ZeroFox Daily Intelligence Brief - March 29, 2023

ZeroFox Daily Intelligence Brief - March 29, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• United Kingdom (UK) Plans to Amend Computer Misuse Act of 1990, Invites Security Community’s Views
• MetaMask Alerts Users of Scammers Hyping Up March 31 Airdrop Rumor
• Crown Resorts: Another Victim in the Long List of GoAnywhere Zero-Day Exploit Victims
• WiFi Protocol Flaw Allows Attackers to Hijack Network Traffic
• Binance CEO Zhao Sued by CFTC over “Willful Evasion” of U.S. Laws and Unregistered Crypto Derivatives Products

United Kingdom (UK) Plans to Amend Computer Misuse Act of 1990, Invites Security Community’s Views

The UK government is exploring a series of amendments to the Computer Misuse Act (CMA) of 1990 and urging ethical hackers, security researchers, and IT consultants to weigh in on proposed changes to the Act. The government is seeking the security community’s views on legislative changes that would give more power to enforcement agencies to pursue malicious actors and close loopholes that prevent bringing them to justice. However, some security campaigners have expressed disappointment at the government for not including any reforms to protect cybersecurity professionals from prosecution, considering that certain defensive techniques commonly used by security teams are criminalized under the current law.

Recommendations:

• UK security professionals and enthusiasts are encouraged to email their views and recommendations to cmareview@homeoffice[.]gov[.]uk by April 6, 2023.
• Follow ZeroFox Intelligence to remain up-to-date on the latest cybersecurity-related happenings.

MetaMask Alerts Users of Scammers Hyping Up March 31 Airdrop Rumor

Cryptocurrency enthusiasts are advised to be wary of scammers targeting them using the lure of claiming or registering for airdrops of MetaMask tokens. The admins of the popular decentralized wallet have warned users, via the official MetaMask Twitter handle, that malicious actors are spreading false and dangerous rumors about a purported airdrop of MetaMask tokens on March 31. Cryptocurrency projects occasionally provide “airdrops” to users—offering cryptocurrency coins or tokens free of charge to users as a reward for using the services of the blockchain or project. Some legitimate airdrops have resulted in users earning significant amounts of money in the form of cryptocurrency. However, the buzz generated by these legitimate airdrops entices crypto enthusiasts to participate in future ones, making them vulnerable targets for disinformation. MetaMask has warned users to be on the lookout for fake sites operated by scammers and phishers, where users may be asked to register with their details to be eligible for the alleged airdrop. Criminals are known to operate malicious sites with smart contracts that drain digital assets from the cryptocurrency wallets of users who interact with these sites.

ZeroFox Intelligence further notes that “MetaMask” is a commonly-spoofed Twitter display name. Any legitimate Twitter post on problems with operating the MetaMask wallet, or even the mere mention of the term “MetaMask,” elicits several replies and quoted Tweets from malicious bots within seconds proffering contact details (leading to accounts run by scammers) to approach for help. Amidst such a scenario, the hype around a fraudulent airdrop on March 31 could potentially lead to threat actors scaling up their attacks.

Recommendations:

• MetaMask has not finalized nor publicly announced a date for token airdrops. Crypto enthusiasts should follow announcements from official MetaMask channels and not heed online rumors.
• Do not provide personal details or register on any third-party platform claiming to be affiliated with MetaMask unless the site is confirmed via official MetaMask channels.
• Do not reveal wallet passwords or secret backup phrases to anyone claiming to be from the MetaMask support team.
• Conduct periodic checks on cryptocurrency wallets to identify the access/permissions allowed to various platforms and revoke unnecessary ones.

Crown Resorts: Another Victim in the Long List of GoAnywhere Zero-Day Exploit Victims

Another significant name in the long list of victims of the Fortra GoAnywhere zero-day vulnerability (CVE-2023-0669) is one of Australia’s largest gambling and entertainment companies: Crown Resorts. The company stated that it has been contacted by a ransomware group that claims to have illegally obtained a limited number of Crown files. However, the Blackstone-owned company asserted that no customer data has been compromised, and business operations have not been impacted. ZeroFox Intelligence notes that more than 130 organizations have been breached by the Clop ransomware group’s exploit of the GoAnywhere zero-day bug, which was disclosed on February 3, 2023. The victim list on the ransomware group’s list site now includes the websites of the Australian state of Tasmania, the city of Toronto (Canada), and the Indian state of Goa, as well as prominent corporate victims such as Hitachi Energy, Virgin Red, and Scholastic.

Recommendations:

• Update GoAnywhere MFT to version 7.1.2 as soon as possible to protect against the exploitation of the zero-day vulnerability.
• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

WiFi Protocol Flaw Allows Attackers to Hijack Network Traffic

Cybersecurity researchers have found a significant security flaw in the design of the IEEE 802.11 WiFi protocol standard that could allow attackers to trick access points into revealing network frames in plaintext. Queued or buffered frames that are meant to be protected from adversaries can be used by the attackers to facilitate data transmission, client spoofing, frame redirection, and capturing. This vulnerability could be exploited to inject malicious content such as JavaScript into TCP packets, which could then be sent to victims in plaintext HTTP connections. Devices from Lancom, Aruba, Cisco, Asus, and D-Link have been found to be vulnerable to these attacks. Cisco has acknowledged the vulnerability in its products but stated that the retrieved frames are unlikely to jeopardize the overall security of a properly secured network.

Recommendations:

• Organizations can implement transport layer security (TLS) to encrypt data in transit, where possible, as it would render the acquired data unusable by the attacker.
• To reduce the probability that such attacks succeed, implement policy enforcement mechanisms to restrict network access.
• Regularly assess the security posture of your organization to identify vulnerabilities and implement appropriate measures to mitigate the risks.

Binance CEO Zhao Sued by CFTC over “Willful Evasion” of U.S. Laws and Unregistered Crypto Derivatives Products

The U.S. Commodity Futures Trading Commission (CFTC) has sued cryptocurrency exchange Binance and its founder Changpeng Zhao for offering unregistered crypto derivatives in the United States in direct violation of federal law. The lawsuit alleges that Binance offered trades for cryptocurrencies, including bitcoin, ether, litecoin, tether, and Binance USD, which the suit referred to as commodities. The CFTC is charging Binance with violating laws around offering futures transactions; illegal off-exchanging commodity options; failing to register as a futures commissions merchant, designated contract market, or swap execution facility; poorly supervising its business; not implementing know-your-customer (KYC) or anti-money laundering processes; and having a poor anti-evasion program. The CFTC accuses Binance of deliberately obscuring the ownership, control, and location of the Binance platform, with Zhao answering to no one but himself. ZeroFox Intelligence notes that the case documents also indicate Binance’s laxity in dealing with transfer of funds of illicit origin via its platform, including those suspected to be flowing from darknet marketplaces such as the now-defunct Hydra marketplace.

Recommendations:

• Customers and other individuals can report suspicious activities or information, such as possible violations of commodity trading laws, to the CFTC’s Division of Enforcement by calling its toll-free hotline (866-FON-CFTC or 866-366-2382), filing a tip or complaint online at hXXps://www.cftc[.]gov/complaint, or by contacting the CFTC Whistleblower Office at whistleblower[.]gov.
• Follow ZeroFox Intelligence to stay up-to-date with the latest news and regulations related to cryptocurrency and Web3 technologies.