Threat Intelligence Bulletin: 12/20/19

Maze Ransomware Authors Name and Shame Victims

After a string of attacks against major organizations worldwide, the Maze group has begun dumping victim data publicly online, in an effort to shame victims who did not meet their demands. This name-and-shame technique may make victims more likely to pay ransoms, which ultimately increases the profitability of ransomware and makes it much more appealing to attackers.

Recommendations

Consider enabling the Cyber Chatter rule in order to monitor activity related to this threat
Ensure defensive systems are up to date with the latest detection
Blacklist network infrastructure associated with this campaign
Remain alert to potential phishing attacks on social media, and avoid downloading suspicious email attachments

Details

The authors behind Maze ransomware have implemented an interesting new tactic to get their victims to pay up - naming and shaming them on a public website. The site lists victims, along with publicly downloaded “proof” files containing sensitive information related to the breached organization. The site also lists locked IP addresses, the date of compromise, and the total amount of data encrypted.

Maze group’s victim-shaming website banner

Figure 1. Maze group’s victim-shaming website banner

The Maze group has targeted organizations within a variety of industries, based in countries across the world. The latest publicized attack is against the City of Pensacola, Florida. When the city refused to pay the $1 million ransom, the group responded by dumping 2 GB of stolen data online. Purportedly, this is just 2 GB out of a total of 32 GB of stolen data.

The Maze group is not the only group extorting their victims in this way, however. Plenty of other ransomware groups have also begun using this tactic, in the hopes of increasing the likelihood that their victim pays the ransom. In May 2019, the Twitter account supposedly belonging to the person behind the Baltimore City ransomware attack provided proof of the attack in the form of court documents posted publicly. The same user also posted several tweets directed at the mayor of Baltimore, demanding the mayor pay up.

Similarly, Team Snatch also employed a name-and-shame approach when they compromised CityComp in May 2019. This kind of extortion may ultimately increase the likelihood that ransomware victims meet the demands of their attackers. ZeroFOX highly recommends taking the precautions detailed in this advisory to mitigate risk of being compromised.

Breaking News: 2019-12-13 - 2019-12-19

Smart Krampus-3PC Malware Targets iPhone Users

More than 100 publisher websites, including online newspaper and international weekly news magazines, were compromised via malicious ads to serve a new mobile malware called “Krampus-3PC”. The malware targets iPhone users who visit any of these compromised websites. The malware first checks whether the ad was hosted by Adtechstack- Adtech provider and then injects another script to check whether the victim’s device was an iPhone. If these parameters are met, then malware executes the payload URL and sends victim data to the attacker’s C&C server. The gathered phone numbers were used later to send phishing texts and cookie IDs which allows the hackers to hijack the browser or to gain access to any of the online accounts which were left open on the victim’s machine.

See the full report here: https://threatpost.com/krampus-3pc-malware-iphone-users/151043/

Why Ring Doorbells Perfectly Exemplify the IoT Security Crisis

Hackers are breaking into users' Ring accounts, which can also be connected to indoor Ring cameras, to take over the devices. There have been multiple incidents across various countries where the hackers hijack Ring cameras to either talk to children or record audios. A Ring Spokesperson said that they investigated various incidents and have no evidence of an unauthorized intrusion or compromise of Ring’s systems or network. The company claims to have taken appropriate actions to promptly block bad actors from known affected Ring accounts. Concerned users have been notified about these incidents by the company. Users are urged to change their passwords regularly and enable two-factor authentication.

See the full report here: https://www.wired.com/story/ring-hacks-exemplify-iot-security-crisis/

Maze Ransomware Demands $6 Million Ransom From Southwire - BleepingComputer

The operators of Maze Ransomware claim that they are responsible for encrypting the data of Southwire Company, LLC (Southwire) from Carrollton, Georgia and are demanding a ransom of 850 BTC, amounting to approximately $6 million. Multiple systems were affected by the attack, causing significant delays in shipping customer orders. As a precaution, the company had to shut down the entire network, including shipping services. The company is fully focused on rebuilding systems and restoring critical operations as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/maze-ransomware-demands-6-million-ransom-from-southwire/

Google rolls out Verified SMS and Spam Protection in Android

Google announced two new message updates for the Android mobile operating system, namely, Verified SMS and Spam Protection. Verified SMS works by confirming the identity of the SMS sender and will only be used to verify the authenticity of SMS messages sent by businesses. It won't verify and add a verification badge to messages sent by normal users. Spam Protection feature works by showing a notification bar at the top of the Messages app when the app believes a newly-received message contains the markers of a classic SMS spam text. Google said it created this feature to help users trust the messages they receive. Android users in the US and selected countries will get access to these new features.

