ZeroFox Daily Intelligence Brief - May 4, 2023
|by Alpha Team
ZeroFox Daily Intelligence Brief - May 4, 2023
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.
Brief Highlights
- City of Dallas Suspends IT Systems to Prevent the Spread of Ransomware Attack
- Drone Goggles Maker Claims Firmware Sabotaged to “Brick” Devices
- Hotels at Risk from Bug in Oracle Property Management Software
- CVE-2023-22921
- CVE-2023-1804
- CVE-2023-22651
- CVE-2020-16134
- CVE-2023-20959
- Telegram: @cloudlogss (90-99) Botnet Breach (2,421,461 Email address and password
- Credit Card Data Breach: 2023-5-3
- Telegram: @cloudlogss (80-89) Botnet Breach (2,248,938 Records) Email address and password
City of Dallas Suspends IT Systems to Prevent the Spread of Ransomware Attack
The City of Dallas has experienced a Royal ransomware attack, which forced its court system to cancel all jury trials and jury duty on May 2 and May 3, 2023. The cyberattack has affected the city’s IT systems, intermittently impacting 911 emergency services (including Dallas Fire Rescue and Dallas County Police Department). The websites of Dallas police and water utilities were reportedly offline because of the attack. There have been at least 29 incidents of ransomware attacks on U.S. local government bodies in the past year, 16 of which have involved data theft.
Recommendations:
- Dallas residents experiencing any problem accessing city services can call 311; emergencies should still dial 911.
- Organizations should implement robust backup and recovery processes for critical data and systems to minimize downtime and the impact of a ransomware attack.
Drone Goggles Maker Claims Firmware Sabotaged to “Brick” Devices
Orqa, which manufactures First Person View (FPV) drone race goggles, has received customer complaints of their devices entering bootloader mode and becoming unusable. The issue appears to stem from a firmware bug that affected the date/time feature. Orca claims that a former contractor introduced the ransomware “time bomb” code into its firmware in order to “brick” customers’ devices with the intent of extracting a ransom from the company. The perpetrator has allegedly posted an unauthorized binary file he claims will address the bricking bug that Orqa fears may also be compromised.
Recommendations:
- Orqa customers should avoid installing any unofficial firmware, even if it claims to fix vulnerabilities. Orqa is now in beta testing for an official firmware update to address the bricking issue.
- Follow ZeroFox Intelligence to remain updated on emerging ransomware threats.
Hotels at Risk from Bug in Oracle Property Management Software
Hotels and hospitality centers worldwide relying on Oracle's Opera property management system are at risk of being targeted via a bug in the software (CVE-2023-21932). Oracle has described the vulnerability as a complex bug in its Oracle Hospitality Opera 5 Property Services product that only an authenticated attacker with highly privileged access could exploit. However, researchers have alleged that they achieved pre-authentication remote code execution using the bug during a live hacking event last year targeting one of the largest resorts in the United States. Attackers exploiting the software can potentially gain access to sensitive personal and financial guest data and potentially update, insert, or delete access to certain system data.
Recommendations:
- Due to the threat posed by a successful attack, customers using the Oracle Hospitality Opera 5 Property Services product should apply critical software patches as soon as possible.
- Removing the privileges or the ability to access the packages from users that do not need the privileges may help reduce the risk of successful attack. Neither approach should be considered a long-term solution, as neither corrects the underlying problem.
VULNERABILITIES
- CVE-2023-22921 A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker with administrator privileges to store malicious scripts using a web management interface parameter, resulting in denial-of-service (DoS) conditions on an affected device. more
- CVE-2023-1804 The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators. more
- CVE-2023-22651 Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. more
EXPLOITS
- CVE-2020-16134 GHSL-2021-053: Remote code execution in Proxyee-Down - CVE-2021-32826 more
- CVE-2023-20959 Pandora 7.0NG Remote Code Execution more
BREACHES
Tags: DIB, tlp:green