Threat Intelligence Bulletin: 11/22/2019 - 11/28/2019

Data Breaches: 2019 Trends and Year in Review

Data breaches are increasingly common, given the huge profit made by cybercriminals who sell stolen data on the dark web. This advisory examines some of the biggest trends in breaches seen in the last year, and discusses some of the ways organizations can better protect themselves.

Recommendations

• Regularly implement software patches as they become available, as soon as possible, to limit your organization’s risk of being exploited
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Megabreach Collection #1 Kicks Off 2019

2019 started with a bang, when the monster Collection #1 breach was made public. Over 772 million records of email addresses and passwords were contained within this breach. When passwords are exposed in breaches like this, they are often used in brute force or credential stuffing attacks. These kinds of attacks run through a list of passwords, usually exposed in a data breach, until one works. This puts users who reuse passwords between websites, at much higher risk of being compromised.

Unsecured AWS Instance Allowed for Capital One Breach

Unsecured servers allowed for several major data breaches - from Capital One to LuminPDF to NordVPN. Capital One left a web application firewall on an AWS instance improperly configured, which allowed an attacker to launch server side request forgery attacks and expose the credit card applications of hundreds of thousands of people. Similarly, LuminPDF experienced a major breach after a MongoDB server was left unsecured on the internet, and when NordVPN failed to implement a proper security protocol on servers housed by a third-party provider, they also experienced a breach. This stresses the importance of verifying security protocols and configurations, to ensure sensitive data is not inadvertently left exposed.

Magecart Hits Major Retailers - Macy’s, Home Depot, and More

Cybercrime syndicate Magecart has targeted retailers in droves this year. This group skims payment card information by compromising seller websites, and injecting malicious code on top of pages used in the payment process to exfiltrate card information. Notably in 2019, department store Macy’s was compromised, which led to the exposure of the personal and payment data of millions of customers. The group targets retailers in huge numbers, however, and have successfully compromised major sites like Forbes, Chegg, and even Home Depot in the last year.

In order to compromise these sites, Magecart generally tries to target some element used to build the site. This is also called a supply-chain attack. Supply chain attacks often also refer to attacks targeting elements of infrastructure related to manufacturing. However, web-based infrastructure is also often targeted. Magecart may target advertising or e-commerce platforms used by retailers to build their online shops. If the group is able to compromise these third-party elements, they are then able to inject malicious code into the sites that use these elements. This also allows for a much greater number of sites to be compromised.

Infighting Between Hacker Forums Leads to (good?) Breaches

Numerous hacking forums also experienced data breaches this year, when rival hacking forums targeted them, seeking to expose and embarrass users. SIM swapping and account takeover forum OGUsers was breached, as was card cracking forum cracked[.]to. These kinds of breaches can actually be beneficial to the general population, however, because it can act as a deterrent for exposed users of these criminal forums to continue illegal activity. One such “revenge” breach, of the carding forum Brian’s Club, exposed 26 million stolen credit card records. Because these records were publicly exposed, issuing banks were able to take appropriate action to cancel these cards before they were purchased by users of the forum.

vBulletin 0-day Leaves Web Forums Vulnerable

In September 2019, a remote code execution vulnerability was disclosed in web forum building platform vBulletin. Exploitation of this vulnerability is simple, and a public exploit is available. If successfully exploited, this vulnerability essentially allows attackers to backdoor forums as they please. Even more concerning is the fact that this exploit has apparently been sold by researchers for years prior to its public disclosure.

Soon after the public disclosure of this vulnerability, the number of forums breached skyrocketed. Some of these forums even contained explicit and taboo content. Even if only a list of users were exposed from these sites, it could potentially be used to blackmail or financially extort users who are afraid of being outed. Although a patch has since been released, many forums have not yet updated, and remain vulnerable. Alpha Team recently conducted a scan to determine how many forums are still running the affected versions of vBulletin, and found tens of thousands still at risk.

Breach Disclosure: People Data

Over 1.2 billion records of publicly available information scraped from social media sites have been leaked, due to an unsecured server. This information includes phone numbers and email addresses, along with work history, and was likely scraped from public social media profiles. Although all data leaked from this server was already public, the correlation of the information to a particular individual was significant in this breach. This could potentially allow atttackers to more easily impersonate their victims.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

In essence, this breach involves "profiles" of individuals that associate publicly available phone numbers, email addresses, and work history with known social media accounts. This aggregation of information could potentially allow attackers to more easily impersonate their victims, or even allow attackers to conduct identity theft more easily.