See the full report here: https://www.zdnet.com/article/google-rolls-out-verified-sms-and-spam-protection-in-android/

New Echobot Variant Exploits 77 Remote Code Execution Flaws - BleepingComputer

An independent security researcher has discovered a new version of the Echobot variant that exploited around 77 Remote Code Execution flaws. The 77 exploits in the current version are for products ranging from routers, IP cameras, VoIP phones, presentation systems, smart home hubs, software, data analytics platforms, biometric scanners, network-attached storage systems, and thermal cameras. An attacker can leverage this to run code of their choice and gain elevated access to victims' devices. It is recommended that users patch their devices with the latest updates, IoT devices for the most part.

See the full report here: https://www.bleepingcomputer.com/news/security/new-echobot-variant-exploits-77-remote-code-execution-flaws/

VeChain Foundation Hacked, $6.5 Million in VET Stolen - Crypto Briefing

The VeChain Foundation has been hacked - likely by an insider seeking to gain access to 1.1 billion VET tokens worth $6.5 million. The hack represents a loss of over 4.6% of the foundation’s treasury and accounts for 1.3% of VeChain’s total supply. The company is working on mitigating the damage caused by the hack and enlisted a dedicated website Vechainstats.com to help monitor and contain the situation.

See the full report here: https://cryptobriefing.com/vechain-foundation-hacked-6-5-million-vet-stolen/

Valuable personal info leaks from Facebook – not Zuck selling it, unencrypted hard drives of staff data stolen

The personal information of nearly 29,000 current and former Facebook employees have been stolen. The theft of data this time is unusual, as hard drives containing unencrypted payroll information were stolen from a Facebook employee's car. The stolen records include employee names, bank account numbers, and partial social security numbers. The company claims that there is no evidence of misuse of the lifted data. Facebook has informed people who were on its US payroll in 2018 and is offering them free identity theft and credit monitoring services. This theft impacts current and former Facebook employees only and no Facebook user data was involved.

See the full report here: https://www.theregister.co.uk/2019/12/13/facebook_data_loss/

Critical Bug in WordPress Plugins Open Sites to Hacker Takeovers

Security researchers have discovered a major vulnerability in two WordPress plugins - Ultimate Addons for Beaver Builder and Ultimate Addons for Elementor, both made by Brainstorm Force. This vulnerability could allow hackers to gain admin access to any WordPress website that had the plugin installed. To exploit the bug and gain full access and control over a site, all that is needed is the email address of an admin user of the site. Brainstorm Force has released a fix for the bug affecting both plugins. WordPress users are urged to update to patched versions of the plugins.

See the full report here: https://threatpost.com/critical-bug-in-wordpress-plugins-open-sites-to-hacker-takeovers/151123/

Ryuk Ransomware Likely Behind New Orleans Cyberattack - BleepingComputer

Researchers at Red Flare Security have attributed the recent ransomware attack on the city of New Orleans to Ryuk ransomware after identifying related files that were uploaded to VirusTotal. One of these, an executable named 'yoletby.exe,' was found to contain numerous references to the City of New Orleans including domain names, domain controllers, internal IP addresses, user names, file shares, and references to the Ryuk ransomware. City authorities have yet to confirm these details, however.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-likely-behind-new-orleans-cyberattack/

Largest hospital system in New Jersey was hit by ransomware attack

Hackensack Meridian Health, one of the largest hospitals in New Jersey, has announced a ransomware attack on Friday that disrupted functions across its clinics and 17 hospitals. The attack began on December 2, 2019, when the hospital's network was breached and all medical records were encrypted. As a result, the hospital was forced to reschedule surgeries and other clinical procedures. Later, the IT staff paid a ransom to decrypt all records. All the systems have been restored and are back online.

