Threat Intelligence Bulletin: 05/29/2020 - 06/04/2020

Thunderspy: An Unpatchable Thunderbolt Security Exploit

A security researcher has discovered a Thunderbolt vulnerability that could allow attackers to bypass system defenses and access the contents of a locked computer's drive in minutes. The new exploit has been dubbed Thunderspy. With just a few minutes of physical access and a couple of hundred dollars of easily purchased equipment, an attacker could bypass a computer's security mechanisms even if it's locked and can encrypt the hard drive. The vulnerability affects all Thunderbolt-equipped machines manufactured before 2019, although macOS devices are only "partially affected." Although exploitation is simple to achieve, it is important to note that physical access is required for successful exploitation. Typically, exploits that require physical access are unlikely to be exploited at-scale. However, in this case, Thunderspy can be used even if the target machine is locked or asleep, making exploitation much more likely than typically is the case.

Recommendations

If you intend to use Thunderbolt connectivity:

• Connect only your own Thunderbolt peripherals. Never lend them to anybody.
• Avoid leaving your system unattended while powered on, even if the screen is locked.
• Avoid leaving your Thunderbolt peripherals unattended.
• Ensure appropriate physical security when storing your system and any Thunderbolt devices, including Thunderbolt-powered displays.
• Consider using hibernation (Suspend-to-Disk) or powering off the system completely. Specifically, avoid using sleep mode (Suspend-to-RAM).

If you do not intend to use Thunderbolt, we strongly recommend to:

• Disable the Thunderbolt controller entirely in UEFI (BIOS). Please note that this renders all Thunderbolt ports inoperable, including USB and DisplayPort connectivity. However, USB-C charging will most likely remain functioning.

Details

Thunderbolt is a high-bandwidth interconnect promoted by Intel and included in laptops, desktops, and other systems. The Thunderspy exploit targets devices with a Thunderbolt port. If your computer has such a port, an attacker who gets brief physical access to it can read and copy all your data, even if your drive is encrypted or if your computer is locked or set to sleep.

Thunderspy enables the creation of arbitrary Thunderbolt device identities and the cloning of user-authorized Thunderbolt devices, even in the presence of Security Levels pre-boot protection and cryptographic device authentication. The exploit can also be used to disable Thunderbolt security and any future firmware updates, increasing the victim’s risk of further future exploitation.

Am I affected?

• No fix is available for systems purchased before 2019.
• For systems purchased in or after 2019, Kernel DMA protection may be available. This partially mitigates Thunderspy. Some information may still be accessible.
• Apple devices running macOS are partially vulnerable to Thunderspy. Apple devices running Windows or Linux are fully vulnerable to Thunderspy.

Conclusion

All Thunderbolt-equipped systems shipped between 2011-2020 are vulnerable. Some systems providing Kernel DMA Protection are partially vulnerable, however some information remains accessible. The Thunderspy vulnerabilities cannot be fixed. In order to mitigate risk, ZeroFOX advises that machines with sensitive information never be let out of the users sight, particularly in public places. When traveling, devices should always be taken in carry on bags. When in public places, devices should never be left unattended, even if they are locked. Taking caution to watch over devices that may be lucrative targets will help prevent potentially sensitive information from being compromised.

Breach Disclosure: Leadhunter

An insecure Elasticsearch cluster has exposed the email and physical addresses, names, phone numbers, and genders of 69 million individuals. The exact source of this information is unclear, however, each row of data contains a reference to “leadhunter.” Although there is a German marketing company with this name, the organization has been confirmed as not being the source of the leaked data.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Similar to another recent breach of unknown origin, popular credential compromise website Dehashed was given the leadhunter data in March 2020. The data is over 110 million rows long, and appears to be aggregated from a variety of sources. Despite the mention of “leadhunter” appearing so frequently, this exposed data has not been attributed to any company associated with the term, and the origin is still unclear.

