Cyware Weekly Cyber Threat Intelligence August 6-10, 2018

The Good

• BlackBerry announced a new ransomware recovery solution that could allow organizations to quickly contain and limit the damage of ransomware attacks. The new feature for BlackBerry Workspaces would freeze the accounts of affected users if their PCs and synced files are infected, and allow IT managers to roll back affected documents and data to the point before the ransomware hit.
• General Motors announced an automotive bug bounty program inviting a few white hat hackers to detect and report bugs in their cars’ software. GM President Dan Ammann announced the program at the Billington Cybersecurity Summit saying the team will include white-hat researchers who we’ve established relationships with through our coordinated disclosure program.”
• Researchers from Nozomi Networks released free tools to help detect the destructive Triton/Trisis malware. The TriStation Protocol Plug-in for Wireshark can detect the malware communicating in the infected network, gather intelligence on the communication, translate function codes and extract PLC programs being transmitted. The second Triconex Honeypot Tool could be used by ICS organizations to set up honeypots to detect Triton reconnaissance scans and attack attempts on their networks.
• LinkedIn said it shut down less than 40 fake accounts on its platform being used to connect with members of US political groups, including one that claimed to be a well-known celebrity. Although the accounts weren’t used to spread fake news or manipulative ads, the firm said they “don’t take their existence lightly.”

The Bad

• Credit card issuer TCM Bank said a website misconfiguration accidentally exposed the personal data of thousands of people who applied for credit cards between early March 2017 and mid-July 2018. Applicants’ names, addresses, dates of birth and Social Security numbers were exposed. The firm said less than 10,000 applicants were impacted.
• The PGA of America fell victim to a ransomware attack. The encrypted files included promotional and creative materials for the PGA Championship that kicked off this week. The PGA was reportedly hit by the BitPaymer ransomware, the same malware that infected the Matanuska-Susitna (Mat-Su) borough in Alaska and several hospitals in Scotland last year.
• TSMC, a major supplier to Apple’s iPhone, said a WannaCry variant crippled its semiconductor fabrication plants this week. The company said a “misoperation” led to the virus infection, adding that it will take a 3 percent revenue hit due to the downtime.
• Security researcher Bob Diachenko discovered a fully exposed MongoDB database online that contained the healthcare information of 2 million patients in Mexico. Exposed data included patients’ full names, gender, dates of birth, insurance data, addresses and disability status.

New Threats

• The author of the infamous GandCrab ransomware seemed to retaliate against South Korean security firm AhnLab after it released a vaccine app for the ransomware. The author reportedly said the upcoming version of the ransomware would contain an alleged zero-day for the AhnLab v3 Lite antivirus.
• IBM X-Force Red researchers discovered 17 vulnerabilities in smart city systems that could be exploited to cause panic or even silence sensors from sounding the alarm during an actual emergency. Researchers said the vulnerabilities, eight of which were deemed “critical” in severity, highlighted how smart cities are still exposed to old-school threats.
• IBM researchers developed a new proof-of-concept dubbed “DeepLocker”, a stealthy AI-powered malware to understand how artificial intelligence and malware techniques can be combined to create a new type of attack. The tool itself hides in other applications until it identifies a suitable victim based on several attributes like facial recognition, geolocation and voice recognition before it attacks.
• The US Internal Revenue Service has warned taxpayers to be wary of scams involving fake charities that could pop up during hurricane season. These scams typically begin with unsolicited contact via a phone call, social media post, email or in-person, but could lead to phishing schemes, identity theft or financial loss.