Breach Disclosure: Knuddels

On September 07, 2018, Knuddels administrators made a post on their forums of an unauthorized disclosure of private user account information. Knuddels is a German chat app that has been in existence since 1999. The initial announcement said that when users log in they will be prompted for a password change. The breach was published on mega.nz and affected users all the way up to July 20, 2018. The breach contained approximately 808,000 records, including email addresses, plaintext passwords, usernames and real names.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Administrators and IT security staff continuously updated the thread as they found out more information. Users questioned Knuddels repeatedly on why their passwords were stored in plain text, and the explanation was that it was to prevent users from sharing their passwords on the platform itself. Although passwords were hashed, this “feature” was created to prevent account misuse and was an “old” feature that they never turned off. Knuddels also claimed that the mega.nz link was posted on cybercriminal forum nulled[.]to, but members of the forum were questioning the reports asking for the leak as it was not present on the website.

Breach Disclosure: DataCamp

In late March 2019, DataCamp, a data science e-learning platform, disclosed a data breach via a post on their website. The breach occurred on February 11, 2019 by a third-party who gained “criminal unauthorized access” to the DataCamp platform. The company claims a subset of its user base was affected and they immediately engaged with a third party forensic firm to help investigate. The data exposed includes 760,000 records of emails, IP addresses, bcrypt hashed passwords and names.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The company says no payment data was accessed since they do not store payment data. The company used bcrypt to hash their passwords, which is a cryptographic hash function designed specifically for hashing passwords, reducing the risk of brute forcing passwords at scale. The company logged out all affected users and issued password resets where appropriate. The full list of exposed data includes name, email addresses, optional personal data, hashed passwords, created dates, last sign in dates and sign in IP addresses.

Malware Update: Lazarus Group HOPLIGHT

On April 10, 2019, US-CERT released a malware report on a new spyware family by Lazarus Group/Hidden Cobra, an APT linked to North Korea. The report names the new malware, HOPLIGHT, as a piece of spyware that is designed to obfuscate traffic while it exfiltrates data from victims' computers. The malware is able to create fake TLS sessions and disguise network connections in order to trick defenders. Beneath all of the obfuscation programs is a function that can covertly exfiltrate files off the computer, as well as do some basic remote administration tool functions such as read or write to disk and access system functions.

Recommendations

• In the ZeroFOX platform, enable the Cyber Attack Chatter Rule, and implement a custom rule to monitor for any company-specific leaked technical information
• Keep your security systems up to date with the latest detections and indicators from US-CERT
• Maintain secure backups of all business critical information
• Create robust network segmentation to prevent pivoting between business units

Details

The US-CERT report did not give any information on how HOPLIGHT is attributed to Lazarus Group/Hidden Cobra. Lazarus Group is an anomaly in Nation-State hacking groups, as its primarily financially motivated as opposed to other groups that have traditional intelligence goals. For example, the group was notoriously attributed to the Sony Hack years ago. For an up to date catalog of Lazarus Group Activity, refer to US-CERT's page on it.

Indicators of compromise provided by US-CERT

File hashes

05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461 

12480585e08855109c5972e85d99cda7701fe992bc1754f1a0736f1eebcb004d 

2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525 

4a74a9fd40b63218f7504f806fce71dffefc1b1d6ca4bbaadd720b6a89d47761 

4c372df691fc699552f81c3d3937729f1dde2a2393f36c92ccc2bd2a033a0818 

70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3 

83228075a604e955d59edc760e4c4ed16eedabfc8f6ac291cf21b4fcbcd1f70a 

d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39 

ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d 

49757cf85657757704656c079785c072bbc233cab942418d99d1f63d43f28359 (rdpproto.dll)

70902623c9cd0cccc8513850072b70732d02c266c7b7e96d2d5b2ed4f5edc289 (udbcgiut.dat)

96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 (MSDFMAPI.INI)

cd5ff67ff773cc60c98c35f9e9d514b597cbd148789547ba152ba67bfc0fec8f (UDPTrcSvc.dll)

IPs

112.175.92.57

113.114.117.122

128.200.115.228

137.139.135.151

181.39.135.126

186.169.2.237

197.211.212.59

21.252.107.198

26.165.218.44

47.206.4.145

70.224.36.194

81.94.192.10

81.94.192.147

84.49.242.125

97.90.44.200