Figure 1: Sample of data contained in the breach

Breaking News: 2020-05-29 - 2020-06-04

Hackers Compromise Cisco Servers Via SaltStack Flaws

Vulnerabilities in SaltStack have been exploited to compromise six Cisco VIRL-PE servers, us-1.virl.info, us-2.virl.info, us-3.virl.info, us-4.virl.info, vsm-us-1.virl.info, and vsm-us-2.virl.info. The flaws, CVE-2020-11651, an authentication bypass issue, and CVE-2020-11652, a directory-traversal issue, exist in the open-source Salt management framework, which is used in Cisco network-tooling products, Cisco Modeling Labs Corporate Edition (CML), and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE). Cisco has remediated the impacted servers, released software updates for the two vulnerable products, and strongly recommends that customers upgrade to a fixed software release to mitigate risks.

See the full report here: https://threatpost.com/hackers-compromise-cisco-servers-saltstack/156091/

Fortune 500 company NTT discloses security breach

Nippon Telegraph & Telephone (NTT) has disclosed a security breach, impacting nearly 621 customers from its communications subsidiary, NTT Communications. The hackers breached several layers of NTT's IT infrastructure and reached an internal Active Directory to steal and upload data to a remote server. The hack took place on May 7 and was discovered on May 11 and is believed to have originated from an NTT base in Singapore. Following the incident, NTT took down the affected systems. The company is investigating the issue and is yet to notify the impacted customers.

See the full report here: https://www.zdnet.com/article/fortune-500-company-ntt-discloses-security-breach/

Minted discloses data breach after 5M user records sold online - BleepingComputer

A US-based marketplace for independent artists, Minted, has disclosed a security breach after a hacker sold a database containing 5 million user records on a dark web marketplace for $2,500. The information exposed includes Minted customers’ names and account login credentials such as email addresses and hashed passwords. The telephone number, billing address, shipping address, and date of birth may have also been impacted. The company has notified the impacted customers and urges them to change their passwords immediately.

See the full report here: https://www.bleepingcomputer.com/news/security/minted-discloses-data-breach-after-5m-user-records-sold-online/

NSA warns of new Sandworm attacks on email servers

The US National Security Agency (NSA) warns of cyberattacks against email servers, conducted by one of Russia's most advanced cyber-espionage units, Unit 74455 of the GRU Main Center for Special Technologies (GTsST). Also known as "Sandworm," this group has been hacking Exim servers since August 2019 by exploiting a critical vulnerability tracked as CVE-2019-10149. Upon exploitation of CVE-2019-10149, shell script from a Sandworm-controlled domain would be downloaded and executed on the target machine. The shell script is capable of performing tasks such as, adding privileged users, disabling network security settings, updating SSH configurations to enable additional remote access, and executing an additional script to enable follow-on exploitation. The NSA urges private and government organizations to update their Exim servers to version 4.93.

See the full report here: https://www.zdnet.com/article/nsa-warns-of-new-sandworm-attacks-on-email-servers/

New fuzzing tool for USB drivers uncovers bugs in Linux, macOS, Windows

Security researchers have created a new fuzzing tool called USBFuzz for testing the security of USB drivers. The tool has discovered a total of 26 new bugs, including 16 memory bugs of high-security impact in various Linux subsystems (USB core, USB sound, and network), a single bug in FreeBSD, three in macOS (two resulting in an unplanned reboot and one freezing the system), four in Windows 8 and Windows 10 (resulting in Blue Screens of Death), one bug in the Linux USB host controller driver and another one in a USB camera driver. 11 of the Linux bugs have already received respective patches. Researchers plan to open-source the tool on GitHub shortly so it can be used for fuzzing USB drivers in different OS kernels.

See the full report here: https://www.helpnetsecurity.com/2020/05/28/fuzzing-usb-drivers/

200K sites with buggy WordPress plugin exposed to wipe attacks - BleepingComputer

According to Wordfence security researchers, PageLayer, a WordPress plugin, is vulnerable to two high-severity security flaws that could be exploited by attackers to wipe WordPress sites running older unpatched versions of the plugin as well as launch takeover attacks. The first flaw allows an authenticated user with subscriber-level and above permissions to update and modify posts with malicious content. The second flaw allows attackers to forge a request on behalf of a site’s administrator to modify the settings of the plugin which could allow for malicious Javascript injection. To defend against potential attacks, users should immediately update their PageLayer installations to version 1.1.2 which fixes the security issues.

