Threat Intelligence Bulletin: 11/8/2019 - 11/14/2019

Breach Disclosure: ToonDoo

The email and IP addresses, salted password hashes, location, and gender of over 6 million ToonDoo users have been exposed in a data breach. This breach occurred in August 2019, with the breach database dump appearing for sale online beginning in November 2019. At present, the ToonDoo site is down and no statement appears to have been released.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

ToonDoo, a platform for creating comic strips, experienced a data breach in August 2019. This breach database was then distributed for sale on hacking forums. The breach included the email and IP addresses, usernames, locations, genders, and salted password hashed of over 6 million site users. At this time, the ToonDoo site is down. No statement appears to have been released by the site.

A breach dump was initially offered for sale on RaidForums in late October 2019, and contained 4.2 million sets of login credentials.

Figure 1. Initial offering on RaidForums.

A few weeks later, on November 8, 2019, a second version of the dump was offered for sale, containing the information of 6,057,000 users.

Figure 2. Second offering, containing 2 million additional sets of credentials.

Dark Web Chronicles, Volume 4: Dark Web Oddities

Although much of the dark web is financial fraud or drug-related, there are also sites outside of the norm. This post highlights a few of the odd, unusual, or otherwise unexpected sites that Alpha Team has come across in our research.

Recommendations

• Continue monitoring the Alpha Team Tab for reports related to dark web activity, such as this one
• If you are interested in further insight, reach out to [email protected] for assistance

Details

An All-Female Carding Group

Queen Galaxy is a carding group that provides various financial fraud services, including wire transfers, CashApp and PayPal transfers, and Amazon digital giftcard codes. These services are not uncommon on the dark web. Teams of carders will collaborate to increase the services they can offer and therefore potential profit. What is unusual in this case is that for an undisclosed reason, the branding of this carding shop proclaims that it is the oldest and “most-trusted” female market.

Figure 1. Queen Galaxy branding.

Although the site has a FAQ section, there is no other explanation as to why this team only chooses to work with women, or why this is used so heavily in their branding.

Figure 2. Wire transfer offered with sale pricing.

The site even offers sales on particular products, like this $3500 wire transfer on sale for $275 instead of the usual $320. They also offer shipping and support around the clock, having spread their team around the world to accommodate this work schedule.

A Site Dedicated to Fixed Football Games

Football Money advertises information regarding fixed football matches with both 100% accuracy and decidedly amateur graphic design. Payment is accepted via both PayPal and Bitcoin, and business is conducted over email.

Figure 3. Football Money home page.

Dark Web Social Media

Although it would seemingly defeat the purpose of Tor browsing, multiple social media platforms are available on the dark web. Facebook actually has an Onion site, and claims not to keep user logs of any kind. Aside from the mainstream, there are also multiple dark web-specific social sites.

Galaxy3 is a rudimentary social platform that allows users to chat with each other, join interest groups, and even post blogs to the community. Topics range from hacking and advertising of stolen passports and ID cards for sale, to WWII history, to a new dark web chess game.

Connect is another dark web social media platform, somewhat similar to Facebook in design. The about section of the site seems somewhat left leaning and centered on political discussion.

Figure 4. Connect social network about page.

Breaking News: 2019-11-08 - 2019-11-14

Nvidia patches severe GeForce, GPU vulnerabilities

Artificial intelligence company Nvidia has patched multiple vulnerabilities in its GeForce graphics software, including one given a high-severity ranking. CVE20195701, is a validation issue that would allow attackers to upload arbitrary DLLs, potentially allowing attackers to execute arbitrary code. Several other vulnerabilities have also been patched, although they are less severe.

See the full report here: https://www.zdnet.com/article/nvidia-patches-severe-geforce-gpu-vulnerabilities/

Genetics startup Veritas rocked by data breach

DNA-testing and genetics company Veritas has reported a data breach. Although they have not disclosed details regarding what information was exposed, the company assures its customers that no genetic or health information was leaked. Veritas assures that investigations are ongoing, and affected parties will be notified.

