Security Vulnerability in jQuery

A new security vulnerability--a “prototype pollution” vulnerability--affecting a jQuery frontend library has recently been detected (CVE-2019-11358) that could allow a hacker to assign themselves admin rights on a web app that uses jQuery code for its frontend. Although this vulnerability has been patched, researchers have also published proof-of-concept demonstrating how this vulnerability could be exploited. jQuery is used in 97% of all websites that use at least one JavaScript library.

Recommendations

• Patch to jQuery v3.4.0, which addresses this vulnerability
• Ensure you are using safe recursive merge implementations
• Consider creating objects without a prototype to avoid them being susceptible to prototype pollution attacks
• Avoid using square bracket notation when working with user-controlled data, and at all if possible

Details

This security vulnerability enables attackers to overwrite a JavaScript application object prototype. When that happens, properties that are controlled by the attacker can be injected into objects and then either lead to denial of service by triggering JavaScript exceptions, or tamper with the application source code to force the code path that the attacker injects.

Although proof-of-concept code exists for this vulnerability, each use of the exploit requires fine tuning, inhibiting wide scale use. Prototype pollution flaws require that attackers have in-depth knowledge of how each website works with its object prototypes, and how these prototypes factor in the grand scheme of things.

Data Breach: Morele

Morele.net, one of the first internet shops in Poland, suffered a data breach in October 2018. On April 20, 2019, the data was made available to ZeroFOX Customers via our Credential Compromise capabilities. This breach contains 2.5 million rows of email addresses, names, telephone numbers and passwords hashed as md5crypt. Although the breach occurred back in October 2018, it was publicly disclosed by the Polish security blog Niebezpiecznik on December 18th 2018.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

According to GDPR, a site that stores the Personal Identifiable Information has up to 72 hours to inform the Office of Personal Data Protection and the victims involved, which Morele allegedly did not do. The blog Niebezpiecznik has been chronicling the breach timeline on their website, bringing to attention some of the shortfalls that Morele had with the breach disclosure. One post describes an SMS phishing campaign using data from the breach to attack the victims who were affected. The breach was made public and available to download by RaidForums user ostrich on April 20, 2019.

Data Breach: Club Penguin

Club Penguin Rewritten is a massive multiplayer online game that is a spinoff of the popular Club Penguin game. In April of 2017, it suffered a data breach as confirmed by its Twitter account. The breach contained 1.7 million records of email addresses, IP addresses, bcrypt password hashes and usernames. The company released a blog post about the incident, but had it subsequently deleted.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Details of the breach are scant. The community post made by the team at Club Penguin Rewritten about the breach is now removed. The official account for the service confirmed a vulnerability in the game source code which caused the breach.

Malware Spotlight: Carbanak

The source code for banking malware APT Carbanak was discovered in the archives of VirusTotal. Researchers found the source code was uploaded over two years ago and contains the source code, plugins and builders that the hackers used to create the malware. The malware authors used it to: transfer money to attacker controlled accounts, inflate account balances, control ATMs and disperse money, and transfer money between banks in China and the US. Carbanak has been very successful for the hackers that employed it and the malware enabled the attackers to steal over one billion euros over the past six years.

Recommendations

• Enable the cyber attack chatter rule in the ZeroFOX platform to monitor for information indicating targeting of your enterprise.
• VirusTotal Links to the leaked malware: source code part 1, source code part 2

Details

The source code to a popular banking APT was discovered by security researchers. Carbanak, a full featured piece of malware which targets banking systems, was found by security researchers at VirusTotal. The researchers uncovered archived versions of the code which were uploaded to VirusTotal’s malware engine a couple of years ago. Carbanak has been very successful for the hackers that employed it and the malware enabled the attackers to steal over one billion euros over the past six years.

In order to gain access to the banking systems, targets at the bank were spear phished and encouraged to open the Carbanak malware. The attackers used Carbanak to progressively gain an increased foothold on the banking systems until they gained administrative access. Once administrative access was gained, they used the malware to: transfer money to attacker controlled accounts, inflate account balances, control ATMs and disperse money, and transfer money between banks in China and the US. Carbanak is one of the most successful and dangerous banking APTs.