See the full report here: https://www.bleepingcomputer.com/news/security/200k-sites-with-buggy-wordpress-plugin-exposed-to-wipe-attacks/

GitHub warns Java developers of new malware poisoning NetBeans projects

GitHub's security team has uncovered a new malware strain named Octopus Scanner that spreads on its site via boobytrapped Java projects. Nearly 26 projects that were managed using the Apache NetBeans IDE (a tool used to write and compile Java applications) contained Octopus Scanner malware. The malware can run on Windows, macOS, and Linux. It scans the victim's workstation for a local NetBeans IDE installation and proceeds to burrow into the developer's other Java projects. As a last step of infection, it downloads a remote access trojan (RAT), allowing the Octopus Scanner operator to hunt for sensitive information on the victim's system. The purpose of the attack is not necessarily to poison open-source Java projects but to place a RAT on the machines of developers working on sensitive projects or inside major software companies.

See the full report here: https://www.zdnet.com/article/github-warns-java-developers-of-new-malware-poisoning-netbeans-projects/

‘Hack-For-Hire’ Firms Spoof WHO To Target Google Credentials

Google’s Threat Analysis Group (TAG) report reveals that “Hack-for-hire” organizations are the latest group of cybercriminals who are taking advantage of the ongoing coronavirus pandemic, using COVID-19 as a lure in phishing emails to steal victims’ Google credentials. Researchers have spotted a spike in activity from several India-based firms that have created Gmail accounts that spoof the World Health Organization (WHO) to send coronavirus-themed phishing emails. The lures encourage people to sign up for direct notifications from the WHO and link to attacker-hosted websites that bear a strong resemblance to the official WHO website. These websites purport to be fake login pages, that then convince victims to hand over their Google account credentials and personally identifiable information (PII), like their phone numbers.

See the full report here: https://threatpost.com/hack-hire-spoof-who-google-credentials/156100/

Highly-targeted attacks on industrial sector hide payload in images - BleepingComputer

Security researchers have analyzed the attacks which use steganography technique to steal employee credentials from organizations tied to the industrial sector. The attack stems through a phishing email containing a Microsoft Office document with a malicious macro code that decrypts and executes a first PowerShell script that downloads an image from randomly selected addresses on Imgur or Imgbox hosting services and begins extracting the payload. The payload is encoded with Base64, encrypted with RSA, and encoded once more using Base64. The data concealed in the images decrypts to a second PowerShell script that further decodes some of its contents, which reveal a sample of Mimikatz open-source application for getting access credentials on Windows. The use of steganography and public image hosting services allows the threat actor to evade network traffic scanners.

See the full report here: https://www.bleepingcomputer.com/news/security/highly-targeted-attacks-on-industrial-sector-hide-payload-in-images/

Exclusive – Any Mitron (Viral TikTok Clone) Profile Can Be Hacked in Seconds - Internet

An Indian vulnerability researcher has discovered a highly critical and unpatched vulnerability in Mitron android app. Mitron is a re-packaged version of the TicTic app. One can log into any targeted Mitron user profile just by knowing his or her unique user ID, which is a piece of public information available in the page source, and without entering any password.

See the full report here: https://thehackernews.com/2020/05/titok-mitron-app-hacking.html

Nworm: TrickBot gang's new stealthy malware spreading module - BleepingComputer

Researchers have discovered a network spreading module known as 'nworm' developed by Trickbot developers. The new Trickbot module can infect Windows domain controllers by evading detection using new techniques. The nworm run from the system memory and disappears once the system is rebooted. However, fully patched and up-to-date versions of Windows can prevent Trickbot infections.

