Threat Intelligence Bulletin: 08/16/2019 - 08/22/2019

Breach Disclosure: Chegg

In April 2018, college textbook rental company Chegg suffered a data breach. Exposed data included usernames, email and shipping addresses, and unsalted md5 hashed passwords. Unfortunately, md5 hashing is widely considered to be insecure and multiple vulnerabilities exist within the algorithm.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

Chegg, a California based textbook rental and study help website, was breached in April 2018. This breach contained usernames, email and shipping addresses, as well as unsalted passwords hashed via md5. Approximately 40 million accounts were compromised. Given the vulnerabilities and security issues within the md5 hashing algorithm, it is likely that these passwords could be unhashed and used to log into compromised Chegg accounts. Potentially, this could be used to make unauthorized purchases or to gain access to stored payment information.

Bulletproof Networks and Residential IP Addresses

On, August 19, 2019 Krebs on Security reported on on Bulletproof residential networks and their use in bots malicious traffic. Bulletproof networks are networks which have a low likelihood of being blocked or terminated even when the hosts serve malicious traffic. Resnet is the focus of the discussion, which is a network of 70,000 IPv4 addresses and advertises itself as a a bulletproof network perfect for bots or buying items with stolen credentials. These residential networks are viewed as bulletproof because online retailers are unlikely to block residential IP addresses because these addresses are shared among whole blocks of residential IP addresses. Due to the rotating addresses, retailers are very cautious to block a potentially legitimate customers when the addresses are reassigned.

Recommendations

• Ensure that you're running a virus scanner with up to date signatures.
• Monitor home network traffic for unexpected connections or data.

Details

Residential networks are being increasingly used for smuggling malicious traffic as reported by Krebs on Security. These networks are attractive to hackers because of their low likelihood of being blocked. Since IP addresses are shared among residential customers, retailers are unlikely to block addresses that exhibit malicious behavior in fear of blocking a future customer who may get assigned one of these addresses.

Resnet, the focus of the investigation, revealed that it contained 70,000 IP residential IP addresses, including AT&T, Verizon, and Comcast. Additionally, 7,000 of these addresses belong to mobile customers. After searching for details of Resnet several references to Hackforums[.]net were found on the forums with advertising that the addresses for sale were botting and shoe buying.

As it turns out, shoe bots are very profitable because designer, limited edition shoes are often bought with stolen credit information and then resold at a much higher markup with profits going directly to the hackers. These networks are perfect for conducting this sort of business because of the low chance that they will be blocked. Even more unsettling is a report from Akamai which states that automated bot activity accounts for almost half of internet bandwidth directed at online retailers.

At this time it is difficult to determine whether these residential networks are legitimately acquired versus obtained through legal means. For instance, WDSPC, which uses AT&T's address space was duped into leasing a large portion of AT&T's address space because WDSPC received a letter claiming to be from AT&T which recommended Resnet as a customer. Given both legitimate and illegitimate methods for claiming residential IP space, residential networks appear to be a long term, viable solution for attackers to have bulletproof networks used for all kinds of malicious traffic.

Alpha Team Research: Studying an Information Operation Campaign - Hong Kong and Twitter

On 19 August, Twitter disclosed a ban wave of approximately 200,000 accounts associated with anti-Hong Kong propaganda. The specific disclosure contained account information and tweets from 936 accounts. In the disclosure, Twitter outlined that this campaign broke multiple terms of service agreements within the platform, and that this botnet was attempting to undermine the legitimacy of the Hong Kong protests. Twitter used a combination of the network data from these accounts, such as source IP addresses, as well as studying the interaction of these tweets and accounts, in order to get high enough confidence to ban these accounts.

Recommendations

• Monitor keywords and protected accounts for any signs of automated behavior
• Work with your ZeroFOX Account Manager and Platform Specialists to spot fake accounts and issue takedowns

Details

ZeroFOX Alpha Team downloaded the accounts and tweets disclosed by Twitter in order to study the campaign. This is arguably the first publicly disclosed information operation provided by the networks, so studying how China performed this operation. Twitter released the accounts and tweets in two sets, referred to as Set 1 and Set 2.

