Breach Disclosure: Bookmate

In February 2019, The Register reported on a trove of information dumps being sold on the dark web. This collection contained details from approximately 16 sources, one of them being Bookmate, a social ebook subscription service. The Bookmate breach specifically contained 4 million rows of email addresses, names, dates of birth, gender, and salted SHA-512 password hashes. The Bookmate breach, along with 7 previously confirmed by ZeroFOX in the Register report, has been made available to the general public, while other dumps have yet to be disclosed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Bookmate is number 8 out of the 16 breaches from The Register report that have been disclosed to the public. The 1.7 GB data dump was for sale for $572 on the dark web. When The Register reached out to the company, they did not respond to a request for comment.

Breach Disclosure: 500px

On February 8th 2019, 500px Support discovered a security breach that resulted in unauthorized access of user profile data. The investigation showed that on July 5th, 2018, an unauthorized party gained access to 15M unique email addresses, usernames, first and last names, gender, dates of birth, city, country and MD5 or bcrypt password hashes. 500px is resetting all users' account passwords as a safety measure.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

500px is number 8 out of the 16 breaches from The Register report that have been disclosed to the public. User data present in 500px systems prior to July 5th was compromised. The investigation made by 500px was coordinated with law enforcement authorities and a third-party expert on the subject. The official announcement of 500px was made on February 13th, 2019, because they waited until it was assured that the systems was secured and the users' data was not accessed without authorization. According to ExtremeTech, the stolen data is useless to access the affected accounts, but personally identifiable information was exposed regardless.

New Malware: Shadowhammer

A supply chain attack on ASUS computers has affected over 1 million of the machines, according to a report from Kaspersky researchers released on March 25. The attack took place between June and November 2018 and affected a wide number of ASUS users, who were targeted based on their specific MAC addresses. Kaspersky believes evidence points to the ShadowPad attack incident from 2017, in which Microsoft publicly attributed to the BARIUM APT actor.

Recommendations:

• Blacklist network infrastructure associated with this campaign
• Make sure defensive systems are updated with the latest detections
• ASUS users can check if their device has been targeted by this campaign on Kaspersky’s website

Details

Although the investigation is still ongoing, Kaspersky has so far stated the attack involves the ASUS Live Update Utility, which is a utility pre-installed on most ASUS computers and used to update certain components. The hackers used an old ASUS update file, injected it with malicious code, and then signed with a legitimate certificate from ASUS, which allowed the campaign to go undetected for several months.

Kasperksy identified specific ASUS users that were targeted based on a hardcoded list of MAC addresses in the trojan, which was used to identify intended targets of the campaign. The researchers identified 600 unique MAC addresses based on 200 samples. However, the researchers did not identify a specific group targeted by this malware, predicting the total distribution of victims should match the distribution of ASUS users.

Kaspersky notified ASUS of this campaign at the end of January 2019.

Indicators of Compromise

Infrastructure:
asushotfix[.]com
141.105.71[.]116
hxxp://liveupdate01.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER365.zip
hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER362.zip
hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER360.zip
hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER359.zip

Hashes:
aa15eb28292321b586c27d8401703494
bebb16193e4b80f4bc053e4fa818aa4e2832885392469cd5b8ace5cec7e4ca19

Breach Disclosure: Whitepages

In February 2019, The Register reported on a trove of information dumps being sold on the dark web. This collection contained details from approximately 16 sources, one of them being Whitepages, an online directory application. The disclosed information contained 11 million rows of email addresses, names and either bcrypt or MD5 password hashes. The Whitepages breach, along with others in the Register report, has been made available to the general public while other dumps have yet to be disclosed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

Whitepages is number 9 out of the 16 breaches from The Register report that was released to the public in February. This disclosed breach contained 11 million rows of email addresses, names and md5 or bcrypt password hashes. The total size of the breach is 2.9GB and the asking price is $1560. The Register attempted to reach out to Whitepages, and the company did not respond to the request for comment.

Dark Web Update: DreamMarket is Shutting Down

Dream Market, a notorious dark net website used to sell goods and services related to cybercrime, is shutting down next month. A report released by ZDNet noted that the announcement on the website came on the same day that Europol, alongside the FBI and DEA, gave a press release on an operation that targeted buyers and vendors on the dark web. The law enforcement agencies reportedly made tens of arrests and seized over 6 million pounds from these arrests. Dream Market has been servicing customers for close to 6 years. As of this date, the registration page of Dream Market shows an official shutdown of 04/30/2019 and is transferring its userbase to a new partner organization.

Recommendations:

• Update Cyber Attack Chatter rules to alert on potential new markets being advertised on social media. Users of Dream Market are already migrating over to secondary markets like Wall Street Market
• Continuously scan for mentions of your organization via the ZeroFOX platform on the "Dark Web" network data source
• If you do not have Dark Web enabled, please reach out to your ZeroFOX Account Manager for more information

Details

The supposed explanation behind the shutdown is that Dream Market has been continuously DDoSed and site maintainers cannot keep it running and will not pay a reportedly large ransom for the DDoSers to cease operations. The ransom to stop the DDoS of DreamMarket was $400,000 USD. Users have been speculating that this is the result of law enforcement seizing the website, but user and moderator waterchain posted and assured users that it has nothing to do with the police activity posted. The partner company was not named, but the onion address is weroidjkazxqds2l.onion. ZeroFOX Alpha Team has HIGH confidence that this partner organization, as well as other markets who have competed with Dream Market, will be the next evolution of cybercrime markets like Dream Market for criminals to use to sell goods and services.