See the full report here: https://www.bleepingcomputer.com/news/security/nworm-trickbot-gang-s-new-stealthy-malware-spreading-module/

Critical 'Sign in with Apple' Bug Could Have Let Attackers Hijack Anyone's Account

A security researcher has reported a critical vulnerability in 'Sign in with Apple' system. This feature was introduced as a privacy-preserving login mechanism that allows users to sign up an account with 3rd-party apps without disclosing their actual email addresses. While authenticating a user via 'Sign in with Apple,' the server generates JSON Web Token (JWT) containing secret information that a third-party application uses to confirm the identity of the signing-in user. Although Apple asks users to log in to their Apple account before initiating the request, it does not validate if the same person is requesting JSON Web Token (JWT) in the next step from its authentication server. The missing validation allows attackers to provide a separate Apple ID belonging to a victim, tricking Apple servers into generating JWT payload that was valid to sign in into a 3rd-party service with the victim's identity. This could result in a full account takeover. Apple has now patched the vulnerability.

See the full report here: https://thehackernews.com/2020/05/sign-in-with-apple-hacking.html

Amtrak resets user passwords after Guest Rewards data breach - BleepingComputer

The National Railroad Passenger Corporation (Amtrak) disclosed a data breach that exposed the personal information of some Guest Rewards members. Amtrak is an independent US government agency that operates a nationwide rail network in 46 states, the District of Columbia, and three Canadian provinces, with 30 million customers. On April 16, 2020, an unknown third party gained unauthorized access to certain Amtrak Guest Rewards accounts. The company has confirmed that no financial data, credit card info, or Social Security numbers were compromised during this incident and reset the passwords on all potentially affected Guest Rewards accounts. Customers impacted by the Amtrak Guest Rewards data breach were also offered a free one-year membership of Experian’s IdentityWorks identity theft protection service.

See the full report here: https://www.bleepingcomputer.com/news/security/amtrak-resets-user-passwords-after-guest-rewards-data-breach/

A new COVID-19-themed campaign targets Italian users

D3Lab researchers have discovered a new phishing campaign against the users of Istituto Nazionale della Previdenza Sociale (INPS). The malicious activity is carried out through a web domain that has name similar to the official one and downloads malware when users opts for receiving the Covid-19 allowance allocated from the Italian state. Named as acrobatreader.apk, is a Trojan-Banker malware that can monitor the actions performed by the user. The malware asks users to enable the accessibility service to take advantage of the legitimate functions of this service and achieve wider access to the system APIs to communicate with other apps on the device. The users are advised to download the apps from authorized sources.

See the full report here: https://securityaffairs.co/wordpress/104053/cyber-crime/a-new-covid-19-themed-campaign-targets-italian-users.html

Microsoft blocks Trend Micro code at center of driver 'cheatware' storm from Windows 10, rootkit detector product pulled from site

Microsoft cybersecurity team has blocked a free Trend Micro anti-virus tool from running on Windows 10 that appeared to alter its operation and cheat through the stringent certification test for drivers. It is necessary for third-party drivers to pass Microsoft's Windows Hardware Quality Labs (WHQL) certification. After reverse-engineering the driver, which sits at the heart of Trend Micro's Rootkit Buster software, the Microsoft team was able to pinpoint flaws in the code, ascertaining that the software can evade hardware certification tests. Trend Micro has also withdrawn downloads of its rootkit detector that uses the driver, from its website.

See the full report here: https://www.theregister.com/2020/05/27/trend_micro_driver_windows_10/

A New York man was charged with stealing credit card data via SQL Injection attacks

According to US DoJ, a New York City man named Vitalii Antonenko was charged for hacking, credit card trafficking, and money laundering conspiracies. The man was arrested in March 2019 and detained on money laundering charges. He and his co-conspirators obtained the credit card data by hacking into vulnerable computer networks. The hackers launched SQL injection attacks to access vulnerable networks and steal Payment Card Data and other PII. The hackers were able to steal card account numbers, expiration dates, and card verification values, along with other personally identifiable information (PII) and put them on sale on cybercrime marketplaces.

