Threat Intelligence Bulletin: 09/06/2019 - 09/13/2019

One Data Breach Occurred This Week

One data breach was disclosed this week, affecting Void[.]to.

For full details on this breach, please see the full disclosures here:

Void[.]to https://cloud.zerofox.com/alpha_team/advisories/794

Breach Disclosure: Void.To

In June 2019, cracking website and community Void[.]to was compromised. The website has a number of forums dedicated to sharing leaked data, video game cheats, general hacking and coding discussion and a marketplace to sell access to machines, cheats and malware. Rival forum Raidforums uploaded the database to their "Official" database forum on June 13, 2019. The leak contains approximately 86,000 rows of usernames, email addresses, passwords, source code and website data.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

Raidforums administrator Omnipotent posted the breach, with the following text:

"Hello RaidForums Community,
Today I have uploaded the VoidTO Forum Database for you to download for free, thanks for reading and enjoy!

|Notes|
On the 13th of June 2019 the forum void[.]to was breached and server shredded, 86,312 users were affected. I have uploaded the full database and root directory of this website for you to download and see for yourself. I hope you enjoy these leaks as I enjoy posting these websites with incapable or ignorant admins/owners who could care less for their users' security. To all reading, have a good day and enjoy the data.

Compromised data: Website activity, Usernames, Emails, IP Addresses, Passwords (Salted MD5 or Sha512_Bcrypt), Source code, Website data, User private messages"

This breach, like the Cracked[.]to and OGUsers breach, shows that crack and leak forums like Void[.]to need to worry about rival forums and not just network defenders and law enforcement.

Alpha Team Research: DNS Over HTTPS (DoH) Case Study

DNS Over HTTPS (DoH) has been a hot topic since the inception of the RFC 8484 in 2018. The goal of DoH, as well as general DNS over TLS (DoT), is to help provide a layer of privacy for end-users who want to prevent the monitoring of traffic, especially in an environment where privacy concerns are a lot higher. Firefox and Chrome both recently shipped support for DoH, and they both connect to Cloudflare which is running their implementation of a DoH tunnel, cloudflared. Network defenders are worried about this implementation, as it has been used by miscreants and malware authors to bypass DNS monitoring altogether.

Recommendations

• Continue monitoring the Alpha Team page on your ZeroFOX Platform for updates on DoH related malware
• Update network and host signature detections with malware that abuses DoH

Details

A fantastic report released by SANS on September 10 outlines the history of DoH, its use as malware, some open source projects and outlines a number of experiments ran with the protocol.

The earliest report of a malware family using DoH is the Godlua backdoor. This malware exploited CVE-2019-3396 in Atlassian's Confluence Server to gain access. Once exploited, the malware used a lightweight Lua-based RAT to connect to its command and control server with the DoH protocol. Only 2 types of commands were implemented in the Linux variant, which was running custom files and executing Linux commands. Another attack using DoH was found by MyOnlineSecurity, where a malware sample used DoH to retrieve a TXT record that was a Base64 encoded URL used to retrieve a spam webpage. In both cases, the implication of DoH in an environment demonstrates the classic conundrum of security versus privacy and how both can be at odds with each other.

For detection, the researcher suggested a few methods. First, TLS inspection would be the easiest way to find DoH, but it comes with a cost of implementation and maintenance. Next, using traditional IDS technologies such as Zeek or Snort, one can write rules that detect whether a machine is connecting to websites that have not had a previous DNS resolution, as this can tip off a DoH C2 tunnel. Application logging can help here as well, but only tell part of the picture as opposed to the 2 previously described methods.

One of the easiest methods in the paper for blocking DoH is to blacklist known DoH servers in your organization's infrastructure, which at the time of this writing is Google and Cloudflare. The problem here is that malware authors can use open source tools such as cloudflared to make their own DoH server, rendering this mitigation method ineffective.

Breaking News: 2019-09-06 - 2019-09-13

Thousands of servers infected with new Lilocked (Lilu) ransomware

A new and unusual strain of ransomware has been identified. Called Lilocked, or Lilu, thousands of infected web servers have been identified since mid-July. This ransomware seems to only target Linux systems, which is rare for ransomware. It also only encrypts a small selection of file types, which generally do not render the system unusable.

See the full report here: https://www.zdnet.com/article/thousands-of-servers-infected-with-new-lilocked-lilu-ransomware/

Exim TLS Flaw Opens Email Servers to Remote 'Root' Code Execution Attacks

Open-source email server Exim contains a flaw that when exploited, could allow for remote code execution. Attackers can send a Server Name Indication (SNI) ending in a backslash-null sequence during the initial TLS handshake in order to trigger this - which means that any Exim server that accepts TLS connections is vulnerable. A patch has been released for this in version 4.92.2.

