Threat Intelligence Bulletin: 02/12/2021

Breach Disclosure: ge.tt

ge.tt, the file sharing service experienced a data breach in December of 2017, with data now being publicly available for users to download on various forums and marketplaces. This breach was carried out by Gnosticplayers, who have played a large role in posting these breaches for quite some time. This breach impacted 2,481,121 accounts including user's names, social media profile identifiers, and SHA256 password hashes.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

This breach was listed for sale on dark web marketplaces along with 24 other companies around the time this originally was up for sale. When listed, this data went for around 4 bitcoins, now this data is freely distributed on hacking forums.

imgur Figure 1: Breach advertisement on RaidForums

Gnosticplayers have for the most part been relatively quiet since their breaching spree, with actors such as Shiny Hunters taking their place, but the effects of Gnosticplayers are still present, with this data still available online for users to download. This data, along with their other breaches can be invaluable in some scenarios when attempting to exploit users or companies.

Breach Disclosure: CityBee

CityBee, the Lithuanian car-sharing service, suffered a data breach in February 2021 exposing the records of over 110,000 customers. The data includes names, email addresses, unsalted SHA-1 password hashes, government IDs, drivers license details and contact information.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

A hacker under the alias of 000 posted within a popular hacking forum offering the CityBee database for free, as well as advertising the sale of a full backup of CityBee data including other company and customer data. The database contains sensitive information of CityBee customers including email addresses and national ID numbers. CityBee have confirmed the authenticity of the list but claim no financial data is involved.

Figure 1: 000 offering the breached database for free

The post advertising the breach was created in February 2021, however it also explains how the data is from 2018. Subsequent posts by the author detail how the breached data was obtained from an exposed Azure blob storage instance. The hacker explains they were able to brute force directory names from the exposed endpoint until they located a directory named "sql". Within this directory they extracted a full backup of multiple CityBee databases which are being offered for sale at $1000 in bitcoin.

Figure 2: Post detailing how the breach happened on RaidForms

Figure 3: Samples of data posted by the hacker to prove authenticity

The hacker offering the data also directly calls out CityBee, claiming they are "lying" and this data has been exposed for a very long time. They also claim to have more databases for sale from other companies, obtained in a similar fashion.

Breaking News: 2021-02-12 - 2021-02-18

‘Annoyingly Believable’ Tax Scam Targets Mobile Users

A well-crafted SMS phishing effort is harvesting personal data and credit-card details under the guise of offering tax refunds. SMS messages are going out to unsuspecting U.K. citizens claiming to be from Her Majesty’s Revenue and Customs (HMRC), the country’s IRS-equivalent. Spotted by researchers at Sophos, the messages tell targets that they’ve received a refund for “overpayment in the year 2019/2020” and are asked to click a link to “proceed." The link redirects to a set of well-designed phishing pages designed to harvest personal data. Scammers are taking the advantage of the taxing season to target users.

See the full report here: https://threatpost.com/believable-tax-scam-mobile-users/163951/

Apple will proxy Safe Browsing traffic on iOS 14.5 to hide user IPs from Google

Apple's upcoming iOS 14.5 release will ship with a feature that will re-route all Safari's Safe Browsing traffic through Apple-controlled proxy servers as a workaround to preserve user privacy and prevent Google from learning the IP addresses of iOS users. The new feature will work only when users activate the "Fraudulent Website Warning" option in the iOS Safari app settings. iOS 14.5 is currently in beta and is expected to be released in the coming months.

See the full report here: https://www.zdnet.com/article/apple-will-proxy-safe-browsing-traffic-on-ios-14-5-to-hide-user-ips-from-google/

Pre-Valentine’s Day Malware Attack Mimics Flower, Lingerie Stores

In an ongoing spear-phishing campaign, scammers are using Valentine's Day lures to direct victims to a malicious document that executes the BazaLoader malware. The phishing emails pretend to confirm hefty orders from lingerie shop Ajour Lingerie and flower store Rose World. These phishing emails ultimately lead recipients to a malicious document that executes the BazaLoader malware, which has the primary function of downloading and executing additional modules.

