Threat Intelligence Bulletin: 07/26/2019 - 08/01/2019

Malicious PHP Concealed in JPEGs used in E-Commerce Attacks

A wave of attacks against Latin American e-commerce site has been identified to be utilizing novel obfuscation techniques. Malicious PHP code is embedded within the EXIF header of a JPEG file, and uploaded to a target website. If this website uses PHP to parse the uploaded image, this code will be executed. This has been used successfully by attackers to run droppers of additional malware on these targeted sites.

Recommendations

• Ensure defensive systems are up to date with the latest detection
• Enable multi-factor authentication on accounts whenever possible
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed

Details

Researchers at Trustwave have identified a wave of attacks utilizing an steganographic technique in order to inject malicious PHP code into JPEG EXIF file headers, and upload malware onto otherwise benign websites. If a website offers functionality to upload images, and parses these files using PHP, the function that parses EXIF metadata can be abused in order to parse embedded malicious code. This is extremely common in pre-packaged website tools, providing attackers with a huge number of potential targets.

In this case, a dropper file was hidden in the EXIF metadata of a JPEG file. When executed, a webshell is downloaded from an external host. This allows for a small file size to be maintained for the JPEG file, which is less likely to cause suspicion. This technique was observed to be used in attacks against Latin American e-commerce sites. As card-not-present fraud continues to rise, it is likely that attacks against online shopping sites will remain popular.

Capital One Suffers Major Breach

Major US financial institution Capital One has been compromised by a software engineer specializing in cloud technology. The data breach consists of records of 100 million people from the US and 6 million in Canada, including names, addresses, dates of birth, credit scores and transaction data. Additionally, the breach included around 140,000 American Social Security Numbers, 80,000 linked bank account numbers, and around 1 million Canadian Social Insurance Numbers.

On Monday, July 29, 2019, The Department of Justice disclosed the arrest of of Paige A. Thompson, charged with the download of nearly 30 GB of data from Capital One’s cloud service.

Recommendations

• If not already enabled, turn on the compromised credentials rule and cyber attack chatter for all relevant entities and ensure relevant emails and 'Capital One' related terms are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

According to an article posted by KrebsOnSecurity, Capital One was informed by an email on July 17th about the possibility of leaked information on a public repository on the mentioned platform. This repository belonged to the ex-Amazon employee, Paige A. Thompson. This person used the moniker ”erratic”, where she posted publicly on Twitter very specific ways she would compromise an organization's AWS infrastructure. The account has already been suspended.

This person also used the 'Netcrave Communications' Slack channel, where she made several posts about being in possession of tens of GBs of data belonging to major companies.

The complaint for Violation of Computer Fraud and Abuse was published by the United States District Court for the Western District of Washington at Seattle, detailing that Thompson had accessed a computer containing information belonging to Capital One Financial Corporation from March 12th 2019 to July 17th 2019, without authorization.

Breaking News - 07.26.2019 - 08.01.2019

Prolific Dark Web Drug Seller Arrested

Richard Castro, of Florida, has been arrested and forced to forfeit over 4 million US dollars in cryptocurrenncy after being caught by a US Department of Justice sting operation. The 36-year old man, known as Chemsusa, Chems_usa, and Jagger109, is charged with trading synthetic opioids including carfentanil, fentanyl, and phenyl fentanyl. Castro sold these drugs on markets like DreamMarket and AlphaBay, but was caught after moving his business off the dark web.

See the full report here: https://www.zdnet.com/article/dark-web-drug-kingpin-charged-forced-to-forfeit-4-million-in-bitcoin/

Jessica Alba's Twitter Account Hacked

Jessica Alba's official Twitter account was hacked over the weekend, and used to post a barrage of racist and homophobic messages. Oddly, many of the tweets requested that rapper YNW Melly be released from jail, where he is currently being held during the trial for the murder of two of the rapper's former friends.

See the full report here: https://securityaffairs.co/wordpress/89014/hacking/jessica-alba-hacked-twitter.html

Louisiana Declares State of Emergency After String of Attacks

After a series of public schools fell victim to ransomware attacks, Louisiana declared a state of emergency. These attacks knocked out IT systems, as well as the office phone system, and all data on Monroe school district's servers.

See the full report here: https://threatpost.com/louisiana-gov-declares-emergency-after-cyberattacks-plague-schools/146713/

Android Ransomware is Back

A new family of Android ransomware has been identified, spread via SMS and other forums. This ransomware spreads malicious links by accessing the contact list and sending texts in 42 different languages based on the phone configuration.

See the full report here: https://www.welivesecurity.com/2019/07/29/android-ransomware-back/

$1.7 Million lost in BEC Scam, North Carolina

North Carolina has fallen victim to a BEC scam. Criminals convinced employees that the bank account information of third-party service providers had changed and routed the payments into attacker-controlled accounts via email.

See the full report here: https://www.bleepingcomputer.com/news/security/north-carolina-county-lost-17-million-in-bec-scam/

Wifiphisher: The new way to get anyone’s Wi-Fi password without cracking

Medium posted a new way to access Wi-Fi passwords by jamming networks and creating an evil-clone that will ask for credentials for people already connected disguising as firmware update.

See the full report here: https://medium.com/@NullByteWht/how-to-hack-wi-fi-get-anyones-wi-fi-password-without-cracking-using-wifiphisher-1d0a6c95f67a