Findings:

• Set 1, 744 users and 1,906,832 tweets

  • 54 languages total, Top 10:

    • Indonesian (in) 794088
    • English (en) 377943
    • Not specified 220931
    • Portugeuse (pt) 183518
    • Chinese (zh) 115283
    • Undetermined (und) 74328
    • Spanish 32818
    • Tagalog (tl) 19603
    • Korean (ko) 13168
    • Estonian (et) 8801

  • 311 separate Twitter apps that were posting these tweets, Top 10:

    • IFTTT (If This Then That) 829112
    • TweetDeck 238272
    • Twitter for Android 159262
    • Twitter Web Client 157521
    • Web 121651
    • Google 118223
    • Zapier 75311
    • Twitter for iPhone 48442
    • TweetCaster for Android 23057

  • Account Creation bucketed by year:

    • 

  • Set 2, 196 users and 1,708,079 tweets

    • 59 languages total, Top 10:
      • Not specified 717192
      • Arabic (ar) 591104
      • English (en) 167573
      • Undetermined (und) 63166
      • Chinese (zh) 54440
      • Spanish (es) 48024
      • Portugeuse (pt) 21259
      • Tagalog (tl) 21030
      • French (fr) 4300
    • 386 separate Twitter apps that were posting these tweets, Top 10:
      • Twitter for iPhone, 687420
      • Web, 353236
      • IFTTT, 73377
      • Twitter Web Client, 64809
      • Twitter for Android, 64388
      • PreggTweets, 28377
      • TweetDeck, 282128
      • Mobile Web, 19460
    • 

Based on this quick study, one can see that a "botnet" on a network like Twitter could involve nurturing accounts so that they varying creation dates in order to not draw suspicion from automated account filters. Many of these accounts and tweets use languages from all over the world, which could implicate that the Chinese government wanted to spread propaganda in languages that consume Twitter data the most or they did not care where their purchased or nurtured accounts originated.

Next, automation is key for a massive-scale propaganda machine. IFTTT is a service that helps automate posting and engagement for its users, so its natural that if you want to run a large campaign that will quickly react to news stories or force sentiment or engagement on users, then its a good choice. The Twitter for iPhone and Web were also interesting data sources, but its been known that click farms are a great way to inflate engagement metrics and have been sold for years before this.

Lastly, the ratio of users to tweets is astonishingly high. Set 1 had 2562.94 tweets per account, and Set 2 had 8714.68 tweets per user. Its clear that these accounts broke ToS and circumvented the Twitter automation filter, but the data also shows that what the community considers a botnet may have different implications on a social network. These networks value automation to help improve user experience for their users. End users also have incomplete information - one of the ways Twitter caught these accounts was due to having access to data such as Source IP, which end users cannot get. With this information, though, some heuristics start to emerge, such as the source app and creation dates, and monitoring keywords and analyzing relationships between accounts can be beneficial for finding information operation campaigns.

ZeroFOX Alpha Team will continue to study this dataset and publish research as we dissect it more.

Breaking News: 2019-08-15 - 2019-08-22

Kaspersky Antivirus Flaw Exposed Users to Cross-Site Tracking Online

If you use Kaspersky Antivirus, a vulnerability in the software may have leaked a unique identifier to any of the websites that you have visited in the last four years. The antivirus software injects javascript into every page a user visits, even in incognito mode. The injected code is used to determine if the user is visiting a potentially dangerous site. Unfortunately, within this code is a unique identifier that is tied to the antivirus user that any knowledgeable party can harvest if running on the same page as the script. This unique identifier could then be used to track the user across websites, even when there is a full expectation of privacy. Kaspersky has patched this vulnerability by replacing the unique identifier with a constant that is used by all users.

See the full report here: https://thehackernews.com/2019/08/kaspersky-antivirus-online-tracking.html

Capital One accused 'breached 30 other organisations'

The Capital One data breach has dominated the mainstream news cycle since its inception last month. Court proceedings of the case show that the developer who breached Capital One also took files from 30 other organizations. This shows that partner and vendor security is just as much of a worry for your company than your organizational assets.

See the full report here: https://www.bbc.co.uk/news/technology-49357758

Router Network Isolation Broken By Covert Data Exfiltration - BleepingComputer

Software based isolation is a key feature in home routers which will often have separate networks for guests and normal home users. Researchers have found that by sending specially crafted packets that data can be leaked from one network to another. For instance, the researchers were able to craft DHCP packets such that certain responses were sent to both networks. Using this, a covert attacker can encode data in DHCP's 32-bit Transaction ID, and then surreptitiously leak that data across network boundaries.

See the full report here: https://www.bleepingcomputer.com/news/security/router-network-isolation-broken-by-covert-data-exfiltration/

'Coordinated Ransomware Attack' in Texas Hits 23 Local Governments - BleepingComputer

Ransomware attacks have been targeting local government officials in Texas. Currently, there are at least 23 government entities impacted. The attack seems to have originated from a single threat actor using an unknown strain of file encrypting malware. The attack has caused multiple organizations to get involved with determining the scope of the damage, including the Department of Homeland Security and the FBI. However, the details and scope of the coordinated attacks is still being investigated.

