Cyware Monthly Threat Intelligence

Monthly Threat Briefing • May 31, 2019
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Monthly Threat Briefing • May 31, 2019
The Good
As we gear up to a new month of the year, let’s quickly glance through all that happened over the past month. Before we get into the cybersecurity incidents and the new threats, let’s first acknowledge all the positive events that happened over the past month. Google has added two new privacy and security features in Chrome. Microsoft has introduced the passwordless authentication method ‘Windows Hello’, to enable Windows 10 users to sign in to their devices using biometric. Meanwhile, Amazon has launched a new feature dubbed ‘Alexa Guard’ which transforms the Echo smart speaker into a smart home security system.
Google plans to add two new privacy and security features in Chrome, namely same-site cookies and anti-fingerprinting protection. The anti-fingerprinting protection blocks certain types of ‘user fingerprinting’ techniques that are being abused by online advertisers.
Microsoft has announced the passwordless authentication method ‘Windows Hello’, that allows Windows 10 users to sign in to their devices using biometric information. The FIDO2 certified authenticator, Windows Hello enables users to authenticate secure access to their devices with a fingerprint, iris scan or facial recognition.
Researchers from the University of Bath and Goldsmiths and the University of London are developing a technology inspired by fitness trackers that could prevent cyber attacks. This technology would signal when someone is resetting a password or updating anti-virus software with sound, lights, and vibration.
Amazon has introduced a new feature dubbed ‘Alexa Guard’ which transforms the Echo smart speaker into a smart home security system. Alexa Guard feature will send alerts to users via their mobile devices if any problem is suspected at home. This feature is compatible with the Amazon Echo, Echo Dot, Echo Plus, Echo Show, Echo Spot, and Echo Input.
New York’s Department of Financial Services has announced the formation of a dedicated ‘Cybersecurity Division’, which will focus on protecting consumers and industries from cyber threats. The new division will enforce cybersecurity regulation, advise on cybersecurity issues, provide guidance on DFS’s cyber regulation, and conduct cyber-related investigations.
Singapore to launch a tool called ‘SG-Verify’ as a part of its smart nation efforts. This tool enables businesses to verify user identity and transfer data via QR codes. In addition, this tool will enhance situational awareness through the collection, sharing, and analysis of data and help government agencies provide more pre-emptive and responsive services.
The Bad
The month of May witnessed numerous data breaches and cyber attacks that saw the exposure of millions of people's personal information across the globe. Amazon has disclosed that it was hit with an extensive fraud last year, where attackers compromised almost 100 seller accounts and stole the loan funds. The networks of Baltimore City Hall and Potter County have been infected with ransomware, forcing the local authorities to shut down the majority of its servers. Last but not least, HCL has inadvertently leaked employees’ personal information and plaintext passwords, customer reports, and web applications for managing personnel.
Amazon has revealed that it was hit with an extensive fraud last year, where attackers compromised almost 100 seller accounts and stole the loan funds. Amazon noted that the accounts were likely compromised by phishing techniques that tricked sellers into providing their account details and login credentials.
A new group dubbed ‘Mirrorthief’ has injected JavaScript-based payment card skimming script on the payment checkout pages of almost 201 campus online stores in the US and Canada. The malicious skimming script designed to steal payment card and personal details of customers is Trojan.JS.MIRRORTHEIF.AA.
Attackers have targeted GitHub, GitLab, and Bitbucket users by replacing the code and commits from the victims’ Git repositories and leaving a ransom note that demands a ransom payment of 0.1 Bitcoin (~$570). A GitHub search revealed that almost 400 Github repositories have been targeted.
The networks of Baltimore City Hall and Potter County have been infected with ransomware, forcing the local authorities to shut down the majority of its servers. However, Potter County managed to get some of its computers back online, and restored its email services and Internet access last week.
An unprotected database belonging to ApexSMS Inc., a SMS text marketing company, has exposed records of almost 80 million people. The exposed data includes hashed email addresses, names, city locations, IP addresses, phone numbers, and carrier network for mobile.
Magecart threat group has injected its card skimming script on Forbes’ subscription website in order to steal the credit card data that customers enter on the checkout page. The infected website has been taken down with the help of Freenom’s anti-abuse API, however, the obfuscated Magecart skimmer script is still present on the forbesmagazine[.]com.