See the full report here: https://securityaffairs.co/wordpress/95152/cyber-crime/new-jersey-hospital-ransomware-attack.html

VISA warns of POS malware incidents at gas pumps across North America

The VISA Payment Fraud Disruption (PFD) team have issued security alerts to gas station merchants about cyber attacks involving point-of-sale(POS) malware. Many of the POS terminals in gas stations operate on older technology that does not encrypt payment card data prior to sending it to the main network. Cyber criminals leverage this flaw to intercept the communication and steal card related information. Gas station merchants are recommended to implement a mechanism to encrypt data during transfer or switch to a chip-and-PIN card acceptance policy.

See the full report here: https://www.zdnet.com/article/visa-warns-of-pos-malware-incidents-at-gas-pumps-across-north-america/

GALLIUM: Targeting global telecom

Microsoft has reported that the GALLIUM group is targeting telecommunications companies. The group exploits unpatched vulnerabilities to compromise systems running on WildFly/JBoss application servers. After successful infiltration, the group aims to collect credentials, and drop web shells to gain persistence and run further commands, on compromised devices. Additionally, second-stage malware is dropped, including customized Gh0st RAT and Poison Ivy malware payloads to evade detection.

See the full report here: https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/

High-Profile Users in the US and Europe Targeted by Zeppelin Ransomware - Security Intelligence

Blackberry Cylance have observed samples of a new variant of Vegalocker, dubbed Zeppelin. The variant is actively targeting technology and healthcare companies in the US and Europe. The ransomware sample checks for Russia or any former Soviet Union country based systems and immediately quits running if detected. Otherwise, it encrypts all the files on the infected system and drop a ransom note. Further, the ransomware samples are found to be hosted on watering hole sites, Pastebin and wrapped in a Powershell loader.

See the full report here: https://securityintelligence.com/news/high-profile-users-in-the-us-and-europe-targeted-by-zeppelin-ransomware/

SQL Server 2019 Security Tool Inadvertently Reveals Where Sensitive Data is Stored

Microsoft’s SQL Server 2019 introduces a new tool: SQL Data Discovery & Classification. Built into SQL Server Management Studio (SSMS), the software allows users to discover, classify, label and report the sensitive data in their databases. Common security tools perform this process outside the database but Microsoft’s new classification tool performs it within a database, revealing the location of sensitive data. Insider attackers can leverage this to track sensitive data and then access it. Users are urged to use a security classifier outside the database to ensure that the data is secure.

See the full report here: https://www.imperva.com/blog/?p=11420

Where's our data, Google? Chrome 79 update 'a catastrophe' for Android users with WebView apps

Developers complain that users' data are being deleted as they receive the Chrome 79 update on Android. A change to the location of profile data in Chrome 79 on Android means that applications using the WebView component lose data stored locally. The problem appears to originate from a change to the location of profile data in Chromium, the open-source project on which Google Chrome is based. The good news is that the update does not delete the previous data but only makes it invisible. It can, therefore, be recovered by a developer or with debug tools, but this is not easy for the user.

See the full report here: https://www.theregister.co.uk/2019/12/16/chrome_79_update_a_catastrophe_for_android_users_with_webview_apps/

Chinese e-commerce site LightInTheBox.com bared 1.3TB of server logs, user data and more

An unsecured and unencrypted Elasticsearch database has exposed over 1.3TB of web server log entries held by Chinese e-commerce website LightInTheBox.com. The exposed server logs included user email addresses, IP addresses, countries of residence, and pages each visitor viewed on LightInTheBox’s website. It also contained data from the company’s subsidiary sites including MiniInTheBox.com. With holiday shopping around the corner, even a large leak with no user Personally Identifiable Information data could be a threat to both the company and its customers. With access to just users’ email addresses and precise browsing history, attackers could easily phish customers.

See the full report here: https://www.theregister.co.uk/2019/12/16/lightinthebox_data_breach_1_5bn_customer_records/

PowerShell Scripts Delivered Via Office Macro Attachments Target Polish Employees

A new phishing campaign has emerged that targets Polish employees who deliver PowerShell scripts. The phishing e-mail includes an attachment that contains a Microsoft (MS) Office macro which checks the language of the installed Office program and only proceeds if it is in the Polish language. A PowerShell script is downloaded that, in turn, downloads a set of additional PowerShell scripts, enabling the threat actor to seize control of the computer remotely. By using deceptively simple commands and minimal code, threat actors can perform data exfiltration and payload downloading while maintaining a relatively small footprint.

