Threat Intelligence Bulletin: 02/21/2020 - 02/27/2020

Threat Update: Emergent Capabilities to Bypass Multi Factor Authentication

The development of tactics that undermine multi-factor authentication (MFA)--including MFA implementations that are not SMS based--as a security control is allowing threat actors to access accounts without needing to circumvent each MFA method individually, increasing the risk of account compromise. For greater effectiveness, these tactics are focusing on gaining post-authentication access to those accounts. Some of the methods have advanced session hijacking operations with reverse proxies and ways to easily automate the account compromise cycle. Other methods rely on mobile malware to approve transactions without the user’s knowledge. Both of these capabilities greatly expand upon the limitations of publicized techniques such as SIM swapping, which is not scalable and only defeats SMS-based MFA. While both mobile malware and session hijacking are active and emerging threats, mitigating session hijacking first is likely to result in a larger impact across the threat landscape, primarily due to its likelihood to affect a larger pool of victims and lower point of entry for threat actors.

Recommendations

• Technical short term mitigations include:
  • looking for specific user agent strings in session connection requests; or
  • logging IPs of inbound requests and checking for frequency of use across multiple sessions and the type of infrastructure the IP is associated with.
• Long term mitigations to eliminate this threat include:
  • Implement FIDO certified U2F hardware keys to prevent session hijacking.
  • Provide a downloadable, custom VPN tunnel to connect authorized user devices to the company server.

Details

Threat actors are starting to undermine multi-factor authentication (MFA) as a security control to access accounts and approve transactions rather than trying to circumvent each MFA method individually. The decreasing security of SMS-based authentication is causing users and companies to look for stronger, more robust methods. This, in turn, is driving the next evolution of undermining MFA where hackers and security researchers are finding new methods of bypassing the existing implementation of MFA. Two known approaches to bypassing all MFA including new implementations that are not SMS based are session hijacking and mobile malware.

Session Hijacking

One way threat actors gain post-authentication access is by hijacking a session via a man-in the middle attack. First, threat actors direct users to a phishing page that requests their login credentials. In turn, the phishing page connects with the server of the actual company the users are trying to do business with, forwarding the access request. The company’s server then provides an authenticated session which the threat actor can then steal to gain full access to the users’ accounts. Recently published free open source tools, like Modlishka, Muraena, and Necrobrowser, have advanced this type of attack by creating reverse proxies and ways to automate the whole process. Modlishka, released in January 2019, allows for “real-time phishing” by acting as a reverse proxy; the tool intercepts traffic—including second factor codes from any source—between the user and login pages.

Muraena and NecroBrowser, released in June 2019, work in tandem to automate phishing against MFA. Muraena intercepts traffic between user and target website, and once credentials have been entered, hands off the session data to NecroBrowser, allowing criminals to log in. Combining these tools with readily available and inexpensive phishing techniques means that threat actors of all skill levels are able to carry out these attacks.

We expect an increase in threat actors using session hijacking as more of them become familiar with the free technology and as users and companies move toward complex MFA methods. It is possible that the techniques have already started to gain traction but are not being actively detected due to overall difficulty in identifying the specific techniques.

Malware

Another way threat actors gain access to an account is by compromising a victim’s mobile device with malware. Some types of mobile malware modify a device to allow a hacker to access accounts and approve transactions after the victim logs in. In general these types of malware feature evasion techniques that make them hard to detect, especially if the user does not have antivirus protection--more commonly absent on phones than computers. With mobile banking becoming increasingly prevalent, we expect to see a rise in the development and deployment of malware to capitalize on a wider audience.

Despite the potential increased utility, mobile malware has significant drawbacks. Currently mobile malware requires considerably more technical capabilities and takes longer to develop and deliver than session hijacking. Additionally, the victim pool is generally harder to compromise. Unlike session hijacking which can be deployed against any device, mobile malware must be built for a specific operating system. Even then, users of a targeted operating system are somewhat shielded as malware typically struggles to appear and remain on official app stores, instead preying upon users that download apps from untrusted sources or requiring advanced exploitation that allows for rogue installations.

Mitigations

While both mobile malware and session hijacking present active threats to users and companies, prioritizing session hijacking for mitigation is likely to result in a larger impact across the threat landscape. Proof-of-concept tools that could be used in session hijacking are becoming more common, and motivated attackers could begin utilizing them in MFA bypass efforts. By mitigating session hijacking, organizations can block these potential intrusions before it becomes a common tactic. On the contrary, by first addressing mobile malware, those threat actors--who represent a smaller but more technically capable group--would easily be able to pivot and adopt easier to implement options. Additionally, existing technology supports the prevention of session hijacking, allowing for more rapid implementation.

User-based Controls

One method to prevent session hijacking is to implement FIDO certified U2F hardware keys. This method is effective because its authentication uses an origin-specific key pair that is registered with a particular website. In the situation where a user inputs their credentials into a threat actor’s proxy, the key would not provide the correct key pair since the proxy website requesting the information is different than the target website, even if the user does not notice. An alternative to this is the FIDO 2 standard which operates in a similar way but allows the authentication method to be digitally stored on a device instead of needing a second physical object that a user would be required to carry with them.

