Cyware Weekly Cyber Threat Intelligence February 12 - 16, 2018

The Good

• A new scalable, secure and decentralized digital currency and payment platform, called Algorand, has been founded by Silvio Micali. Silvio is a Turing Award-winning cryptographer and professor of computer science at MIT. Pillar and Union Square Ventures are providing seed funding, of worth $4 million, for the same. Algorand attempts to address the scaling challenges of the blockchain technology through rapid and efficient user consensus, enabling even the smallest transactions, regardless of volume or number of users.
• A new feature, which eliminates the need for passwords, is under testing by Microsoft for Windows 10. The latest Insider preview release (build 17093), relies on the Authenticator app on Android and iOS. The Authenticator app can authorize or block requests to login, thus rendering passwords redundant. The feature is also available in Windows 10 S. However, users are advised to configure Windows Hello and the Authenticator app properly.
• Mastercard announced that all users of its service will not be able to use biometrics--including fingerprint and facial recognition. A deadline of April 2019 has been set for biometric identification for users. Along with PIN numbers and passwords, all banks that accept Mastercard payments will have to support biometric identification mechanisms, for all remote payments. The biometric authentication will be used in conjunction with a mobile device.
• Microsoft has released new features to allow IT professionals better assess if their devices are patched against the Meltdown and Spectre flaws. The feature is available in Windows Analytics, and offers details on the firmware installed on the device and if necessary security patches have been applied to the firmware.

The Bad

• Hackers have injected an in-browser Monero miner to 4,275 sites--including government websites such as uscourts.gov, ico.org.uk, & manchester.gov.uk--in order to use the visitors’ CPU to mine for Monero digital currency. These sites utilized the Coinhive in-browser mining (cryptojacking) script.
• BitGrail, an Italian cryptocurrency exchange platform, announced on its website that 7 million Nano (worth around $202.3 million) was found missing. The company claims unauthorized transactions as the reason. Currently, all withdrawals and deposits from the site have been halted. Nano cryptocurrency was worth $11.90 at the time the announcement was made.
• A hacker using the alias NullHumanity managed to find a critical vulnerability in Canadian Freedom Mobile and used the bug to download confidential customer data, and warned the company to establish proper security measures. Customer data--including phone number, address, call history and other information--was reportedly stolen.
• Two different data leaks have taken place due to misconfigured databases exposing the personal details of thousands of people. One of the victims is the Maryland Joint Insurance Association, which left access to a customer file repository, unsecured. The data repository contained customer details such as names, addresses, phone numbers, birth dates, and full Social Security numbers; along with financial data such as check images, full bank account numbers, and insurance policy numbers. Another victim is MDJIA access credentials for ISO ClaimSearch. The exposed database contained millions of reports on individual insurance claims for industry professionals. Both breaches occurred due to NAS server with an open port 9000.
• Several core domains names of Newtek Business Services Corp., were stolen resulting in shut off of emails and stranded websites of several customers. Newtek is a web services conglomerate that operates more than 100,000 business websites and around 40,000 managed technology account. As per sources, three of the core domains were  hijacked and replaced by a Vietnamese hacker. The hacker replaced the login page many Newtek customers used to remotely manage their Web sites (webcontrolcenter[dot]com) with a live Web chat service. However, Newtek mentioned in an email that the company was changing domains due to “increased” security.

New Threats

• Security researchers from Nvidia and Princeton University have developed a new tool to explore how hackers could take advantage of the CPU flaws and discovered a brand new way of exploiting Meltdown and Spectre flaws. The techniques, dubbed MeltdownPrime and SpectrePrime, pit two CPU cores against each other to dupe multi-core systems and get access to their cached data. Thus, hackers can steal sensitive information like passwords.
• Scammers are using a new, macro-less technique to infect users with a credential-stealing malware. This attack technique relies on users opening Word documents, but doesn’t require them to enable Macros. Evidence suggests that currently only one group is actively using this technique.
• Two malware packages--referred to as HARDRAIN and BADCALL--were reportedly released by Hidden Cobra, aka Lazarus Group. Reports about the malware packages was given by the Department of Homeland Security (DHS) and FBI. The malware is capable of installing a remote access tool (RAT) payload on Android devices, and force infected Windows systems to act as a proxy server, disguising their command-and-control communications to appear as if they are encrypted TLS/SSL (HTTPS) sessions.
• Kotlin is an open-source programming language, fully-supported for Android. Starting from Fortune 500 companies (like Twitter, Uber etc), many apps were built using Kotlin. As per Google’s claims, Kotlin reduces the amount of boilerplate code needed to create an app—which makes it much safer. However, first samples of Android malware created using Kotlin were found on Google Play by security researchers.