Although the number of records included in this breach is significant, it is important to note that all leaked information was already public. No payment information or passwords were included in this breach. The exact source of this information is unknown. Some of these records appear to have originated from People Data Labs, however, there is no indication that the company was actually breached. Rather, these records seem to be cobbled-together from a number of different sources.

Breaking News: 2019-11-22 - 2019-11-28

1.2 Billion Records Found Exposed Online in a Single Server

A massive data trove of social networking profiles combined with phone numbers and email addresses was found by a security researcher. The database was open on the internet and anyone could connect to it and view or download the contents. A data broker called PDL supposedly owns the servers hosting the data, but there isn't clear attribution on who put the data on the server.

See the full report here: https://www.wired.com/story/billion-records-exposed-online/

T-Mobile discloses security breach impacting prepaid customers

T-Mobile disclosed a data breach wherein it had affected small number of prepaid service customers. Exposed data included customer names, billing addresses, phone numbers, account numbers, rate plans, and plan features. T-Mobile stated that information such as passwords, financial information, or social security numbers were not accessed. T-Mobile is reaching out to affected customers via SMS and recommends them to change account passwords and PIN codes as additional protection.

See the full report here: https://www.zdnet.com/article/t-mobile-discloses-security-breach-impacting-prepaid-customers/

Edenred Payment Solutions Giant Announces Malware Incident - BleepingComputer

Edenred Payment Solutions disclosed a malware incident that affected its computing systems. This payment provider provides a platform that processes payment information for over 50 million employees and 2 million partner merchants. The company did not disclose the malware strain that affected them, but users were complaining about intermittent access to their payment platforms.

See the full report here: https://www.bleepingcomputer.com/news/security/edenred-payment-solutions-giant-announces-malware-incident/

Catch Restaurants Disclose Credit Card Stealing Malware Incident - BleepingComputer

Catch Hospitality Group, a New York-based catering company, has reported a data breach incident that allowed attackers to steal credit card information from customers. The point-of-sale systems (POS) at NYC hotspots Catch NYC, Catch Rooftop and Catch Steak were infected with malware. The malware attempted to steal data encoded on the magnetic strip of credit cards, which include credit card number, expiration date, and internal verification code. Affected customers are advised to monitor credit card statements for any discrepancies.

See the full report here: https://www.bleepingcomputer.com/news/security/catch-restaurants-disclose-credit-card-stealing-malware-incident/

New bypass disclosed in Microsoft PatchGuard (KPP)

A Turkish developer has published a proof-of-concept, dubbed as ByePg, which can bypass the Microsoft Kernel Patch Protection (KPP) security feature, also known as PatchGuard. First introduced in 2005 in Windows XP, Patchguard is used as a security feature to prevent apps from patching the kernel. Kernel patching is popularly used by rootkit developers to embed malware at OS level. Additionally, the exploit bypasses Hypervisor-Protected Code Integrity (HVCI), a feature that allows Microsoft to blacklist bad drivers on users' devices. Microsoft has confirmed the issue and classified it as a bug since the exploit need admin rights to execute.

See the full report here: https://www.zdnet.com/article/new-bypass-disclosed-in-microsoft-patchguard-kpp/

110 Nursing Homes Cut Off from Health Records in Ransomware Attack

Virtual Care Provider Inc. (VCPI), a company that provides IT consulting, Internet access, data storage, and security services to around 110 nursing homes was hit by Ryuk Ransomware. Impacted care centers are unable to access crucial patient medical records. Attackers have encrypted all data the company hosts for its clients in demand for a whopping $14 million ransom in exchange for a digital key to unlock access to the files. The company's CEO, Karen Christianson said that the company cannot afford to pay the huge ransom but is fully focused on rebuilding systems and restoring operations.

See the full report here: https://krebsonsecurity.com/2019/11/110-nursing-homes-cut-off-from-health-records-in-ransomware-attack/

Registers as “Default Print Monitor”, but is a malicious downloader. Meet DePriMon

ESET researchers have discovered a new and sophisticated payload downloader called DePriMon that uses multiple stages and non-traditional techniques. DePriMon is a powerful, flexible and persistent tool designed to download a payload and execute it. DePriMon is downloaded to memory and executed directly from there as a DLL using the reflective DLL loading technique. It is never stored on disk. It has a surprisingly extensive configuration file with several interesting elements, its encryption is properly implemented and protects the C&C communication effectively.

