Threat Intelligence Bulletin: 08/09/2019 - 08/15/2019

Breach Disclosure: StockX

StockX, a Detroit based e-commerce company founded in 2015, has disclosed a data breach that affected 6.8 million accounts. The breach consists of names, emails, physical addresses, purchase history and MD5 encrypted passwords. StockX published about the breach in their news section on August 8, 2019.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

StockX was initially alerted to suspicious activity involving their customer data on July 26, 2019. They immediately started an investigation on the possible sources of the breach and concluded that an unknown third party gained access to their customer data. According to the disclosure, no credit card or payment information was compromised.

StockX is contacting their affected customers, making changes in their inner infrastructure and is offering 12 months of MyIDCare fraud detection and identity theft protection for victims.

Phishing to Blame for iNSYNQ Ransom Attack

iNSYNQ, a QuickBooks cloud hosting firm, was hit by a MegaCortex attack July 16. New details have come to light surrounding the attack after a customer briefing was held August 8. Nearly 50% of customer files were encrypted in the attack. At present, most of the data has been recovered, and only 10% remains encrypted.

Recommendations

• Use caution when opening unexpected emails, especially from unknown senders
• Maintain and frequently update offline backups of all critical information
• Ensure defensive systems are updated with the latest detection
• Consider enabling the Cyber Chatter rule in order to monitor activity related to this malware family

Details

In mid-July, iNSYNQ fell victim to the MegaCortex ransomware. MegaCortex is known for scaling ransom demands to its victim's perceived ability to pay, ranging from $20,000 to nearly $6 million. Although iNSYNQ has declined to release the amount demanded of them, chief executive Elliot Luchansky has stated it was a "very substantial amount." Ultimately, the firm has declined to pay the ransom.

Additionally, Hold Security, has disclosed that they have discovered dark web chatter related to the compromise, indicating that the attack began July 6, when an employee fell for a phishing attack. Given that the date of compromise was July 16, this means attackers would have maintained system access for 10 days prior to data encryption.

Breach Disclosure: Cracked[.]TO

The cracking forum and community Cracked[.]to recently experienced a data breach. The site released a statement on their official Twitter page, as well as on the site itself. Leaked information consisted of 749,000 usernames, IP addresses, private messages and encrypted password hashes.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

The forum administrator posted the following statement regarding the incident:

Hello Cracked.to Members,

I wish I would have never been forced to do such a thread but that's what you get for trusting the wrong people. I will take full responsibility as it was only my fault. 

Today, 27.07.2019, I got the message that an old person of my trust has forum backups that contains the database and folder files. Those backups could be valid from End of 2018 until June 2019.
Since it's not longer in my hands that the database and forum files remain private, I wanted to use this thread to give everyone a warning about what could happen.

The database has not been published yet. However there is a chance that it's going to happen, hence we forced every user to change his password. We are also resetting all database sessions within the next few hours.

Before everyone panics:

We have changed the hashing algorithm of passwords from mybb default (md5) to something more advanced a few months ago, which makes it almost impossible to decrypt your passwords.

I'm beyond sorry that this has happened, especially for the community. 

- Forum Administration

After this initial post, the breach data was posted publicly by rival forum HackForums. In response, Cracked[.]to released a follow-up statement:

A wannabe "leaking-forum" released the database backup today that contains all data from 21st of July 2019. As announced a few weeks ago all passwords are crypted with advanced hashing (no, not Argon2, get your infos right next time) and therefore pretty much useless.

I have wiped all mybb_sessions today.
There will be consequences for the forum that is responsible for distributing the backup and for the person that leaked it.

Note: your passwords are safe! You don't need to worry or panic about those! We are not using md5 hashing.

- Forum Administration

Alpha Team Research: Deep Dive into Cerberus Banking Malware

A new banking trojan Cerberus is in the wild and available in a primarily Russian cybercrime forum. The trojan has the ability to determine the top level window and if the application is a banking app, the trojan has the ability to overlay a fake screen on top of the bank’s dialog in order to collect personal information, such as: username, last name, first name, password, date of birth, and social security number. There is no exploit vector in the wild and the trojan must be installed through social engineering or phishing.