Just as cybercriminals are seeking to bypass MFA altogether to compromise accounts, companies can also take measures to bypass phishing altogether to prevent session hijacking. A company could provide users with a downloadable custom VPN tunnel that connects a user’s device to the company’s server. By conditioning users to only use this pre-established means of communication, phishing emails that prompt users to enter their credentials on fake login pages would lose viability. This concept is derived from the popular anti-phishing recommendation that users bookmark login pages to use as pre-established lines of communication to access their accounts. The added benefit here to merely bookmarking a page is that the communication is VPN-protected and therefore would prevent against attacks that are able to intercept traffic coming from a user’s device. This also allows a company to encourage or require the usage of these secure tunnels for a client to do business with them, further increasing effectiveness.

Either of these solutions provide enhanced defenses against MFA bypass attacks but no singular protection measure is foolproof. Layering defenses allows the weakness of one layer to be mitigated by the strengths of another. Pre-established means to communicate only work if the user is not encouraged to connect via compromised methods, whether through social engineering or convenience. While FIDO-certified keys are currently a best practice, flaws or bypasses to them will likely be found eventually. Combining the two, however, and requiring an origin-specific key pair in addition to a VPN would greatly reduce the likelihood a threat actor could compromise both the secure connection and the MFA method to gain access to a session and transfer funds. However, without significant development costs to make this a seamless user experience, the additional friction of this layered technique may increase customer dissatisfaction in the short term.

Network-based Controls

It is also possible to detect and mitigate reverse proxy activity through analysis of a company’s web server logs and subsequent blacklisting. It is likely that requests from a proxy to initially authenticate a session--as well as further attempts to use a session post-authentication--emanate from the same or a limited number of IP addresses. Since this IP information would be logged in connection to multiple victims from likely various geographic locations, configurations could be made to detect the anomalous behavior and corroborate it against IP reputation checks. Those IP addresses can then be blacklisted from the company's server as appropriate.

For the Muranea and NecroBrowser tool set, there are two unique interactions that potentially allow for detection of those tools when used against a company. In Muranea’s configuration files for its proxy, we observed that it has a set of file type exclusions that mainly relate to images, including .ICO files. Since a typical visit by a legitimate user to a website will include a request for the website’s favicon, an .ICO file, the exclusion of this request is an indicator of potential proxy behavior and is detectable in web server logs. Within Necrobrowser’s code, we observed that it includes a unique default useragent string. While default values like this enhance usability for less technical threat actors, they are also indicators that can be blacklisted.

IOCs

Necrobrowser default useragent string Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Zombie/73.0.3683.86 Safari/537.36

Muraena proxy configuration omitted file types "ttf", "otf", "woff", "woff2", "eot", "ase", "art", "bmp", "blp", "cd5", "cit", "cpt", "cr2", "cut", "dds", "dib", "djvu", "egt", "exif", "gif", "gpl", "grf", "icns", "ico", "iff", "jng", "jpeg", "jpg", "jfif", "jp2", "jps", "lbm", "max", "miff", "mng", "msp", "nitf", "ota", "pbm", "pc1", "pc2", "pc3", "pcf", "pcx", "pdn", "pgm", "PI1", "PI2", "PI3", "pict", "pct", "pnm", "pns", "ppm", "psb", "psd", "pdd", "psp", "px", "pxm", "pxr", "qfx", "raw", "rle", "sct", "sgi", "rgb", "int", "bw", "tga", "tiff", "tif", "vtf", "xbm", "xcf", "xpm", "3dv", "amf", "ai", "awg", "cgm", "cdr", "cmx", "dxf", "e2d", "egt", "eps", "fs", "gbr", "odg", "svg", "stl", "vrml", "x3d", "sxd", "v2d", "vnd", "wmf", "emf", "art", "xar", "png", "webp", "jxr", "hdp", "wdp", "cur", "ecw", "iff", "lbm", "liff", "nrrd", "pam", "pcx", "pgf", "sgi", "rgb", "rgba", "bw", "int", "inta", "sid", "ras", "sun", "tga"

Strategic Threat Intelligence Bulletin: Strike on Soleimani - Why Iran's Hands are Tied

Despite the gravity of the targeted strike against the iconic Qassem Soleimani, Iran is hamstrung in its ability to respond more significantly to the United States because of feared retaliation and escalation. Iran cannot afford an escalatory cycle of events with the US, especially one that it would be perceived as losing, making any devastating response to the United States a highly risky proposition that could start an unwinnable cycle of violence. For this reason, many options seemingly on the table, including a devastating cyber blow, are not actually suitable for Iran. The most likely response by Iran in the coming months—should it even decide to further respond at all—is a limited but targeted attack against U.S. assets in the region, probably either against the Baghdad embassy or naval assets in the Persian Gulf.

Recommendations

Companies that operate or have locations in the Middle East should monitor for any potential change in tensions between Iran and the United States. Identify any physical assets or entities that may be collocated with the U.S. government or that may have overt U.S. government connections—such as government contractors—and conduct an audit of your physical security protections for those assets. Develop robust incident response and contingency plans for interruptions of high-risk locations.