See the full report here: https://cofense.com/powershell-scripts-delivered-via-office-macro-attachments-target-polish-employees/

Google fixes Chrome 79 data loss bug on Android

Google has released a patch for a bug that reset or caused data loss for some Android applications. The bug impacted only Android apps built to run on top of WebView, a slimmed-down version of the Chrome browser. The bug will be fixed in Chrome for Android, version 79.0.3945.93, which will restore user access to their old data and is being rolled out to users this week. Chrome and WebView updates are synced on Android devices, effectively fixing all impacted applications. Users are advised to patch as soon as possible.

See the full report here: https://www.zdnet.com/article/google-fixes-chrome-79-data-loss-bug-on-android/

A Twitter cyberattack on the Epilepsy Foundation posted strobing images that could trigger seizures

A series of cyberattacks on the Epilepsy Foundation's Twitter account exposed thousands of people to videos of flashing strobe lights in an apparent attempt to trigger seizures, causing significant harm to those with the condition. Flashing lights at certain intensities or in certain patterns can trigger a seizure in people with photosensitive epilepsy. While the population of those with photosensitive epilepsy is small, the impact can be quite serious. The foundation has reported the issue to law enforcement officials. Twitter said it has some tools in place to protect this kind of abuse and are exploring additional options.

See the full report here: https://www.cnn.com/2019/12/17/tech/epilepsy-strobe-twitter-attack-trnd/index.html

Facebook Fixes WhatsApp Group Chat Security Issue

A bug was detected in WhatsApp chat platform that allowed attackers to send maliclious messages on group chats and crash the entire application. Initially, the attacker gains access by manipulating the message parameter containing the user's phone number. Other message parameters are also tampered to create a malicious message and send it to all the group members, leading to loop-crash. A fix for the flaw is available in WhatsApp version 2.19.58 and users should apply it manually.

See the full report here: https://www.darkreading.com/attacks-breaches/facebook-fixes-whatsapp-group-chat-security-issue/d/d-id/1336645

Canadian Insurance Firm Hit By Maze Ransomware, Denies Data Theft - BleepingComputer

Andrew Agencies, an Insurance and financial service company based out of Canada was targeted by Maze Ransomware. The attack happened on 21st, October 2019 wherein the attackers intruded into the company network and encrypted 245 computers. Attackers have disclosed 876 usernames and users hashed passwords and demanded ransom amount of $1.1 million from the company. According to reports, the encrypted data was of size 63 terabytes. The company stated that it is not going to pay a ransom amount as there was no evidence of any sensitive data stolen. However, Maze operators claim that they have 1.5 GB of data about insurance customers.

See the full report here: https://www.bleepingcomputer.com/news/security/canadian-insurance-firm-hit-by-maze-ransomware-denies-data-theft/

Honda Exposes 26,000 Records of North American Customers - BleepingComputer

Personally Identifiable Information (PII) of nearly 26,000 Honda customers has been exposed after misconfiguring an Elasticsearch cluster. The database in question is a data logging and monitoring server for telematics services for North America covering the process for new customer enrollment as well as internal logs. The exposed information included the customers' full names, email addresses, phone numbers, mailing address, vehicle make and model, vehicle VINs, agreement ID, and various service information on their Honda vehicles. If leaked, this information can be used in highly targeted phishing attacks. Honda claims that none of its North American customers' financial information, credit card data, or credentials were exposed in the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/honda-exposes-26-000-records-of-north-american-customers/

TP-Link Routers Give Cyberattackers an Open Door to Business Networks

TP-Link patched a critical firmware vulnerability, tracked as CVE-2017-7405 in Archer C5 v4 routers. If exploited, an attacker can take control of the router’s configuration via Telnet on the local area network (LAN) and connect to a File Transfer Protocol (FTP) server through the LAN or wide area network (WAN). The vulnerability was discovered by IBM Red‘s Grzegorz Wypych. Users are advised to apply patches to the device through the TP-Link support portal.