See the full report here: https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/

Smartphone maker OnePlus discloses data breach - ZDNet

OnePlus suffered a data breach which allowed attackers to gain access to their customer orders. OnePlus believes the hacker's entry point was a vulnerability in the website. The exposed information included customer names, contact numbers, emails, and shipping addresses, but not passwords or financial details. While the breach was not announced publicly, OnePlus acknowledged the issue via an email to affected customers.

See the full report here: https://www.zdnet.com/article/smartphone-maker-oneplus-discloses-data-breach/

Splunk Faces Y2K Bug-Like Problem Unless Patched - BleepingComputer

The popular logging platform Splunk has identified a bug impacting the ability to recognize timestamps for events with a two-digit year. Similiar to the Y2K bug from the year 2000, this bug resides in the way that the date-time parser extracts the year from timestamps, only being able to extract two-digit years up to 2019. If users do not patch their systems by January 1, 2020 systems will treat incoming data as having an invalid timestamp year, and could potentially add the incorrect year for events impacting search effectiveness.

See the full report here: https://www.bleepingcomputer.com/news/security/splunk-faces-y2k-bug-like-problem-unless-patched/

Sale of 4 Million Stolen Cards Tied to Breaches at 4 Restaurant Chains

Four compromised restaurant chains in the midwest and eastern United States were the source of over 4 million credit cards recently for sale on a popular carding forum on November 23rd. Krystal, Moe's, McAlister's Deli, and Schlotzsky's were all breached, with Krystal announcing one last month, and the other three disclosing breaches in August of 2019. Nearly 50% of the locations for these restaurants were breached and had customer payment card data exposed. According to Gemini, a financial fraud intelligence company, the forum where these cards were posted most likely waited to announce this breach and availability to not flood the market with credit cards, which would oversaturate the market and lower the prices for these cards.

See the full report here: https://krebsonsecurity.com/?p=49648

A hacking group is hijacking Docker systems with exposed API endpoints

A hijacking group is mass-scanning the Internet in search of Docker platforms that have API endpoints exposed online. The purpose of these scans is to allow the hacker group to send commands to the Docker instance and deploy a cryptocurrency miner on a company's Docker instances, to generate funds for the group's profits. Once the group identifies an exposed host, attackers use the API endpoint to start an Alpine Linux OS container and run commands to install a classic XMRRig cryptocurrency miner. Users and organizations that run Docker instances are recommended to check if their API endpoints are exposed on the internet, close the ports, and then terminate unrecognized running containers.

See the full report here: https://www.zdnet.com/article/a-hacking-group-is-hijacking-docker-systems-with-exposed-api-endpoints/

T-Mobile Prepaid Hit by Significant Data Breach

T-Mobile suffered a data breach, allowing unauthorized access to more than a million prepaid customers' personal information and account details. The company claims that no payment information, Social Security numbers, or passwords were exposed in the breach. Affected customers are advised to change their passcode or PIN as soon as possible.

See the full report here: https://www.darkreading.com/attacks-breaches/t-mobile-prepaid-hit-by-significant-data-breach/d/d-id/1336462

Stop us if you've heard this one: Facebook and Twitter profiles silently slurped by shady code

Facebook and Twitter claim that third-party applications like One Audience and Mobiburn use "malicious" software development kits (SDKs) to quietly collect swathes of personal information from people's accounts without permission. In the case of Twitter, the offending SDK was built and maintained by marketing house One Audience, while, Facebook, says it has had to shut down two SDKs for similar activity: both the One Audience SDK and an SDK from marketing company MobiBurn were allegedly found to be harvesting profile information including names, genders, and email addresses when used in third-party apps. Security researchers encourage people to be cautious when choosing third-party apps that require access to their social media accounts.