The low likelihood of an Iranian cyber attack against private companies does not negate the benefits of preparing for intrusions. Companies can help mitigate potential Iranian intrusions by following many best practices:

• Beware of phishing and social engineering schemes that have allowed for initial access in past Iranian intrusions.
• Iranian APTs have reportedly been targeting vulnerabilities in VPN services as of late and have been reported in the past using other exploits for initial access. Ensure your VPN capabilities and other externally facing services—such as RDP—in particular are patched, and disable unnecessary ports, protocols, and services where possible.
• To mitigate lateral movement, require complex passwords and multi-factor authentication wherever possible.
• Iranian actors have conducted DDoS attacks against private companies in the past, so ensure your protections for these types of attacks are up-to-date.
• Iranian actors have been attributed to wiper attacks in the past; although this type of attack is unlikely as retribution, maintaining off-site backups for your most critical data will help mitigate this threat.

Details

The Logic of the Missile Strikes

The United States’ strike against Qassem Soleimani—a military commander, leader, and hero like no other in Iran—was a significant blow to Iran’s military and the country as a whole. Head of the Islamic Revolutionary Guard Corps’ Quds Force, he was the mastermind for decades behind Iran’s overseas operations that gave the country substantial influence in the region. The U.S. strike was highly targeted, bombastic, and an affront to this influence in the region, especially in Iraq. For both domestic and international reasons Iran was forced to respond to this in short order.

Iraq’s Shia majority government is currently heavily influenced by Iran, and Iran’s ability to leverage irregular forces into control in the region is perhaps best exemplified by its role in Iraq. The magnitude of the U.S. strike in a country where Iran has significant influence required a demonstration of force to reassure allies and warn enemies that Iran would not give up its freedom of movement in the region.

By responding in kind, Iran mitigated the chances for further escalation. Iran was clearly keen to avoid further escalation beyond their missile attack: Tehran reportedly passed warnings about the missile strikes through other countries, giving the US enough time to move personnel to fortified bunkers, and Iranian officials also claimed the attack was “proportionate” and in “self-defense” under the UN Charter. Choosing the missile attack as its immediate reaction to the Soleimani strike afforded Iran a relatively measured and controlled response, enough to send a message but, as evidenced, not so much to prompt escalation. In contrast, switching the response from the same physical location and similar type of munition to, for example, the cyber domain and out of theater would have likely been viewed as escalatory by the United States, possibly prompting U.S. retaliation directly against assets in Iran.

Iran’s Current Calculations

The missile strikes against bases in Iraq solved the immediate need to show force, but especially because the impact was limited (in part perhaps because of warnings), Iran probably feels it needs to take further action. Iran has to prove to regional adversaries as well as its domestic audience—both the general populace and fundamentalist factions—that it will not allow other states to take such grievous action without retribution. A weak response might be seen by regional powers as a sign that Iran is distracted or unable to maintain its regional power status. A firm, calculated show of force could bolster nationalist pride and divert attention in the midst of some of the worst protests in the last decade, which were exacerbated by the Iranian regime’s admission of guilt in shooting down the Ukrainian airliner on January 8.

At the same time, Tehran wants to avoid any further escalation that could spin into a conflict it is not prepared for or capable of winning. Iran is already involved in some manner in conflicts in Iraq, Syria, Lebanon, and Yemen. Furthermore, despite Iran’s large conventional military, the United States’ superior air power, precision strike capability, and advanced technology would likely result in a significantly lopsided conflict favoring U.S. forces. A full-scale conflict between the United States and Iran might also draw in regional powers allied against Iran such as Saudi Arabia. By contrast Iran’s allies in the region are limited to proxy groups and a war-damaged Syria, and other global powers like Russia and China would probably provide only non-lethal aid and possibly limited lethal aid.

Iran’s concerns about U.S. retaliation are substantiated by over a decade of extrajudicial killings under the U.S. drone program and statements by current Administration officials. U.S. Secretary of Defense Mark Esper stated after the Iranian missile strike that the United States had the authority to strike against both Iran and its proxies in retaliation for any subsequent attacks. U.S. special representative for Iran Brian Hook stated that Soleimani’s successor, Esmail Ghaani, would “suffer the same fate” as Soleimani if he targeted Americans.

What are Iran’s Options?

On paper, Iran has a wide range of options to further harm the United States, including the oft-mentioned cyber attack. In practice, Iran will most likely need to meet certain criteria in order to judge a response to the United States as successful, limiting the options available. Those criteria do not simply include revenge for the targeted strike, but also posturing and the possibility of American retaliation and escalation, which is a significant constraint on any of Iran’s actions. Assuming Iran decides it needs to take further action, the only two options that meet all of these criteria are kinetic action or a cyber attack, and between those two, kinetic action is much more likely, because for a cyber attack to meet the criteria, it would likely be seen as a significant escalation and thus invite U.S. reprisals in Iran itself.

The criteria that Iran will likely consider in determining how to further respond to the United States include:

• Revenge
  • The action should make it clear it is retaliation for the strike on Soleimani.
    • It must be attributed to the Iranian state or Iranian-affiliated forces (as opposed to unaffiliated sympathizers or unknown actors).
  • It should be within a 3-month window to avoid confusion about whether it is retaliation or serves some other strategic purposes.
• Posturing
  • The action should send the message to sympathetic domestic and regional audiences, as well as regional adversaries, that Iran will not tolerate such actions without a response.
  • The action should be arguably proportionate to allow Iran to justify its response to the international community, for example under the U.N. Charter’s Article 51 (self-defense).
  • The action must beget the right type of attention on the event to have the most impact possible under the conditions. It should be visible and striking enough as to guarantee wide media coverage.
• The risk of U.S. reprisal
  • Any action should be no more than and most likely would be less than proportionate to avoid a subsequent U.S. reprisal.
  • It should be targeted to avoid a significant increase in the number of casualties.
  • It should focus on U.S. military influence in the region.