See the full report here: https://threatpost.com/tp-link-routers-cyberattackers-open-door/151254/

Cryptocurrency-mining botnet uses a Taylor Swift image to hide malware payloads

According to Sophos, the MyKingz crew is now experimenting with steganography, a technique that allows them to hide malicious files inside legitimate ones. The operators of MyKingz, a cryptocurrency-mining botnet are currently using an image of pop singer Taylor Swift to hide malware payloads they send to infected computers. The purpose of using this technique is to trick security software running on enterprise networks. These security products will only see a host system downloading a banal JPEG file, rather than a much dangerous EXE file.

See the full report here: https://www.zdnet.com/article/cryptocurrency-mining-botnet-uses-a-taylor-swift-image-to-hide-malware-payloads/

Breaking News: 2019-12-20 - 2019-12-26

Nexus Mods Game Modding Site Discloses Data Breach - BleepingComputer

Nexus Mods, one of the largest gaming modification websites on the web suffered a data breach that might have exposed registration information of its users. The firm, in a security notice, stated that on the 8th of November, 2019 it detected suspicious activity by an unauthorized third party against their services through an exploit in their legacy codebase. The company confirmed that only a small number of user's records were accessed by the attackers from the old user service. Following the attack, the affected endpoints were secured also warned the users to be vigilant for potential phishing or credentials attacks that might use the user’s registration email and password.

See the full report here: https://www.bleepingcomputer.com/news/security/nexus-mods-game-modding-site-discloses-data-breach/

Frankfurt shuts down IT network following Emotet infection

To prevent future malware attacks, Frankfurt, one of the largest financial hubs in the world, shuts down its IT network following infection with the Emotet malware. After the Justus Liebig University, Bad Homburg City, and the Catholic University. Frankfurt is the fourth German entity that shut down its IT network in the past two weeks because of Emotet. Shutting down an IT network can cause financial losses for both public and private organizations. As of now, there is no clear estimate as to when the problem will be fully resolved.

See the full report here: https://www.zdnet.com/article/frankfurt-shuts-down-it-network-following-emotet-infection/

Honda Exposes 26,000 Records of North American Customers - BleepingComputer

Personally Identifiable Information (PII) of nearly 26,000 Honda customers has been exposed due to a misconfigured Elasticsearch cluster. Exposed information included the customers' full names, email addresses, phone numbers, mailing address, vehicle make and model, vehicle VINs, agreement ID, and various service information on their Honda vehicles. If leaked, this information can be used in highly targeted phishing attacks. Honda claims that none of its North American customers' financial information, credit card data, or credentials were exposed in the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/honda-exposes-26-000-records-of-north-american-customers/

Jet2 cyber-attack: IT worker with grudge jailed

A former Jet2 IT contractor has been jailed for cyber-attack on the company. 27 year-old Scott Burns, from Morley in Leads deleted the user credentials of 2000 members of staff, preventing them from logging into their network accounts. This took down the network for 12 hours. He was arrested by the National Crime Agency officers three weeks later and jailed for 10 months for his actions, which cost the company £165,000.

See the full report here: https://www.bbc.co.uk/news/uk-england-leeds-50843669

267M Facebook Users’ Phone Numbers Exposed Online

Security researchers have discovered Facebook data floating around in the wild. According to experts, the unsecured Elasticsearch database compromised more than 267 million customer records. The records disclosed unique Facebook IDs, phone numbers, full names, and a timestamp. The affected Facebook users in the database were mostly from the United States. A database this big is likely to be used for phishing and spam, particularly via SMS. As of now, it is unclear as to how the information in the database was collected. Facebook users are urged to be vigilant for suspicious text messages.

See the full report here: https://threatpost.com/267m-facebook-phone-numbers-exposed-online/151327/

Fake Star Wars Streaming Sites Steal Credit Cards From Fans - BleepingComputer

The hype around the new Star Wars: The Rise of Skywalker movie is actively being exploited to lure fans into fake streaming sites, where attackers seek to steal credit card details and infect victims with malware. Researchers have found over 30 fraudulent websites and 65 malicious files that supposedly distribute free copies of the latest film in the franchise. These websites collect unwary users’ credit card data, under the pretense of necessary registration on the portal and instead of getting a free pirated copy of the new Star Wars installment, the victims get malware.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-star-wars-streaming-sites-steal-credit-cards-from-fans/

Manitoba insurance agency admits it was hit by ransomware - IT World Canada

Andrew Agencies, a Manitoba-based insurance agency has announced it was hit by Maze Ransomware after the gang behind the attack publicized the incident. The attack occurred on October 21st, 2019 and encrypted 245 computers. The firm has refused to pay the ransom amount of $1.1 million demanded by the Maze group, which threatens to release more sensitive information belonging to the agency. Andrew Agencies has released a statement that there is no evidence sensitive personal details have been jeopardized.

