The Good

As we approach the end of the year, here are the top highlights from the cybersecurity landscape this week. Let us dive into the good and the bad events, followed by the new threats that emerged during this period. In good, firstly, Apple announced its open-to-all bug bounty program which now invites vulnerability reports for a much wider spectrum of products. Also, the U.S House of Representatives passed legislation aimed at protecting the U.S. energy grid from cyberattacks. Further, Google announced financial aid to the open-source cybersecurity community to motivate volunteer work done by them.

• Apple opened its bug bounty program to all security researchers, shifting from an invitation-based bug bounty program. The company will now accept vulnerability reports for a much wider spectrum of products that includes iPadOS, macOS, tvOS, watchOS, and iCloud. In addition, the company has also increased its maximum bug bounty reward from $200,000 to $1,500,000, of course depending on the exploit chain's complexity and severity.

• The anti-robocall TRACED act was finally passed by the senate. It will make it easier for consumers to identify robocalls so that they can avoid answering them. The legislation would require telecom carriers to implement, at no extra charge, a number-authentication system to help consumers identify who’s calling. It would also increase penalties for robocallers who flout the law.

• Legislation aimed at protecting the U.S. energy grid from cyberattacks, under the 2020 National Defense Authorization Act (NDAA), was passed by the U.S House of Representatives. Also, the cyber and physical security of North America’s energy grid was tested recently as part of a major exercise called GridEx V.

• This week, Google announced that it will offer financial aid to motivate volunteer work done by the open-source community for improving cybersecurity. The tech giant will help them arrange additional resources while prioritizing the security of their products. The support is available for both small teams ($5,000) as well as for a large team ($30,000) of developers.

The Bad

The week witnessed a number of breaches and threat actors targeting companies worldwide. A researcher found an exposed database containing over 267 million Facebook users’ IDs, phone numbers, and names. In other news, At least 200 equipment manufacturers across the world fell victim to a malware campaign called ‘Gangnam Industrial Style’. Also, data belonging to more than 1 million mobile users was found lying exposed on the servers of Conor Solutions.

• A database containing more than 267 million Facebook users’ IDs, phone numbers, and names was left exposed on the web without a password or any other authentication. Experts think this may be the result of an illegal scraping operation wherein bots might be used to copy sensitive information online. More sophisticated attacks could be also planned through this data since it includes both a phone number and email address.

• Canada’s LifeLabs admitted to paying attackers to retrieve information on over 15 million customers. The compromised data included names, home addresses, email addresses, usernames, passwords, and health card numbers. Some 85,000 lab results were stolen as well. As per the firm, the stolen data was dated 2016, and earlier.

• At least 200 critical infrastructure equipment manufacturers across the world fell victim to a malware campaign called ‘Gangnam Industrial Style.’ The APT group behind the campaign used industry sector-themed spear-phishing emails and a combination of free tools to steal confidential information through a new variant of Separ malware. However, 60 percent of the affected companies were in South Korea alone.

• Hackensack Meridian Health, the largest hospital in New Jersey, was hit by ransomware that disrupted its network completely. Elective surgeries for roughly 100 patients were rescheduled as a result of the ransomware incident. Soon, it was reported that it paid threat actors an undisclosed sum to restore data compromised in the cyberattack.

• The data belonging to more than 1 million mobile users were exposed in a massive data breach event affecting South African ICT company Conor Solutions. Private browsing data, cell phone numbers, and personal identifying information of the users were at risk. Conor has over 80 million mobile subscribers to their products, with some prominent customers, including Vodafone and Telkom.

• A ransomware attack crippled the city of New Orleans impacting more than 4000 computers, which led the state government to declare a state of emergency. New Orleans Chief Information Officer Kim LaGrue said the city was prepared for a ransomware attack, and that all the targeted data is backed up.

• Multiple news reports confirmed the hacking of security cameras of the Amazon-owned Ring where third-parties could access the video feeds and speakers of the cameras to frighten members of the affected households. The issues came to light after cybersecurity company Bitdefender published evidence that Ring's Doorbell Pro had a flaw that could have exposed a user's WiFi details.

• An audit report revealed that sensitive private data of Massachusetts taxpayers were exposed to cyberattacks. The agency had not taken steps to assess the potential threats to taxpayer data, such as Social Security numbers and tax-payment histories, posed by outside vendors. The state Department of Revenue was found unprepared to respond to or mitigate an event of a cyberattack.