A kinetic strike on U.S. assets in the region meets many of the objectives. Whether by proxy groups or Iranian forces, a direct attack would send a clear message of retaliation, because even if conducted by a proxy group, the United States would consider such attacks the responsibility of Iran. Using proxy groups also may lessen the risk of retaliation by offsetting the attribution, though with Soleimani now deceased, control over Iranian-aligned proxy groups may be more difficult. Direct attacks would also probably be the easiest to accomplish in a short timeline given Iran’s foothold in the region, and there are a variety of physical targets given the United States’ presence.

The risk of U.S. reprisal significantly constrains Iran’s ability to respond via cyber means. An offensive attack risks retaliation because it changes the domain of the military action, opening up the possibility for the United States to respond via other offensive methods. It also might be difficult to achieve in a short- to mid-term time frame. American assets in the region are likely to be heavily guarded from a cyber perspective, while softer targets inside the United States might be easier to target but would be more likely to prompt escalation and retaliation because it expands the operational area outside the Middle East. Too, a cyber offensive that is measured enough to avoid retaliation risks ambiguity and an underwhelming effect; however, a larger attack that is more clearly attributed risks retaliation. There is a fine line that Iran would need to walk to achieve the right retaliation via cyber methods, and it may be difficult for Iran to accurately judge likely responses to a cyber attack.

Iran would most likely choose to respond via a cyber attack as a secondary option to kinetic action. Choosing cyber would most likely be the result of unpredictable internal factors, such as disputes and challenges among top government or military officials that affect decision-making or kinetic capabilities.

Other theoretical options—such as missile testing and conventional weapons development, nuclear advancements, or a disinformation campaign—do not clearly demonstrate revenge against the United States. Since the U.S. strike, Iran has already revealed a new ballistic missile and attempted to launch a satellite. Yet even though the United States has objected to Iran’s missile development and space launches, there was no media coverage or U.S. government statement connecting these most recent activities to any retaliation. However, Iran might consider missile testing and these other capabilities to help with the goal of posturing while also accomplishing longer-term strategic goals.

The Likeliest Option

Iran must choose an option where it can carefully control the risk for retaliation, otherwise it risks getting into an uncontrollable escalation cycle at a time when it is encumbered with significant domestic challenges and other regional conflicts. A follow-up kinetic attack by Iranian forces or proxy groups against US forces in the region is the option that would best achieve Iran’s objectives as outlined. Such an attack could be carefully moderated to avoid retaliation while emphasizing the message that Iran maintains control in the region.

One of the most high-profile targets in the region include the U.S. embassy in Baghdad, which has already been attacked by Iranian-affiliated proxy groups and would send an unmistakable message to the United States, who has had an embassy attacked by Iran once before. Another potential target in the region is the U.S. Fifth Fleet headquartered in Bahrain, another country with Iranian-affiliated proxy groups. Targeting U.S. naval vessels in the Persian Gulf with, for example, limpet mines would be a feasible option and one that Iran has reportedly used before.

In the unlikely event Iran did decide to respond with a cyber attack, it would likely be a relatively showy but low-impact cyber attack, probably against a softer, government-related target inside the United States. Such an attack would be focused first on government and then on peripheral industries, such as defense contracting or think tanks. Only after exploring those targets would Iran likely consider other U.S. companies with less clear connections to the government.

Threat Update: Dopple Leaks Shaming Website

Based on the popularity of Maze Ransomware's name and shame technique of calling out victims that hadn't paid their ransom and releasing their content, a new site has appeared mirroring this tactic. DoppelPaymer, an offshoot of BitPaymer, has set up a Dopple Leaks site which is naming companies that haven't paid their ransom, and uploading the data that was stolen from these companies to the public.

Details

This new technique used by Ransomware authors has been growing in popularity lately due to the success that Maze has had, and will most likely continue to grow in an effort for attackers to get more money from their victims. Companies have two choices when hit with a ransomware attack, pay the ransom and hope the attackers keep their word and provide a valid decryption key, and that they don't still leak your data, or they can not pay the ransom and hope for the best. Ransomware authors started using this technique in order to show they mean business and will most certainly leak your data if you don't pay the ransom.

By proving they will upload your data, it's somewhat of a reassurance to victims that if they do indeed pay the ransom, their data will not get exposed and they'll be "fine" (remediation and cleanup of this attack will involve a lot of work, but they won't have all their data exposed for everyone to see). This is not guaranteed though, which is why it's so hard for victims to make the decision to pay or not. Lastly, it also makes sense for the ransomware creators to keep their word, since if a company paid the ransom and the attackers still released their data, it may persuade other victims to not pay since they'll still release the data. This incentivizes the attackers to keep their word to ensure they keep getting money from victims.