See the full report here: https://threatpost.com/valentines-day-malware-attack/163900/

Scammers target US tax pros in ongoing IRS phishing attacks - BleepingComputer

In an attempt to steal Electronic Filing Identification Numbers (EFINs), identity thieves are targeting US tax professionals in an ongoing phishing campaign, warns Internal Revenue Service (IRS). The phishing emails ask tax preparers to email copies of their "EFIN (e-file identification number) verification and Driver's license" as part of a bogus verification process. Once they get their hands on this information, the fraudsters will illegally file tax returns for refunds by impersonating the targeted professionals. IRS urges tax professionals to be aware of other common phishing scams that seek EFINs, Preparer Tax Identification Numbers (PTINs), or e-Services usernames and passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/scammers-target-us-tax-pros-in-ongoing-irs-phishing-attacks/

Yandex suffers data breach after sysadmin sold access to user emails - BleepingComputer

Yandex disclosed that one of its system administrators had enabled unauthorized access to almost 5,000 Yandex email inboxes. According to the company, payment details have not been impacted. Yandex’s security team has blocked unauthorized access to the compromised mailboxes. Yandex has also alerted the owners of the breach and that they need to change their account passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/yandex-suffers-data-breach-after-sysadmin-sold-access-to-user-emails/

Microsoft now forces secure RPC to block Windows Zerologon attacks - BleepingComputer

Microsoft has enabled enforcement mode for updates addressing the Windows Zerologon vulnerability(tracked as CVE-2020-1472) on all devices that installed February month's Patch Tuesday security updates. February 9, 2021, and superseding Windows Updates enable enforcement mode on all supported Windows Domain Controllers and will block vulnerable connections from non-compliant devices.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-now-forces-secure-rpc-to-block-windows-zerologon-attacks/

Leading Canadian rental car company hit by DarkSide ransomware - BleepingComputer

Canadian Discount Car and Truck Rentals has been hit with a DarkSide ransomware attack where the hackers claim to have stolen 120GB of unencrypted data, including finance, marketing, banking, account, and franchisee data. The cyberattack has disrupted the company's online rental services at discountcar[.]com.

See the full report here: https://www.bleepingcomputer.com/news/security/leading-canadian-rental-car-company-hit-by-darkside-ransomware/

SU data breach exposes nearly 10000 names, Social Security numbers - The Daily Orange

The names and Social Security numbers of about 9,800 Syracuse University students, alumni, and applicants have been exposed after someone gained unauthorized access to an employee’s email account between Sept. 24 and Sept. 28, 2020. The university has sent letters to affected students, alerting them that the university had investigated a data security breach involving some of their personal information.

See the full report here: http://www.saywww.dailyorange.com/2021/02/names-social-security-numbers-of-syracuse-university-students-exposed-in-data-breach/

Android App Barcode Scanner Transformed Into Malware Before Google Removed It - Cyber Security News

Google Play Store has removed the Barcode scanner app after users complained of suspicious ads and adware was detected. According to a Malwarebytes Lab post, the Android app with over 10 million downloads Barcode Scanner, turned into malware. Malwarebytes analysis reveals that the app turned into malware possibly after receiving the December 2020 update.

See the full report here: https://latesthackingnews.com/2021/02/12/android-app-barcode-scanner-transformed-into-malware-before-google-removed-it/

CD Projekt's stolen source code allegedly sold by ransomware gang - BleepingComputer

A ransomware gang who says they stole unencrypted source code for the company's most popular games and then encrypted CD Projekt's servers claims to have sold the data. In a ransom note left behind on encrypted systems, the attackers claim to have stolen the source code for Cyberpunk 2077, Witcher 3, Gwent, and an unreleased version of Witcher 3.

