The Good

It’s time to welcome the first weekend of August with the most interesting threat intel of the week. Before delving into the security incidents and new threats, let’s first take a look at all the positive events. Google is planning to add a new security feature to its Chrome browser to reduce side-channel attacks. Microsoft has announced secure protection for IoT devices with its Azure Security Center. Meanwhile, the National Institute of Standards and Technology is coming up with new guidance for sharing ZIP files securely with others.

• Google is planning to add a new security feature to the Chrome web browser which is designed to prevent attackers from launching side-channel attacks. This new feature will partition Chrome's HTTP cache using top frame origin in order to prevent tracking a user's activity by abusing the browser's HTTP cache.

• Microsoft announced the general availability of Azure Security Center for IoT devices. Azure Security Center will provide security protection for all deployed IoT devices. This includes identifying and responding to emerging threats, as well as finding vulnerabilities in your IoT configurations.

• The U.S. National Institute of Standards and Technology is preparing a guidance to educate the public and government agencies on how to securely share ZIP files over the internet. This guidance will provide a good understanding of how to compress many files into a single place while protecting all of that data with strong encryption.

• Google announced that the Advanced Protection Program is now extended to G Suite and Google Cloud Platform (GCP) users. GCP users can now take advantage of the program and protect themselves against cyber attacks. The tech giant has also announced that Titan Security Key kits are now available in Canada, France, Japan, and the U.K.

The Bad

Several data breaches and security incidents were witnessed in this week. Capital One suffered a massive data breach exposing the personal and credit card information of almost 106 million US and Canadian customers. Honda Motor Company has exposed 134 million records of employee system data for over 300,000 employees due to an unprotected database. Last but not least, the UK-based education company, Pearson suffered a data breach impacting approximately 13,000 schools and universities in the United States.

• Capital One suffered a major data breach after a hacker exploited a configuration vulnerability in the web application firewall. This exposed the personal and credit card information of almost 100 million people in the United States and around 6 million people in Canada. The exposed information includes personal information, credit card data, transaction data, Social Security numbers, linked bank account numbers, and Social Insurance numbers of consumers and small businesses who applied for credit card products between 2005 and 2019.

• Bayamón Medical Center and its affiliate Puerto Rico Women And Children’s Hospital fell victim to a ransomware attack. The incident impacted nearly 422,496 Bayamón Medical Center patients and 99,943 Puerto Rico Women And Children’s Hospital patients. The ransomware infection encrypted all computer files that contained patients’ personal information.

• Sephora, the online shopping site for beauty products, cosmetics, and skincare products suffered a data breach compromising the personal information and login credentials of its customers. The exposed information includes customers’ names, dates of birth, gender, email addresses, beauty preferences, and encrypted passwords. Customers who used Sephora’s online services in Singapore, Malaysia, Indonesia, Thailand, Philippines, Hong Kong SAR, Australia, and New Zealand were impacted by the breach.

• The Los Angeles Police Department fell victim to a data breach exposing the personal information of nearly 2500 LAPD officers and 17,500 police officer applicants. The exposed information includes the names, dates of birth, email addresses, passwords. The data breach occurred due to an old database that is no longer used by the Personnel Department.

• Attackers infected the Georgia Department of Public Safety (DPS) with ransomware. The ransomware infection compromised all the laptops installed in police cars across the state. The attack infected the entire DPS network forcing the department to shut down all its IT systems including email servers, public website, and backend servers. The incident impacted three Georgia police departments including Georgia State Patrol, Georgia Capitol Police, and Georgia Motor Carrier Compliance Division.

• Ameritas suffered a data breach incident that compromised its customers’ personal information including Social Security numbers. The data breach occurred after Ameritas’ employees fell victim to a phishing attack providing their email credentials. The compromised information includes customers’ names, addresses, email addresses, Social Security numbers, and policy numbers.

• An unprotected Elasticsearch database belonging to Honda exposed almost 134 million records of personal information and system data for over 300,000 employees across the globe. The database was found to be left open for almost six days from July 01, 2019, and was secured on July 06, 2019, nearly 10 hours after the security researcher notified the owner about the database.

