Cyware Weekly Threat Intelligence, August 26 - 30, 2019

Weekly Threat Briefing • Aug 30, 2019
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Aug 30, 2019
The Good
Let’s welcome the weekend by revisiting all that happened in cyberspace over the week. Before delving into the security incidents and new threats, let’s first take a look at all the positive events. The Governor of Louisiana has announced plans to establish a cyber facility named the ‘Louisiana Cyber Coordination Center (LC3). Google has announced the launch of the ‘Developer Data Protection Reward Program’ (DDPRP) and the expansion of the ‘Google Play Security Reward Program’ (GPSRP). Meanwhile, Microsoft is working on adding automatic phishing detection to enterprise in-org forms.
Google has announced a new bug bounty program named ‘Developer Data Protection Reward Program’ (DDPRP) through which researchers can report cases of abuse in Android apps, OAuth projects, and Chrome extensions. The tech giant has also announced the expansion of its ‘Google Play Security Rewards Program’ (GPSRP) to include all Android apps from the Google Play Store with over 100 million or more installs.
The Governor of Louisiana John Bel Edwards and Major General for the Louisiana National Guard Glenn Curtis have announced plans to establish a cyber facility named the ‘Louisiana Cyber Coordination Center (LC3)’. This facility will be established at the Water Campus in Baton Rouge.
The Australian government has extended the Consumer Data Right (CDR) to include the energy sector in order to ensure that the privacy of electricity consumers’ data is protected. In addition to this, the federal government has released a consultation paper to seek feedback on the data access model that will apply to the energy sector.
Microsoft is working on adding automatic phishing detection to enterprise in-org Microsoft forms. This will detect malicious password collection in forms and surveys. Automatic phishing detection for enterprise in-ord forms is expected to be rolled out in September 2019.
The Bad
Several data breaches and security incidents were witnessed in this week. Researchers have uncovered over 80 eCommerce websites that have been compromised by Magecart attackers. Web hosting provider Hostinger suffered a data breach compromising the personal information of over 14 million customers. Last but not least, Mastercard suffered a data breach after the customer data from its Priceless Specials loyalty program was leaked on the internet.
Hostinger has been hit with a data breach incident, that has impacted nearly 14 million customers. The data breach occurred after an unauthorized third party gained access to its internal API server. The compromised server contained clients’ first names, usernames, email addresses, hashed passwords, and IP addresses.
Mastercard suffered a security incident, exposing customers’ information on the internet after its Priceless Specials loyalty program was breached. The exposed information includes customers' names, dates of birth, gender, email addresses, phone numbers, home addresses, payment card numbers, and the time of first registration with Priceless Specials.
Lyons Companies, a leading insurance broker in Delaware, experienced a data breach incident compromising customers’ sensitive information. The compromised email accounts contained customers' names, dates of birth, contact information, driver's license information, financial information, medical record numbers, patient identification numbers, diagnosis and treatment information, and health insurance and claims information.
Imperva has disclosed that it suffered a data breach incident impacting the users of its Cloud Web Application Firewall (WAF) product, previously known as Incapsula. The data exposure has impacted a subset of customers of its WAF product who had accounts registered up until September 15, 2017. The exposed Incapsula customer database included email addresses and hashed and salted passwords. A few Incapsula customers also had their API keys and customer-provided SSL certificates exposed.
Security researchers have discovered that Magecart attackers have compromised over 80 eCommerce websites that were running an outdated version of Magento. 25% of these compromised websites are large brands in the motorsports industry and luxury retail.
A North Korean cyber-espionage group ‘Kimsuky’ has targeted several retired South Korean diplomats, military officials, and the members of South Korea's Foreign Ministry and Unification Ministry. The attacks occurred between mid-July and mid-August of 2019. They were basically carried out through spear-phishing emails that included links to fake login pages.
Hundreds of dental practice offices in the US had their data and patient records encrypted by Sodinokibi ransomware. On August 26, 2019, Sodinokibi aka Revil infected DDS Safe, an online backup product from Digital Dental Record (DDS), through its cloud management provider, PercSoft. Over 400 dental offices have been impacted by the ransomware attack.
ThaiCERT, ETDA, and a department in the Ministry of Digital for Economy and Society learned that Thai personal information has been found in foreign database systems of gambling websites. Following this, ThaiCERT examined the leaky database and found out that the database holds the personal information of over 41 million individuals including 3.3 million Thai citizens. The exposed information includes names, phone numbers, birthdays, ID card numbers, and bank account numbers.
New Threats
This week also witnessed the occurrence of several new malware strains and vulnerabilities. Researchers have uncovered a new version of Trickbot that includes new dynamic webinjects to steal PIN codes from Verizon Wireless, T-Mobile, and Sprint users. Researchers have found out malicious clickjacking scripts that intercept user clicks on at least 613 popular websites. Meanwhile, Apple released an update to the iOS 12.4 version to patch the jailbreak security flaw.