See the full report here: https://securityaffairs.co/wordpress/104031/cyber-crime/man-stole-credit-card-data.html

VivaVideo, “Spyware” App Maker, Contains Remote Access Trojan and Requests Dangerous App Permissions

QuVideo Inc, a Chinese company, developed apps that are found acting as spyware. The 5 apps in the QuVideo network request 2-9 dangerous permissions including reading phone state, GPS location, video audio, and read and write files to external drives. In 2017, the VivaVideo app was identified as spyware by the Indian intelligence community. VidStatus app contains a remote access Trojan known as Android/AndroRat. According to experts, more than 150 million Android users have installed the software are at risk. Android users are recommended to delete the apps.

See the full report here: https://www.securitymagazine.com/articles/92484-vivavideo-spyware-app-maker-contains-remote-access-trojan-and-requests-dangerous-app-permissions

Hackers demand millions in ransom for stolen Stadler Rail documents - swissinfo.ch

The hackers demanded a ransom of $6 million in Bitcoin after stealing data from Swiss train manufacturer Stadler Rail in early May. The company's internal monitoring service had found the attack. When the company refused to negotiate, hackers published some of the stolen documents on the internet and shared images of internal documents via an anonymous Twitter message. The perpetrators claim to have 4 GB of data with no less than 10,000 documents. The blackmailers gave Stadler a second chance to pay the ransom before the publishing of the remaining part of the stolen data. The company has initiated criminal proceedings and is cooperating with all the relevant authorities.

See the full report here: https://www.swissinfo.ch/eng/business/cyberattack-_hackers-demand-millions-in-ransom-for-stolen-stadler-rail-documents/45794036

Joomla team discloses data breach

The team behind the Joomla open source content system (CMS) announced a security breach last week. The incident took place after a member of the Joomla Resources Directory (JRD) team left a full backup of the JRD site (resources.joomla.org) on an Amazon Web Services S3 bucket owned by their company. The backup file was not encrypted and contained details for roughly 2,700 users who registered and created profiles on the JRD website. The exposed details include name, business address, business email address, phone number, company URL, nature of the business, encrypted password (hashed) IP address, and newsletter subscription preferences. All JRD users are advised to change their password on the portal, and also on other sites where they reused the password.

See the full report here: https://www.zdnet.com/article/joomla-team-discloses-data-breach/

Hacker leaks database of dark web hosting provider

A hacker has publicly leaked the database of Daniel's Hosting (DH), the largest free web hosting provider for dark web services. The leaked data was obtained after the hacker breached DH earlier this year, on March 10, 2020. The hacker breached the portal, stole its database, and then wiped all servers. The hacker that goes by the name KingNull uploaded a copy of the stolen database on a file-storing portal. The leaked data includes 3,671 email addresses, 7,205 account passwords, and 8,580 private keys for .onion (dark web) domains. DH has shut down its service and has urged users to move their sites to new dark web hosting providers.

See the full report here: https://www.zdnet.com/article/hacker-leaks-database-of-dark-web-hosting-provider/

Ransomware locks down the Nipissing First Nation - BleepingComputer

The Nipissing First Nation administration suffered a ransomware attack on May 8, 2020, that disrupted the functioning of all departments of its administration. Nipissing First Nation (NFN) is an urban reserve with 11 communities spread on the shore of Lake Nipissing. NFN staff was able to interrupt the attack upon discovery and immediately shut down all servers and discontinued remote access. A preliminary investigation revealed that none of the personal or confidential information was compromised.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-locks-down-the-nipissing-first-nation/

Office 365 to give detailed info on malicious email attachments - BleepingComputer

