single day. The achievement comes after a period of sustained growth the company has been seeing for the past two years, and especially since August 2020, when the search engine began seeing more than 2 billion search queries a month regularly.

See the full report here: https://www.zdnet.com/article/duckduckgo-surpasses-100-million-daily-search-queries-for-the-first-time/

Windows 10 bug causes a BSOD crash when opening a certain path - BleepingComputer

A bug in Windows 10 causes the operating system to have a Blue Screen of Death crash simply by opening a certain path in a browser's address bar or using other Windows commands. While it has not been determined if this bug could be exploited for remote code execution or elevation privilege, in its current form, it can be used as a denial of service attack on a computer.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-10-bug-causes-a-bsod-crash-when-opening-a-certain-path/

Multiple backdoors and vulnerabilities discovered in FiberHome routers

At least 28 backdoor accounts and several other vulnerabilities have been discovered in the firmware of a popular FTTH ONT (Fiber-to-the-Home Optical Network Terminal) router, widely deployed across South America and Southeast Asia. According to a researcher, the device firewall is only active on the IPv4 interface and not on IPv6, allowing threat actors direct access to all of the router's internal services, as long as they know the IPv6 address to access the device. Starting with this issue, he detailed a long list of backdoors and vulnerabilities discovered on the device, which he claims attackers could abuse to take over ISP infrastructure.

See the full report here: https://www.zdnet.com/article/multiple-backdoors-and-vulnerabilities-discovered-in-fiberhome-routers/

Critical flaws in Orbit Fox WordPress plugin allows site takeover

Security researchers have discovered two security vulnerabilities in the Orbit Fox WordPress plugin. The flaws are a privilege-escalation vulnerability and a stored XSS bug that impacts over 40,000 installs. Two vulnerabilities can be exploited by attackers to inject malicious code into websites using the vulnerable version of the plugin and take over them. The vulnerabilities have been addressed with the release of version 2.10.3.

See the full report here: https://securityaffairs.co/wordpress/113394/hacking/wordpress-orbit-fox-flaws.html?utm_source=rss&utm_medium=rss&utm_campaign=wordpress-orbit-fox-flaws

AnyVan confirms digital break-in, says customer names, emails and hashed passwords exposed

Anyvan, the European online marketplace that lets users buy delivery, transport, or removal services from a network of providers, has confirmed it was the victim of a digital burglary that involved the theft of customers' personal data. The company stated that a security breach resulted in unauthorized access to data from its user database. According to the firm, customers' names, email, and a cryptographic hash of their password were accessed and 'potentially viewed' but no other personal data was unwittingly shared.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/01/19/anyvan_confirms_digital_breakin_says/

IObit forums hacked in widespread DeroHE ransomware attack - BleepingComputer

Windows utility developer IObit was compromised over the weekend to perform a widespread attack to distribute DeroHE ransomware to its forum members. IObit forum members began receiving emails claiming to be from IObit. The email contains a link that distributes a .zip file. This zip file includes digitally signed files from the legitimate IObit License Manager program, but with the IObitUnlocker[.]dll replaced with an unsigned malicious version. When IObit License Manager[.]exe is executed, the malicious IObitUnlocker[.]dll will be executed to install the DeroHE ransomware. When encrypting victims, the ransomware appends [.]DeroHE extension to encrypted files.

See the full report here: https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-in-widespread-derohe-ransomware-attack/

500K+ records of C-level people from Capital Economics leaked online

Security researchers have found a leak of 500K+ records of C-level people from Capital Economics on a Russian-speaking forum. Capital Economics is one of the leading independent economic research companies in the world that provides macroeconomic, financial market, and sectoral forecasts and consultancy. Leaked records include email IDs, password hashes, addresses, etc.