• An international hacker group hacked the website of Randolph County and replaced the “Welcome to Randolph County” homepage with a graphic of a person in a Guy Fawkes mask holding a protest sign saying “Join the Revolution”. A hacker group called ‘VandaTheGod’ is speculated to be responsible for the hack. A Twitter account with a username ‘VandaTheGod’ posted a series of tweets that appear to claim responsibility for the hack.

• Pearson suffered a data breach after an unauthorized third-party gained access to Pearson Clinical Assessment's program, AIMSweb. This impacted approximately 13,000 schools and universities in the United States. The compromised information included students’ names, dates of birth and email addresses. Pearson notified its customers about the breach and stated that it is offering free credit monitoring services for all impacted customers.

• A security researcher at WizCase, Daniel Brown discovered an unprotected Elasticsearch database that contained voter information for over 14.3 million Chileans, which accounts for nearly 80% of the country's entire population. The leaky database contained names, gender, age, addresses, and tax ID numbers (RUT, or Rol Único Tributario) for 14,308,151 individuals.

• South Korea has become the latest major victim of Card Present (CP) data theft after details of over one million payment cards have been made available online. According to Gemini Advisory, 230,000 records were put up for sale on June 2019, and 890,000 records in July 2019. However, the source of these payment card details has not yet been identified yet.

New Threats

This week also witnessed the occurrence of several new malware strains and vulnerabilities. Researchers spotted a new version of the TrickBot banking trojan that targets Microsoft Defender. A new variant of Mirai botnet which had its command & control server placed in the Tor network was discovered. A major vulnerability was also unearthed in Apple’s instant messaging service iMessage.

• Researchers spotted a new version of the TrickBot banking Trojan that targets Microsoft Defender in order to prevent its detection and removal. This new Trickbot version uses additional 12 methods to disable Windows Defender and Microsoft Defender ATP in Windows systems. These methods utilize either Registry settings or the Set-MpPreference PowerShell command to set Windows Defender preferences.
• A new RFI attack campaign that leverages Remote File Inclusion (RFI) vulnerabilities for deploying phishing kits was identified. This campaign targeted a bank in the European Union. Attackers abuse RFI flaws to upload phishing landing pages in order to steal banking credentials from victims.
• Apple’s instant messaging service iMessage contains a major security flaw in the application. The vulnerability (tracked as CVE-2019-8646) is an out-of-bounds read issue which impacts all iPhones starting from iPhone 5s and later as well as devices such as iPad Air and iPod touch 6th generation. However, the vulnerability has been patched by Apple in its latest version iOS 12.4.
• Researchers spotted a new Android ransomware dubbed ‘Android/Filecoder.C’. This ransomware can use the victim’s contact lists and spread further via SMS with malicious links. It can send out a batch of malicious SMSes, encrypt most of the user files, and request a ransom.
• Security researchers observed a new malware campaign that targets a Chinese government agency with Zegost malware. This malware is known to collect specific information from the infected machines. Its capabilities include collecting information such as internet connection state, RDP port number, and QQ login numbers, recording keystrokes, as well as launching processes in order to evade detection from antivirus software.
• Researchers detected a critical vulnerability in Android versions between 7.0 (Nougat) and 9.0 (Pie). Tracked as CVE-2019-2107, the flaw is a remote code execution (RCE) vulnerability that lies in the Android media framework. This vulnerability could allow attackers to hack the device when it plays a malware-embedded video. However, the flaw is patched by Google in its July security update.
• A new variant of Mirai botnet which had its Command & Control server placed in the Tor network was discovered by security researchers. This was done to maintain anonymity. The variant contained four C&C servers with 30 hard-coded IP addresses. This new sample scans the TCP ports 9527 and 34567 to find vulnerable IP cameras and DVRs from remote access and control.
• Researchers observed two new malvertising campaigns recently. The first campaign uses exploit kit to bypass ad-blockers, while the other is known for targeting Mac users via web redirections. The first one leverages RIG exploit kit to infect a toolbar with malware whereas the second campaign redirects Mac users to a domain on the Safari browser. The domain delivers a malware-infected Flash Player installer.