Threat Intelligence Bulletin: 01/10/20

Breach Disclosure: India Rail

On January 8 2020, a Medium post made by security company dvuln outlined a disclosure for a data breach that was made to them. The breach involved the app India Rail. India Rail is a top app on the Apple App Store, and the data breach was due to an exposed Firebase database. The breach contained 2,357,684 rows of emails, usernames and plain-text passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The main security issue was due to lax access security controls to the Firebase application ran by India Rail. Anyone could connect and access the database if they knew the URL, or if they scraped the URL. Luckily, the researcher found the URL and lack of keys or authentication by reverse engineering the application. The other major issue here is that the passwords were stored in clear-text and without cryptographic hashing in place, exposing the passwords for pivoting and credential stuffing by attackers.

Breach Disclosure: Planet Calypso

After yet another exploitation of the vBulletin RCE vulnerability, CVE-2019-16759, the forum of gaming site Planet Calypso has been breached. This resulted in exposed usernames, email and IP addresses, and salted MD5 hashed passwords for 64,000 site users.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

This data breach dump was offered for sale on RaidForums beginning in September 2019, after an initial breach in July 2019.

Figure 1. Sales ad for this database dump on RaidForums

Given that this vBulletin vulnerability is so often exploited, ZeroFOX urges forum administrators to update vBulletin as soon as possible. The CVE being exploited to breach forums such as this one is fixed in version 5.5.5. Versions 5.0.0 - 5.5.4 remain vulnerable.

Breach Disclosure: GoGames

In December 2019, manga website GoGames was breached. 3.9 million user email and IP addresses, usernames, and salted MD5 hashed passwords were exposed. Site administrators have not responded to requests for comment regarding the breach. This is not the first time the site has been breached - in October 2015, the site exposed the same data for 3.4 million users.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

This breach occurred in December 2019, however, data has since been made publicly available. The breach dump is now being offered for sale on RaidForums.

Figure 1. Sale ad for GoGames dump on RaidForums

There are conflicting reports on the date that this breach occurred, with some sources claiming that this breach is from 2015. However, it appears that this breach is recent, and that the December 2019 date is the correct one.

Given that this is the second major breach of this site and that site admins have not released a statement regarding improvements to the security of the site, ZeroFOX would caution potential users against making a profile on this site.

Breach Disclosure: BtoBet Platform

A breach in the betting platform BtoBet has led to the compromise of gambling sites Surebet247, BetAlfa, BetWay, BongoBongo, and TopBet. In total, details related to 444,000 users have been leaked, including transaction history and bet details.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

BtoBet is a platform commonly used by betting sites. After multiple African and South American gambling websites were breached in January 2020, the platform began investigating a potential security vulnerability. As of January 9th, the company no findings have been released regarding this investigation. Security researchers on Twitter have also said that the company has actively blocked anyone on Twitter who is discussing this breach.

Breach Disclosure: EuropaJobs

In August 2019, the European job hunting website Europa[.]jobs was breached. 226,000 user email addresses, salted hashed passwords, and extensive personal information related to job applications like uploaded CVs, birthdate and address, were exposed. Site administrators have not responded to requests for comment regarding the breach. The site is no longer up, however, the breach database is available for purchase on RaidForums.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

This breach occurred in August 2019, and the breached database is now offered for sale by multiple actors on RaidForums.

Figure 1. Sale ad for Europa[.]jobs dump on RaidForums

The database is also available for purchase on the Russian forum XSS[.]is.

Breaking News: 2020-01-10 - 2020-01-16

Google Removed Over 1.7K Joker Malware Infected Apps from Play Store - BleepingComputer

Approximately 1,700 apps infected with the Joker Android malware have been removed by Google's Play Protect from the Play Store. These malicious apps were originally designed by Joker's creators to perform SMS fraud. However, newer versions have moved to a technique called toll fraud, using which, the attackers trick victims into subscribing to or purchasing various content via their mobile phone bill. Both of the billing methods mentioned above provide device verification, but not user verification. To automate the malicious billing process avoiding user interaction, the attackers take advantage of injected clicks, custom HTML parsers, and SMS receivers.

See the full report here: https://www.bleepingcomputer.com/news/security/google-removed-over-17k-joker-malware-infected-apps-from-play-store/

Why is a 22GB database containing 56 million US folks' personal details sitting on the open internet using a Chinese IP address? Seriously, why?

A white-hat hacker operating under the handle Lynx discovered a database containing the personal details of 56.25m US residents floating around in the wild. The exposed NoSQL database contained names, home addresses, phone numbers, and ages of nearly 56.25m US residents on the public internet. Supposedly, all this information is being served from an IP address associated with Alibaba's web hosting wing in Hangzhou, east China, for reasons unknown. As of now, it is unclear as to how and why the information in the database was collected.