Microsoft will soon provide its Office 365 Advanced Threat Protection (ATP) users with more details on malware samples and malicious URLs discovered following detonation. Along with the detonation chain, Microsoft also plans to share a detonation summary, with details such as detonation time range, the verdict of the file or URL, related entities, screenshots, and more. The detonation service is used by Office 365 ATP to check file attachments and embedded links in real-time and is designed to expose malicious signals including behaviors like dropped and downloaded files, registry manipulation for persistence and storing stolen information, outbound network connections, and more. The company plans to roll out the update during June 2020 for all Office 365 environments with an Advanced Threat Protection plan.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-to-give-detailed-info-on-malicious-email-attachments/

Ransomware Attack Kidnaps Austrian City By Cointelegraph - Investing.com

Weiz, an Austrian village, suffered a NetWalker ransomware attack, impacting the public service system. The hackers used COVID-19 lures as bait through phishing emails, embedded with malicious links, to penetrate the village's public network. The attack resulted in the exposure of stolen data from building applications and inspections.

See the full report here: https://www.investing.com/news/cryptocurrency-news/ransomware-attack-kidnaps-austrian-city-2187944

Data on Indian Mobile Payments App Reportedly Exposed via Open S3 Bucket

Data belonging to millions of Indian citizens who had signed up for an Indian mobile payment app called BHIM may have been put at risk after it was left exposed and unencrypted in a misconfigured Amazon S3 storage bucket. According to the vpnMentor researchers, the S3 bucket contained 409GB of data representing 7.26 million records of customers. The data included scans of national ID cards; photos used as proof of residence; professional certificates, degrees, and diplomas; and names, date of birth, and religion. It also included ID numbers for government programs and biometric identifiers such as fingerprint scans. The National Payments Corporation of India (NPCI), which launched BHIM in 2016, however denied that any user data had been compromised.

See the full report here: https://www.darkreading.com/attacks-breaches/data-on-indian-mobile-payments-app-reportedly-exposed-via-open-s3-bucket/d/d-id/1337968

VMware discloses important local privilege escalation bug in 3 products - SC Magazine

VMware’s latest security advisory discloses three vulnerabilities spread out among five products. The most significant of this trio is time-of-check time-of-use (TOCTOU) flaw in the service opener of Fusion, VMRC, and Horizon Client that can be locally exploited to escalate privileges to root. Designated as CVE-2020-3957, the bug was fixed in version 11.5.5. Vmware has also issued fixes for a denial-of-service vulnerability (CVE-2020-3958) in the shader functionality of ESXi, Workstation and Fusion and a memory leak vulnerability (CVE-2020-3959) in the VMCI module of ESXi, Workstation and Fusion. Patches for VMRC and Horizon Client are still forthcoming.

See the full report here: https://www.scmagazine.com/home/security-news/vulnerabilities/vmware-discloses-important-local-privilege-escalation-bug-found-in-3-products/

Google brings the Advanced Protection Program to Nest devices - BleepingComputer

Google has announced its Advanced Protection Program for nest devices. The program is mainly aimed at high-risk targets such as journalists, activists, business leaders, and political teams, but it is available for anyone to join. To enroll, users need two security keys, such as a Google Titan key or other FIDO-based security keys. When enrolled, the program provides enhanced protection against Google account phishing attacks, data theft, malicious apps. In addition to phishing and account protection, the Advanced Protection Program will also prevent from installing third-party apps, limit what web apps have access to the Google data, and add stronger account recovery verifications if keys are lost.

See the full report here: https://www.bleepingcomputer.com/news/google/google-brings-the-advanced-protection-program-to-nest-devices/

REvil ransomware gang publishes 'Elexon staff's passports' after UK electrical middleman shrugs off attack

REvil/Sodinokibi ransomware group hacked UK power grid middleman Elexon and published the stolen files on their shaming website. The company was reported to be hacked two weeks ago. The stolen documents include documents that appeared to be passports of Elexon staff members and an apparent business insurance application form. The company is yet to confirm the incident.