See the full report here: https://www.itpro.co.uk/security/34787/genetics-startup-veritas-rocked-by-data-breach

Microsoft Warns of More Harmful Windows BlueKeep Attacks, Patch Now - BleepingComputer

BlueKeep is a wormable Windows RDP vulnerability that allows for remote code execution if successfully exploited. Microsoft has issued a warning for Windows users regarding attacks exploiting BlueKeep, in order to drop cryptocurrency miners on victim machines. Microsoft has confirmed that the attacks detected on November 2 are linked with a similar campaign seen in September. Although only coin miners are being dropped at the moment, Microsoft warns that this could easily be used to drop much more damaging payloads.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-more-harmful-windows-bluekeep-attacks-patch-now/

Specially Crafted ZIP Files Used to Bypass Secure Email Gateways - BleepingComputer

A new phishing campaign has been discovered distributing NanaCore RAT via specially crafted ZIP files. The spam email pretends to be shipping information from an Export Operation Specialist of USCO Logistics. The ZIP archive was designed to bypass email security measures, and contains 2 archive structures. One is a harmless decoy image file called order.jpg and another is a file called SHIPPING_MX00034900_PL_INV_pdf.exe which is the NanoCore Remote Access Trojan (RAT). Only certain decompression utility versions were able to extract the NanoCore executable- others were only able to extract the benign file. This resulted in fewer infected victims, despite the attacker's obfuscation attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/specially-crafted-zip-files-used-to-bypass-secure-email-gateways/

QNAP Warns Users to Secure Devices Against QSnatch Malware - BleepingComputer

QNAP has issued a warning to customers, urging them to secure Network-Attached Storage (NAS) devices against QSnatch malware. The malware harvests and exfiltrates user credentials found on compromised NAS devices, and it is also capable of executing malicious code. The company has released Malware Remover versions 3.5.4.0 and 4.5.4.0, which are capable of removing the malware. In addition to updating this application, QNAP urges users to change device passwords, enable IP and account access protection, disable SSH and Telnet connections, and to change the system port number.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-warns-users-to-secure-devices-against-qsnatch-malware/

Apple Mail on macOS leaves parts of encrypted emails in plaintext

A security flaw has been identified in macOS, that allows for encrypted emails to be stored in plaintext. This affects every version of the operating system, from Sierra to the current version of Catalina. This behavior is due to a Siri voice assistant feature that provides contact information upon a user's request. If Apple Mail is configured to send and receive encrypted emails, Siri collects plaintext versions and stores them in snippets.db files. No fix is currently available, and Apple has declined to release a patch timeline. As a workaround, users are encouraged to disable Apple Mail from Siri Suggestions and Privacy.

See the full report here: https://www.zdnet.com/article/apple-mail-on-macos-leaves-parts-of-encrypted-emails-in-plaintext/

Platinum APT Shines Up New Titanium Backdoor

The Platinum APT is back with new malware, a backdoor called Titanium. Titanium uses several steps to compromise its targets. Initially, an exploit is used to gain system privileges and establish a connection with the command and control server and download a dropper. This dropper installs a Windows task in order to establish persistence. Next, a self-extracting archive, or SFX, is fetched and used to download the Titanium backdoor. The command and control traffic of this malware is obfuscated using commands hidden in an encrypted PNG image, a technique known as steganography.

See the full report here: https://threatpost.com/platinum-apt-titanium-backdoor/150062/

QuikSilver and Billabong Affected by Ransomware Attack - BleepingComputer

Action sports company Boardriders was hit by ransomware last week, which impacted subsidiaries Quiksilver and Billabong. Multiple systems were affected by the attack, causing significant delays in shipping customer orders. No specific details regarding the attack have been released at this point. Boardriders is currently working to resume normal operations.

See the full report here: https://www.bleepingcomputer.com/news/security/quiksilver-and-billabong-affected-by-ransomware-attack/

Major ASP.NET hosting provider infected by ransomware

SmarterASP.NET, an ASP.NET hosting provider, was hit by a ransomware attack on Saturday. It is the third major web hosting firm to be hit with ransomware this year. The attack disrupted service for many of the company's 440,000 customers, as data on customer servers was encrypted. The company has confirmed the attack and is working to decrypt the data.