Attackers hacked the webcast of the first Eurovision semi-final to display faked explosions along with a warning about a missile attack. Viewers switching on to the Kan webcast saw the warning “Risk of missile attack. Please take shelter,” along with the sound of a rocket-warning siren. The Israeli national broadcaster, Kan, suspects Hamas to be behind this action.
HCL has inadvertently leaked employees’ personal information and plaintext passwords, customer reports, and web applications for managing personnel. The exposed employee information includes candidate ID, name, mobile number, joining date, joining location, recruiter SAP code, recruiter name, created date, user name, cleartext password, BGV status, offer accepted, and a link to the candidate form.
Over 12,000 unprotected MongoDB databases have been deleted by Unistellar attackers, who left behind a ransom note asking the owners of the databases to contact them to have the data restored. The reason for asking the owners to contact might be the fact that the hacker could charge ransom amount in cryptocurrency according to the sensitivity of the database.
The SLCERT has uncovered that websites of almost 11 institutions in Sri Lanka have been hacked and defaced by attackers. The impacted websites include those of the Kuwait Embassy in Colombo, the Tea Research Institute in Talawakelle, The Rajarata University in Mihintale and 10 other private institutions. However, none of the gov.lk websites have been affected by the attacks.
Salesforce deployed a database script to its production environment that inadvertently broke the access permission settings across organizations and gave employees access to all of their company's files. Salesforce customers in Europe and North America were the most impacted by this incident.
An unprotected database belonging to Chtrbox, a social media marketing firm, has exposed the contact information of over 49 million Instagram influencers, celebrities, Food bloggers, and brand accounts. The exposed information includes Instagram bio, profile picture, number of followers, email addresses, locations, and phone numbers.
Google accidentally stored unhashed passwords for some of its G suite users for almost 14 years due to an implementation error. Google confirmed that there has been no evidence of any improper access to or misuse of the impacted G Suite passwords.
Unauthorized third-parties have hacked the databases of the news aggregation site Flipboard and have potentially downloaded the user data contained within them. The hacked databases contained Flipboard users’ account information including user names, hashed and salted passwords, email addresses, and digital tokens used to login to Flipboard using site credentials from Google, Facebook, and Twitter.
The website of First American Financial Corp exposed almost 885 million sensitive documents online including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images. According to the researcher who uncovered the breach, anyone who knew the URL for a valid document at the firstam.com website could view other documents by simply modifying a single digit in the link.
Canva, an Australia-based company that provides graphic design service, has been hacked by ‘Gynosticplayers’ and data for roughly 139 million users have been compromised. The stolen data included users personal information including names, usernames, email addresses, residential city, and country. The compromised data also includes password hashes for almost 61 million users and Google token for other users.
A misconfigured database belonging to Amadeus has exposed information on 36 million booked flights, 15 million passengers, over one million hotel bookings, and 700,000 visa applications. Information on international travel plans of high-ranking Israeli diplomats including Israeli Prime Minister Benjamin Netanyahu has been exposed.
Attackers hacked the gift card website of the major UK pub chain, Greene King, and accessed customers’ personal information. The compromised information includes names, email addresses, user IDs, encrypted passwords, addresses, postcode, and gift card order numbers of customers.
Attackers implanted malware on point-of-sale systems at 102 Checkers and Rally’s locations in order to steal customers’ payment card data. The payment card information stored on the magnetic stripe of payment cards including cardholder names, payment card numbers, card verification codes, and expiration dates have been compromised.
Security researchers Noam Rotem and Ran Locar from VpnMentor have uncovered an unprotected Elasticsearch database belonging to Pyramid Hotel Group. The unsecured database has exposed almost 85GB in security logs of major hotels including Aloft Sarasota of Marriott property, Tarrytown House Estate in New York, Carton House Luxury Hotel in Ireland, Aloft Hotels in Florida, and Temple Bar Hotel in Ireland.
New Threats
Several new malware, ransomware, vulnerabilities, and threat groups emerged over the past month. Threat actor group TA542 ’s signature payload Emotet was found distributing third-party payloads such as Qbot, The Trick, IcedID, and Gootkit. The Department of Homeland Security (DHS) has published a detailed analysis of the ELECTRICFISH malware, which is associated with the North Korean government. Meanwhile, WhatsApp had a critical vulnerability in its audio call feature that could allow attackers to install spyware on mobiles via a WhatsApp call.