See the full report here: https://www.bleepingcomputer.com/news/security/coordinated-ransomware-attack-in-texas-hits-23-local-governments/

Mozilla Firefox Bug Let Third-Parties Access Saved Passwords - BleepingComputer

Mozilla just patched a vulnerability in Firefox that allowed any user to copy password information from the browser's built in database. Fortunately, the exploit requires the user to be local on the machine. Additionally, the password database is enabled by default and does not require a master password to be setup before allowing users to use the saved passwords feature.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-firefox-bug-let-third-parties-access-saved-passwords/

Microsoft Warns of Phishing Attacks Using Custom 404 Pages - BleepingComputer

Microsoft has issued a warning regarding phishing campaigns that redirect the user to a custom 404 error page. These error pages display a fake Microsoft login page, which harvests credentials for scammers. This malicious 404 page is served to any url in an attacker controlled domain, which allows for a virtually unlimited number of unique phishing links.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-phishing-attacks-using-custom-404-pages/

Patches for 2 Severe LibreOffice Flaws Bypassed Update to Patch Again

Multiple vulnerabilities have been identified in LibreOffice.Two of these are script executiuon vulnerabilities, which can be utilized to execute arbitrary code. LibreOffice originally patched one of these script execution vulnerabilities in February, however, the patch is bypassable. A new patch has been released for this vuln.

See the full report here: https://thehackernews.com/2019/08/libreoffice-patch-update.html

Phone Numbers Exposed By Inconsistent Password Reset Processes - BleepingComputer

New research has been released, regarding the use of pasword reset procedures to identify phone numbers linked to a victim email address. Password reset mechanisms generally reveal between 2-5 digits of a phone number. These exposed digits can then be matched againt public lists of phone numbers, to obtain a list of potentially valid numbers.

See the full report here: https://www.bleepingcomputer.com/news/security/phone-numbers-exposed-by-inconsistent-password-reset-processes/

Router Network Isolation Broken By Covert Data Exfiltration - BleepingComputer

Software based isolation is a key feature in home routers which will often have separate networks for guests and normal home users. Researchers have found that by sending specially crafted packets that data can be leaked from one network to another. For instance, the researchers were able to craft DHCP packets such that certain responses were sent to both networks. Using this, a covert attacker can encode data in DHCP's 32-bit Transaction ID, and then surreptitiously leak that data across network boundaries.

See the full report here: https://www.bleepingcomputer.com/news/security/router-network-isolation-broken-by-covert-data-exfiltration/

'Coordinated Ransomware Attack' in Texas Hits 23 Local Governments - BleepingComputer

Ransomware attacks have been targeting local government officials in Texas. Currently, there are at least 23 government entities impacted. The attack seems to have originated from a single threat actor using an unknown strain of file encrypting malware. The attack has caused multiple organizations to get involved with determining the scope of the damage, including the Department of Homeland Security and the FBI. However, the details and scope of the coordinated attacks is still being investigated.

See the full report here: https://www.bleepingcomputer.com/news/security/coordinated-ransomware-attack-in-texas-hits-23-local-governments/

Mozilla Firefox Bug Let Third-Parties Access Saved Passwords - BleepingComputer

Mozilla just patched a vulnerability in Firefox that allowed any user to copy password information from the browser's built in database. Fortunately, the exploit requires the user to be local on the machine. Additionally, the password database is enabled by default and does not require a master password to be setup before allowing users to use the saved passwords feature.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-firefox-bug-let-third-parties-access-saved-passwords/

Hackers Planted Backdoor in Webmin, Popular Utility for Linux/Unix Servers

The Webmin 0-day story takes an interesting turn - a supply chain attack was the supposed reason for the 0-day in the web-based management software. This was a hot button story already due to the public disclosure without notification at Defcon which came with its own Metasploit module to boot. A blog post made by Webmin devs stated that they are still figuring out how the backdoor was introduced within the technology.

See the full report here: https://thehackernews.com/2019/08/webmin-vulnerability-hacking.html

Vulnerabilities in Google Nest Cam IQ can be used to hijack the camera, leak data

TALOS, Cisco's Threat Research arm, found 8 vulnerabilities in Google's Nest Cam IQ. The camera is part of a suite of Google products used for home security, so having vulnerabilities within your home security products is a harrowing thought. Two of the vulnerabilities are remote code execution flaws. A Google spokesperson commented and said the flaws are being patched in upcoming updates.