See the full report here: https://www.theregister.co.uk/2020/01/09/checkpeoplecom_data_exposed/

Unremovable malware found preinstalled on low-end smartphone sold in the US

An Android phone, Unimax UMX U686CL, subsidized by the US government for low-income users comes preinstalled with malware. Researchers at Malwarebytes found that the device was preinstalled with a heavily obfuscated malware that can install adware and other unwanted apps without the knowledge or permission of the user using an app named Wireless Update containing the Adups malware. The second dangerous component included on these phones was a malware coded to work as a dropper for a second-stage malware payload, a well-known adware strain known as HiddenAds. These two malicious apps are unremovable, making the phone dangerous to use.

See the full report here: https://www.zdnet.com/article/unremovable-malware-found-preinstalled-on-low-end-smartphone-sold-in-the-us/

Hundreds of millions of cable modems are vulnerable to new Cable Haunt vulnerability

Four Danish researchers have discovered a critical zero-day vulnerability, tracked as CVE-2019-19494 (Cable Haunt attack) in Broadcom's cable modem firmware across multiple vendors. The firmware is vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. The researchers have published proof-of-concept code for the users to test their cable modem and see if it's vulnerable to a Cable Haunt attack. Broadcom has yet to respond to the report issued by the researchers.

See the full report here: https://www.zdnet.com/article/hundreds-of-millions-of-cable-modems-are-vulnerable-to-new-cable-haunt-vulnerability/

Scammers Use Fake Windows 10 Overlay to Trick Victims - TechNadu

In a newly discovered scam, fake full-screen Windows 10 overlay with Chrome browser is being used to trick the victims. The fake image puts the browser in full-screen mode to convince the victim that their screen has been blocked by police and asks them to pay $800 using a credit card as a fine for child porn. Depending on the victim’s location and system language, the local Police logo and the language on the overlay screen changes. Upon entering the credit card details to pay $800, the credit card data will be sent to the scammer. As long as the victim is trapped inside the fake overlay screen, the start menu, closing or launching apps will be disabled and hitting “F11”, or “Alt+Tab”, or “Ctrl+Alt+Delete” can get victims back to their real desktop.

See the full report here: https://www.technadu.com/scammers-use-fake-windows-10-overlay-to-trick-victims/89374/

Card-Stealing Scripts Infect Perricone's European Skin Care Sites - BleepingComputer

Perricone's European skincare sites were infected with card stealing scripts. Two malicious scripts were found on the Perricone website. The first script was injected in November 2018 but due to coding error the card data was not delivered to the attacker's domain and this was because of the second script which detected the competing web skimmer and altered the code so that the host domain could not download the malicious script. The malicious code attempts to connect to a domain that is known for many other security breaches. The malicious code is still present on three Perricone MD's websites. However, it does not affect all customers as it is speculated that the code filters the victims based on the country or on the device used to access the websites.

See the full report here: https://www.bleepingcomputer.com/news/security/card-stealing-scripts-infect-perricones-european-skin-care-sites/

Office 365 users: Beware of phishing emails pointing to Office Sway

Office 365 users are being warned on phishing emails and getting redirected to phishing and malicious pages hosted on Office Sway, a web application for content creation that’s part of Microsoft Office. The phishing mail camouflages as a fax receipt and asks the victim to open the attachment to view it. Victims who fall for the scheme are directed to a landing page hosted on Sway, which instructs them to click on another link that will either download a malicious file or lead them to a spoofed Office 365 login page.

See the full report here: https://www.helpnetsecurity.com/2020/01/10/phishing-office-sway/

Sodinikibi Ransomware Hits New York Airport Systems - BleepingComputer

Albany International Airport's staff announced that the New York airport's administrative servers suffered a ransomware attack. The Sodinokibi Ransomware spread through the Albany County Airport Authority's network via the maintenance server of its managed service provider (MSP) Logical Net and also reached the backup servers. Left without backups, the airport paid the "under six figures" ransom the attackers demanded. According to airport officials, the majority of encrypted files were administrative documents and archived data. Personal and financial details of the customers have not been jeopardized.

