E3 Leak Exposes PII of 2000 Journalists

Names and Addresses of Over 2000 Journalists Leaked by E3 Trade Show

Major tech trade show E3 has leaked the personal addresses of 2000 journalists who registered to attend the 2019 iteration of the conference. This database was available publicly on the conference website, but has since been taken down. Although E3 has released a statement regarding the leak, the damage has been done and this database has been circulated online.

Recommendations

Consider enabling the Compromised Credentials rule to monitor involvement in future data breaches
Consider enabling the Dark Web Mentions rule in order to monitor dark web activity related to your montored entities

Details

Youtuber Sophia Narwitz has discovered a spreadsheet containing the names and personal addresses of 2000 journalists who attended E3 2019, a popular electronics trade show. The database was freely available on the E3 website, and was titled "Registered Media List." Sophia promptly contacted the ESA, and they have since removed this spreadsheet.

This breach affects journalists from publications including Vice, Polygon, IMDb, and also Twitch and YouTube content creators. ESA has made the following statement regarding the breach:

ESA was made aware of a website vulnerability that led to the contact list of registered journalists 
attending E3 being made public. Once notified, we immediately took steps to protect that data and 
shut down the site, which is no longer available. We regret this occurrence and have put measures in 
place to ensure it will not occur again.

News of the breach has since spread across Twitter, and has been posted about by a few nefarious groups known to hold journalists in contempt. Alpha Team highly recommends considering the use of the Dark Web Mentions rule to monitor for potential information leak of important entities on the dark web.

Breaking News - 08.06.2019

ECh0raix Ransomware Decryptor Restores QNAP Files For Free

A decryptor has been released for the eCh0raix ransomware. This malware family generally targets QNAP NAS devices, and has been active since June 2018. Many victims of the ransomware will now be able to decrypt infected devices.

See the full report here: https://www.bleepingcomputer.com/ransomware/decryptor/ech0raix-ransomware-decryptor-restores-qnap-files-for-free/

FBI Warns of Romance Scams Turning Victims into Money Mules

New research on ever-popular romance and confidence scams has been released - with over $363 million in losses reported. Interestingly, this research actually shows that victims of these scams tend to be used as money mules for funds gained due to business email compromise, in order to transfer funds for scammers.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-romance-scams-turning-victims-into-money-mules/

New Flaws in Qualcomm Chips Expose Millions of Android Devices to Hacking

New vulnerabilities have been identified in the Qualcomm chipsets used in many Android devices. Exploitation of these vulns could allow a remote attacker to hijack control of a targeted device.

See the full report here: https://thehackernews.com/2019/08/android-qualcomm-vulnerability.html

Security researchers warned for years about the cloud-security flaw used in the massive Capital One hack, but Amazon apparently leaves it up to customers to protect

New information has surfaced regarding the Capital One database breach. The vulnerability that likely allowed for breach, is a server-side request forgery that has been known since 2014. Alpha Team highly recommends customers enable the compromised credentials rule in order to monitor for their involvement in future breaches.

See the full report here: https://www.businessinsider.com/capital-one-hack-vulnerability-on-cloud-amazon-known-for-years-2019-8

Ransomware, “wiper” malware attacks have more than doubled, IBM team says

Research teams at IBM claim that they are seeing a 200% increase in ransomware and wiper malware attack, over the last six months. 50% of cases seen by the team were attacks against organiziations in the manufacturing industry. Oil and gas, and education sectors are also often targeted.

See the full report here: https://arstechnica.com/information-technology/2019/08/ransomware-wiper-malware-attacks-have-more-than-doubled-ibm-team-says/

Unpatched KDE vulnerability disclosed on Twitter

An unpatched vulnerability in KDE Frameworks has been publicly disclosed. Successful exploitation of this vulnerability could result in malicious code being run on a targeted device. A proof of concept has been released publicly, and prior to the notification of the vendor by the researcher, who did not follow any sort of responsible disclosure policy, and claims he just wanted to release an 0-day prior to Defcon.

See the full report here: https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/