This new site has been around only for a week, with the first victim, Sekure Merchants, posted on 02-21-2020, with three more victims posted over the next three days, including Bidvest Panalpina Logistics, Bretagne Telecom, and Pemex.

Figure 1. Dopple Leaks site showing victim data

On 02-26-2020, a Twitter account potentially associated with DoppelPaymer @DoppelPaymer, tweeted that there are much larger breaches coming soon, including Tesla, SpaceX, and Boeing.

Figure 2. Tweet from DoppelPaymer announcing potential new breaches

Conclusion

There is a lot to consider when hit with a ransomware attack and sites like this don't make the decision any easier, however, it's something new for your executive team to consider when making the decision to pay the ransom or not. This type of extortion can at least identify the worst-case scenario in your response process, since you know with a certain degree that if you don't pay, all your data would potentially become public, which is often the worst fear of any company. Even if you have a robust backup process in place and can restore all of your data with no issue, the risk is still there that the data will be leaked, and with the popularity of these sites, it's bound to get some publicity and could be harmful to victims.

Breach Disclosure: Slickwraps

On February 21st, Slickwraps experienced a data breach due to a database containing customer data being exploited and accessed by an unauthorized party. The information contained names, emails, and addresses for around 858,000 users, however, no passwords or financial data were contained in the breach.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The database contained 858,000 unique email addresses, and also included names, addresses, phone numbers and purchase history for users. Slickwraps stated that if users checked out as guests, this information would not have been available.

A user by the name of Lynx0x00 posted on Medium about how he hacked Slickwraps on February 21st. The user explains how they saw Slickwraps engaging in deceptive advertising and how they were possibly involved in "unscrupulous business activities". The attacker was able to achieve remote-code execution through a phone customization section on their website, which allowed the attacker to upload a .htaccess file enabling access to resumes of current and past Slickwrap employees as well as 9GB of personal customer photos used for phone skins.

From there, the attacker obtained credentials for a 17GB MySQL database which included:

• All SlickWraps admin account details, including password hashes
• All current and historical SlickWraps customer billing addresses
• All current and historical SlickWraps customer shipping addresses
• All current and historical SlickWraps customer email addresses
• All current and historical SlickWraps customer phone numbers
• All current and historical SlickWraps customer transaction history
• Current SlickWraps API credentials for MadMimi
• Current SlickWraps API credentials for PayPal Payments Pro
• Current SlickWraps API credentials for Braintree
• Current SlickWraps API credentials for ShipHero
• Current SlickWraps API credentials for Zendesk
• Current SlickWraps API credentials for Facebook
• Current SlickWraps API credentials for Twitter
• Current SlickWraps API credentials for Instagram

The attacker then was able to access their Slack team as well as account balances and transaction logs for their payment gateways. Lastly, the attacker gained access to their Content Management System (CMS) and "...could have deleted their entire company".

The attacker attempted several times to make contact with Slickwraps, however, these messages were ignored and resulted in the attacker going public with the data. The attacker claimed that Slickwraps reset passwords, attempted to remove the remote shells they created, changed API keys, and reinstalled their Magento eCommerce platform.

Throughout the entire process, the attacker repeated attempts to make contact with Slickwraps, however all their requests were ignored or met with limited answers, which resulted in the attacker disclosing all this information and contacting HaveIBeenPwned to provide the breached data.

Breach Disclosure: Straffic

The Israeli marketing firm Straffic experienced a data breach resulting in the exposure of 140GB of data from an exposed Elasticsearch database. The database contained 305 million rows of data, with 49 million unique email addresses, which also included names, addresses, phone numbers and genders of impacted individuals.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Straffic.io markets itself as a private performance marketing network, and was founded in June of 2017. Typically breached Elasticsearch databases like this are exposed publicly and have either no authentication or weak passwords in place. However, in this case, credentials for Straffic's Elasticsearch database were found on a domain by a DevOps engineer. The engineer discovered the credentials through a domain that had been included in spam SMS messages to him for some time, and ultimately found the file containing credentials for the Elasticsearch instance, allowing him to gain access to the database.

Breaking News: 2020-02-21 - 2020-02-27

DOD DISA discloses data breach

The Defense Information Systems Agency (DISA), a Department of Defense (DOD) agency has disclosed a data breach. The breach occurred between May and July 2019, where attackers could have compromised DISA systems. Employees' personal information, including social security numbers, was exposed during the breach. However, there is no evidence to suggest that the exposed data was misused. DISA, the agency that provides secure telecommunications and IT support for the White House, US diplomats, and military troops, is offering free credit monitoring to all impacted.

See the full report here: https://www.zdnet.com/article/dod-disa-discloses-data-breach/

Croatia's largest petrol station chain impacted by cyber-attack

INA Group, Croatia's biggest oil company, suffered a cyberattack affecting its business operations. According to the sources, the company was hit by Clop ransomware, that encrypted some of the company’s backend servers. The attack took place on 14 February 2020, impacting the company’s ability to issue invoices, register loyalty card use, issue new mobile vouchers, issue new electronic vignettes, and allow customers to pay gas utility bills. Petrol fuel supply and transactions were not affected. Currently, the company is working on restoring all systems.

