ZeroFox Daily Intelligence Brief - March 23, 2023

ZeroFox Daily Intelligence Brief - March 23, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Hackers Using New Methods to Steal Credit Card Detail by Injecting Malicious Scripts into Payment Gateway
• Netgear’s Orbi 750 Series Routers’ PoC Exploits for Vulnerabilities Released
• CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management
• Nexus, an Emerging Android Banking Trojan Targets 450 Financial Apps

Hackers Using New Methods to Steal Credit Card Detail by Injecting Malicious Scripts into Payment Gateway

MageCart threat actors are injecting malicious scripts directly into payment gateway modules used to process credit card payments in order to evade detection by security scans while stealing credit card data. In these attacks, the threat actors have been observed modifying the files of Authorize.net, a payment-processing system that supports the payment gateway’s integration to an ecommerce platform WooCommerce. The hackers also abused WordPress’s Heartbeat API to emulate regular traffic and mix it with victims’ payment data during exfiltration—helping to avoid detection by security tools monitoring the network. The code injections encrypt the victim's payment details and store it in an image file that the attackers can later retrieve and also allow them to intercept the customers’ names, shipping addresses, phone numbers, and postal codes.

Recommendations:

• It is essential for website owners and administrators that utilize WooCommerce and WordPress sites to stay vigilant and enforce robust security measures.
• Consumers should use a credit card with favorable customer fraud policies or a prepaid card with a set spending limit when shopping online in order to protect themselves from this type of credit card theft.
• Users should be cautious regarding any unexpected emails they receive after making an online purchase, particularly those that contain links or attachments, as these could be follow-on attacks using exfiltrated customer data.

Netgear’s Orbi 750 Series Routers’ PoC Exploits for Vulnerabilities Released

Security researchers have discovered that popular home router Netgear Orbi can be remotely exploited using the access control functionality by means of a critical-severity vulnerability tracked as CVE-2022-37337. In attacks leveraging this bug, an attacker can exploit admin consoles by sending a unique HTTP request to the vulnerable router to carry out arbitrary commands on the device. However, the exploits require local access, valid credentials, or the admin console to be publicly accessible, making the bug challenging to exploit. Researchers have observed that about 10,000 Orbi devices use default admin credentials, leaving them vulnerable to attacks.

Recommendations:

• Home router users should reset the manufacturer’s default credentials on their devices to something anonymous with a strong password.
• Since Netgear Orbi 750 device updates are not automatically installed, users should manually check if their device is running the latest version released on January 19, 2023 (4.6.14.3).
• Users should update to the latest version to protect against attacks leveraging this bug.
• Stay informed about emerging threats, vulnerabilities, and security recommendations by following ZeroFox Intelligence.

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management

The Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have jointly released a best-practices guide for administrators as part of the Enduring Security Framework (ESF). The guide offers various recommendations to secure systems against Identity and Access Management (IAM) threats. IAM is a framework that organizations can follow to secure an employee's access to company information, resources, and devices and to audit their access to company infrastructure. The guide covers best practices for identity governance, environmental hardening, identity federation/single sign-on (SSO), multi factor authentication, and IAM auditing/monitoring.

Recommendations:

• Make a clear assessment of the organization’s IAM capabilities and risk posture and ensure that IAMs and SSO requirements protect not only the enterprise but its partners and consumers as well.
• Monitor the activity between an enterprise’s applications and systems and its network traffic, as well as external network traffic for suspicious or unusual changes.
• Analyze the security parameters within the enterprise environment, and identify the security gaps that exist in an organization’s enterprise.

Nexus, an Emerging Android Banking Trojan Targets 450 Financial Apps

Security researchers have warned of an emerging Android banking trojan called Nexus, which has been employed in attacks against 450 financial applications. Nexus is available via Malware-as-a-Service and is advertised on underground forums or through private channels. Experts believe that Nexus is in the early stages of development despite being actively used in multiple campaigns. It provides all the main features to perform Account Takeover (ATO) attacks against banking portals and cryptocurrency services, such as credential stealing and SMS interception.

Recommendations:

• Keep mobile devices and apps updated with the latest security patches, and be cautious about granting permissions on the apps.
• Use strong, unique passwords for online accounts, including financial accounts.
• Enable two-factor authentication (2FA) wherever possible.
• Only install apps from trusted sources, such as Google Play Store or Apple App Store.