Threat Intelligence Bulletin: 10/18/2019 - 10/24/2019

NordVPN's Server Hacked and TLS Private Keys Stolen

NordVPN recently disclosed that one of their servers was compromised by attackers and claimed that no credentials were stolen, no logs were present, and the scope of the attack was very small. NordVPN places the blame for their compromise on their hosting provider and largely underplayed the severity of the attack. Notably, the CEO of their hosting company refuted NordVPN's claims and told the public that NordVPN is very lax on security, especially compared to other VPN providers that they host. Furthermore, it was revealed that the attack was much more serious than stated -- NordVPN's private TLS keys were leaked and valid from March through October 2018.

Recommendations

• Monitor social network chatter regarding further NordVPN security issues.
• Consider creating your own VPN or hosting a VPN provider on infrastructure that you own.
• Use VPN software and providers with a good track record of security and privacy.

Details

NordVPN has reported a third party breach in their network. Apparently, this network breach happened in March of 2018 and NordVPN was only made aware of the incident a few months ago. One of NordVPN’s servers in a data center in Finland was accessed without authorization. The attacker obtained access by using a remote management software that was left behind by the data center operatives. NordVPN responded that the compromised server did not contain user activity logs, that none of their applications send user-created credentials, and no other servers were affected.

The severity of the attack is greater than NordVPN stated, however. There is evidence that the TLS keys for the compromised server were stolen in May of 2018. According to DarkDotFail, there was evidence that NordVPN was hacked and their TLS certificates compromised on 8chan. Additionally, their hosting provider responded to the allegations by NordVPN that they had left remote management software on their servers and claimed that NordVPN doesn’t take security seriously and they are trying to pin the blame onto their server provider (Figure 1).

Figure 1. Response from the CEO of the server provider.

In Figure 2, the supposed hacker advises against using NordVPN and links to some dropped text files from the hacker’s session showing compromised NordVPN boxes, .bash_history, and private keys of the NordVPN servers. The attacker appears to have full control over the containers and the data going into and out of the containers. At the time of the attack, due to forward secrecy of the TLS certificates, only the past hour of traffic could be decrypted with the stolen keys. However, future traffic masquerading as the legitimate NordVPN would be possible which could lead to further compromising of all future messages.

Figure 2. 8chan post showing compromised NordVPN TLS private keys.

However, it seems that the expired private TLS keys were leaked, meaning anyone can setup a server with their expired credentials. One Twitter user hexdefined showed how to create a server with the expired credentials that appears to come from nordvpn.com.

To demonstrate the potential issue, the user hexdefined set up a fraudulent version of the NordVPN site using the leaked private keys of the server. Figure 3 shows a localhost version of the NordVPN site using the leaked keys. Figure 4 shows a user visiting the fake site with compromised credentials and an example misconfiguration message that would be visible to a user if they accessed the site. The message warns of an expired key and a potentially misconfigured end-user clock. If the user wants to know more information about the potential attack, they will be greeted with another warning dialog (Figure 5) that goes into further details about a potentially misconfigured end-user system time. Also accompanying the warning is the admonition that if the configuration error is not on the end-user’s system, then there is nothing that the user can do. Finally, when the user accepts the risk of visiting the site, they are greeted with a message “this is not NordVPN” (Figure 6), while showing a properly authenticated TLS session in the URL bar.

Figure 3. Running the server with the expired NordVPN credentials.

Figure 4. A user visiting the fraudulent server and being confronted with a server misconfigured error. Due to the expired credentials, the user is asked to check if their computer’s clock is misconfigured.

Figure 5. A user examining the severity of the expired certificate error, which expired over a year ago.

Figure 6. A user accepting the risks of the fraudulent server and proceeding to the site.

Because NordVPN did not realize they had been compromised between March and early October, 2018, their users remained vulnerable to man-in-the-middle attacks that could have been launched with valid TLS certificates, for this entire period. NordVPN has largely not taken responsibility for the errors they made and have constantly downplayed the severity of the incident. The use of valid TLS certificates makes it highly unlikely that a victim would even realize that they were under attack. At this time it is unclear if the attack had been used in the wild while the certificates were valid. Despite the attack happening on only 1 of their 3000 servers, it is clear that a motivated attacker could have easily launched compromised TLS sessions.

Dark Web Chronicles, Volume 3: Duck Duck Go - Legitimacy of Dark Web Aggregators

Given the quick and sometimes chaotic nature of the Dark Web, and the desire to beat out competitors to make more money, there has been an increase in fraudulent sites mimicking legitimate dark web sites. Given the popularity of site aggregators, where identifying legitimate and active sites can be tricky, some malicious actors are trying to get in on the game and potentially steal donations destined for the legitimate site. We examine how a popular dark web site aggregator has struggled for months to get to the top of Google and Duck Duck Go, and why they have that challenge to begin with.