See the full report here: https://thehackernews.com/2019/09/exim-email-server-vulnerability.html

Joker Spyware Found in 24 Google Play Apps

24 applications on the Google Play Store have been removed after they were found to contain Joker spyware. This spyware displays unwanted malicious ads to victims, and also signs victims up for paid premium subscriptions without their consent. Prior to takedown, these apps had been downloaded a collective 472,000 times.

See the full report here: https://threatpost.com/joker-spyware-google-play-apps/148053/

Multiple Code Execution Flaws Found In PHP Programming Language

Multiple remote code execution vulnerabilities have been found in PHP. Even failed exploitations attempts of these vulnerabilities would likely result in a denial of service. These vulnerabilities have been patched in versions 7.3.9, 7.2.22, and 7.1.32.

See the full report here: https://thehackernews.com/2019/09/php-programming-language.html

FunkyBot Malware Intercepts Android Texts, 2FA Codes

New spyware, FunkyBot, is targeting Android users in Japan. The malware poses as a legitimate application to encourage users to download it, then later sends a mass text to a victim's entire contact list with a link to the malware in order to spread itself. It also sets itself as the default SMS handling application, giving it access to all texts on an infected device, including those associated with multi-factor authentication. Interestingly, it uses Instagram in its C2 communications.

See the full report here: https://threatpost.com/funkybot-malware-intercepts-android-texts-2fa-codes/148059/

600,000 GPS trackers left exposed online with a default password of '123456'

600,000 GPS trackers from the Chinese IoT company Shenzhen i365-Tech are using the default password "123456." Over 30 models of this manufacterer have been found using this password. Anyone who logs in with this password has access to the tracker's location using the attached SIM card phone number, and can even eavesdrop on conversations taking place near the tracker.

See the full report here: https://www.zdnet.com/article/600000-gps-trackers-left-exposed-online-with-a-default-password-of-123456/

What a bunch of DoSers: Wikipedia says it was walloped by 'bad faith' actors over weekend

Wikipedia was targeted by a barrage of denial of service attacks over the weekend, rendering European and UK versions of the site intermittently unavailable. A low-level actor group, UKDrillas, has taken credit for the attacks on Twitter. Access to the site has since been restored.

See the full report here: https://www.theregister.co.uk/2019/09/09/wiki_ddos_attack/

Telnet backdoor vulnerabilities impact over a million IoT radio devices

Vulnerabilities have been identified in Telestar IoT radio devices. An undocumented Telnet service was found running on port 23, accessible by external attackers. This service can be exploited to gain root access, enabling attackers to fully hijack the device. Ultimately, this could be used to build a botnet or otherwise distribute malware via compromised devices. A patch has since been released by the manufacturer.

See the full report here: https://www.zdnet.com/article/critical-vulnerabilities-impact-over-a-million-iot-radio-devices/

New Malware Uses Windows BITS Service to Stealthy Exfiltrate Data

New malware has been attributed to the Stealth Falcon threat actor group. This malware uses the Microsoft BITS (Background Intelligence Transfer Service) to communicate with its command and control servers. Utilizing a built-in Microsoft component makes these C2 communications more difficult to detect. The Stealth Falcon actor group has been active since 2012, and has targeted journalists and activists in the Middle East.

See the full report here: https://thehackernews.com/2019/09/stealthfalcon-virus-windows-bits.html

Hacked Instagram Account of Robert Downey Jr. Pushes iPhone Giveway - BleepingComputer

Yet another celebrity social media account has been compromised in the recent wave of high-profile account takeovers. Robert Downey Jr's Instagram account was hijacked, and used to post links to fake giveaway scams. Allegedly, users who clicked the links would be entered to win an iPhone XS, Apple Watch, Tesla, or MacBook Pro, however, these links really just led to phishing surveys.

See the full report here: https://www.bleepingcomputer.com/news/security/hacked-instagram-account-of-robert-downey-jr-pushes-iphone-giveway/

Critical Exim Flaw Opens Millions of Servers to Takeover

Exim, an open-source mail transfer agent for UNIX-like operating systems, contains a potential remote code execution vulnerability in it's latest versions. A specially crafted TLS packet that abuses how Exim interprets SNI requests results in a buffer overflow, which can in turn be used for remote code execution. According to the article, there are over 5 million servers worldwide with Exim publicly listening and serving clients.

See the full report here: https://threatpost.com/critical-exim-flaw-opens-millions-of-servers-to-takeover/148108/

New Release Brings BlueKeep to Metasploit

It finally happened - a pull request on Metasploit's Github added Bluekeep to its capabilities. The original Bluekeep CVE was reserved in November of last year and was first reported publicly in May of this year. Out of the 142019 unique vulnerabilities talked about on Twitter this year, CVE-2019-0708 is the most talked about vulnerability.