See the full report here: https://www.theregister.com/2020/06/01/elexon_ransomware_was_revil_sodinokibi/

Apple has just patched the recent iOS 13.5 jailbreak

Apple has released an emergency update for iOS to repair a vulnerability in the kernel that could grant the attackers with root access and run arbitrary code with kernel privileges. This update comes after the release of the "Unc0ver jailbreak" that could virtually hack any iPhone. The details of the vulnerability are not yet public. Apple users are advised to apply the security patches.

See the full report here: https://techcrunch.com/?p=1996905

G Suite Marketplace primed for a privacy scandal, researchers warn

Researchers at Two Six Labs have analyzed the permissions requested by third-party Google apps listed on the G Suite Marketplace and revealed that these apps communicate with undisclosed external services, that create an opportunity for secret data exfiltration from Google accounts. They spotted another issue with the G Suite Marketplace's review process. Since the review process takes a long turnaround to make API calls and categorize them as either sensitive or restricted, Google allows app developers to list apps as "unverified" on the G Suite Marketplace. Although Google restricts the installation of unverified apps to 100, researchers found many unverified apps that gained more than 100 users. Researchers have warned that this may result in malicious apps being uploaded on the store for the sole purpose of collecting data from Google users.

See the full report here: https://www.zdnet.com/article/g-suite-marketplace-primed-for-a-privacy-scandal-researchers-warn/

Severe Cisco DoS Flaw Can Cripple Nexus Switches

Cisco's NX-OS software is vulnerable to a high-severity flaw (CVE-2020-10136) that could allow an unauthenticated, remote attacker to bypass the input access control lists (ACLs) configured on affected Nexus switches, and launch a denial of service (DoS) attacks on the devices. According to Cisco, a successful exploit could cause the affected device to unexpectedly decapsulate the IP-in-IP packet and forward the inner IP packet. The flaw impacts Nexus 1000, 3000, 5500, 5600, 6000, 7000, and 9000 series, and Cisco Unified Computing System (UCS) 6200 and 06300 Series Fabric Interconnects. Users can check if their version of Cisco NX-OS is impacted using a checking tool available on Cisco’s advisory and update to the fixed versions respectively.

See the full report here: https://threatpost.com/cisco-dos-flaw-nexus-switches/156203/

Two Critical Android Bugs Open Door to RCE

Android is vulnerable to two critical bugs (CVE-2020-0117 and CVE-2020-8597) that could allow a remote attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process, impacting Android versions 8 to 10. Depending on the privileges associated with the application, an attacker could also install programs, view, change or delete data, or create new accounts with full user rights. Google has addressed these critical flaws in its latest monthly Android update along with many other high-severity flaws. Users are advised to update to the latest fixed version to mitigate risks.

See the full report here: https://threatpost.com/two-critical-android-bugs-rce/156216/

Ransomware gang says it breached one of NASA's IT contractors

DopplePaymer ransomware gang claims to have breached the network of Digital Management Inc. (DMI), a Maryland-based company that provides managed IT and cyber-security services on demand. To support their claims, the DopplePaymer gang posted on their dark web site nearly 20 archive files, including HR documents to project plans. The group also posted a list of 2,583 servers and workstations that they claim are part of DMI's internal network, and which they have encrypted and are now holding for ransom. DMI is yet to respond to the claims.

See the full report here: https://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/

REvil ransomware creates eBay-like auction site for stolen data - BleepingComputer

The REvil ransomware group, also known as Sodinokibi, has introduced a new section on their data leak site used to conduct auctions and sell victim's stolen data to the highest bidder. The ransomware gang also uses the site to post samples of the stolen data and then threaten to release the actual files and eventually post a link to the stolen data so that other threat actors can use it for free if the victims do not meet the ransom demand. Currently, the ransomware operators are auctioning the stolen data for two companies.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomware-creates-ebay-like-auction-site-for-stolen-data/

Attackers Target 1M+ WordPress Sites To Harvest Database Credentials

Between May 29 and May 31, researchers successfully blocked over 130 million attacks targeting 1.3 million WordPress websites. The attackers attempted to download WordPress websites configuration files and harvest their database credentials. The campaign unsuccessfully tried to exploit old cross-site scripting (XSS) vulnerabilities in WordPress plugins and themes. Researchers urge websites that may have been compromised to change their database password and authentication unique keys and salts immediately.