See the full report here: https://www.itworldcanada.com/article/manitoba-insurance-agency-admits-it-was-hit-by-ransomware/425299

Emotet Malware Uses Greta Thunberg Demonstration Invites as Lure - BleepingComputer

A new Emotet campaign has been discovered, which lures its victims into opening a malicious attachment by inviting them to a new climate change demonstration by Greta Thunberg, a Swedish environmental activist. The email attachment is a malicious Word document named “Support Greta Thunberg.doc” which when opened prompts the victims to click on “enable editing” and then on “enable content”. Upon doing so a malicious macro will launch a PowerShell command that downloads and executes Emotet, which sends further spam and downloads more malware to the victim's system.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-uses-greta-thunberg-demonstration-invites-as-lure/

Personal data of 2400 MINDEF, SAF personnel potentially affected by data breach - CNA

The personal data of 2,400 Ministry of Defence (MINDEF) and Singapore Armed Forces (SAF) personnel may be affected by a potential personal data breach. The potential breach was a result of email phishing activities involving malicious malware sent to its employees’ email accounts. Potentially exposed information includes names, NRIC numbers, home addresses or telephone numbers. ST Logistics, who operates several logistics services for MINDEF and SAF personnel, has notified the victims about the breach and ensures its customers better security.

See the full report here: https://www.channelnewsasia.com/news/singapore/st-logistics-mindef-saf-2400-personal-data-breach-phishing-email-12202786

Tokyo 2020 Staff Warns of Phishing Disguised As Official Emails - BleepingComputer

In a new phishing campaign, a cyber-espionage group is delivering phishing emails in an attempt to spoof the Tokyo Organizing Committee of the Olympic and Paralympic Games (Tokyo 2020). Tokyo 2020 Summer Olympics staff has published a warning to alert on an ongoing phishing campaign. Although the email may look official and legitimate, clicking on the attached links or downloading attachments can be dangerous. If acted upon, these phishing emails can steal data and infect the victim's machine with malware.

See the full report here: https://www.bleepingcomputer.com/news/security/tokyo-2020-staff-warns-of-phishing-disguised-as-official-emails/

Cisco Security Appliances Targeted for DoS Attacks via Old Bug - BleepingComputer

Attackers are actively exploiting an old bug in Cisco’s Appliances Adaptive Security (ASA), to conduct DoS attacks. The vulnerability, tracked as CVE-2018-0296, is leveraged by an unauthenticated remote attacker to send crafted HTTP requests and cause the appliance to reload. An attacker can also view sensitive information without authentication. Cisco has addressed this issue and released fixes for affected products.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-security-appliances-targeted-for-dos-attacks-via-old-bug/

Uninstall ToTok, an Alleged Emirati Spy App, From Your Phone Now

According to US intelligence officials, ToTok, an Emirati messaging application is being used as a surveillance tool. The application is being used by the UAE government to follow users’ conversations, track locations, and access social connections. First released on July 27, 2019, it has at least 600,000 downloads across the Android and iOS platforms and is widely used in UAE and US. Google and Apple have removed ToTok from their app stores.

See the full report here: https://www.wired.com/story/totok-alleged-emirati-spy-app/

Wawa Data Breach: Malware Stole Customer Payment Card Info

Convenience store chain Wawa disclosed a card breach after its security team found malware installed on its payment processing systems. Wawa said the malware collected payment card information from customers who used credit or debit cards at their stores and gas stations. The malware was installed on its servers on March 4 this year and had remained undetected up until December 10. Affected data includes credit and debit card numbers, expiration dates and cardholder names used at Wawa in-store payment terminals and fuel dispensers between March 4 and Dec. 12. The number of victims to this breach is not known. Affected users are advised to review account statements and report any discrepency. The company is offering credit monitoring and identity-theft protection without charge to affected customers.

