Security Incident: Dockerhub

On 25 April 2019, Docker discovered unauthorized access to one of their Docker Hub databases. The disclosure they posted noted that the database stored a subset of non-financial user data. The support team discovered approximately 190,000 accounts that may have been exposed in the breach. The number is about 5% of their user base, and in response, they sent an email out to the affected accounts to issue a password reset.

Recommendations

• Reset all passwords for organizational Dockerhub accounts
• Audit for any Dockerhub accounts that your developers use with production services and reset those passwords
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

According to the disclosure, password hashes were exposed in the breach. The disclosure page did not note what type of cryptographic hashing was used on the password fields. All affected users were forced to reset their password and the hashes were invalidated. The company also noted that Github and Bitbucket tokens for Dockerhub autobuilds were compromised, which they subsequently revoked. No official images have been compromised.

Security Incident: Citycomp

On 30 April 2019, Motherboard published an article about a breach at Citycomp, an internet infrastructure provider. A statement from Citycomp said that cybercriminals have "..hacked and blackmailed and the attack is ongoing". The cybercriminals created a website with a Github style directory listing of all of the victims stored in separate folders. Officials from Citycomp have notified affected customers and are working on remediation of the incident.

Recommendations

• In the ZeroFOX platform, enable the Cyber Attack Chatter Rule, and implement a custom rule to monitor for any company-specific leaked technical information
• If you are a Citycomp customer, contact your account managers there for additional information related to the breach
• Reach out to ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

ZeroFOX Alpha Team obtained the website hosting the files, located at https://citycomp[.]de. There is a Github-style directory listing and a README section. The README is as follows:

Who is a Citycomp?
As a multi-vendor service provider, today we maintain over 70,000 servers and storage systems of every type and size in 75 countries. We also support over 500,000 units of clients' hardware (PCs, workstations, printers, cash registers).

Our engineers are specialists in the field of servers and storage. We are also fully skilled in the networks and desktops field. Our engineers spent many years with different manufacturers servicing server and storage system hardware prior to joining CITYCOMP Service GmbH, and received first-class training.

We gradually won our clients' confidence through delivering proven quality and through being client-centred, and they responded by entrusting more and more of their systems to us. Many data-centre operators have appointed us as their strategic partner for safeguarding the operational status of their critical IT systems, and in on-site service situations our engineers deliver IMAC/D/R* and rollout services.

312 570 files in 51 025 folders, over 516 Gb data financial and private information on all clients, include VAG, Ericsson, Leica, MAN, Toshiba, UniCredit, British Telecom and etc..

Downloading of files will be available Apr, 31, 2019


Best regards: imboristheblade@protonmail[.]com

Permanent link: http://snatchvwddns6zto[.]onion (to open via TOR browser)

The email address, imboristheblade@protonmail[.]com, is a known email address associated with the Snatch ransomware. The TOR link also references snatch within the referenced domain. The company mentioned that they were being blackmailed for the information which coincided with previous actions by this actor. At the time of this writing, some of the files are downloadable on the website.

Breach Disclosure: Appartoo

In March 2017, Appartoo, a French flatsharing website, suffered a data breach. The website did not publish anything on their blog or released a statement about the breach. The company notified users in early 2017 about the incident. Approximately 50,000 rows of account data were leaked.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The breach contained the following data:

• Ages
• Authentication tokens
• Email addresses
• Employment statuses
• Genders
• IP addresses
• Martial status
• Names
• SHA-256 hashed passwords
• Physical addresses
• Private messages
• Social media profiles