Cyware Weekly Threat Intelligence, September 16 - 20, 2019

Weekly Threat Briefing • Sep 20, 2019
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Sep 20, 2019
The Good
The week is almost over, but before we welcome the weekend let’s brush through the important happenings in the world of cybersecurity. Let’s begin with the positive advancements of this week. Engineers from Purdue University and Tohoku University have developed new hardware that demonstrates the basis of a probabilistic computer to efficiently solve problems in cybersecurity and other domains. An Israeli startup called GK8 has built a new cold storage cryptocurrency wallet that is electronically disconnected from other devices to minimize the attack surface. Milwaukee School of Engineering (MSOE) has opened a new cyber-learning facility with the aid of a $34m alumnus donation.
Experts from Purdue University and Tohoku University have built the first hardware to demonstrate the basis of a probabilistic computer called p-bits. These are capable of performing calculations that would normally require quantum computers. These computers are believed to help solve problems more efficiently in areas such as cybersecurity, data analytics, and financial services among others.
GK8, an Israeli startup, has built a cold-storage crypto wallet that has on-network capabilities. This technology ensures only uni-directional communication from the wallet to outside, and never the other way round. The digital wallet device is not electronically connected to other digital devices, to prevent attacks.
Milwaukee School of Engineering (MSOE) has opened a new cyber-learning facility with an alumnus donation of $34 m. The facility has several classrooms, laboratories, staff offices, and auditorium apart from a data center that houses an NVIDIA GPU-accelerated AI supercomputer.
Google removed two Chrome ad-blocker extensions that were using misleading names. Apart from taking on the names of popular extensions, they were also reported to be cookie-stuffing. This is a technique of adding extra information to a user’s cookie to earn commission for payments made on the sites.
ClassNK, a Tokyo ship classification society, has announced that it is forming a cross-sectional team of marine and security experts to boost cybersecurity. The approach is said to include various measures that will combine physical, technical, and organizational approaches to mitigate any risks.
The Bad
Many data breaches and cybercrimes were in the news this week. The personal data of 20 million Ecuador citizens was compromised owing to a leaky Elasticsearch database. Also, 24.3 million Lumin PDF’s users’ data that included names, gender, Google Access tokens among others were found on a hacking forum. Mobile users of hotel chains were hit in a Magecart attack to steal payment details and sensitive data.
The personal information of over 20 million Ecuador citizens was exposed because of a leaky Elasticsearch database. The exposed data includes personal information of individuals and family members, financial information, employment details, and other data. The database contained around 18GB of data, that appeared to be sourced from Ecuadorian government registries, an automotive association called Aeade, and an Ecuadorian national bank named Biess among others.
Carle Foundation Hospital fell victim to a data breach after three employee email accounts were compromised. Data belonging to certain patients who availed cardiology or surgery services at the hospital was believed to be compromised. The compromised data includes patient information such as names, dates of birth, diagnosis, and treatment.
Data of 24.3 million Lumin PDF users was found on a hacking forum. The data, which is on a 2.25GB ZIP file includes names, gender, Google Access tokens, email addresses, locale settings, and hashed password strings.
A phishing page was found pretending to be ‘The Guardian SecureDrop’ site. It promotes an Android application that performs malicious activities in the devices it infects. The page harvests unique codenames given to sources who submit information via the SecureDrop service.
Researchers analyzed over 2300 Picture Archiving and Communication System (PACS) servers and found out that at least 590 systems were unsecured, exposing more than 24.3 million patient records. The servers were spread across 59 countries including the United States, Brazil, Italy, and India.
Two unsecured MongoDB databases with 1,444,375 records of email accounts, 2,196,840 passwords strings, and 752,645 entries of usernames were discovered. The databases were found to belong to a criminal group that is responsible for the Gootkit malware.
An unprotected drive with 1.7 terabytes of data has exposed the installation details of SORM hardware by Nokia in coordination with Mobile TeleSystems (MTS). The exposed data also includes schematics, administrative credentials, email archives, and other materials relating to telecom infrastructure projects. At least 64 Russian telecommunication providers were also affected by this data breach.
The personal data of customers of major airline companies owned by Lion Air and Malindo Air was found in an open AWS storage bucket. The exposed data includes names, email addresses, phone numbers, physical addresses, passport numbers, passport expiration dates, dates of birth, and passenger and reservation IDs.
Magecart card-skimming attack hit hotel chains across 14 countries. Mobile users of these hotel chains were targeted to steal payment card details and other sensitive information. Both the hotel websites were observed to be developed by a Spain-based company named Roomleader, whose module was compromised to inject malicious code.
Akamai has reported the fourth-largest DDoS attack the company has encountered in terms of the highest reflected amplification factor. The attack, that generated 35GB junk traffic per second, was said to be targeted at one of its clients in the gaming sector.
Scotiabank’s source code and sensitive data such as credentials for services, keys to access the bank’s backend systems and services in different parts of the world, and software blueprints were found on publicly accessible GitHub repositories.
Hackers have infected Click2Gov payment portals in 8 cities. Almost 20,000 payment records have been compromised and are said to be available on the dark web for sale. The affected cities include Deerfield Beach, Palm Bay, Milton, and Coral Springs in Florida to name a few.
New Threats
New vulnerabilities and malware came to light this week. The Emotet botnet has reappeared in a new campaign after a break. Nemty ransomware’s code has been upgraded but the threat actors have decided to retain the version number. In other news, thousands of misconfigured Google Calendars were discovered to be exposing sensitive data online.