See the full report here: https://www.theregister.co.uk/2019/11/26/facebook_twitter_data_loss/

Cheap kids smartwatch exposes the location of 5,000+ children

W2, a $35 kids' smartwatch made by a Chinese company SMA, was caught exposing the personal details and location information for more than 5,000 children and their parents. The smartwatch was primarily designed to help parents keep track of their kids' geographical location. Attackers could query the smartwatch's backend via a publicly accessible web API which is the same backend where the mobile app also connects to retrieve the data it shows on parents' phones and collect data on all kids and their parents. The data exposed via this Web API included the child's current geographical location, device type, and SIM card IMEI.

See the full report here: https://www.zdnet.com/article/cheap-kids-smartwatch-exposes-the-location-of-5000-children/

HP Warns That Some SSD Drives Will Fail at 32,768 Hours of Use - BleepingComputer

HP has released an advisory to address the issue in Serial-Attached SCSI solid-state drives. The devices are used in multiple server and storage products for enterprise, such as HPE ProLiant, Synergy, Apollo, JBOD D3xxx, D6xxx, D8xxx, MSA, StoreVirtual 4335 and StoreVirtual 3200. A bug in the drive causes it to crash after exactly 32,768 hours and lead to data loss. Out of the 20 affected drives affected, 8 have been fixed. For the rest of the products, the company will release a firmware update in the second week of December.

See the full report here: https://www.bleepingcomputer.com/news/hardware/hp-warns-that-some-ssd-drives-will-fail-at-32-768-hours-of-use/

Phishers Create Fake Sites as Bait for Holiday Shopping Deals - BleepingComputer

Security researchers have come across a new phishing campaign wherein a lookalike site impersonates a legitimate Ray-Ban website. The phishing email pretends to be a Black Friday promotion that offers custom Ray-Ban sunglasses at 80% off on the normal price. Upon clicking on the enclosed link victims will be redirected to a website that has full functional product listing and check out pages. While clicking on the checkout page, it prompts the victim to make the payment via PayPal and redirects it to the PayPal payment page wherein the victim will enter his credentials and confirms his purchase. It is unknown whether the scam is to steal the money or to sell the cheap pair of knockoffs.

See the full report here: https://www.bleepingcomputer.com/news/security/phishers-create-fake-sites-as-bait-for-holiday-shopping-deals/

Clop Ransomware Tries to Remove Malwarebytes, Native Security Tools From Infected PCs - Security Intelligence

The newly discovered Clop ransomware tries to encrypt the victim's data by attempting to remove Malwarebytes and other native tools from the Windows machines it infects. Clop is a variant of the CryptoMix ransomware, that uses the Clop extension and signs its CIopReadMe.txt ransom note with "Don't Worry C|0P". Due to this, the ransomware is known as Clop Ransomware. Users of Windows machines are advised to strengthen their digital defenses against phishing campaigns and other common delivery vectors for ransomware.

See the full report here: https://securityintelligence.com/news/clop-ransomware-tries-to-remove-malwarebytes-native-security-tools-from-infected-pcs/

Microsoft says new Dexphot malware infected more than 80,000 computers

Microsoft researchers have discovered a new malware that infects the Windows computers to hijack their resources, mine cryptocurrency, and generate revenue for the attackers. Dubbed as Dexphot, the malware has been active since October 2018 and reached its peak in mid-June this year, infecting almost 80,000 computers. Dexphot malware operates as a second-stage payload, which is dropped on ICLoader infected systems. ICLoader is a malware that is side-installed as part of software bundles, without the user's knowledge, or along with cracked or pirated software. All the files associated with Dexphot malware use fileless execution to run inside the computer's memory only, that help them evade signature-based detections. It also employs "living off the land" technique to abuse legitimate Windows processes and run its own executables and processes. Furthermore, the polymorphism technique helps the malware to constantly change its artifacts. The multi-layered persistence mechanisms make this a highly complex malware.

See the full report here: https://www.zdnet.com/article/microsoft-says-new-dexphot-malware-infected-more-than-80000-computers/

New DeathRansom Ransomware Begins to Make a Name for Itself - BleepingComputer

A new ransomware dubbed DeathRansom has been seen actively distributed lately, but it's still unknown how this is being spread to victims at this time. Initially this malware simply renamed files instead of encrypted them, allowing people to retrieve their files unharmed, however, with recent updates, the files are now being encrypted and impacting victims. The creators of the malware are asking for 0.1 BTC to send the victims their decryption key.

See the full report here: https://www.bleepingcomputer.com/news/security/new-deathransom-ransomware-begins-to-make-a-name-for-itself/