See the full report here: https://www.bleepingcomputer.com/news/security/cd-projekts-stolen-source-code-allegedly-sold-by-ransomware-gang/

Ransomware attack on city of Bainbridge Island vendor exposes data - Kitsap Sun

A ransomware attack on a vendor that the city of Bainbridge Island uses for water and sewer billing and handling business and occupation tax processing possibly exposed customer information, the city said in a Friday evening news release. The breach appears to have affected data from a range of jurisdictions around Puget Sound, including the cities of Redmond, Monroe, Mountlake Terrace, and Auburn.

See the full report here: https://www.kitsapsun.com/story/news/2021/02/12/ransomware-attack-city-bainbridge-island-vendor-exposes-data/4468289001/

Utah water managers check cyber security after hackers target Florida water system - KJZZ

An alarming cyber attack out of Florida has Utah water managers doing an extra check on their systems this week. Hackers targeted a small water system in Florida on Feb. 5, trying to release toxic amounts of a chemical.

See the full report here: https://kjzz.com/news/utah-water-managers-check-cyber-security-after-hackers-target-florida-water-system

Secret Chat in Telegram Left Self-Destructing Media Files On Devices

Popular messaging app Telegram fixed a privacy-defeating bug in its macOS app that made it possible to access self-destructing audio and video messages long after they disappeared from secret chats. The vulnerability was discovered by security researcher Dhiraj Mishra in version 7.3 of the app, who disclosed his findings to Telegram on December 26, 2020. The issue has since been resolved in version 7.4, released on January 29.

See the full report here: https://thehackernews.com/2021/02/secret-chat-in-telegram-left-self.html

Cong social media warriors website prone to hacking, Twitter user shows ‘data leak’ from INC portal - NewsroomPost

Amid allegations of homegrown Koo App compromising the personal details and data of users, a social media user has unearthed the vulnerability of the Congress portal itself. Recently, Congress launched a mega campaign of recruiting “5 Lakh Social Media Warriors” xxps://www[.]incsmw[.]in/. The registration form seeks info like Name, Address, Mobile No, Twitter/FB a/c handles, Email, etc. A social media user has reportedly found that this INC portal ‘leaking’ data of its members.

See the full report here: https://newsroompost.com/india/cong-social-media-warriors-website-prone-to-hacking-user-shows-data-leak-from-inc-portal/580117.html

PayPal fixes reflected XSS vulnerability in user wallet currency converter

PayPal has fixed a reflected cross-site scripting (XSS) vulnerability found in the currency converter feature of user wallets. PayPal said the bug existed in the currency conversion endpoint and was caused by a failure to properly sanitize user input.

See the full report here: https://www.zdnet.com/article/paypal-fixes-reflected-xss-vulnerability-in-business-wallet/

The kingpin behind Joker’s Stash retires with a billionaire exit

Several reports indicate that the world’s largest darknet market (DNM), in terms of stolen credit card and identity sales, has called it quits after operating since 2014. Joker’s Stash explained in mid-January that the business would be closing shop in mid-February, and it has followed through with the plan.

See the full report here: https://securityaffairs.co/wordpress/114580/cyber-crime/jokers-stash-retires.html?utm_source=rss&utm_medium=rss&utm_campaign=jokers-stash-retires

Egregor ransomware operators arrested in Ukraine

A joint operation between French and Ukrainian law enforcement has reportedly led to the arrests of several members of the Egregor ransomware operation in Ukraine. The arrested individuals are thought to be Egregor affiliates whose job was to hack into corporate networks and deploy the ransomware.

See the full report here: https://www.zdnet.com/article/egregor-ransomware-operators-arrested-in-ukraine/

Pro-India hackers use Android spyware to spy on Pakistani military - BleepingComputer

Two variants of Android spyware connected to pro-India, state-sponsored hacking campaigns have been discovered. The two malware strains, dubbed Hornbill and SunBird, have been linked to Confucius, an advanced persistent threat (APT) group thought to be state-sponsored and to have pro-India ties.