Recommendations

• If you are a financial customer, we recommend turning on app store impersonation coverage to find potentially malicious apps
• Consider enabling Cyber Attack Chatter in the platform to monitor chatter related to this malware
• Enable 2-factor authentication to help prevent phishing attacks

Details

Cerberus, a new banking trojan, is making waves in the malware-for-rent business. Popular banking trojans, such as Anubis, Red Alert 2.0 and GM Bot had previously cornered the market, but as these trojans and associated botnets have gone offline, Cerberus has taken their place.

Cerberus is a trojan for Android that, once installed, allows the attacker to take complete control of the system. Like most trojans, once activated, it hides itself from installed application. Then, the trojan masquerades as a Flash Player Service and requests permission to use the Accessibility Services. If this is granted, the trojan registers itself with its command and control server and allows a remote attacker to perform a variety of functions. Cerberus does not exploit a vulnerability to end up on a user’s Android device. Instead, it relies on social engineering to get the application installed on the end user’s phone.

Some of the capabilities of the trojan include: taking screenshots, recording audio, recording keylogs, sending, receiving, and deleting SMSes, stealing contact lists, forwarding calls, collecting device information, tracking device location, stealing account credentials, disabling Play Protect, downloading additional apps and payloads, removing apps from the infected device, pushing notifications, and locking the device's screen.

One of the main features of the trojan is the ability to overlay dialogs on top of legitimate banking applications. As mentioned before, access to the Accessibility Services permission allows the trojan to obtain the package name of the top level window which it uses to determine if a banking app is currently displayed. Cerberus has overlays for: 7 U.S. banking apps, 7 French banking apps, 1 Japanese banking app and 15 non-banking apps. Typically, the username, last name, first name, password, date of birth, and social security number are the types of data that the trojan collects.

The authors also use some tricks to make it harder to execute the trojan within a virtualized environment. Specifically, they detect if there is motion while using the device by measuring the output of the accelerometer. The logic behind this is that a virtualized environment would not produce the same accelerometer readings as a real phone, so the attacker would know not to execute the trojan with full capabilities. These tactics make reverse engineering the trojan more difficult.

Even for interested parties with cash in hand, obtaining the malware is neither cheap nor easy. The authors advertise renting the malware for various chunks of time: $2000 for 1 month usage, $7000 for 6 months and up to $12,000 for 12 months. However, not everyone is granted access to the bot. Below is a post made regarding the availability of the trojan to potential buyers posted by the authors on Aug 08, 2019:

Дорогие друзья, прошу не обижаться тем, кому мы отказали даже в тесте. Мы выбираем партнёров, у которых взникнет минимум проблем, и выноса мозга, тех кто знаком более менее со сферой, или готов в ней разбираться. Увы, с абы кем мы работать не будем.

Так же в команду (для сотрудничества) требуются следующие люди:
- кто сможет делать точечную работу по US, UK, CA, AT, AU и JP(Япония в приоритете) банкам;
- Имеют лоадеры в Google Play которые имеют более 100к установок.
- Знакомы с веб дизайном, css, js (без jquery) для написания инжектов.

Dear friends, I ask you not to be offended if we refused you a test and a bot. By special criteria, we choose people who can work with the bot and get profit from it.

The following people are also required in the team:
- To work on banks of the following countries: US, UK, CA, AT, AU and JP (Japan is a priority);
- They have loaders on Google Play that have more than 100k installations.
- Familiar with web design, css, js (without jquery) for writing injections.

Some key takeaways from this message are that the banks they target are within a tight ecosystem. They are targetting wealthy countries specifically and omit all Commonwealth of Independent States (CIS), most notably. Additionally, the user must have an application that has the capability to load external software and that the software must be installed at least 100,000 times. As stated previously, there is no exploit vector to get Cerberus on an end user’s phone. Instead, social engineering and phishing attacks would be used to convince the user to download Cerberus which is precisely why they require web development experience. The no jQuery requirement is likely to avoid common, fingerprintable Javascript patterns which would lower the efficacy of the phishing pages used to install Cerberus.