See the full report here: https://www.zdnet.com/article/croatias-largest-petrol-station-chain-impacted-by-cyber-attack/

Haken Malware Family Infests Google Play Store

Check Point researchers have found eight malicious Android apps on Google Play that distribute the Haken malware family, that mimics the user and clicks on anything that appears on the device’s screen. The Haken malware exfiltrates sensitive data from victims and secretly signs them up for expensive premium subscription services. The apps were mostly camera utilities and children’s games, including “Kids Coloring,” “Compass,” “qrcode,” “Fruits coloring book,” “soccer coloring book,” “fruit jump tower,” “ball number shooter” and “Inongdan.” Google has removed these malicious apps from its app store.

See the full report here: https://threatpost.com/haken-malware-family-infests-google-play-store/153091/

Google removes 600 Android apps in Play Store adware crackdown

Google has removed nearly 600 apps from the Play Store and banned abusive Android developers who break app store rules by showing out-of-app ads. Out-of-app ads originate from one app but appear on top of other apps. To ensure the Play Store and Android ad ecosystem remains a healthy one, Google said it plans to continue cracking down on out-of-app ads, to publish better tools for app makers to help them become compliant with ad industry standards and, to change how the Android OS itself works to cope with this new wave of out-of-app ads.

See the full report here: https://www.zdnet.com/article/google-removes-600-android-apps-in-play-store-adware-crackdown/

ISS World Hit with Malware Attack that Shuts Down Global Computer Network - Mash Viral

ISS World cut off access to shared IT services across its customer sites and offices worldwide after it was the target of a malware attack on 17 February 2020. According to reports, the attackers used ransomware, noting the immediate cut off of online services as a typical indicator of a cyber extortion scheme. The company has identified the root cause of the attack and is currently working on restoring its systems. However, the attack left the 43,000 employees of the company without access to email or other online services, according to reports.

See the full report here: https://mashviral.com/iss-world-hit-with-malware-attack-that-shuts-down-global-computer-network/

Slickwraps Data Breach Exposes Financial and Customer Info - BleepingComputer

Slickwraps, a mobile device case retailer that sells custom cases has suffered a data breach, exposing financial and customer information. An independent security researcher claims to have gained full access to the Slickwraps web site, using a path traversal vulnerability in an upload script used for case customizations. Further, the resumes of employees, 9GB of personal customer photos, ZenDesk ticketing system, API credentials, and personal customer information such as hashed passwords, addresses, email addresses, phone numbers, and transactions could also be accessed.

See the full report here: https://www.bleepingcomputer.com/news/security/slickwraps-data-breach-exposes-financial-and-customer-info/

Windows 10 Gets Temp Patch for Critical Flaw Fixed In Buggy Update - BleepingComputer

A temporary third-party fix is available for remote code execution vulnerability in Internet Explorer 9/10/11. Tracked as CVE-2020-0674, the vulnerability can be leveraged by attackers to silently execute arbitrary commands on an unpatched system when the user visits a specially crafted website. Although the KB4532693 update was released this month to address this issue, it created more problems by preventing users from restoring the original profile. The 0Patch platform has released a micropatch - bite-size code that corrects security problems in real-time and takes effect without rebooting the machine.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-10-gets-temp-patch-for-critical-flaw-fixed-in-buggy-update/

MGM Sued Over Its Massive Data Breach - The Motley Fool

MGM has publicly acknowledged the 2019 breach, in which hackers allegedly stole the data of more than 10 million of its guests, this week. While the company claims that the leaked records didn't include sensitive credit card information, tech website ZDNet reported that on February 20, the cyber-thieves posted full names, addresses, birthdates, phone numbers, and emails of 10.68 million former guests, including those of numerous celebrities, to a hacker forum. According to Reuters, the law firm Morgan & Morgan has filed a lawsuit against MGM over the data breach.

See the full report here: https://www.fool.com/investing/2020/02/22/mgm-sued-over-its-massive-data-breach.aspx

Android Malware: Joker Still Fools Google's Defense, New Clicker Found - BleepingComputer

New samples of Joker malware are found in the official Android repository that is specifically created to avoid Google's detection mechanisms. Named as Bread, it is a spyware and premium dialer that can access notifications, read and send SMS texts. These capabilities are used to invisibly subscribe victims to premium services. The malware was hidden in the camera, wallpaper, SMS, and photo editing software. An XOR encryption is used to conceal the malicious function. Once installed, the infected application communicates with the C&C server to execute another payload that listens to incoming SMS, extract the premium service confirmation code (2FA) to avail the premium service. The malware does not target devices from the U.S. and Canada, a function that reads the operator information specifically to filter out these regions. Joker’s authors are adapting new cloaking and obfuscation techniques to remain undetected.

See the full report here: https://www.bleepingcomputer.com/news/security/android-malware-joker-still-fools-googles-defense-new-clicker-found/

Privacy Concerns Raised Over New Google Chrome Feature - BleepingComputer

Google Chrome has released the latest version, Chrome 80 with a new feature called 'Scroll To Text Fragment'. The new web feature allows users to create links to a specific word on a web page and automatically highlight it. According to a Brave browser researcher, this feature poses a potential risk and can lead to data leak. The feature could allow an attacker under certain conditions to determine if the particular text appears on a page or determine if a person is friends with or follows someone on social networks like Facebook and Twitter. Furthermore, this feature is enabled by default for all sites that automatically imposes a potential privacy risk on all sites.