Recommendations

• Ensure that you have enabled the Domain Security rules for your domains to ensure that visitors to your site are browsing your legitimate domain
• Use trusted, verified and well-known sites when browsing. This isn’t an issue specific to dark web sites, as there are countless other phishing sites that capitalize on variations of domain names
• Along with ensuring you’re browsing to the proper pages, always verify the intended recipient of online payments
• Continue monitoring the Alpha Team Tab for reports related to dark web activity, such as this one
• If you are interested in further insight, reach out to [email protected] for assistance

Details

Dark.fail, a dark web site aggregator which has a list of various sites and if they are currently online or not, recently tweeted that they were finally the number 1 search result in DuckDuckGo when searching for dark.fail. For months, other sites, such as darkfail.us, darkfail.com, dark-fail.com took presedence over the legitimate site in the result listing, and were identified as phishing sites masquerading as the popular dark web site aggregator.

This trend has spread to other dark web sites and aggregators, including DarknetLive which experienced the same problem, having a few legitimate results, and then a number of phishing sites. In the tweet by DarknetLive, they claim that many of the phishing sites for DarknetLive are being operated by the same entities behind the Dark.fail phishing sites as well.

Using dark.fail first, we notice that the 3 main sites impersonating dark.fail are for the most part, a decent replica of the original site. These sites are:

• darkfail.us
• darkfail.com
• dark-fail.com

There are some minor differences at first, with two of the three sites displaying different title bar messages. For instance, dark.fail uses "Which darknet site are online?" versus "Is a darknet site online?". The next difference is that the timestamps do not match up with actual UTC time, with most of the sites being correct, however, dark-fail.com is 2 hours and 12 minutes ahead of the others. The other major difference that is immediately apparent is that there is currently a warning to users about the NordVPN breach that just occurred, advising users to be careful, rotate passwords and adjusting their OPSEC. On the legitimate site this warning is present, and the only phishing site that includes this warning is darkfail.com, the others don't include a warning at all, and look like the typical page, pre-NordVPN breach.

Link Analysis

There are some major differences between the sites directories, and the links that they are pointing users to. For instance, all but one of the sites point Dread (a popular Reddit like site on the Dark web) to the legitimate Dread url, however, one points users to an unknown .onion address that doesn't resolve.

We examined various conflicting domains referenced by each of the site, and for the most part they all list the same .onion pages for the site, however, darkfail.com has the most differences, with the majority of the sites listed as random .onion sites, with almost all of them being unable to load the site. Given that the referenced sites aren't routing to other phishing type pages, it's assumed that the main reason would be for users trying to donate to the legitimate site, and inadvertently donating to the fraudulent site.

Interesting to note, that one of the domains, darkfail.us was registered to speedsteppers@protonmail[.]com, who was the owner of Dream Market from 2013. It is unknown at this time if they are the same individual, however, it is more probable that this is just a cover email address for the registrant. The other sites have Whois protection enabled, or are using illegitimate contact information. Last thing to note is that the three fraudulent sites referenced in this article have all been registered in the last 160 days, with one as early as 60 days ago, whereas dark.fail has been around for almost 2 years.

Donations

One of the most probable reasons for these phishing sites is for collecting donations through Bitcoin or Monero. At the bottom of each site there is a section for donations if users of the site were inclined to support the site and help keep it running.

The legitimate dark.fail site has the following addresses associated with it:

dark.fail Bitcoin: 1MeGeJXcTCMW6CLjQQiZcbaZ2FLYSKUMZS Monero: 83yNBMMhBK5fyosQ3g4qD1LS1RUXMUVuATVGAZ1assQwDfVDHDNDWEx9wnC1PqpK8SFTV5F4R8kPjc6Pt8hm7DhYJD8stNJ Total Received: 0.00976053 (11 Transactions)

darkfail.us Bitcoin: 17xSoTmmmzZABnw2d3FWi1PDPNoUgXS4Vz Monero: 8854wXhegtfdWHorhTqb1g8V94biewtqQ1DHUCMzx2rKcF2PtPg94BEQVVWaDvSFA9b2LtMzijxD3ETKpL2Atkr7VXpJn42 Total Received: 0.01171358 (14 Transactions)

darkfail.com Bitcoin: 3QEekAQM1ofqRoVGbSx6ur7b2JcAJ8MKYp Monero: 8APYKnAEsEuFmkuNmDKW7zUE1Y7cY1nXfMWA8ZzB3qZc9Dz93b3n5nMgKetjWkRQaTU8HH2zs916W6c3avi4ks8aPBrvbo7 Total Received: 0.04206767 (4 Transactions)

dark-fail.com Bitcoin: 1MeGeJXcTCMW6CLjQQiZcbaZ2FLYSKUMZS Monero: 83yNBMMhBK5fyosQ3g4qD1LS1RUXMUVuATVGAZ1assQwDfVDHDNDWEx9wnC1PqpK8SFTV5F4R8kPjc6Pt8hm7DhYJD8stNJ Total Received: Reuses the addresses from dark.fail