These requirements allow the users of Cerberus to form a unique community. Meaning, all partners have the ability to contribute to the ecosystem and no one can just use the app individually without contributing at least 100,000 installs of their own applications. And take note, the installs must be on the Google Play marketplace, and not a secondary market, which makes obtaining the requisite number of installs even harder.

Additionally, ensuring that the trojan operates in specific markets, they can guarantee a density of available botsover a lucrative attack surface. This seems to be a reason they target the countries that they do, in addition to the perceived wealth of the nations mentioned.

Microsoft Patches Remote Desktop to Prevent Worm

Microsoft has announced two patches for vulnerabilities in the Remote Desktop service which allows an attacker to execute arbitrary code remotely. This attack allows an unauthenticated user to execute arbitrary code, which could potentially lead to a worm, if the vulnerability is exploited by hackers. All currently supported versions of Windows are vulnerable and Microsoft recommends patching vulnerable systems as soon as possible. In the case where a system cannot be patched, Microsoft recommends turning on Network Level Authentication.

Recommendations

• Patch vulnerable systems https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1182
• Enable Network Level Authentication if unable to patch vulnerable systems.

Details

Microsoft has patched two Remote Code Execution (RCE) vulnerabilities in Remote Desktop which affects all currently supported Versions of windows. The systems vulnerable are: Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, and all supported versions of Windows 10, including server versions. These vulnerabilities are especially worrying because the flaw happens during a pre-authentication phase of Remote Desktop, which means an outside attacker can send a specially crafted message and achieve arbitrary code execution on the target system. Given that, these vulnerabilities are described as wormable due to their potential to be remotely exploited with a payload that exploits other vulnerable systems. Additionally, Microsoft recently patched the BlueKeep vulnerability, which was another RCE in the Remote Desktop service. Patches have been released to fix these issues but Microsoft has proposed enabling Network Level Authentication to partially mitigate the attack for those who are unable to patch their systems at this time.

Breaking News: 2019-08-09 - 2019-08-15

Phishing Attacks Enlist Amazon AWS, Microsoft Azure in Ploys

Recently, phishing attacks have been seen to utilize AWS to host landing pages. This is a new development - as attacks have not been commonly seen to leverage enterprise cloud storage providers on the same level as those geared towards consumers, like Dropbox.

See the full report here: https://threatpost.com/phishing-amazon-aws-s3-cloud-buckets/147111/

Saefko: A new multi-layered RAT

A new remote access trojan (RAT) has emerged on the malware scene. Saefko seeks to exfiltrate system information and report back to attackers. It also checks victim browser history, in order to look for searched related to credit cards, social media, cryptocurrency, and other potentially valuable information for attackers to steal.

See the full report here: https://www.zscaler.com/blogs/research/saefko-new-multi-layered-rat

Decade-old remote code execution bug found in phones used by Fortune 500

Researchers at McAfee have revealed a 10-year old bug in Avaya phones at BlackHat this week. Exploitation of this bug could allow for the unauthorized acess to phone audio. Avaya has since published a patch for the bug.

See the full report here: https://www.zdnet.com/article/decade-old-remote-code-execution-bug-found-in-phone-used-by-up-to-90-percent-of-fortune-500/

Apple will now pay hackers up to $1 million for reporting vulnerabilities

Apple has bumped up its bug bounty significantly - researchers reporting vulnerabilities in Apple products could now receive up to $1 million USD.

See the full report here: https://thehackernews.com/2019/08/apple-bug-bounty.html

Facebook hits two app developers with lawsuit

Two Chinese developers are being sued by Facebook, over alleged ad fraud. LionMobi and JediMobi, based in Hong Kong and Singapore respectively, purportedly planted malware on people's phones in order to generate fake clicks on Facebook ads. These clicks generated payouts from Facebook, through the social network's ad platform. This malware was allegedly delivered through malicious mobile apps, posing as tools to "clean" a device, a calculator, and a battery life extender.

