Cyware Weekly Cyber Threat Intelligence February 18-22, 2019

The Good

We’re back with the most interesting cybersecurity news of the week. Let’s start with all the positive advancements that happened in the cybersecurity landscape. Google has developed a browser API called ‘Trusted Types’ that helps Chrome fight against DOM-based XSS attacks. SK Telecom has announced to launch its Quantum Security Gateway solution to prevent hacking in self-driving cars. Meanwhile, a group of researchers has been working on a system to detect run-time trojan attacks on deep neural networks (DNN) models.

• Google has developed a new Chrome feature that fights against DOM-based XSS attacks. This new feature is a browser API called ‘Trusted Types’ that helps Chrome fight against certain cross-site scripting XSS vulnerabilities. The feature adds another level of protection at the browser level to protect users from cross-site scripting vulnerabilities such as DOM-based XSS.
• SK Telecom has announced to launch its Quantum Security Gateway solution to prevent hacking in self-driving cars. The solution is an integrated security device that will be installed inside cars and protects various electronic units and networks in the cars. The gateway solution once installed inside cars, monitors various devices for Vehicle-2-Everything (V2X), Bluetooth, radar, smart keys, and driver assistance systems.
• A group of researchers along with CSIRO’s Data61 has been working on a system to detect run-time trojan attacks on deep neural networks (DNN) models. The system named STRIP (STRong Intentional Perturbation) effectively detects trojan attacks on DNN-based computer vision applications.

The Bad

Several data breaches and massive cyber attacks occurred over the past week. The third batch containing 93 million accounts stolen from 8 companies was put up for sale on the Dream Market marketplace. NCBP POS Vendor suffered a breach compromising nearly 140 restaurants. In the meantime, an unprotected server exposed almost 2.7 million health-related call recordings that dated back to 2013.

• The seller ‘gnosticplayers’ was back this week with a collection of 93 million stolen account credentials from 8 companies. This is the third batch made available for sale by gnosticplayers in the Dream Market marketplace which is worth 2.6249 bitcoin amounting to $9,400.
• Attackers compromised North Country Business Products (NCBP) IT systems and planted malware on its clients’ Point-of-Sale (POS) systems. The attack has impacted nearly 140 food chains such as coffee shops, restaurants, bars, standalone hotels, and various food chain franchises. The impacted food chains included Dunn Brothers Coffee, Someburros, Zipps Sports Grill, and more.
• A storage server containing real-time call recordings made to the 1177 Swedish Healthcare Guide helpline for health care information was found publicly available without any password protection. The unprotected server which was left open without a password exposed almost 2.7 million health-related call recordings that dated back to 2013.
• JD Finance Android App stored users’ screenshots to its cache without user permission. A user posted a video on Weibo describing how the Android app for JD finance stored screenshots taken of his account on the China Merchants Bank app to its cache. According to the user, the screenshots containing sensitive banking information was intercepted without his knowledge.
• White hat hackers have flooded VKontakte (VK) with a spam campaign as part of a revenge prank against the social network as the company failed to acknowledge the security researcher who reported a vulnerability a year ago. The white hat hackers carried out the spam campaign with a computer worm created by Baghosi, which is a community for Russian social media app developers.
• A hacker compromised Tampa Mayor Bob Buckhorn's Twitter account on 21, February 2019. The hacker used the compromised account to send out fake bomb threats and missile threats against the City of Tampa staff, Tampa International Airport, and the Tampa VA office.
• An unprotected MongoDB instance exposed private data of almost 458,388 individuals residing in Delhi, India. The unprotected database was 4.1 GB sized and was named ‘GNCTD’ which also stands for Government of National Capital Territory of Delhi. The exposed data included individuals personal data such as Aadhaar numbers, voter card numbers, ration card numbers, designation, means of transportation, health conditions, monthly income, education, etc.
• AdventHealth has notified 42,000 patients about a 2017 data breach that went on for more than a year. The incident occurred in August 2017 and lasted until December 2018. The breached data included patients’ medical histories, insurance carriers, Social Security numbers, names, phone numbers, dates of birth, health insurance information, weights, and email addresses.
• Researchers observed a new Ad fraud campaign dubbed ‘DrainerBot’ which plays invisible ad videos in Android devices via infected apps. The DrainerBot ad fraud scheme uses malicious codes in Android apps to deliver ad videos to mobile devices that have installed the infected apps. The ad fraud scheme has been distributed via infected Android applications that have almost 10 million downloads.
• A new phishing attack dubbed ‘NoRelationship’ was observed recently that bypasses Microsoft’s Exchange Online Protection (EOP) URL filters which scans Microsoft Office documents such as Word (.docx), Excel (.xlsx), and PowerPoint (.pptx). The attackers behind the ‘NoRelationship’ phishing campaign deleted external links from a relationship (xml.rels) file which is a legitimate file that lists all links included in an attachment. This lead to Microsoft’s Exchange Online Protection filters not detecting the malicious URL.