See the full report here: https://www.bleepingcomputer.com/news/security/privacy-concerns-raised-over-new-google-chrome-feature/

ISS reveals malware attack impacted parts of the IT environment

ISS World, the multinational Denmark-based facility services company, was hit with malware on 17 February 2020. In response to the incident, the firm disabled access to shared IT services worldwide. The website was restored on Friday. ISS is performing a forensic investigation and is yet to confirm the source of the attack. Experts believe that the incident response procedure implemented by the company detected a ransomware infection that was mitigated with the shut down of online services.

See the full report here: https://securityaffairs.co/wordpress/98321/malware/iss-reveals-malware-attack.html

Google sued by New Mexico attorney general for collecting student data through its Education Platform

Google is facing a new lawsuit for allegedly using the Google for Education platform to gather personal and private data from students with an age of less than 13 years. The lawsuit was filed by AG of New Mexico for allegedly “spying” on children who use the company's educational apps. The company offers free Chromebooks to schools and access to the G-Suite for Education service as part of the Google for Education platform. Google has dismissed the lawsuit saying it’s “factually wrong” and claimed that the school has complete control over the privacy of the students. The company also pointed out that children’s personal information is not used for advertising purposes.

See the full report here: https://securityaffairs.co/wordpress/98304/digital-id/google-collecting-student-data.html

WhatsApp, Telegram Group Invite Links Leaked in Public Searches - BleepingComputer

Private invite links for WhatsApp and Telegram groups are available through special search parameters on popular web search engines. According to security researchers, the lapse in security allowed the discovery of group links including illegal porn, far-right, and anti-government movements. By simple browsing, Jane Wong, a mobile app reverse engineer was able to find search results of 470,000 links for WhatsApp, allowing anyone to join the groups and access to members' phone numbers. Channel admins are advised to manage the group visibility appropriately to mitigate risks.

See the full report here: https://www.bleepingcomputer.com/news/security/whatsapp-telegram-group-invite-links-leaked-in-public-searches/

New Mozart Malware Gets Commands, Hides Traffic Using DNS - BleepingComputer

A new backdoor malware called Mozart is using the DNS protocol to receive instructions from the attackers and evade detection. Apart from being a name resolution protocol, the DNS protocol also allows you to query TXT records that contain text data. This feature is used for domain ownership verification for online services and email security policies such as Sender Policy Framework or DMARC. Attackers can leverage DNS TXT records to store instructions that are later retrieved by the malware to execute commands on the infected computer. The malware is believed to be distributed via phishing emails that contain malicious PDF attachments embedded with a link that redirects to a JScript file which when executed extracts a base64 encoded executable. Upon execution, the malware communicates with the hardcoded DNS to fetch instructions and execute it on the targeted system. Users are recommended to install security software and intrusion systems that monitor DNS TXT queries.

See the full report here: https://www.bleepingcomputer.com/news/security/new-mozart-malware-gets-commands-hides-traffic-using-dns/

Zyxel Fixes 0day in Network Storage Devices

An actively exploitable zero-day critical vulnerability (CVE-2020-9054) impacting Zyxel's network-attached storage (NAS) devices receives an update to fix the flaw. According to security researchers, the vulnerability could allow an attacker to remotely compromise more than a dozen types of Zyxel NAS products without any help from the users. Zyxel urges users to avoid direct product exposure to the internet and connect it to a security router or firewall for additional protection.

See the full report here: https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/

Racoon Malware Steals Your Data From Nearly 60 Apps - BleepingComputer

A new malware called Racoon is found to extract sensitive data from around 60 applications on a targeted computer. First found in April 2019, the malware is distributed via exploit kits, phishing, and potentially unwanted applications. The malware allows attackers to access an administration panel that lets them customize the malware, access stolen data, and download the builds of the malware. The malware extracts information from applications such as Google Chrome, Mozilla Firefox, Microsoft Edge, Internet Explorer, Opera, Vivaldi, Waterfox, SeaMonkey, UC Browser, Electrum, Ethereum, Exodus, Jaxx, Monero, Outlook, Thunderbird, and Foxmail. Additionally, the malware collects system details, snap pictures of the infected systems' screens and, acts as a dropper for other malicious files.

See the full report here: https://www.bleepingcomputer.com/news/security/racoon-malware-steals-your-data-from-nearly-60-apps/

New Critical RCE Bug in OpenBSD SMTP Server Threatens Linux Distros - BleepingComputer

Security researchers have discovered a critical-severity bug in the OpenSMTPD email server. Dubbed CVE-2020-8794, the remote code execution bug is present in OpenSMTPD's default installation. If exploited, this vulnerability could allow attackers to remotely run shell commands as root on the underlying operating system. Users are urged to apply the latest security patches as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/new-critical-rce-bug-in-openbsd-smtp-server-threatens-linux-distros/

Google Patches Chrome Browser Zero-Day Bug, Under Attack

Google has patched a zero-day bug in Chrome, running on the Windows, macOS and Linux platforms. The vulnerability tracked as CVE-2020-6418 is being actively exploited to produce a type-confusion issue in Chrome’s open-source JavaScript and Web Assembly engine, called V8. Users are recommended to install the patch on their browsers to avoid risks.