See the full report here: https://www.zdnet.com/article/major-asp-net-hosting-provider-infected-by-ransomware/

Two security researchers earned $60,000 for hacking an Amazon Echo - TechCrunch

Researchers at the Pwn2Own hacking contest have unearthed flaw in Amazon Echo Show 5. The devices use an older version of Chromium which contains a bug that allows attackers to take full control of the device when it is connected to a malicious Wi-Fi hotspot, due to an integer overflow vulnerability. IoT devices often use older versions of software, and may be difficult to patch. This "patch gap" makes them prime targets for exploitation.

See the full report here: https://techcrunch.com/2019/11/09/browser-bug-amazon-echo-hack/

TrickBot Malware Uses Fake Sexual Harassment Complaints as Bait - BleepingComputer

TrickBot, a banking trojan, is using fake sexual harassing complaints in an attempt to spoof the U.S. Equal Employment Opportunity Commission (EEOC). TrickBot's phishing e-mails also include information that has been gathered about the potential victim, like their name and employer, to appear more credible. After victims are successfully infected, sensitive information is exfiltrated. Additionally, TrickBot may also drop additional ransomware on the compromised device.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-malware-uses-fake-sexual-harassment-complaints-as-bait/

Magento Urges Users to Apply Security Update for RCE Bug - BleepingComputer

E-commerce platform Magento has issued a warning regarding exploitation attempts against CVE-2019-8144, a recently disclosed remote code execution vulnerability. If successfully exploited, this vulnerability could enable an unauthenticated user to insert a malicious payload into a merchants site and execute it. A patch has been available since October 8, 2019, and Magento's Security Team urges merchants running Magento Commerce 2.3.x to install this update to protect their stores from exploitation.

See the full report here: https://www.bleepingcomputer.com/news/security/magento-urges-users-to-apply-security-update-for-rce-bug/

McAfee antivirus software impacted by code execution vulnerability

McAfee antivirus has disclosed a vulnerability that would allow an attacker to load an arbitrary DLL binary into multiple services. This allows for the execution of arbitrary code in multiple systems. This vulnerability could also be leveraged to bypass antivirus scanning, effectively whitelisting a binary. McAfee has released a fix in Version 16.0.R22 Refresh 1, and users are urged to patch as soon as possible.

See the full report here: https://www.zdnet.com/article/mcafee-antivirus-software-impacted-by-code-execution-vulnerability/

YouTube BitCoin Videos Pushing Predator Info-Stealing Trojan

A new bitcoin scam is leveraging YouTube in order to distribute Predator the Thief malware. YouTube videos are being used to promote a tool that would supposedly generate a bitcoin address private key. The promoted application, however, is actually a trojan in disguise. This trojan, called Predator the Thief, exfiltrates a victim's passwords, as well as access the webcam, and steal files on an infected device.

See the full report here: https://www.bleepingcomputer.com/news/security/youtube-bitcoin-videos-pushing-predator-info-stealing-trojan/

Mexico's Pemex Oil Suffers Ransomware Attack, $4.9 Million Demanded

Mexican oil company Pemex was hit with DoppelPaymer ransomware on November 10, 2019. Although the ransomware demanded a $4.9 million ransom to decrypt affected systems, the state-owned organization has released a statement that they have resumed normal operations. This ransomware may have been distributed by Emotet, a prolific banking trojan that often drops additional ransomware like DoppelPaymer.

See the full report here: https://www.bleepingcomputer.com/news/security/mexicos-pemex-oil-suffers-ransomware-attack-49-million-demanded/

Facebook confirms bug grants access to iPhone users' cameras

A bug in the Facebook mobile app for iPhone opens the user's camera as they scroll through their news feed. Many people were concerned with this flaw given Facebook's track record for managing user data has been less than stellar. The company stated that they were unaware of any photos or videos being uploaded as a result of this flaw. A fix has been submitted to the Apple app store and in the mean time, if users are concerned, they can disable their camera completely in their phone settings.