See the full report here: https://securityaffairs.co/wordpress/113581/deep-web/capital-economics-data-leak.html?utm_source=rss&utm_medium=rss&utm_campaign=capital-economics-data-leak

UK police warn of sextortion attempts in intimate online dating chats

In a recent sextortion scam documented by the UK's Thames Valley police, a scam artist recorded an intimate video with a young man and demanded £200 ($270) on pain of it being sent to all of his family and friends. The man refused, but over the next two hours, he received over 100 demands for payment. The victim blocked her and deactivated all of his accounts before contacting law enforcement.

See the full report here: https://www.zdnet.com/article/uk-police-warn-of-sextortion-attempts-in-intimate-online-dating-chats/

FBI warns of vishing attacks stealing corporate accounts - BleepingComputer

The U.S. Federal Bureau of Investigation has issued a warning of ongoing vishing attacks by cybercriminals, focusing their operations to target employees of companies who maintain network access and an ability to escalate network privileges. The threat actors are using Voice over Internet Protocol (VoIP) platforms to target employees of companies worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-vishing-attacks-stealing-corporate-accounts/

OpenWRT reports data breach after hacker gained access to forum admin account

The OpenWRT forum, a large community of enthusiasts of alternative, open-source operating systems for routers, announced a data breach. The attack occurred on Saturday, around 04:00 (GMT), when an unauthorized third party gained admin access and copied a list with details about forum users and related statistical information.

See the full report here: https://www.zdnet.com/article/openwrt-reports-data-breach-after-hacker-gained-access-to-forum-admin-account/

A Chinese hacking group is stealing airline passenger details

A suspected Chinese hacking group has been attacking the airline industry for the past few years with the goal of obtaining passenger data in order to track the movement of persons of interest. The intrusions have been linked to a threat actor named Chimera, a group that is believed to be operating in the interests of the Chinese state. The group's typical modus operandi usually begins with collecting user login credentials that leaked in the public domain after data breaches at other companies. This data is used for credential stuffing or password spraying attacks against a target's employee services, such as email accounts. Once in, the operators search for login details for corporate systems, such as Citrix systems and VPN appliances. They access the internal network to deploy Cobalt Strike and move to as many systems as possible.

See the full report here: https://www.zdnet.com/article/a-chinese-hacking-group-is-stealing-airline-passenger-details/

Google search bug freezes tabs when using a custom date range - BleepingComputer

A bug in Google Search is causing a browser tab to freeze when searching between a specified range of dates. According to users' reports, this bug started a few days ago and is affecting all sections of Google Search, including News, Books, Images, Videos, etc. According to the Firefox developer console, this issue appears to be caused by JavaScript associated with the feature. Google is aware of the issue and is hoping to resolve it soon. In the meantime, Google recommends using the 'before:' and 'after:' search directives instead.

See the full report here: https://www.bleepingcomputer.com/news/google/google-search-bug-freezes-tabs-when-using-a-custom-date-range/

Google Chrome 88 released: RIP Flash Player and FTP support - BleepingComputer

Google has released Chrome 88 on January 19th, 2021, to the Stable desktop channel. Google has completely removed Flash Player and FTP support from the browser as a part of security improvements.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-88-released-rip-flash-player-and-ftp-support/

DNSpooq bugs let attackers hijack DNS on millions of devices - BleepingComputer

Researchers have uncovered a set of flaws in dnsmasq, popular open-source software used for caching Domain Name System (DNS) responses for home and commercial routers and servers. Three security flaws tracked as CVE-2020-25686, CVE-2020-25684, and CVE-2020-25685 could enable DNS cache poisoning. Researchers also shed light on four buffer-overflow vulnerabilities (CVE-2020-25687, CVE-2020-25683, CVE-2020-25682, and CVE-2020-25681) in dnsmasq.

See the full report here: https://www.bleepingcomputer.com/news/security/dnspooq-bugs-let-attackers-hijack-dns-on-millions-of-devices/

Bugs in Signal, Facebook, Google chat apps let attackers spy on users - BleepingComputer

A security researcher discovered vulnerabilities in multiple video conferencing mobile applications that allowed attackers to listen to users' surroundings without permission before the person on the other end picked up the calls. The security flaws patched in the Signal, Google Duo, Facebook Messenger, JioChat, and Mocha messaging apps.