See the full report here: https://www.bleepingcomputer.com/news/security/sodinikibi-ransomware-hits-new-york-airport-systems/

US Govt Warns of Attacks on Unpatched Pulse VPN Servers - BleepingComputer

The US Cybersecurity and Infrastructure Security Agency (CISA) has released a warning to organizations to patch their Pulse Secure VPN servers. A vulnerability tracked as CVE-2019-11510 could allow remote unauthenticated attackers to compromise vulnerable VPN servers, gain access to all active users and their plain-text credentials, and execute arbitrary commands. Attackers could leverage this flaw to deliver REvil (Sodinokibi) malware on patched VPN servers. Organizations with unpatched Pulse Secure VPN environments are strongly urged to upgrade to the corresponding fixes.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-warns-of-attacks-on-unpatched-pulse-vpn-servers/

Australia Bushfire Donors Affected by Credit Card Skimming Attack

Attackers have compromised a website collecting donations for the victims of Australia's bushfires and injected Magecart script to collect payment information from donors. These scripts steal credit card details, payment information from the eCommerce website or checkout pages and send the information to a remote site under the attacker's control. The Malwarebytes Threat Intelligence Team has informed the site about the incident but is yet to hear back from them.

See the full report here: https://www.bleepingcomputer.com/news/security/australia-bushfire-donors-affected-by-credit-card-skimming-attack/

Beware of Amazon Prime Support Scams in Google Search Ads

A malicious ad campaign was discovered in Google search results that lead users to fake Amazon support sites and tech support scams. If a user clicks on the ad, they are redirected to a page that attempts to impersonate Amazon and includes a phone number to call to receive help. The phone number is different from the legitimate Amazon support number. Users must be careful while clicking on search results.

See the full report here: https://www.bleepingcomputer.com/news/security/beware-of-amazon-prime-support-scams-in-google-search-ads/

Sodinokibi Ransomware Publishes Stolen Data for the First Time

The authors of Sodinokibi ransomware have published data of one of the victims because a ransom was not paid on time. Links to approximately 337MB of allegedly stolen victim files were published on a Russian hacker and malware forum. The hackers claim that this data belongs to Artech Information Systems, an IT staffing company in the U.S. The company is yet to confirm the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-publishes-stolen-data-for-the-first-time/

TrickBot Adds Custom, Stealthy Backdoor to its Arsenal

The authors behind Trickbot malware have developed a new backdoor, dubbed “PowerTrick” in order to infiltrate high-value targets. According to research from SentinelLabs, PowerTrick is deployed on TrickBot-infected systems to bypass advanced security restrictions and execute commands to carry out tasks to leverage PowerShell utilities. It is also used as a backdoor to deploy payload. Trickbot operators are adapting new ways to use backdoor as a gateway to other backdoors and evade detection.

See the full report here: https://threatpost.com/trickbot-custom-stealthy-backdoor/151663/

Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices - BleepingComputer

Ryuk ransomware is actively exploiting the Wake-on-Lan feature to turn on powered off devices in a compromised system. Wake-on-Lan is a hardware feature that allows administrators to wake up a powered down device by sending a special network packet. On a compromised network, the ransomware performs scan the device’s ARP table to check if the entries are part of the private IP address subnets of "10.", "172.16.", and "192.168.”. After finding these entries, a Wake-on-Lan (WoL) packet to the device's MAC address to have it power up. After a successful WoL request, the ransomware encrypts the remote computer’s drive. The advanced techniques allow the ransomware to affect more machines via a single infection. Administrators are advised to allow Wake-on-Lan packets from administrative devices and workstations only.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/

CISA Releases Test Tool for Citrix ADC CVE-2019-19781 Vulnerability - BleepingComputer

DHS CISA released a public domain tool that enables users and administrators to test whether their Citrix Application Delivery Controller (ADC) and Citrix Gateway software are vulnerable to the CVE-2019-19781 security flaw. Citrix has scheduled to release patches for Citrix ADC and Citrix Gateway on 20th January 2019. The vulnerability provides a gateway for attackers to perform arbitrary code execution via directory traversal if successfully exploited. The exploits are publicly available and are actively used to target vulnerable systems. Administrators are strongly recommended to apply mitigation measures and monitor for further attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-releases-test-tool-for-citrix-adc-cve-2019-19781-vulnerability/

Nemty Ransomware to Start Leaking Non-Paying Victim's Data - BleepingComputer

In the Nemty Ransomware affiliate panel, the ransomware developers have a news feed where they post their plans, bug fixes, and upcoming changes coming to their ransomware-as-a-service. According to a recent 'News' post shared with BleepingComputer, The Nemty Ransomware has plans to create a blog to facilitate the publishing of stolen data of their non-paying victims. This new technique of stealing files from companies and leaking them if the victims do not pay was started by the Maze Ransomware and followed by the Sodinokibi Ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/nemty-ransomware-to-start-leaking-non-paying-victims-data/

Scammers Dupe Texas School District Out of $2.3M

Manor Independent School District has lost $2.3 million after falling victim to an email scam. Reportedly, the phishing scam started in November and continued through December, before it was discovered by the Texas school district. Unfortunately, the school failed to recognize that the bank account information had been changed and they sent three separate transactions over a month before it was recognized that it was a fraudulent bank account. It was in three separate transactions that the school district lost a total of $2.3 million to the frauds.