• A thief reportedly stole multiple unencrypted physical hard drives from a Facebook payroll staffer's car. Some tens of thousands of current and former Facebook employees were impacted. The company also faced criticism due to how long it took to come clean—the break-in took place on 17 November 2019. According to Bloomberg, banking information of 29,000 Facebook employees in the U.S. was compromised.

• Chinese e-commerce site LightInTheBox suffered a data breach exposing 1.3TB of web server log entries. The unsecured and unencrypted data was accessible from an ordinary web browser and was being held on an unprotected Elasticsearch database.

New Threats

Meanwhile, cybercriminals continue to exploit weaknesses in networks and devices while giving security teams in organizations a very hard time. Now, a team of researchers found at least 47 million smart tracker watches vulnerable to exposure of confidential data including location and voice recordings. Facebook-owned Whatsapp also addressed a severe bug allowing a group member to crash the messaging app for other group members. Moreover, a new backdoor ‘Poison Frog’ was found to be used by the OilRig threat actor group.

• At least 47 million kids’ smart tracker watches were found affected by multiple vulnerabilities allowing attackers to retrieve or change the real-time GPS position, or to steal audio recordings. The biggest flaw lied in a common shared cloud platform used to power millions of cellular-enabled smartwatches. The researchers commented that it is only the tip of the iceberg.

• Operators of Smominru (aka DarkCloud or Hexmen) botnet were found using an image of a pop singer to hide malware payloads as part of their latest infection process. The group primarily focused on infecting Windows systems to deploy various cryptocurrency-mining apps to generate profits. The botnet’s internet scanning modules identify vulnerable hosts to gain a foothold on infected computers.

• WhatsApp addressed a severe bug that could have allowed a malicious group member to crash the messaging app for all members of the same group. An attacker can trigger the vulnerability by sending a maliciously crafted message to a targeted group. The issue resided in XMPP, a communication protocol for instant messaging.

• British citizens were targeted in a new scam email campaign that purports to be from Royal Mail. The email tricks victims into handing over their card details for a free iPhone 11 Pro. It also includes a link that takes the victim to a website having the Currys PC World logo. The website prompts the victim to share their personal details and pay a small fee of $2.62 for insured shipping.

• Researchers have uncovered a new backdoor ‘Poison Frog’ being used by the OilRig threat actor group. The new executable which is written in C# comes with multiple issues. For instance, one sample did not execute because it used command for ‘Poweeershell.exe’ instead of ‘Powershell.exe’ while others still had the PDB path inside their binary. The malware disguised as fake Cisco AnyConnect application to propagate on victims’ systems.

• A new botnet called Momentum was found targeting the Linux platform on various CPU architectures such as ARM, MIPS, Intel, Motorola 68020, and more. The main purpose of the botnet was to open a backdoor and accept commands to conduct various types of DoS attacks against a given target. The backdoor being distributed by the Momentum botnet were Mirai, Kaiten, and Bashlite variants.

• The popular Barco ClickShare wireless presentation system was found riddled with several vulnerabilities. These flaws could allow an attacker to manipulate information during presentations, steal passwords, and other sensitive data. The flaws can also be exploited to install a backdoor and other malware. The highlighted issues have been patched with the release of a new firmware update.

• The Emotet trojan gang started sending Christmas-themed emails with an intent to infect users. The emails are disguised as a Christmas party invite and use subjects like ‘Christmas Party next week’ or ‘Christmas party.’ These invites ask the recipients to view an attached malicious Word document with names like ‘Christmas party.doc’ and ‘Party menu.doc.’ The document once opened, unleashes the embedded macros that will later install the trojan in Windows.

• Researchers uncovered an exploitable design flaw in KeyWe Smart Lock which allowed an attacker to easily pick the device by intercepting the secret passphrase sent between the lock and KeyWe’s app. Unfortunately, there wasn’t any firmware update available for the flaw, so smart lock owners will either have to replace the lock or live with the risk of an attacker hacking it to gain access to their home.

• Schneider Electric has patched vulnerabilities affecting Modicon M580, M340, Quantum, and Premium controllers. These products were affected by DoS vulnerabilities and are caused by improper check for unusual or exceptional conditions. It remained unclear though whether the vulnerabilities were remotely exploitable from the internet. This vulnerability was identified by industrial cybersecurity firm Applied Risk.

• Two serious vulnerabilities discovered in the NPM CLI have been patched recently. One of these flaws allowed a binary planting attack. The flaw affects NPM CLI versions prior to 6.13.3. The second vulnerability exists in bin-links, which is an NPM package that manages links from the bin field to the file in “./node_modules/.bin/”. To exploit these vulnerabilities, an attacker would have to persuade a user to install a cleverly crafted bin entry file.