See the full report here: https://threatpost.com/google-patches-chrome-browser-zero-day-bug-under-attack/153216/

Firefox enables DNS-over-HTTPS by default (with Cloudflare) for all U.S. users

The DNS-over-HTTPS security feature in Mozilla is now a default setting for all Firefox users in the U.S. This feature allows Firefox to send all DNS queries to the Cloudflare DNS servers instead of the default DNS servers set by the operating system, router, or network provider. DNS-over-HTTPS (DoH) is a protocol that finds the server IP address of a certain domain name over an encrypted connection to a DNS server rather than sending queries in the plaintext. This feature makes it difficult for hackers to conduct man-in-the-middle attacks, manipulate DNS queries and eavesdrop on the Internet connection. This also helps to hide browsing history from attackers on the network and prevent data collection by third parties.

See the full report here: https://thehackernews.com/2020/02/firefox-dns-over-https.html

PayPal Users Hit With Fraudulent 'Target' Charges via Google Pay - BleepingComputer

Hackers are making fraudulent charges on PayPal accounts linked via GooglePay. PayPal users from Germany have reported that they were charged with fraudulent transactions ranging from €1,73 to over €1800 through Target stores or Starbucks in the United States. According to a security researcher, PayPal's contactless payments via Google Pay could have led to fraud. PayPal has fixed the issue and is establishing a process for refunding customers. However, no insights were provided as to how the attackers were able to make fraudulent charges.

See the full report here: https://www.bleepingcomputer.com/news/security/paypal-users-hit-with-fraudulent-target-charges-via-google-pay/

Kr00k Bug in Broadcom, Cypress WiFi Chips Leaks Sensitive Info - BleepingComputer

A vulnerability, CVE-2019-15126, residing in some popular WiFi chips present in client devices, routers, and access points, could allow attackers to partially decrypt user communication and expose data in wireless network packets. Dubbed as Kr00k, the flaw was identified in components from Broadcom and Cypress, which are integrated into mobile phones, tablets, laptops, IoT gadgets, impacting over one billion devices. Products with WiFi chips from Qualcomm, Realtek, Ralink, and Mediatek are not impacted. Broadcom and Cypress have issued a firmware fix to vendors and the update should be available for devices that are still in support and users should install it where it is not applied automatically.

See the full report here: https://www.bleepingcomputer.com/news/security/kr00k-bug-in-broadcom-cypress-wifi-chips-leaks-sensitive-info/

Samsung says Find my Mobile glitch not connected to recent data leak

Samsung has admitted that personal data of a few customers may have been leaked in a data breach last week. The company also confirmed that the strange ‘1’ notification in the Find My Mobile app and data leak were two unrelated incidents and that “a technical error isolated to its UK website” led to some customers finding others’ details in their accounts. Customers were able to see information such as names, telephone numbers, email addresses, physical addresses, and order histories belonging to others without authorization.

See the full report here: https://www.zdnet.com/article/samsung-says-find-my-mobile-glitch-not-connected-to-recent-data-leak/

Australian banks targeted by DDoS extortionists

A new extortion scam is targeting Banks and other organizations from the Australian financial sector and threatening them to carry out distributed denial of service (DDoS) attacks unless the organizations pay ransom fees in the Monero (XMR) cryptocurrency. According to the Australian Signals Directorate's Australian Cyber Security Centre (ACSC), no DDoS attacks have been observed. However, ASCS has issued security threat advice, recommending organizations to be prepared to operate effectively despite the threats and any potential DoS.

See the full report here: https://www.zdnet.com/article/australian-banks-targeted-by-ddos-extortionists/

DoppelPaymer Hacked Bretagne Télécom Using the Citrix ADC Flaw - BleepingComputer

Bretagne Télécom, a privately held French cloud hosting and enterprise telecommunication company was hit by DoppelPaymer Ransomware attack. The attackers have exploited the CVE-2019-19781 vulnerability against the unpatched servers and dropped DoppelPaymer Ransomware payload on it. The ransomware was able to infiltrate and encrypt 148 machines running application servers on Windows 7, Windows 8, and Windows 10, and containing data belonging to around thirty small business customers and demanded ransom of 35 bitcoins. Fortunately, the company did not lose any data and did not pay any ransom as it was able to restore all the encrypted systems using Pure Storage FlashBlade arrays.

See the full report here: https://www.bleepingcomputer.com/news/security/doppelpaymer-hacked-bretagne-t-l-com-using-the-citrix-adc-flaw/

Hackers Scanning for Vulnerable Microsoft Exchange Servers, Patch Now! - BleepingComputer

The attackers are actively scanning the Internet for vulnerable Microsoft Exchange Servers which was patched by Microsoft recently. Tracked as CVE-2020-0688, the remote code execution flaw exists in the Exchange Control Panel (ECP) component. If exploited, authenticated attackers can execute code remotely with SYSTEM privileges on an exploited server and fully compromise it. According to a security researcher, an attacker who compromises the device or credentials of an enterprise-user can take over the exchange server. Hence, it is recommended to patch the vulnerable exchange servers as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-scanning-for-vulnerable-microsoft-exchange-servers-patch-now/