See the full report here: https://www.bleepingcomputer.com/news/security/pro-india-hackers-use-android-spyware-to-spy-on-pakistani-military/

Google Chrome, Microsoft Edge getting this Intel security feature - BleepingComputer

Chromium-based browsers such as Microsoft Edge and Google Chrome will soon support the Intel CET security feature to prevent a wide range of vulnerabilities. Intel's Control-flow Enforcement Technology (CET) is a hardware security feature initially introduced in 2016 and added to Intel's 11th generation CPUs in 2020.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-microsoft-edge-getting-this-intel-security-feature/

This phishing email promises you a bonus - but actually delivers this Windows trojan malware - ZDNet

Security researchers at Fortinet have discovered a new phishing campaign that tries to lure enterprise users with fake customer complaint reports, fake billing statements, and even the offer of a phony bonus. The campaign uses a new variant of the Bazar trojan, which has been linked to the developers of Trickbot, that comes equipped with anti-analysis techniques to make it more difficult for antivirus software to detect. If successfully deployed, it can provide cybercriminals with a backdoor into a compromised Windows system to allow them to control a user’s device, gain additional access to a corporate network to steal sensitive data, and deploy malware.

See the full report here: https://www.zdnet.com/article/this-phishing-email-promises-you-a-bonus-but-actually-delivers-this-windows-trojan-malware/

VMware fixes command injection issue in vSphere Replication

VMware has recently released security patches to address a serious command injection vulnerability, tracked as CVE-2021-21976, in its vSphere Replication product. The vulnerability can be exploited by an attacker with admin privileges to execute shell commands on the underlying system. Users are recommended to upgrade to the fixed versions.

See the full report here: https://securityaffairs.co/wordpress/114619/security/vmware-command-injection-vsphere-replication.html?utm_source=rss&utm_medium=rss&utm_campaign=vmware-command-injection-vsphere-replication

Cyberattack on Dutch Research Council (NWO) suspends research grants - BleepingComputer

Servers belonging to the Dutch Research Council (NWO) have been compromised, forcing the organization to make its network unavailable and suspend subsidy allocation for the foreseeable future. The organization says that its servers have been hacked and that its network is not accessible. The ISAAC server has been shut down until the incident assessment removes all suspicion of the possibility of malware infection. As a result, the processes of SIA and NRO remain suspended indefinitely.

See the full report here: https://www.bleepingcomputer.com/news/security/cyberattack-on-dutch-research-council-nwo-suspends-research-grants/

Security bugs left unpatched in Android app with one billion downloads

An Android application downloaded more than one billion times contains unpatched vulnerabilities that the app maker has failed to fix for more than three months. The vulnerabilities impact the Android version of SHAREit, a mobile app that allows users to share files with friends or between personal devices.

See the full report here: https://www.zdnet.com/article/security-bugs-left-unpatched-in-android-app-with-one-billion-downloads/

DDoS attack takes down EXMO cryptocurrency exchange servers - BleepingComputer

UK-based crypto exchange Exmo suffered a distributed denial-of-service (DDoS) attack. In a separate alert issued through the company's official Twitter account, EXMO said that it's working on addressing the issue.

See the full report here: https://www.bleepingcomputer.com/news/security/ddos-attack-takes-down-exmo-cryptocurrency-exchange-servers/

Microsoft is testing a hidden Windows Terminal Settings screen - BleepingComputer

Starting in Windows Terminal Preview 1.6, released two weeks ago, Microsoft is testing a feature that allows users to configure the application's settings using a hidden graphical user interface. It is an open-source application developed by Microsoft to open multiple console tabs in the same Windows. Each of these console tabs can be for different shells, including the Windows command prompt, PowerShell, Linux shells installed in Windows Subsystem, or custom shells installed by the user.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-is-testing-a-hidden-windows-terminal-settings-screen/

France Ties Russia's Sandworm to a Multiyear Hacking Spree

The French information security agency ANSSI published an advisory warning that hackers with links to Sandworm, a group within Russia's GRU military intelligence agency, had breached several French organizations. The hackers with tools and techniques it links to Sandworm have stealthily hacked targets by exploiting an IT monitoring tool called Centreon and appear to have gotten away with it undetected for as long as three years.

