Breach Disclosure: Rome Lawyers

On May 07 2019, an article published by Repubblica revealed a data breach of emails belonging to 30,000 lawyers in Rome. Anonymous Italy claimed responsibility for the breach in a tweet that same day. Although no passwords were revealed in the breach, sensitive emails and around 42,000 unique e-mail addresses were leaked to the public.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The tweet itself tagged the mayor of Rome, Virginia Raggi. The tweet also contained a link to a blog published by the group, where they outlined the attack as well as provided links to the data troves. The attackers posted screenshots of an administrator and webmail service with direct links to the respective pages, so it looks like they accessed the emails directly. The breach appears to be a retaliation for the arrest of two Anonymous-IT members, Aken and Otherwise, who were arrested years prior.

Massive Data Leak at First American Title Company

First American, a financial company that deals with real estate title insurances for Fortune 500 companies, leaked hundreds of millions of documents related to the deals as reported by Brian Krebs. The May 24 2019 report outlined a disclosure by a real estate developer to Brian Krebs after the company failed to respond to the developer. The trove of documents dated back to as early as 2003, and contained sensitive PII as well as financial documents related to title deals for the company.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The website was supposedly vulnerable to a traversal attack. If an attacker knew just one linke with an ID on the website, for example ?id=500, then they could increment or decrement the counter to retrieve every single document stored in the system. Krebs did not have any proof that this data was used by fraudsters, but commented that this could be a gold mine for BEC criminals. The criminals trick victims into fraudulently wiring money to attacker controlled accounts by impersonating legitimate people, such as executives or in this case, real estate brokers.

Docker Race Condition Vulnerability Leads to Host Filesystem Access

On May 28 2019, security researcher Dennis Fisher released a blog post detailing a vulnerability in Docker that allows attackers to get read and write access to any path on the host Docker server. The CVE issue number is CVE-2018-15664, which addresses this specific vulnerability in Linux. The vulnerability is the result of a race condition in how the Docker software handles symbolic links on the container filesystem. The race condition falls under a class of problems called time of check to time of use (TOCTOU).

Recommendations

• Upgrade Docker as soon as the company releases a fix for the CVE
• Consider updating the Cyber Attack Chatter rule to listen for chatter of CVE-2018-15664 being used in the wild

Details

The function call FollowSylinkInScope is the vulnerable function. The function is supposed to take a given path and safely resolve it within the container. If the attacker can add a symlink component after the path resolution but before it is operated on, then the attacker can resolve a path on the host machine, breaking out of the container. The researcher who found the bug, Aleksa Sarai, coordinated with the Docker security team, and the two parties agreed to release the vulnerability before the fix in order for the public to adjust their security postures as needed.