See the full report here: https://www.bleepingcomputer.com/news/security/bugs-in-signal-facebook-google-chat-apps-let-attackers-spy-on-users/

VLC Media Player 3.0.12 fixes multiple remote code execution flaws - BleepingComputer

VideoLan released VLC Media Player 3.0.12 for Windows, Mac, and Linux last week with numerous improvements, features, and security fixes. The buffer overflow or invalid dereference vulnerabilities in VLC Media Player could trigger either a crash of VLC or an arbitrary code execution with the privileges of the target user. While VideoLan states that this vulnerability will likely crash VLC Media Player, they warn that attackers could use it to leak information or remotely execute commands on the device. VideoLan states that they have not seen exploits abusing these vulnerabilities in the wild and strongly advises all users to download and install the updated version 3.0.12.

See the full report here: https://www.bleepingcomputer.com/news/software/vlc-media-player-3012-fixes-multiple-remote-code-execution-flaws/

Critical Cisco SD-WAN Bugs Allow RCE Attacks

Cisco is warning of multiple, critical vulnerabilities in its software-defined networking for wide-area networks (SD-WAN) solutions for business users. The most serious of these flaws could be exploited by an unauthenticated, remote attacker to execute arbitrary code on the affected system with root privileges. Cisco has issued patches addressing these vulnerabilities. Users are advised to apply the patches as soon as possible.

See the full report here: https://threatpost.com/critical-cisco-sd-wan-bugs-rce-attacks/163204/

Hacker leaks full database of 77 million Nitro PDF user records - BleepingComputer

A threat actor claiming to be a part of ShinyHunters has leaked the full database of Nitro PDF for free on a hacker forum. The massive Nitro PDF data breach was reported last year. The leaked database contained the email addresses, names, and passwords of more than 77 million Nitro PDF user records.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-leaks-full-database-of-77-million-nitro-pdf-user-records/

Hacker posts 1.9 million Pixlr user records for free on forum - BleepingComputer

Over the weekend, a threat actor known as ShinyHunters shared a database for free on a hacker forum that it claims was stolen from Pixlr while they breached the 123rf stock photo site. The alleged Pixlr database posted by ShinyHunters contains 1,921,141 user records consisting of email addresses, login names, SHA-512 hashed passwords, a user's country, whether they signed up for the newsletter, and other internal information. ShinyHunters stated that they downloaded the database from the company's AWS bucket at the end of 2020. While Pixlr is yet to confirm the leaked database, users are strongly advised to change their passwords on the site.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-posts-19-million-pixlr-user-records-for-free-on-forum/

NSA urges system administrators to replace obsolete TLS protocols

The US National Security Agency has issued a security advisory urging system administrators in federal agencies and beyond to stop using old and obsolete TLS protocols. NSA recommends that only TLS 1.2 or TLS 1.3 be used; and that SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 not be used. They have also published a list of tools on its GitHub profile to help system administrators to identify systems on their internal networks still using obsolete TLS protocol configurations.

See the full report here: https://www.zdnet.com/article/nsa-urges-system-administrators-to-replace-obsolete-tls-protocols/

Google Chrome now checks for weak passwords, helps fix them - BleepingComputer

Google has added a new feature to the Chrome web browser that will make it easier to check if their stored passwords are weak and easy to guess, exposing users to brute force attacks or password cracking attempts. Google Chrome allows creating, storing, and filling your passwords with a mouse click while browsing the web using a built-in password manager. After finding weak passwords, Chrome will allow you to change them using stronger ones that can be generated on the spot and stored for later use. The new feature will be rolled out to Google Chrome users over the coming weeks after updating to version 88.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-now-checks-for-weak-passwords-helps-fix-them/