See the full report here: https://threatpost.com/attackers-target-1m-wordpress-sites-to-harvest-database-credentials/156255/

YouTube channel credentials in high demand on hacker forums - BleepingComputer

Security researchers have observed an increased demand for stolen YouTube credentials on cybercrime forums where access to the accounts was sold in bulk. Youtube channels provide hackers a new audience to expose to fraudulent activities. The hackers can even hijack the Youtube channels and ask the legitimate owner to pay a ransom to get it back. YouTube community support is filled with complaints from users that lost access to their channel and were demanded a ransom. The data comes mostly from infected computers, phishing campaigns, or logs of credentials. It is combed for logins to specific services and then auctioned on forums.

See the full report here: https://www.bleepingcomputer.com/news/security/youtube-channel-credentials-in-high-demand-on-hacker-forums/

Google Faces $5B Lawsuit for Tracking Users in Incognito Mode

A complaint has been filed in federal court that claims Google collects data via Google Analytics and Google Ad Manager, along with other applications and plug-ins, violating users' privacy by collecting their data while they searched the Web in incognito mode or private browsing. The complaint also claims that Google misled millions of people into thinking their information and habits were private while they used incognito browsing. The lawsuit seeks at least $5 billion in damages per person for violations of federal wiretapping and California privacy laws.

See the full report here: https://www.darkreading.com/endpoint/google-faces-$5b-lawsuit-for-tracking-users-in-incognito-mode/d/d-id/1337997

San Francisco retirement program SFERS suffers data breach - BleepingComputer

The San Francisco Employees’ Retirement System (SFERS), managing the benefits program for active and retired employees of San Francisco, California, suffered a data breach, impacting nearly 74,000 SFERS members data from no later than August 29th, 2018. On February 24, 2020, an unauthorized person gained access to a database hosted in a test environment that was set up by one of SFERS vendors. According to the breach notification, the leaked information for all members includes a member's name, address, date of birth, and beneficiary information. Retired members also had IRS Form 1099R information (excluding SSN) and the direct deposit bank account routing numbers exposed. Finally, if a member had registered at the site, the leaked information would have included their login name and security questions and answers. SFERS is offering a complimentary one-year membership of Experian’s IdentityWorks monitoring service for the impacted members.

See the full report here: https://www.bleepingcomputer.com/news/security/san-francisco-retirement-program-sfers-suffers-data-breach/

Netwalker ransomware continues assault on US colleges, hits UCSF - BleepingComputer

The Netwalker ransomware group has allegedly infected the University of California San Francisco (UCSF), stolen unencrypted data, and encrypted their computers. To support their claim, the NetWalker operators have posted screenshots of some of the stolen files, including images of student applications with social security numbers, a spreadsheet, and folder listings that appear to contain employee information, medical studies, and financials. UCSF is yet to respond to the incident.

See the full report here: https://www.bleepingcomputer.com/news/security/netwalker-ransomware-continues-assault-on-us-colleges-hits-ucsf/

Hackers hijack one of Coincheck's domains for spear-phishing attacks

Japanese cryptocurrency exchange Coincheck stated that the hackers gained access to its account at Oname[.]com (company's domain registrar provider) on Sunday, May 31st, 2020. According to the researcher, the hackers modified the primary DNS entry for Coincheck's coincheck[.]com domain. The hacker registered a lookalike domain to the AWS server since Coincheck uses Amazon's managed DNS service and replaced the original awsdns-61[.]org with awsdns-061[.]org inside the Oname[.]com from the backend which allowed them to manage DNS queries for the Coincheck portal. Further, the hackers sent spear-phishing emails to certain users by impersonating the coincheck[.]com domain and redirecting email replies to their servers.

See the full report here: https://www.zdnet.com/article/hackers-hijack-one-of-coinchecks-domains-for-spear-phishing-attacks/