See the full report here: https://www.welivesecurity.com/2019/08/08/facebook-android-app-developers-lawsuits/

Suspected BITTER APT Continues Targeting Government of China and Chinese Organizations

A phishing campaign has been spotted impersonating the Chinese Ministry of Foreign Affairs. Using Let's Encrypt certificate information, researchers have identified this group responsible for this site as the BITTER APT. Sites have also been seen impersonating the China National Aero-Technology Import and Export Corporation, the National Development and Reform Commission, and the Ministry of Commerce.

See the full report here: https://www.anomali.com/blog/suspected-bitter-apt-continues-targeting-government-of-china-and-chinese-organizations#When:19:24:00Z

Cloud Atlas threat group updates weaponry with polymorphic malware

Cloud Atlas, an APT known to target Russia, Ukraine, and parts of Europe, is now using polymorphic components in their infection chain. The latest attacks seen coming from this APT utilize polymorphic code in the HTML and Visual Basic droppers, which serve to drop additional malware to steal passwords and other sensitive information.

See the full report here: https://www.zdnet.com/article/cloud-atlas-threat-group-updates-weaponry-with-polymorphic-malware/

Canon DSLR Cameras Can Be Hacked With Ransomware Remotely

Vulnerabilities have been identified in several Cannon DSLR cameras, including the PowerShot SX740 HS, PowerShot SX70 HS, and PowerShot G5X Mark II. These vulnerabilities are within the implementation of picture transfer protocol within these Canon devices. All could be exploited over WiFi or USB, and could result in an attacker taking control of the device. Potentially, these vulnerabilities could be leveraged in order to hold a victim's devices for ransom.

See the full report here: https://thehackernews.com/2019/08/dslr-camera-hacking.html

Cerberus: A New Android 'Banking Malware For Rent' Emerges

Android banking malware continues to rise with packages that aim to give a great user experience to those who are willing to pay for it. Cerberus is a new Android banking trojan that focuses heavily on creating phishing page overlays for victims once they install the trojan. Its important to note that these Cerberus, much like other trojans like Anubis, do not rely on vulnerabilities in order to infect a user. Instead, they rely on social engineering users into installing apps that then install the Cerberus package.

See the full report here: https://thehackernews.com/2019/08/cerberus-android-banking-trojan.html

HVACking: Remotely Exploiting Bugs in Building Control Systems - BleepingComputer

A well-known and well-mitigated vulnerability, buffer overflow, was found in a popular controller for managing critical systems by McAfee Threat Research. This research shows how hard it is for critical infrastructure vendors to find and patch vulnerabilities before they are shipped, but also that the industry lacks information security professionals and research to help secure systems tied to physical control systems.

See the full report here: https://www.bleepingcomputer.com/news/security/hvacking-remotely-exploiting-bugs-in-building-control-systems/

4 Dating Apps Pinpoint Users Precise Locations and Leak the Data

Researchers at Pen Test Partners found that they could determine the exact location of users of Grindr, Romeo, Recon and 3fun just by knowing the username of the targeted user. The researchers used spoofed location data to obtain distances to a given user from multiple points which allowed them to triangulate the user with precision. Additionally, Grindr includes altitude data which can be further used to determine elevation along with precise latitude and longitude.

See the full report here: https://threatpost.com/4-dating-apps-pinpoint-precise-locations/147247/

Curious Orca BEC Scammers Use Email Probes to Validate Targets - BleepingComputer

Business Email Compromise fraudsters are getting more advanced - this group known as "Curious Orca" uses a series of validation steps to qualify their "lead" lists. This is eerily similar to how sales teams build lead lists, and it also goes to show that the cybercrime community has a vibrant economy when it comes to how you can help their mission.

See the full report here: https://www.bleepingcomputer.com/news/security/curious-orca-bec-scammers-use-email-probes-to-validate-targets/

Header aches in Firefox, Tor, Brave and Chrome as HTTP opens new security holes

Alt-Svc is a relatively new header in the world of web. First created in 2016, the header is primarily used to redirect clients to other services, in order to help with load balancing or directing traffic to a closer server. The research for this header shows that browsers have implemented the header in an insecure manner, where a malicious server can issue Alt-Svc to a Firefox or Tor client to port scan a machine that the victim has access to, leading to privacy concerns.