See the full report here: https://www.wired.com/story/sandworm-centreon-russia-hack/

Microsoft will alert Office 365 admins of Forms phishing attempts - BleepingComputer

Microsoft is adding new security warnings to the Security and Compliance Center (SCC) default alert policies to inform IT admins of detected phishing attempts abusing Microsoft Forms in their tenants. This phishing protection feature will proactively identify malicious password collection in forms and surveys.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-will-alert-office-365-admins-of-forms-phishing-attempts/

Malvertisers Exploited WebKit 0-Day to Redirect Browser Users to Scam Sites

A malvertising group, ScamClub has exploited a zero-day vulnerability in WebKit-based browsers to inject malicious payloads that redirected users to fraudulent websites gift card scams. The attack leveraged a bug, CVE-2021–1801, that allowed malicious parties to bypass the iframe sandboxing policy in the browser engine that powers Safari and Google Chrome for iOS and run malicious code. The operators of ScamClub have delivered more than 50 million malicious impressions over the last 90 days, with as many as 16MM impacted ads being served in a single day. Following the disclosure, Apple patched the WebKit vulnerability in iOS 14.4 and macOS Big Sur.

See the full report here: https://thehackernews.com/2021/02/malvertisers-exploited-webkit-0-day-to.html

Misconfigured Baby Monitors Allow Unauthorized Viewing

According to researchers, a vulnerability affecting multiple baby monitors could allow someone to drop in and view a camera’s video stream. Hundreds of thousands of individuals are potentially affected by this vulnerability. The issue exists in the manufacturers’ implementation of the Real-Time Streaming Protocol (RTSP), which is a set of procedures used by various cameras to control their streaming media.

See the full report here: https://threatpost.com/baby-monitors-unauthorized-viewing/163982/

A Sticker Sent On Telegram Could Have Exposed Your Secret Chats - The Hacker News

Security researchers have disclosed the details of a now-patched flaw in the Telegram messaging app that could have exposed users' secret messages, photos, and videos to remote malicious actors. The flaws stemmed from the way secret chat functionality operates and in the app's handling of animated stickers, allowing attackers to send malformed stickers to unsuspecting users and gain access to messages, photos, and videos that were exchanged with their Telegram contacts through both classic and secret chats. Telegram released a series of patches on September 30 and October 2, 2020, addressing these flaws.

See the full report here: https://thehackernews.com/2021/02/a-sticker-sent-on-telegram-could-have.html

Microsoft Edge is getting a new child-friendly Kids Mode - BleepingComputer

Microsoft is adding a new 'Kids Mode' to the Microsoft Edge browser that provides a safe environment for children to browse the web and consume family-friendly content. The new mode is geared towards children between the ages of 5-8 and 9-12. It provides a limited browsing experience, including Bing SafeSearch, children-friendly content, and restricted access to only family-friendly sites. Once enabled, the mode will allow the browser to go into full-screen mode and display a family-friendly background, with a Bing SafeSearch field and quick links to popular kid sites.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-edge-is-getting-a-new-child-friendly-kids-mode/

Kia Motors America experiences massive IT outage across the US - BleepingComputer

Kia Motors USA is experiencing a nationwide outage affecting IT servers, self-payment phone services, dealer platforms, and phone support after the Kia Owners Portal went offline and began displaying an error message stating that Kia was "experiencing an IT service outage that has impacted some internal networks." The cause of the outage currently is unknown. However, the outage has been ongoing for four days and Kia stated that they are working to resolve the issues.

See the full report here: https://www.bleepingcomputer.com/news/security/kia-motors-america-experiences-massive-it-outage-across-the-us/

Microsoft pulls Windows KB4601392 for blocking security updates - BleepingComputer

Microsoft removed a faulty servicing stack update, which was causing issues for Windows users when they tried to install last week’s Patch Tuesday security updates. Microsoft’s servicing stack update provides fixes for the component that installs Windows updates. This particular defective update (KB4601392) was applied to Windows 10 users (version 1607 for 32-bit and x64-based systems) and Windows Server 2016 users.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-pulls-windows-kb4601392-for-blocking-security-updates/

Centreon says only 15 entitites were targeted in recent Russian hacking spree

French software company Centreon said today that none of its paid customers were the victims of a years-long hacking campaign that came to light on Monday. Exposed in a report published by ANSSI, France's cyber-security agency, the hacking campaign lasted between 2017 and 2020 and targeted companies running Centreon's primary product, a software package of the same name, used for monitoring IT resources inside large companies.