See the full report here: https://threatpost.com/wawa-data-breach-malware-stole-customer-payment-card-info/151337/

Personal data of 2400 MINDEF, SAF personnel potentially affected by data breach - CNA

See the full report here: https://www.channelnewsasia.com/news/singapore/st-logistics-mindef-saf-2400-personal-data-breach-phishing-email-12202786

NVIDIA Patches High Severity Vulnerability in GeForce Experience - BleepingComputer

NVIDIA has addressed a vulnerability in the Windows NVIDIA GeForce Experience (GFE) app that could potentially allow attackers to escalate privileges or cause denial-of-service conditions on unpatched software. The vulnerability, tracked as CVE-2019-5702, can be exploited by gaining local access and installing malicious tools on vulnerable systems. Successful exploitation of this vulnerability allows attackers to render Windows machines and disrupt services. The flaw impacts Windows computers running versions of NVIDIA GeForce Experience before 3.20.2. Users are advised to download the latest version to patch this issue.

See the full report here: https://www.bleepingcomputer.com/news/security/nvidia-patches-high-severity-vulnerability-in-geforce-experience/

Google Chrome impacted by new Magellan 2.0 vulnerabilities

According to the Tencent Blade security team, new vulnerabilities in SQLite can allow attackers to run malicious code in Google Chrome. The vulnerabilities, dubbed as “Magellan 2.0”, target apps using the SQLite database using a Chrome feature called the WebSQL API. The API is used to translate JavaScript code into SQL commands. The improper input validation in SQL commands can allow malicious SQL code injection and execute it on behalf of the attacker. To exploit this, the app must allow direct input of raw SQL commands. SQLite and Google Chrome have fixed the bugs.

See the full report here: https://www.zdnet.com/article/google-chrome-impacted-by-new-magellan-2-0-vulnerabilities/

Twitter Fixes Bug that Enabled Takeover of Android App Accounts

Android users are urged to update their Twitter app to mitigate a security bug that allows hackers to access private account data and control accounts to send tweets and direct messages. The bug impacts older versions of Android. The versions 7.93.4 (KitKat – released Nov. 4, 2019) and 8.18 (Lollipop – released Oct. 21, 2019) have fixed the issue. The impacted Twitter users will be notified via email or via Twitter itself.

See the full report here: https://threatpost.com/twitter-fixes-bug-that-enabled-takeover-of-android-app-accounts/151393/

Critical Citrix Flaw May Expose Thousands of Firms to Attacks - BleepingComputer

Networks of nearly 80,000 firms could be exposed to hacking attacks due to a newly discovered vulnerability impacting the Citrix Application Delivery Controller (NetScaler ADC) and the Citrix Gateway (NetScaler Gateway). Tracked as CVE-2019-19781, this vulnerability could allow remote attackers to access a company's internal network without requiring authentication. If exploited, it could lead to arbitrary code execution. Users are urged to upgrade all of their vulnerable machines to a fixed version.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-citrix-flaw-may-expose-thousands-of-firms-to-attacks/

Dropbox Zero-Day Vulnerability Gets Temporary Fix - BleepingComputer

Security researchers have disclosed a zero-day vulnerability in Dropbox for Windows that can enable an attacker to attain Windows SYSTEM privileges. There is an arbitrary file overwrite issue in DropboxUpdater service that can allow an attacker with local user access to escalate privileges and execute code as SYSTEM. Until Dropbox rolls out a better version, an interim solution can be applied via 0Patch, a platform that delivers micropatches for known issues before a permanent, official fix becomes available.

See the full report here: https://www.bleepingcomputer.com/news/security/dropbox-zero-day-vulnerability-gets-temporary-fix/

Uptick Seen in ISO Email Attachments Delivering Malware - BleepingComputer

There is a surge in a malicious campaign that delivers malware in disk image file (.ISO) formats. The remote access trojan such as NanoCore, Remcos, and LokiBot information stealer was being delivered this way to lower its detection rate. In a recent campaign, attackers have created a fake FedEx shipment email written in French stating shipment delivery of FedEx parcel was failed due to incorrect address and tricks the victims to download the document from FedEx site and update the address. The image in the email points to an ISO file attempting to appear as a PDF file that contains executable for NanoCore RAT.