There is also a PGP public key at the bottom of the site, with dark.fail, darkfail.com and dark-fail.com all reusing the same key, while darkfail.us using their own PGP key. It's interesting to note that each of the phishing sites attempt to mimic the original site, but all are missing one area or another. For instance, darkfail.us has the same title bar message, but is missing the NordVPN alert, while darkfail.com includes the NordVPN alert, but has a different title bar message. dark-fail.com is the most obvious fake, with a completely different title bar message, and includes text from Empire Marketplace at the bottom, possibly for SEO purposes, but, for some reason doesn't try to monetize visitors since they are reusing the Bitcoin and Monero addresses from the legitimate site.

Takeaways

While there were no identified phishing pages that were active linked in the fraudulent sites, it is highly possible that malicious actors could use better Search-Engine Optimization (SEO) to get their sites ahead of the real dark web aggregators and get more users visiting their sites. The immediate gain for malicious attackers would be using their own bitcoin addresses to receive donations, with other motivations being routing users to other illegitimate pages to gain credentials or other sensitive information from users.

Breaking News: 2019-10-18 - 2019-10-24

Agent Tesla Keylogger Is Now a Top Phishing Threat

Agent Tesla is a keylogger which has made its way into multiple industries. The keylogger makes its way onto systems usually by the attacker creating an archived version of the malware and then attaching that to an email. It is particularly effective against those agencies which do not have policies for handling emails with archived messages. Agent Tesla uses email to exfiltrate data back to the attacker but also has support for FTP and HTTP POST as additional ways to get data out of the victim's system. Setting up email policies for outgoing emails, web application firewalls, and email archive scanner are all ways that Agent Tesla can be thwarted, short of removing the malware from the host machine.

See the full report here: https://cofense.com/agent-tesla-keylogger-now-top-phishing-threat/

Fleecing the onion: Darknet shoppers swindled out of bitcoins via trojanized Tor Browser

A version of the Russian language Tor browser has been trojanized to collect Bitcoins. Attackers modified an official version of the Tor browser which allows them to swap BitCoin wallets while transactions are in progress in order to change the destination wallet of the coins. The modified browser keeps all binaries intact but modifies settings so the Tor browser cannot update itself which allows the trojanized Tor browser to persist. The attackers also modify the HTTPs Anywhere plugin to include a script on all pages, which potentially allows arbitrary code to be executed within any context.

See the full report here: https://www.welivesecurity.com/2019/10/18/fleecing-onion-trojanized-tor-browser/

Toilet paper thieves stopped by facial recognition

Facial recognition software is now being used to limit the amount of toilet paper that a person can use. In Guangzhou, China, a person who wishes to use the restroom and obtain toilet paper must allow their face to be scanned. If the same face is scanned before 10 minutes have elapsed, the machine will not dispense toilet paper. More than 700 cities in China are currently building smart toilet infrastructure. In Shanghai, over 150 smart toilets have been built that use sensors to monitor how long someone has been sitting, as well as air quality and the level of water, depending on how long someone has been using the toilet. China continues to roll out advanced artificial intelligence to all corners of the country.

See the full report here: https://www.abacusnews.com/tech/toilet-paper-thieves-stopped-facial-recognition/article/3033550

Hackers Backdoor Sites by Hiding Fake WordPress Plugins - BleepingComputer

Wordpress has been the target of malicious actors since the platform's inception. Today, hackers continue to exploit Wordpress by including malicious payloads inside of normal plugins. initiatorseo, also known as updrat123 is an example plugin with hidden functionality. This malicious plugin contains a full copy of UpdraftPlus, which currently has over 2 million installations on Wordpress sites. Maintaining legitimate functionality on top of having a malicious backdoor makes it easier for attackers to establish and maintain a foothold on the victim's site. The malware stays hidden until a user with a specially crafted user agent string visits the webpage. Once the malware is installed the attacker can use the backdoor to upload additional malware or malware droppers. Researchers also observed scripts being dropped on Wordpress installations which allow an attacker to brute force passwords of another site while using stolen resources to do so.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-backdoor-sites-by-hiding-fake-wordpress-plugins/

