Threat Intelligence Bulletin: 08/23/2019 - 08/29/2019

Alpha Team Research: OGUsers and Account Takeover Case Study

In May 2019, infamous SIM swapping and account takeover forum OGUsers was compromised. A rival site, HackForums, published the full contents of OGUser's database on their database downloads page. The forum focused heavily on services, products and tutorials on stealing cryptocurrency, hijacking social media accounts and SIM swapping attacks. ZeroFOX Alpha Team conducted a detailed exploration on the OGUser’s forum, which was breached earlier this year. Our findings demonstrate the average user of an account takeover forum does not show the technical prowess of a typical cybercriminal “hacker” or a nation-state actor, but rather they follow an easier path and focus heavily on social engineering techniques and purchasing accounts with their own funds to achieve their objectives.

Recommendations

• Consider enabling the cyber attack chatter rule to monitor hacking forums such at this one, for chatter related to your organization

Details

SIM Swap attacks are account compromises where a cybercriminal takes over a phone number of a victim via swapping out the SIM card in order to circumvent account protections set by the victim. The ZeroFOX Alpha Team obtained the database; subsequent examination showed that users of this website did not necessarily have good operational security and that although the users of the forum “specialized” in account takeover, many of them trusted the forum to keep their data safe and private.

Out of the 112,719 accounts that were in OGUsers, only 199 of them had two-factor authentication enabled, a staggeringly low .0017%. Users were from 169 countries, with English speaking countries accounting for 54% of the registered accounts. ⅓ of them had email addresses that were part of other breaches - so if they signed up with an email address [email protected], these users also had the same email in other breaches ‘other-than-OGUsers (341 unique breaches to be exact). 89% of the users on OGUsers linked a social site to their profile, making attribution easier and reducing their operational security posture. Some notable profile-linked sites include: Instagram, Kik, XBOX Live, Snapchat, Twitter, Youtube, Twitch and Facebook. The forum was concerned about discussion of competitors, and actively censored the forum. Some of these were other account takeover sites, like Ogflip and Doxagram, while there were larger cybercriminal hacking forums with account takeover subforums, like Leakforums and Hackforums.

Although this was a forum dedicated to cybercrime, users themselves were ineffective at operational security. There was also a sense of community and connectedness in this forum - most users had some social site linked to their profile. For a paranoid security person, this would represent a high likelihood of attribution - which is good for those battling cybercrime, but not for the cyber criminals. Eventually, one would expect the evidence to add up and for the prying eyes of law enforcement to fall on the forum. However, this seemed not to be a concern for most users of the forum given their poor operational security. Users also seemed to trust the site, exchanging their own payment credentials in private messages, despite that forum admins can access these records at any time.

Breach Disclosure: 8Tracks

In June 2017, playlist tracking service 8Tracks suffered a data breach. In the disclosure written by the company, they believe that one of their developer's Github accounts was compromised which led to the breach. They cited the reason for the compromise as a "lack of 2-factor authentication". The breach contained approximately 18 million rows of usernames, emails and salted SHA-1 passwords.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

The breach disclosure did not specifically say what cryptographic hashing algorithm was used to protect user passwords. The company believes that the affected Github account was used to pivot to a backup table that contained the data. It's hard to imagine exactly what happened here, but it sounds like the user account had enough sensitive data to access backup tables, whether it was stored in Github itself or on a server that was not as secure as their production databases.

Cybersecurity Firm Imperva Exposes Customer Data

On August 27, 2019, cybersecurity firm Imperva disclosed on their official blog a security issue that has resulted on exposure of customer data. This impacts customer of Imperva's "Cloud Web Application Firewall" (Cloud WAF), who had accounts as of September 15, 2017. Exposed information includes email addresses and hashed passwords for some cases, while other cases include API keys and customer SSL certificates. These certificates and API keys could allow attackers to break an affected organization's encryption and intercept content sent to their web application.

Recommendations

• Change passwords related to Cloud WAF
• Enable two-factor authentication and reset API keys
• Work with your ZeroFOX Account Manager and Platform Specialists to identify compromised credentials

Details

Imperva was notified on August 20 about the data exposure from a third party. Imperva claims that this exposure impacts only customers who had accounts through September 17, 2017, specifically, customers using the Incapsula service, the Cloud Web Application Firewall (CloudWAF). With access to the exposed data, an attacker could reduce Incapsula security settings or expose device traffic.