New Threats

Over the past week, several new vulnerabilities and malware strains emerged. A Monero cryptocurrency-mining malware variant has been found using a combination of RADMIN and MIMIKATZ exploit tools to spread across networks. Researchers uncovered a new ATM malware dubbed WinPot that uses a slot machine interface to steal funds by compromising ATMs. Last but not least, Researchers spotted a critical flaw in four popular password managers that could allow attackers to steal login credentials from the PC’s memory.

• A Monero cryptocurrency-mining malware variant has been found using a combination of RADMIN and MIMIKATZ exploit tools to spread across the local area networks. The attack campaign primarily targets companies in China, Taiwan, Italy, and Hong Kong.
• Researchers from Avast detected a new malware strain dubbed Rietspoof, which is distributed via instant messaging clients such as Facebook Messenger and Skype. Rietspoof is a multi-stage malware that utilizes several stages to drop a more versatile malware. The actual Rietspoof malware is dropped in the third stage with capabilities such as downloading or uploading files, starting processes, or initiating a self-destruct function.
• Researchers spotted a critical flaw in four popular password managers in Windows 10. The vulnerable password managers, when installed and enabled on a system, could allow attackers to steal login credentials from the PC’s memory. The four password managers in question are 1Password, Dashlane, KeePass, and LastPass.
• A new phishing campaign using a new variant of Separ malware was recently observed infecting hundreds of businesses located mainly in Southeast Asia, the Middle East, and North America. The attack started at the end of January and has affected around 200 companies and over 1,000 individuals.
• A new malware dubbed Muncy has been spotted targeting victims worldwide. Muncy malware is distributed via a phishing campaign that impersonates the logistics giant DHL to trick users. Apart from spoofing the emails, the attackers behind Muncy are also leveraging poorly configured SMTP servers to distribute the malware.
• A Security firm recently discovered that LUNAR SPIDER, developer of BokBot distributed WIZARD SPIDER’s custom variant TrickBot. The security firm’s findings revealed that a BokBot executing a loader, also downloaded a separate TrickBot loader. When this TrickBot’s configuration file was analyzed, both trojans also had similar features.
• Windows servers running IIS are impacted by a bug that allows malicious HTTP/2 requests to severely affect its performance. The vulnerability can cause a CPU usage spike up to 100 percent if abused by malicious HTTP/2 requests sent to a Windows server running IIS. Microsoft has addressed this bug through its 14 updates released for Windows OS and Windows servers.
• Researchers uncovered a new ATM malware dubbed WinPot that uses a slot machine interface to steal funds by compromising ATMs. WinPot, also known as ATMPot, is designed to compromise the ATMs and force these machines to empty their cassettes of all funds. A seller of the malware has recently offered WinPot v.3 which includes a revamped interface and a currently unidentified program called ‘ShowMeMoney’.
• A new malware campaign targeting Russian organization with specially crafted malicious Word documents was observed recently. The malware campaign was linked to the North Korean Lazarus threat group also known as HIDDEN COBRA. Researchers noted that the Lazarus threat actor group’s new campaign targeting Russian entities uses Word documents in the initial infection stage and then drops the KEYMARBLE backdoor Trojan.
• Drupal CMS notified its users of a highly critical vulnerability that could lead to remote code execution of PHP. The critical bug affects Drupal core branches Drupal 8.6x, Drupal 8.5x and earlier. The bug also impacts other web services modules enabled such as JSON:API in Drupal 8 and Service Module or the RESTful web services module in Drupal 7. Drupal noted that the bug was due to some files failing to properly sanitize data from non-form sources.