See the full report here: https://www.darkreading.com/threat-intelligence/new-release-brings-bluekeep-to-metasploit/d/d-id/1335765

Lilocked Ransomware Infects Thousands of Linux Servers to Encrypt Files - Security Intelligence

Linux ransomware is on the rise, this time with a strain called Lilu. Lilu specifically targets Linux web servers, and mostly encrypts web-server based files. At the time of writing, researchers have yet to figure out how the ransomware makes it way to the webservers.

See the full report here: https://securityintelligence.com/news/lilocked-ransomware-infects-thousands-of-linux-servers-to-encrypt-files/

Google to Experiment 'DNS over HTTPS' (DoH) Feature in Chrome 78

Google responds to Firefox's announcement with their own DoH (DNS over HTTPS) implementation in Chrome 78. This has lead to concerns from network defenders as it will be much harder to perform malicious traffic analysis without breaking TLS, which is a significant cost that not all companies are williing to invest in.

See the full report here: https://thehackernews.com/2019/09/chrome-dns-over-https.html

Intel Patches Privilege Escalation Flaw in Easy Streaming Wizard - BleepingComputer

It is not often you see a patch from Intel, but the company released two security updates for their software and hardware products that could allow attackers to do a privilege escalation and information disclosure on a victim machine, without any user interaction. The hardware fix was on their Intel Xeon processor family, which could allow an attacker to abuse a race condition to access information that they were not authorized to access.

See the full report here: https://www.bleepingcomputer.com/news/security/intel-patches-privilege-escalation-flaw-in-easy-streaming-wizard/

Hundreds of BEC Scammers Arrested in Nigeria and U.S. $3.7 Million Recovered

Hot off the heels of the BEC talk at Derbycon, the FBI announced today that there were 281 arrests related to a massive BEC ring. The largest arrests were in Nigeria, a staggering 167 suspects, with other arrests in the US, UK, France, Ghana, Kenya, Japan and Malaysia. The FBI's IC3 just recently published statistics around BEC, saying it has caused $26 Billion dollars in loss from 2016 to 2019.

See the full report here: https://thehackernews.com/2019/09/nigerian-bec-scams-arrested.html

Microsoft Patch Tuesday Sept. 2019: Vulnerability disclosures and Snort coverage

Massive patch tuesday from Microsoft - 19 critical vulnerabilities that all can result in remote code execution, 65 important and 1 moderate vulnerability patched. Of the 19 critical, the vulnerable services include Windows RDP, Sharepoint, Hyper-V, Chakra, VBScript, Azure DevOps server and the Windows OS.

See the full report here: https://blog.talosintelligence.com/2019/09/microsoft-patch-tuesday-sept-2019.html

Iranian Hackers Hit Over 60 Universities to Get Library Access - BleepingComputer

Cobalt Dickens, an APT associated with the Iranian government, was caught running a phishing operation in July and August of this year. The operation involved targeting 60 universities in 60 separate counrties. The group uses free domains operated by the Freenom domain service and free TLS certificates from Lets-Encrypt to save some money and reduce attribution from paying for infrastructure.

See the full report here: https://www.bleepingcomputer.com/news/security/iranian-hackers-hit-over-60-universities-to-get-library-access/

Intel CPUs Vulnerable to Sensitive Data Leakage in NetCAT Attack

A new vulnerability for Intel processors dubbed NetCAT (not to be confused with the popular command line networking tool) was released by researchers affecting Intel CPUs since 2012. This vulnerability is a side-channel vulnerability that allows attacks to abuse a timing attack using a remote cache side channel, thus resulting in data leakage of potentially sensitive information. The researchers here demonstrated it on an SSH server, and although impressive, it's not easy to exploit.

See the full report here: https://threatpost.com/intel-cpus-vulnerable-data-leakage-netcat/148221/

New SIM Card Flaw Lets Hackers Hijack Any Phone Just By Sending SMS

A scary development in the SIM Swapping world - this attack abuses an app that allows telco's to easily manage SIM cards. Unlike traditional SIM swap attacks, where it involves social engineering a telco employee, this one abuses a vulnerability in an app called S@T browser which allows attackers to remotely transfer the SIM from a victim phone to an attacker controlled phone. Furthermore, the researchers who discovered this attack say that they "..are quite confident that this exploit has been developed by a specific private company that works with governments to monitor individuals".

See the full report here: https://thehackernews.com/2019/09/simjacker-mobile-hacking.html

Silk Road 3.1 is Back?

The infamous dark web marketplace Silk Road 3.1 looks to be back after a partial exit scam. User dax posted on Dread, the Dark Web version of reddit, about the re-birth of the website. The post claims that the site is fully functional and open for business.

See the full report here: https://twitter.com/DarkDotFail/status/1171167452513914881