Breach Notification - Verifications.io

On 7 March 2019, security researcher Bob Diachenko published an article describing his discovery of a large database of emails on an insecure, internet-facing MongoDB server. This trove of data contained approximately 800 million email address and metadata information. The database itself did not contain any sensitive information such as passwords or credit cards, but it does contain potentially personally identifiable information such as phone numbers, dates of birth, IP addresess and location information. Diachenko notified Verifications.io of the insecure server, and they subsequently shutdown the server as well as their website.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Diachenko outlined in his article that Verifications.io was a peculiar website. It marketed itself as an "enterprise email validation service" which is typically associated with a way for spammers and cybercriminals to upload email addresses to the service to verify it they respond to emails. This is particularly useful if a cybercriminal obtains a large email dump and wants to see whether or not the email inboxes don't bounce the verification email. Diachenko reached this conclusion by prodding the exposed dataset for metadata and found large lists of SMTP servers, dirty words that triggered a bounce, spam traps and blacklisted IP addresses. It is important to note that no passwords or sensitive information was in the dataset, but the scale of the dataset makes an attractive trove for cybercriminals to target victims via email.

Breach Notification - Houzz

On 4 Feb 2019, Houzz released a security announcement about an unauthorized disclosure of a file that contained sensitive data about its userbase. Houzz is an online platform for connecting homeowners and housing professionals that also helps broker financial transactions between the two. The breached information contained sensitive account information such as hashed passwords, usernames, IP addresses and zip codes. Social Security Numbers and bank account information were not affected.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

There were approximately 49 million records inside the compromised file. The type of information inside the breach includes the information publicly visible on a Houzz profile, internal identifiers, email addresses, user IDs, "one-way encrypted passwords" [sic], IP addresses and geolocation information. Social media profiles were also disclosed as they were most likely used for Single Sign-on workflows into Houzz. The company learned about the incident in late Dec 2018. The one-way encrypted passwords could mean they were cryptographically hashed, which is the recommended way to store passwords for authentication, but without the company disclosing the algorithm they used it is hard to tell.

Malware Spotlight: New POS Malware GlitchPOS For Sale

A new POS malware, GlitchPOS, was reported being sold on dark net markets. This malware is used to infect machines that contain credit card data and exfiltrate the data from memory to send to an attacker controlled Command and Control (C2) server. Malware of this type is generally deployed to Point of Sale (POS) systems or websites that process credit card data in order to maximize its effectiveness. The research group that found it, TALOS, has high confidence that this malware was created by the same actor that deployed the DiamondFox L!NK botnet.

Recommendations

• In the ZeroFOX platform, enable the Cyber Attack Chatter Rule, implement a custom rule to monitor for any company-specific leaked technical information, add unique domains as Independent Search Terms under relevant entities, and add verified accounts that you would like to monitor for mentions related to cyber reconnaissance
• Keep your security systems up to date with the latest detections
• Maintain secure backups of all business critical information
• Create robust network segmentation to prevent easy movement of hackers between business units

Details

The malware created by a known malware developer, edbitss. edbitss is the author behind the DiamondFox L!NK botnet as (reported)[https://blog.talosintelligence.com/2019/03/glitchpos-new-pos-malware-for-sale.html] by Checkpoint in 2017. The dropper is a VisualBasic program that UPX decodes another VisualBasic program which is GlitchPOS. The malware itself exfiltrates credit card numbers from RAM, communicates with the C2 server and has some basic update and configuration options. GlitchPOS deploys weak encryption of C2 commands via XOR encryption. The C2 server is a web app that displays infected devices in a world map, and shares similar verbiage and pictures as the DiamondFOX control panel.

IoCs from TALOS:

ed043ff67cc28e67ba36566c340090a19e5bf87c6092d418ff0fd3759fb661ab (SHA256)
abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553 (SHA256)

C2 server
coupondemo[.]dynamicinnovation[.]net

URLs
hxxp://coupondemo[.]dynamicinnovation[.]net/cgl-bin/gate.php
hxxp://coupondemo[.]dynamicinnovation[.]net/admin/gate.php
hxxp://coupondemo[.]dynamicinnovation[.]net/glitch/gate.php

Malware Update: Newly Patched Windows Vulnerability Exploited by two APTs

CVE-2019-0797, a vulnerability in Win32k that was patched by Microsoft in its latest update, has been actively used by two APT groups. The vulnerability is a privilege escalation vulnerability that allows attackers to run code in a privileged context. Kaspersky Labs disclosed to ThreatPost on 13 Mar that FruityArmor and Sandcat have been observed using this vulnerability to attack target systems. In order to use the exploit, either actor had to be logged onto the system. FruityArmor and SandCat primarily target the Middle East and Saudi Arabia.

Recommendations

• In the ZeroFOX platform, enable the Cyber Attack Chatter Rule, implement a custom rule to monitor for any company-specific leaked technical information, add unique domains as Independent Search Terms under relevant entities, and add verified accounts that you would like to monitor for mentions related to cyber reconnaissance
• Keep your security systems up to date with the latest detections
• Maintain secure backups of all business critical information
• Create robust network segmentation to prevent easy movement of hackers between business units

Details

The specific privilege escalation vulnerability occurs in the Win32k driver. The exploit targets the lack of proper synchronization between two system calls, where it creates a race condition when the calls perform a certain number of operations at the same time. Once exploited, an attacker can use the privileged context of the kernel to execute arbitrary code. The reporters of the vulnerability disclosed to Microsoft on 22 Feb, 2019 and the patch went out this month.