New Way Found to Use Alexa, Google to Voice Phish and Eavesdrop on Users

Researchers have found a way to launch a variety of attacks against smart home devices. A malicious application can insert a minute of silence after a user believes that a voice command has ended. This minute of silence can be inserted when an application returns an error message -- such as when used in the wrong country of origin. The silence makes the user think that control has been handed back to the device. Then, the malicious application can phish the user, by asking for the user's password all the while the user thinks control has been handed back to the device, when in actuality the malicious application records and ships off the password. Another attack, telling the application to stop in the middle of execution, allows a malicious user to keep recording after the user has told the application to no longer run. This can be used to passively collect conversations even after the user believes that the device is no longer recording. Researchers demonstrated these vulnerabilities as a way to showcase unexpected consequences of having a speech to text engine as the main interface of a device and to encourage thinking about these issues when designing such devices.

See the full report here: https://threatpost.com/new-way-found-to-use-alexa-google-to-voice-phish-and-eavesdrop-on-users/149352/

Winnti Groups skip2.0: AMicrosoft SQL Server backdoor

The hacker group Winnti is back at it again with their skip-2.0 malware which targets Microsoft SQL Server versions 11 and 12. This backdoor allows attackers to connect to any account by using a magic password. The malware also hides these special logins from the logs to make the attack even more stealthy. The backdoor patches several functions in SQL Server so that a magic password automatically lets a user into any account while short circuiting password checks to always respond that the user has entered the correct password. A YARA rule has been released by researchers to detect this malware.

See the full report here: https://www.welivesecurity.com/2019/10/21/winnti-group-skip2-0-microsoft-sql-server-backdoor/

Gustuff return, new features for victims

Gustuff malware has reemerged, with a few new features compared to its initial appearance in April. This Android malware primarily targets Australian banks, as well as recruiting apps. Using Instagram-related domains, Gustuff propagates via malicious SMS messages containing a link. It then checks infected devices for targeted banking and recruiting apps. Even if these apps are not present, it is still used in further propagation, with the malware sending over 300 text messages per hour.

See the full report here: https://blogs.cisco.com/security/talos/gustuff-return-new-features-for-victims

Facebook promises action on 2020 US election fraud, wipes out fake networks from Russia, Iran

Using the Singapore elections as a trial run, Facebook has rolled out new protections it hopes will prevent misinformation campaigns. Advertisers must now verify their location and identity in order to run ad campaigns on social or political issues. This news breaks as Facebook announces that they have removed numerous networks of accounts engaged in misinformation attacks. Three of these networks originated in Iran, and one in Russia.

See the full report here: https://www.zdnet.com/article/facebook-tackles-fake-iran-russian-accounts-promises-action-on-election-fraud/

US military data exposed in 179GB Autoclerk leak

Sensitive information related to Best Western hotel chain customers, including the US military, has been exposed due to a vulnerability in the Autoclerk reservations system. By exploiting these vulnerabilities, researchers were able to gain access to 179 GB of data including reservation and travel dates, full name, home address, and masked payment information. This compromised data included travel plans for US military officials.

See the full report here: https://www.itpro.co.uk/security/34671/us-military-data-exposed-in-179gb-autoclerk-leak

Czech authorities dismantle alleged Russian cyber-espionage network

Czech government officials are reporting that they have detected and destroyed infrastructure used in Russian espionage operations against the Czech Republic, as well as other NATO and EU members. Reportedly, these actions were taken in March 2019. This is not the first time that the Czech Republic has reported Russian attacks, with additional allegations being made in 2017 as well as early 2019. Russia denies these, and all previous allegations.

See the full report here: https://www.zdnet.com/article/czech-authorities-dismantle-alleged-russian-cyber-espionage-network/

AWS servers hit by sustained DDoS attack

Amazon Web Services (AWS) was the victim of a DDoS attack that ran for about 8 hours on Tuesday starting around 1:30PM EST. This DDoS impacted the Route 53 DNS service in AWS, which was mitigated by AWS for the most part, however, flagged some legitimate customer queries as being malicious during the attack. AWS advised customers of a few mitigations to do, namely specifying the region of S3 buckets when making requests, as well as asking SDK users to specify the region as part of the S3 configuration to ensure the endpoint name is region-specific. At this time, all services have been restored by AWS.