See the full report here: https://www.theregister.co.uk/2019/08/13/header_banged_for_bafflingly_bad_behavior/

8 New HTTP/2 Implementation Flaws Expose Websites to DoS Attacks

HTTP/2 has been around for a number of years but adoption has been low amongst the tech data giants. In this report, researchers at Netflix and Google disclosed vulnerabilities in several implementations of HTTP/2, all leading to DoS attacks for these servers. A small malicious packet could be used to trigger resource exhaustion amongst these implementations, a condition that could hurt the adoption of these protocols for long term use.

See the full report here: https://thehackernews.com/2019/08/http2-dos-vulnerability.html

New Data Breach Has Exposed Millions Of Fingerprint And Facial Recognition Records: Report - Forbes

A new breach of biometric data was found in an open database that belonged to the company Suprema and exposed 28 million records and 28 gigabytes of data. Among the data were fingerprints, facial recognition, security clearances and respective levels, logs of staff access, and unencrypted usernames and passwords. Additionally, no cryptography was used in storing this biometric data and this is especially problematic because once a user's biometric data is in the wild, it can always be compromised due to the properties being immutable. The company says it will act responsibly and disclose the magnitude and gravity of the compromise once they have finished their internal investigation.

See the full report here: https://www.forbes.com/sites/zakdoffman/2019/08/14/new-data-breach-has-exposed-millions-of-fingerprint-and-facial-recognition-records-report/

New Bluetooth Vulnerability Lets Attackers Spy On Encrypted Connections

A new bluetooth vulnerability, that affects over a billion devices, are susceptible to a vulnerability that allows a third party to intercept and change transmitted data. The vulnerability is referred to as KNOB (Key Negotiation of Bluetooth) and directly affects the entropy negotiation protocol of bluetooth. The key negotiation takes place and their devices can choose entropy between 1 and 16 bytes, with either party able to downgrade the entropy. The downgrade is allowed because the bytes of entropy are variable depending on a device's implementation. Additionally, the key negotiation takes place in clear text, so a third party could perform the downgrade on behalf of both devices, allowing the attacker to easily brute force the 1 byte of entropy and then read and mutate data sent between devices.

See the full report here: https://thehackernews.com/2019/08/bluetooth-knob-vulnerability.html

Microsoft Voicemail Notifications Used As Bait in Phishing Campaign - BleepingComputer

A new style of phishing was caught in the wild that abuses how people view emails related to Microsoft Voicemail Notifications. The emergence of abusing phones and phone technologies, especially with robocallers, shows that the security community needs to fix this idea that phone numbers are a trusted source of contact. In this post, security firm Avanan outlines a campaign where phishers spam emails of victims with a template that looks like a Microsoft 365 voicemail alert.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-voicemail-notifications-used-as-bait-in-phishing-campaign/

Kaspersky Antivirus Flaw Exposed Users to Cross-Site Tracking Online

If you use Kaspersky Antivirus, a vulnerability in the software may have leaked a unique identifier to any of the websites that you have visited in the last four years. The antivirus software injects javascript into every page a user visits, even in incognito mode. The injected code is used to determine if the user is visiting a potentially dangerous site. Unfortunately, within this code is a unique identifier that is tied to the antivirus user that any knowledgeable party can harvest if running on the same page as the script. This unique identifier could then be used to track the user across websites, even when there is a full expectation of privacy. Kaspersky has patched this vulnerability by replacing the unique identifier with a constant that is used by all users.

See the full report here: https://thehackernews.com/2019/08/kaspersky-antivirus-online-tracking.html

Capital One accused 'breached 30 other organisations'

The Capital One data breach has dominated the mainstream news cycle since its inception last month. Court proceedings of the case show that the developer who breached Capital One also took files from 30 other organizations. This shows that partner and vendor security is just as much of a worry for your company than your organizational assets.

See the full report here: https://www.bbc.co.uk/news/technology-49357758