See the full report here: https://www.theguardian.com/technology/2019/nov/12/facebook-bug-iphone-camera-access

PureLocker Ransomware Can Lock Files on Windows, Linux, and macOS - BleepingComputer

PureLocker, a ransomware that can paralyze major operating systems like Windows, Linux, and macOS is being used to attack production servers. When victims are successfully infected, locked files are appended with a "CR1" extension. The malware encrypts all files except executables and leaves a note on the user's desktop demanding that the user contact the attackers email address in order to pay the ransom in order to recover their files. The malware has flown under the radar because it is designed to self terminate after execution, leaving no traces behind. Additionally, if the malware detects a debugger is running, the malware promptly exits, a common practice to prevent researchers from reverse engineering malicious code, As of now, details about PureLockers victims and their ransom demands are unknown.

See the full report here: https://www.bleepingcomputer.com/news/security/purelocker-ransomware-can-lock-files-on-windows-linux-and-macos/

Don't trust the Trusted Platform Module it may leak your VPN server's private key (depending on your configuration)

Trusted Platform Modules (TPM) used to protect cryptographic keys to secure operating systems are not completely reliable. The University of California and the University of Lbeck have discovered that TPMs expose timing information by providing a side channel that allows the recovery of the private keys used for cryptographic signatures. The researchers identified flaws in Intel's fTPM and STMicroelectronics TPM which have been designated CVE-2019-11090 and CVE-2019-16863 respectively. Intel addresses these flaws in the INTEL-SA-00241 patch.

See the full report here: https://www.theregister.co.uk/2019/11/12/don/

ZoneAlarm hit in data breach - TechRadar

ZoneAlarm suffered a data breach which allowed attackers to gain access to one of its forums. The attackers were able to harvest 4,500 customer records containing hashed password, email addresses, and dates of birth. The attack occurred in the vBulletin forum software and the hackers exploited a 0-day in the forum software to gain access. While the breach was not announced publicly ZoneAlarm acknowledged the issue in an email to customers encouraging them to change their password. This serves as an all too common reminder that keeping software up to date is critical to the security of every organization and out of date software will often lead to exploitation by hackers.

See the full report here: https://www.techradar.com/news/zonealarm-hit-in-data-breach

Strange AnteFrigus Ransomware Only Targets Specific Drives - BleepingComputer

In a new malvertising campaign, it was discovered that the RIG exploit kit is installing a new ransomware called AnteFrigus. The RIG exploit kit uses the malicious scripts hosted on the attackers owned site to exploit the Internet Explorer vulnerabilities. Upon exploiting the vulnerabilities, it installs a payload on the victims machine without their knowledge. The ransomware encrypts all the files on the drives i.e D:, E:, F:, G:, H:, and I: and mapped network drives but except the files with following string: dll, adv, ani, big, bat, bin, cab, cmd, com, cpl, cur, deskthemepack, diagcab, diagcfg, diagpkg, drv, exe, hlp, icl, icns, ico, ics, idx, ldf, lnk, mod, mpa, msc, msp, msstyles, msu, nls, nomedia, ocx, prf, rom, rtp, scr, shs, spl, sys, theme, themepack, wpx, lock, key, hta, msi, pck. The encrypted file will be appended with random character extension. It then drops a ransom note on the desktop which contains instructions for ransom payment. According to researcher, the ransomware is still in development and is still being analyzed for any kind of weakness which could lead to free decryptor.

See the full report here: https://www.bleepingcomputer.com/news/security/strange-antefrigus-ransomware-only-targets-specific-drives/

New ZombieLoad v2 Attack Affects Intel's Latest Cascade Lake CPUs

ZombieLoad is back with its latest version which is capable of exploiting the data-leaking side-channel vulnerability and is tracked as CVE-2019-11135 residing in Intels Transactional Synchronization Extensions (TSX). It affects the most recent Intel CPUs, including the most recent Cascade Lake. Exploitation may allow an authenticated user to potentially enable information disclosure via a side-channel with local access. Users of the affected Intel Processors are recommended to update to the latest firmware version provided by the system manufacturer that addresses the issues.

See the full report here: https://thehackernews.com/2019/11/zombieload-cpu-vulnerability.html