See the full report here: https://www.bleepingcomputer.com/news/security/uptick-seen-in-iso-email-attachments-delivering-malware/

Maze Ransomware Releases Files Stolen from City of Pensacola - BleepingComputer

The operators of Maze Ransomware responsible for encrypting the City of Pensacola demanded a ransom of $1,000,000 and have released 2GB of files that were allegedly stolen during their ransomware attack. According to Bleeping Computer, the Maze actors released the stolen data to prove to the media that they steal more than just a few files during a ransomware attack. Maze actors claim to have exfiltrated 32GB of files before encrypting the network. However, city authorities are yet to confirm these details.

See the full report here: https://www.bleepingcomputer.com/news/security/maze-ransomware-releases-files-stolen-from-city-of-pensacola/

New Mozi P2P Botnet Takes Over Netgear, D-Link, Huawei Routers - BleepingComputer

Netgear, D-Link, and Huawei routers are actively being targeted by a new peer-to-peer (P2P) botnet dubbed Mozi. The botnet is implemented using a custom extended Distributed Hash Table (DHT) protocol that helps in establishing the botnet network and hiding the payload in normal DHT traffic. The malware propagates by logging in to targeted routers or CCTV DVR that comes with a weak password. After the payload is dropped and executed on the compromised system, the newly activated bot automatically joins the Mozi P2P network as a new node. The new bot nodes receive and execute commands from the botnet master, while simultaneously searching and infecting other vulnerable devices.

See the full report here: https://www.bleepingcomputer.com/news/security/new-mozi-p2p-botnet-takes-over-netgear-d-link-huawei-routers/

Entercom Radio Network Hit By Second Cyber Attack This Year - BleepingComputer

Radio network and broadcasting company, Entercom has been targeted in a cyberattack that may have impacted the back-office functions, forcing some stations to run recorded programs. On-air machines remained largely unaffected but some markets could not import music logs and other types of content. With more than 235 radio stations and an audience of over 170 million people, the company experienced connectivity problems that disabled email communication, access to files, and content for the digital platforms. This is the second time the network has suffered a cyberattack, the first one being a ransomware attack in September that caused significant financial losses. At the moment, details about the latest incident remain private but the company has confirmed the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/entercom-radio-network-hit-by-second-cyber-attack-this-year/

This popular dating app suffered a serious data breach and you should update it now - International Business Times, Singapore Edition

Plenty of Fish (PoF), a popular dating application suffered a data breach that may have put users' private information at risk. Although the sites say that the "private" information will not be displayed to the public, the information can still be accessed via the app's API using freely available tools. Hackers can use these free tools to access these hidden data, putting the users at risk. The exposed information include the users' first names and postal ZIP codes. PoF has rolled out a fix for the issue and urges users to update their profiles to display preferences to ensure that their personal information is not at risk.

See the full report here: https://www.ibtimes.sg/this-popular-dating-app-suffered-serious-data-breach-you-should-update-it-now-36552

Two-Year Long Phishing Campaign Impersonates Canadian Banks - BleepingComputer

A new phishing campaign is targeting Canadian banks via a large-scale infrastructure. The infrastructure behind these attacks includes hundreds of phishing websites designed to impersonate major Canadian banks' websites to steal user credentials by utilizing custom-crafted and legitimate-looking email messages with malicious PDF attachments. Attackers send emails with a false sense of urgency and trick victims into submitting personal information and leverage these credentials to steal money from the victims. Check Point's research team has discovered over 300 domains that closely resemble bank websites and host phishing websites for Canadian banks.

See the full report here: https://www.bleepingcomputer.com/news/security/two-year-long-phishing-campaign-impersonates-canadian-banks/

PayPal Phishing Attack Promises to Secure Accounts, Steals Everything - BleepingComputer

PayPal customers are being served with phishing emails camouflaged as "unusual activity" in a new campaign. After the victims land on the phishing site, they are taken to a series of fake login pages designed to harvest their PayPal usernames and passwords. In the next step, victims are asked to fill out their billing addresses (including their name, phone number, and date of birth), as well as their credit and debit card data to steal money from the victims. On spotting phishing emails as an official email sent by PayPal, customers are urged to report to [email protected] and to delete it as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/paypal-phishing-attack-promises-to-secure-accounts-steals-everything/