Cyware Weekly Threat Intelligence, December 30, 2019 - January 03, 2020

The Good

The new year has arrived, and with glasses raised and timeless stories recounted, let’s begin the cybersecurity round up for the past week with the good headlines first. Deutsche Bank, Mastercard, and IDEMIA have come together for the launch of the first card to tap motion code technology. Also, the Department of Homeland Security is looking forward to setting up a centralized vulnerability disclosure platform for all federal government agencies. Further, the York College, UK announced a new apprenticeship course in cybersecurity to help organizations upskill their existing staff.

• The Department of Homeland Security and the General Services Administration are exploring the option of setting up a centralized vulnerability disclosure platform that could serve as a primary point of entry for security researchers analyzing flaws in government systems. While such a platform might be managed by CISA, other agencies might have to kick in some of their own funding and participation would be voluntary.
• The York College, UK has launched a new apprenticeship course in cybersecurity to help organizations upskill their existing staff. It has invested $78,000 in a state-of-the-art cybersecurity lab, utilizing the latest virtualized working environment. A study showed that there could be 100,000 unfilled cybersecurity jobs in the UK by 2022.
• Deutsche Bank, Mastercard, and IDEMIA will be teaming up to introduce the Calma Deutsche Bank Card—the first card in Spain to tap motion code technology. It has a card verification code (CVC) that changes every four hours to enhance the financial institution’s overall security level in the area. More interestingly, the card is expected to reimburse victims of online thievery or non-delivery of items purchased.

The Bad

The holiday season wasn’t a cake walk for employees of some organizations that suffered data breaches and other security incidents this week. Now, Landry Inc. disclosed the discovery of malware on payment processing systems used in its network of restaurants. On the other hand, Wyze Labs confirmed a data leak impacting over 2.4 million of its users. Also, Special Olympics of New York had its email server hacked by attackers to target donors through phishing attacks.

• Foreign currency service Travelex was forced to take its websites offline following a cyberattack. Its U.K. website is currently offline, displaying a ‘server error’ page. Its corporate site said the site was offline while it makes upgrades. The group added that its investigations so far suggested no personal or customer data compromise.
• US dining and hospitality corporation Landry’s Inc. disclosed a payment security incident through a company breach notification where it mentioned the discovery of malware on payment processing systems used in its network of restaurants. An investigation has revealed that customers’ payment cards could have been mistakenly swiped on the order-entry systems instead of the PoS terminals. The firm reveals that the payment card swiped between March 13, 2019, and October 17, 2019, may have been affected in the incident.
• Cryptocurrency exchange Poloniex has enforced a password reset for users whose email addresses and passwords were leaked on Twitter. In an email shared with customers a few days back, Poloniex told that some unknown account shared a list of email addresses and passwords on Twitter claiming that the credentials could be used to log in to Poloniex accounts.
• Unauthorized access to an employee email account of Moss Adams affected the Personally Identifiable Information (PII) of its customers and employees. Some of the information contained in the breached account includes names and Social Security numbers. The company is in the process of notifying the affected individuals. It has also offered to pay for identity theft protection and credit monitoring services for those affected, as per the law.
• Smart home tech makers Wyze Labs confirmed a data leak impacting over 2.4 million of its customers. The incident had occurred due to an unguarded Elasticsearch database. The database was left open for over three weeks, from December 4 to December 26, 2019. As a precautionary measure, Wyze logged out all users by pushing a token refresh and added another level of protection.
• The UK Cabinet Office inadvertently exposed the personal information of 1,000-plus New Year's Honour 2020 recipients which includes several well-known celebrities. Along with their names, the office had shared their home and work addresses and postal codes. The honorees were the ones who have been recognized for their activity in the arts, sciences, medicine, sports, or government.
• The Special Olympics of New York had its email server hacked around this year’s Christmas holiday and was later used to launch a phishing campaign against previous donors. The hack only affected the communications system that stored contact information and no financial data. The phishing email was camouflaged as an alert of a donation transaction ($1,942.49), set up for automatic deduction from the target’s account within two hours.
• The IT network of a U.S. Coast Guard maritime facility was brought offline for more than 30 hours after being affected by Ryuk ransomware. In another incident, cloud hosting and managed IT services provider Synoptek was hit by Sodinokibi ransomware. The company paid the ransom in a bid to restore operations. Maastricht University also admitted to have fallen victim to a ransomware attack.
• Microsoft seized 50 web domains of the North Korean government-backed Thallium hacking group. The seized domains were used by the group in different cyberattacks to send phishing emails and host phishing pages. Most of their targets were based in the U.S., Japan, and South Korea. The goal of many of these attacks was to infect victims with malware such as KimJongRAT and BabyShark.
• San Antonio’s Center for Health Care Services (CHSC) and Roosevelt General Hospital (RGH) in New Mexico had to bring down their systems in response to a larger-scale cyber-attack. While RGH suffered malware infection on November 14, CHSC was impacted by a handful of attacks during December.

