Data Breaches: 2019 Trends and Year in Review

Data breaches are increasingly common, given the huge profit made by cybercriminals who sell stolen data on the dark web. This advisory examines some of the biggest trends in breaches seen in the last year, and discusses some of the ways organizations can better protect themselves.

Recommendations

Regularly implement software patches as they become available, as soon as possible, to limit your organization’s risk of being exploited
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Megabreach Collection #1 Kicks Off 2019

2019 started with a bang, when the monster Collection #1 breach was made public. Over 772 million records of email addresses and passwords were contained within this breach. When passwords are exposed in breaches like this, they are often used in brute force or credential stuffing attacks. These kinds of attacks run through a list of passwords, usually exposed in a data breach, until one works. This puts users who reuse passwords between websites, at much higher risk of being compromised.

Unsecured AWS Instance Allowed for Capital One Breach

Unsecured servers allowed for several major data breaches - from Capital One to LuminPDF to NordVPN. Capital One left a web application firewall on an AWS instance improperly configured, which allowed an attacker to launch server side request forgery attacks and expose the credit card applications of hundreds of thousands of people. Similarly, LuminPDF experienced a major breach after a MongoDB server was left unsecured on the internet, and when NordVPN failed to implement a proper security protocol on servers housed by a third-party provider, they also experienced a breach. This stresses the importance of verifying security protocols and configurations, to ensure sensitive data is not inadvertently left exposed.

Magecart Hits Major Retailers - Macy’s, Home Depot, and More

Cybercrime syndicate Magecart has targeted retailers in droves this year. This group skims payment card information by compromising seller websites, and injecting malicious code on top of pages used in the payment process to exfiltrate card information. Notably in 2019, department store Macy’s was compromised, which led to the exposure of the personal and payment data of millions of customers. The group targets retailers in huge numbers, however, and have successfully compromised major sites like Forbes, Chegg, and even Home Depot in the last year.

In order to compromise these sites, Magecart generally tries to target some element used to build the site. This is also called a supply-chain attack. Supply chain attacks often also refer to attacks targeting elements of infrastructure related to manufacturing. However, web-based infrastructure is also often targeted. Magecart may target advertising or e-commerce platforms used by retailers to build their online shops. If the group is able to compromise these third-party elements, they are then able to inject malicious code into the sites that use these elements. This also allows for a much greater number of sites to be compromised.

Infighting Between Hacker Forums Leads to (good?) Breaches

Numerous hacking forums also experienced data breaches this year, when rival hacking forums targeted them, seeking to expose and embarrass users. SIM swapping and account takeover forum OGUsers was breached, as was card cracking forum cracked[.]to. These kinds of breaches can actually be beneficial to the general population, however, because it can act as a deterrent for exposed users of these criminal forums to continue illegal activity. One such “revenge” breach, of the carding forum Brian’s Club, exposed 26 million stolen credit card records. Because these records were publicly exposed, issuing banks were able to take appropriate action to cancel these cards before they were purchased by users of the forum.

vBulletin 0-day Leaves Web Forums Vulnerable

In September 2019, a remote code execution vulnerability was disclosed in web forum building platform vBulletin. Exploitation of this vulnerability is simple, and a public exploit is available. If successfully exploited, this vulnerability essentially allows attackers to backdoor forums as they please. Even more concerning is the fact that this exploit has apparently been sold by researchers for years prior to its public disclosure.

Soon after the public disclosure of this vulnerability, the number of forums breached skyrocketed. Some of these forums even contained explicit and taboo content. Even if only a list of users were exposed from these sites, it could potentially be used to blackmail or financially extort users who are afraid of being outed. Although a patch has since been released, many forums have not yet updated, and remain vulnerable. Alpha Team recently conducted a scan to determine how many forums are still running the affected versions of vBulletin, and found tens of thousands still at risk.