See the full report here: https://threatpost.com/scammers-dupe-texas-school-district-out-of-2-3m/151773/

Ryuk Ransomware Waking Up Powered-Down Devices to Encrypt Them - Security Intelligence

Some Ryuk ransomware variants now have the ability to "wake up" powered-down devices on a local network to perform additional infections. The ransomware had a module that would scan the ARP table of the infected computer and attempt to perform "wake-on-LAN" commands to machines in the ARP table. This was done via a magic packet sent by the variant, a feature of wake on LAN.

See the full report here: https://securityintelligence.com/news/ryuk-ransomware-waking-up-powered-down-devices-to-encrypt-them/

More than 600 million users installed Android 'fleeceware' apps from the Play Store

Fleeceware, a type of mobile app that deceptively uses trial periods and then charges users, is a new attack vector on mobile stores. Security researchers at Sophos dropped a report that outlined a new set of apps abusing trial mechanisms, and the apps collectively had over 600 million users. The researchers suggest that users check the payment history of their app store accounts to see if they were charged.

See the full report here: https://www.zdnet.com/article/more-than-600-million-users-installed-android-fleeceware-apps-from-the-play-store/

Equifax Settles Class-Action Breach Lawsuit for $380.5M

Equifax may be required to pay out an additional $125 million to victims of the 2017 data breach, after the initial payout of $380.5 million. This is more than the original FTC proposal of $300 million to be paid out to victims. In addition to the settlement payouts, the company will be required to pay at least $1 billion for security improvements, $1.4 billion in litigation expenses, and over $300 million in various fees and fines.

See the full report here: https://threatpost.com/equifax-settles-class-action-lawsuit/151873/

Online Pharmacy PlanetDrugsDirect Discloses Security Breach - BleepingComputer

PlanetDrugsDirect, a Canadian online pharmacy, suffered a data breach that may have exposed its customers' name, address, e-mail address, phone number, medical information including prescriptions, and payment information. Currently, it’s unclear exactly how the customer information was compromised, and just how many PlanetDrugsDirect customers are affected. The company has notified the affected customers via email and urges them to keep a close eye on their bank account and credit card activity.

See the full report here: https://www.bleepingcomputer.com/news/security/online-pharmacy-planetdrugsdirect-discloses-security-breach/

iPhones Can Now Double As a Security Key for Google Accounts - BleepingComputer

Google announced that iPhones running iOS 10 or later can be used as security keys to protect Google accounts against phishing attacks. The security key in iPhone uses Bluetooth to verify sign-ins on Chrome OS, iOS, macOS and Windows 10 devices without the need to pair your devices. This way, Google accounts can be protected against hacking attempts on any device with your iPhone's help, even when sensitive information like your user credentials has been stolen. Google Smart Lock app is to be installed before setting up the iPhone as a Google account security key. Google recommends registering a backup security key to your Google account to use if you lose your iPhone.

See the full report here: https://www.bleepingcomputer.com/news/security/iphones-can-now-double-as-a-security-key-for-google-accounts/

United Nations hit by major phishing attack - TechRadar India

The United Nations suffered a major phishing attack, exposing the login details of hundreds of its workers. It is believed that the criminals used Emotet malware to launch the phishing campaign. Researchers who unfolded the malicious campaign found that the hackers purported to be from the Permanent Mission of Norway. The phishing mail included an attachment that required the 'Enable editing' or 'Enable Content' to view the document, which when activated, executes malicious Word macros that downloads and installs Emotet on the victim's device. Emotet would then run in the background while sending out spam emails to other victims, as well as downloading malicious payloads, such as the dangerous TrickBot trojan, which is linked to the Ryuk ransomware.

See the full report here: https://www.techradar.com/news/united-nations-hit-by-major-phishing-attack

Critical WordPress Bug Leaves 320,000 Sites Open to Attack

Security researchers have discovered a critical vulnerability in two WordPress plugins- InfiniteWP Client and WP Time Capsule. Both plugins are designed to allow users to authenticate to multiple WordPress installations from one central server. However, both plugins contained logical issues in the code which could allow an attacker to log in to an administrative account without the password. InfiniteWP Client plugin below 1.9.4.5 and WP Time Capsule versions below 1.21.16 as vulnerable. WordPress users are urged to update both software versions of the plugins.

See the full report here: https://threatpost.com/wordpress-bug-leaves-sites-open-to-attack/151911/