New Threats

The week also saw the discovery of new malware and flaws affecting different software and hardware products. Cisco issued critical security warnings regarding its Data Center Network Manager software that could expose enterprise customers to remote attacks. In other news, the infamous Cloud Hopper attack campaign was found to have affected 14 more companies than earlier expected. Also, researchers reported three critical remote code execution vulnerabilities in Ruckus Wireless routers.

• Cisco disclosed a dozen bugs affecting its Data Center Network Manager (DCNM) software, including three critical authentication-bypass bugs that could expose enterprise customers to remote attacks. The tech firm warned that a remote attacker can bypass DCNM's authentication and carry out tasks with administrative privileges on an affected device.
• A malicious extension named Shitcoin Wallet was found stealing passwords and private keys from cryptocurrency wallets and cryptocurrency portals. To initiate the stealing process, the extension requests permission to inject JavaScript code on 77 websites. When users navigate to any of these 77 sites, the extension loads and injects an additional JS file from ‘https://erc20wallet[.]tk/js/content_.js’. The JS file contains the obfuscated code to trick users. Once activated, the malicious JS code records the user’s login credentials, searches for private keys, and finally sends the data to erc20wallet[.]tk.
• Developers at Starbucks left an API key exposed that could be used by attackers to access internal systems and manipulate the list of authorized users. The issue was rated as ‘critical’ because it could allow attackers to execute commands on systems, add or remove users which have access to internal systems, and potentially AWS account takeover. The key was found in a public GitHub repository.
• Scammers involved in sextortion email scams were found utilizing new tactics to bypass spam filters. These include sending emails in foreign languages or splitting bitcoin addresses into two parts. Adding these two tactics made it more difficult for the recipient to understand what they are receiving. The emails analyzed claim that a spyware has been installed on the recipient’s system that has captured several inappropriate images and videos of them.
• A new investigation revealed that the infamous Cloud Hopper attack, led by the China-linked APT10 hacking group, has targeted 14 more companies than expected and could still be active on several companies’ networks. The latest list of victim organizations included at least a dozen cloud service providers including CGI Group Inc., Tieto Oyj, and IBM Corp. The attack against managed service providers had started around late 2016.
• The logo maker service Vistaprint had exposed more than 638,000 files on an unprotected Amazon S3 bucket. Many of the leaked files were default logo maker images, while the remaining were logos made by users of the Vistaprint logo maker service. The problem was fixed as soon as the issue was noticed by Vistaprint.
• A new trojan called Lampion was found targeting Portuguese users. It uses anti-debug and anti-VM techniques. The trojan was reportedly distributed via email templates based on the Portuguese Government Finance & Tax. The email includes a link which, when clicked, initiates the download of the malware.
• Security researchers discovered three critical remote code execution vulnerabilities in Ruckus Wireless routers. The flaws let malicious hackers bypass the routers and take control of it remotely. The vulnerabilities existed in the web-based interface. Ruckus fixed the security flaws with the release of a new 200.7.10.202.92 version and customers were advised to update their router.