See the full report here: https://www.zdnet.com/article/centreon-says-only-15-entitites-were-targeted-in-recent-russian-hacking-spree/

Cred-stealing trojan harvests logins from Chromium browsers, Outlook and more, warns Cisco Talos

Cisco Talos has uncovered a credential-stealing trojan that lifts your login details from the Chrome browser, Microsoft's Outlook, and instant messengers. The Masslogger trojan’s latest variant is delivered through phishing emails and contained a multi-volume RAR archive using the .chm file format and .r00 extensions. It is a credential stealer and keylogger that has the ability to exfiltrate data through SMTP, FTP, or HTTP protocols. The threat actors behind Masslogger were seen targeting organizations in southern and eastern European countries.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/02/18/masslogger_cisco_talos_research/

Kia Faces $20M DoppelPaymer Ransomware Attack

Kia Motors America has reportedly been attacked by DoppelPaymer ransomware following a nationwide IT outage. The ransomware operators claim to have stolen a huge amount of data and threaten to publish the lifted information. DoppelPaymer has demanded $20 million for both a decryptor and the promise to not leak stolen data.

See the full report here: https://www.darkreading.com/attacks-breaches/kia-faces-$20m-doppelpaymer-ransomware-attack/d/d-id/1340188

Ninja Forms WordPress Plugin Bug Opens Websites to Hacks

Ninja Forms, a WordPress plugin, contains four critical security vulnerabilities that together could allow a remote attacker to take over a WordPress site. The four bugs allow lower-privileged users to carry out a range of malicious activities including, eavesdropping on emails, taking over admin accounts, installing arbitrary add-ons to a target site, and redirecting site owners to malicious destinations. The bugs have been patched in the latest fixed version Ninja Forms 3.4.34.1.

See the full report here: https://threatpost.com/ninja-forms-wordpress-plugin-hacks/164042/

Microsoft force installs Windows 10 update to remove Flash Player - BleepingComputer

Microsoft is force installing a Windows 10 update that removes the embedded 32-bit version of Adobe Flash Player from the operating system. Starting yesterday, Microsoft has begun to distribute the 'Update for Removal of Adobe Flash Player for Windows 10 (KB4577586)' update via Windows Update as what they state is an optional update. Once installed, this update could no longer be removed.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-force-installs-windows-10-update-to-remove-flash-player/

U.S. Charges 3 North Korean Hackers Over $1.3 Billion Cryptocurrency Heist

The U.S. Department of Justice (DoJ) on Wednesday indicted three suspected North Korean hackers for allegedly conspiring to steal and extort over $1.3 billion in cash and cryptocurrencies from financial institutions and businesses. The three defendants are said to be members of the Reconnaissance General Bureau, a military intelligence division of North Korea, also known as the Lazarus group, Hidden Cobra, or Advanced Persistent Threat 38 (APT 38). The conspiracy involved creating malicious applications that masqueraded as legitimate cryptocurrency trading platforms, only to use them as a backdoor to transfer money to their accounts fraudulently.

See the full report here: https://thehackernews.com/2021/02/us-charges-3-north-korean-hackers-over.html

QNAP patches critical vulnerability in Surveillance Station NAS app - BleepingComputer

The QNAP Surveillance Station app contains a flaw that could allow attackers to execute malicious code remotely on network-attached storage (NAS) devices running the vulnerable software. The critical security flaw is a stack-based buffer overflow vulnerability which when exploited allows attackers to execute arbitrary code. QNAP has fixed the critical vulnerability in the following software versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) and Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS).

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-patches-critical-vulnerability-in-surveillance-station-nas-app/