Breach Disclosure: OGusers

On May 19 2019, Brian Krebs published a story about a data breach of a popular account hijacking forum, OGusers. OGusers is a website that is well-known for their SIM swapping attacks and taking over accounts of their victims. On May 12, administrators of OGusers posted about an 'outage' of the website which resulted in loss of several months of messages. On May 16, an administrator of RaidForums uploaded the entire OGusers database for anyone to download for free on the website. The website contained 161,000 email addresses, usernames, IP addresses, private messages and salted md5 password hashes.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The attack here is rather ironic - a forum dedicated to compromising accounts had their accounts compromised by a rival forum. Omnipotent, the administrator of RaidForums, posted the following text in their leak thread:

"Hello RaidForums Community, Today I have uploaded the OGUsers Forum Database for you to download for free, thanks for reading and enjoy!

|Notes| On the 12th of May 2019 the forum ogusers.com was breached 112,988 users were affected. I have uploaded the data from this database breach along with their website source files. Their hashing algorithm was the default salted MD5 which surprised me, anyway the website owner has acknowledged data corruption but not a breach so I guess I'm the first to tell you the truth view his statement here or if you don't want to visit their website view it here. According to his statement he didn't have any recent backups so I guess I will provide one on this thread lmfao.

Compromised data: Website activity, Usernames, Emails, IP Addresses, Passwords (Salted MD5), Source code, Website data, User private messages"

Cybercriminals Steal 100,000 from Crypto User via Sim Port Attack

On May 20 2019, a Medium post by Coinmonks contributor Sean Coonce chronicled a harrowing tale of how he lost over $100,000 in cryptocurrency from a SIM port attack. In the world of cybercrime, SIM porting is a method where an attacker impersonates their victim to a phone carrier and convinces the carrier to transfer ownership of the phone number to an attacker-controlled phone. Although the service to port SIMs is a legitimate offering by carriers, it is often abused by criminals to take over a user's phone. Depending on how much the victim relies on their mobile phone number for the security of their accounts, an attacker can theoretically gain access to most of the victim's accounts by issuing reset codes directly via text.

Recommendations

• Contact your carrier and ask to put a PIN passcode on your account as a layer of protection
• Consider using a two-factor authentication application instead of text messages for your auth workflows
• If you have to use text messages, use a VOIP service like Google Voice, which cannot be SIM swapped

Details

The blog post goes into detail of a multi-day fiasco where the author thought he was dealing with a bad SIM card. He believed that the attackers gained enough personally identifiable information from his social presence in order to socially engineer his phone carrier. This news comes a few days after the breach announcement for the infamous account hijacking forum, OGusers. Wired published an article in 2018 on preventing SIM port attacks, but protections can differ by carrier.

Vulnerability Disclosure: Researcher drops 3 Windows 10 0-days

On May 22 2019, security researcher SandboxEscaper dropped 3 Windows 10 0-days on their Github. Two of the 0-days are local privilege escalations (LPE) and one is a sandbox escape for IE11. US CERT/CC Vulnerability Analyst Will Dormann confirmed on Twitter that the LPEs worked on a fully patched Windows 10 machine. SandboxEscaper released 4 Windows 0-days last year without notifying Microsoft last year. As reported by ZDnet, the vulnerabilities released last year were weaponized as early as 3 weeks from the disclosure.

Recommendations

• Enable Cyber Attack Chatter rule and add relevant terms related to these vulnerabilities
• Patch your Windows systems as soon as Microsoft releases security updates

Details

There has been little information why SandboxEscaper released these vulnerabilities other than having gripes with Microsoft. The researcher started talking about the bugs on their personal blog on May 21, 2019, advertising them for no less than $60,000 each. Both LPEs abuse how Windows Task Scheduler parses Discretionary-Access-Control-Lists. The third vulnerability is in Internet Explorer 11. As of May 22, 2019, the Github repo is up.