See the full report here: https://www.zdnet.com/article/vulnerabilities-in-google-nest-cam-iq-can-be-used-to-hijack-your-camera/

The Pwn Star State: Nearly two dozen Texas towns targeted by tiresome ransomware

Ransomware has been a huge problem for small government and municipalities throughout the US. Atlanta, Baltimore and now Texas have been affected by file-encrypting attacks. Some folks have suggested the ransomware is a Sodinokibi variant, but the Texas Department of Information Resources declined to comment on the variant. They did confirm, though, that a single threat actor infected 23 separate Texas organizations in this attack.

See the full report here: https://www.theregister.co.uk/2019/08/20/texas_towns_ransomware/

Twitter bans 936 accounts managed by the Chinese state, aimed at Hong Kong protests

Election and geopolitical security is a hot button topic for the social networks entering the 2020 political season. Twitter found close to 1,000 accounts abusing their Terms of Service to post pro-China propaganda during the Hong Kong Protests. They also tipped off Facebook who subsequently banned pages and accounts doing the same thing on their platform.

See the full report here: https://www.zdnet.com/article/twitter-bans-936-accounts-managed-by-the-chinese-state-aimed-at-hong-kong-protests/

Researcher publishes second Steam 0-day after getting banned on Valve's bug bounty program

A researcher who has previously disclosed a local privilege escalation vulnerability for the Steam client published another vulnerability. This time, he couldn't disclose it through HackerOne, due to allegedly being banned from the platform. The HackerOne staff let him know that this style of vulnerability was not in scope for Valve's disclosure program, so when he published it outside the HackerOne program, the staff barred him from submitting anymore via the platform.

See the full report here: https://www.zdnet.com/article/researcher-publishes-second-steam-0-day-after-getting-banned-on-valves-bug-bounty-program/

Apple, Google, and Mozilla block Kazakhstan's HTTPS intercepting certificate

This story outlines the importance of the browser ecosystem and how it can influence geopolitical issues. Apple, Google and Mozilla all united and banned the root certificate of the Kazakhstan government, meaning that their browsers will show an error anytime that certificate is served to Kazakh citizens. The Kazakhstan government supposedly ran their HTTPS-interception project for 3 weeks and then stopped it.

See the full report here: https://www.zdnet.com/article/apple-google-and-mozilla-block-kazakhstans-https-intercepting-certificate/

Suspected Capital One hacker requests release from jail on health grounds

The alleged Capital One hacker has requested release from federal jail. Thompson's lawyers submitted a request to release her from jail as it is a threat to her mental health. According to the published proceedings, law enforcement felt that Thompson is a flight risk and "is a danger to herself and others".

See the full report here: https://www.zdnet.com/article/suspected-capital-one-hacker-requests-release-from-jail-on-safety-grounds/

No REST for the wicked: Ruby gem hacked to siphon passwords, secrets from web devs

Yet another supply chain attack against a language ecosystem - this time, a popular REST client in Ruby was backdoored. CVE-2019-15224 was assigned to a vulnerability in the rest-client Rubygem, where someone inserted a backdoor into the gem that exfiltrated local environment variables to a C2 server. This shows that ecosystem and supply chain security is still very much a problem for these highly complex and highly available package managers.

See the full report here: https://www.theregister.co.uk/2019/08/20/ruby_gem_hacked/

Unpatched Squid Servers Exposed to DoS, Code Execution Attacks - BleepingComputer

Squid servers versions 4.0.23 through 4.7 are susceptible to a vulnerability that can cause a heap overflow when processing HTTP Authentication credentials. Tracked as CVE-2019-12527, a malicious user can send a specially crafted packet to DoS a Squid server or get remote code execution. Mitigations include disabling basic HTTP Authentication or not allowing ftp connections to the server.

See the full report here: https://www.bleepingcomputer.com/news/security/unpatched-squid-servers-exposed-to-dos-code-execution-attacks/

Valve patches recent Steam zero-days, calls turning away researcher 'a mistake'

Valve backtracked on their Steam zero-day disclosure gaffe, saying that turning away the researcher who previously disclosed two local privilege escalation vulnerabilites was 'a mistake'. In response, the gaming company updated their disclosure policy, patched the two vulnerabilities and is reviewing the researcher's ban on HackerOne.

See the full report here: https://www.zdnet.com/article/valve-patches-recent-steam-zero-days-calls-turning-away-researcher-a-mistake/

Google Twice Misses Android App with Open-Source Spyware Code - BleepingComputer

The AhMyth Android RAT strikes again, this time within a music app on the Google Play Store. The interesting take on this research is that AhMyth is an open-source project, and Google did not catch this in their app store. This variant, although now removed on Google Play, is riddled all over secondary app stores, making the Android ecosystem even more unstable as users try to download non-approved apps to their devices.

See the full report here: https://www.bleepingcomputer.com/news/security/google-twice-misses-android-app-with-open-source-spyware-code/