See the full report here: https://www.cloudpro.co.uk/cloud-essentials/public-cloud/8276/aws-servers-hit-by-sustained-ddos-attack

Firefox, Chrome Bugs Allow Arbitrary Code-Execution

Critical vulnerabilities impacting Firefox 69 and Firefox ESR 68.1 have been identified that could allow arbitrary code execution on the victim's machine. The Multi-State Information Sharing and Analysis Center (MS-ISAC) have stated that the privilege level of Firefox and the user running it would be a factor in how impactful this vulnerability can be to users, with the most impacted organizations being medium to large government entities and enterprises. It is recommend to update to Firefox 70, which Mozilla has just released which addressed these and other vulnerabilities.

See the full report here: https://threatpost.com/critical-firefox-bugs-arbitrary-code-execution/149455/

New Cache Poisoning Attack Lets Attackers Target CDN Protected Sites

A new cache poisoning attack impacting popular Content Delivery Network (CDN) services, such as Amazon CloudFront, Cloudflare, Fastly, and Akamai has been discovered by security researchers. The nature of this attack works by sending a malformed HTTP header for a resource, which is ignored by the caching server, but raises an error when being processed by the origin server. An attacker would only need to send one malformed HTTP header to exploit this issue, which would most likely evade traditional DDoS or Web Application Firewall (WAF) defenses. The impact with this attack is that whatever content is being served by CDN's can be blocked from being served (things like patches or firmware updates that fix certain vulnerabilities) or disabling important security alerts from banking or government websites. Multiple companies, such as Amazon Web Services and Microsoft have identified patches for this issue, and would prevent the caching of error pages with certain status codes in the responses.

See the full report here: https://thehackernews.com/2019/10/cdn-cache-poisoning-dos-attack.html

MedusaLocker Ransomware Wants Its Share of Your Money - BleepingComputer

A new ransomware dubbed MedusaLocker has been seen in the wild starting at the end of September, however, the methods for distribution are not known at this time. This malware goes through various processes to prepare the machine for encryption, such as restarting the Lanman Workstation service, creating registry keys, and shutting down certain security service processes to ensure all data files are closed and accessible for encryption. Lastly, it will then clear the Shadow Volume Copies so that they cannot be used to restore files, removes backups and disables the Windows automatic startup repair. It then encrypts files using a RSA-2048 public key included in the ransomware. Due to the recent nature of this ransomware, it is not known if it can be decrypted at this time, or how much it costs to get a decryption key from the distributors.

See the full report here: https://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/

Discord Turned Into an Info-Stealing Backdoor by New Malware - BleepingComputer

The Windows version of the popular chat app Discord has been targeted by attackers through the creation of a new backdoor and information stealing trojan. Dubbed "Spidey Bot", this malware will collect information from a victim machine such as local IP address, contents of the victims clipboard, username, phone number, email and more. Normal users will not know they've been compromised by this unless they are monitoring network traffic, which makes this even more tricky to catch. At the moment, Discord needs to be uninstalled and then reinstalled to completely remove the malware, since any other attempts to delete the installer will cause the infected files to remain and execute the malicious commands when started.

See the full report here: https://www.bleepingcomputer.com/news/security/discord-turned-into-an-info-stealing-backdoor-by-new-malware/

Bug that grants admin rights to malware found in Maxthon, China's favorite browser

Maxthon, a popular browser with more than 670 million installs, primarily in China had a new vulnerability which allowed admin rights and persistence at boot time. This bug was due to the unquoted service path vulnerability, which is a trivial vulnerability to exploit, and is a well known vulnerability that should be easy to identify in software when developing it. This vulnerability impacts Maxthon 5.x versions, including the most recent release, however, a fix is scheduled for release next week. This vulnerability is significant, since it impacts so many users and can be exploited by numerous threat actors for various gains.

See the full report here: https://www.zdnet.com/article/bug-that-grants-admin-rights-to-malware-found-in-maxthon-chinas-favorite-browser/

Cash App Scammers Deal Their Cons on Twitter, Instagram, YouTube - BleepingComputer

Money flipping scams are nothing new, and have been around for quite some time, however, with new apps out there promoting legitimate cash rewards for engaging with them, these attacks are easier to blend in and look legitimate. The popular app, Cash App, gives out money for promoting their content or referring friends to use the app, however, this is a small amount of money, and doesn't require users giving them money before rewarding them. Scammers are targeting victims by asking for money in return to flip their original cash into a much larger return and targeting all the popular social media networks, in the form of money flipping or routing victims to phishing sites or other ad fraud related sites.

See the full report here: https://www.bleepingcomputer.com/news/security/cash-app-scammers-deal-their-cons-on-twitter-instagram-youtube/