This week
-
The bad news continues for Uber: last week, the trial of former CISO Joe Sullivan commenced over an alleged coverup of a data breach (vol. 5, iss. 37); this week the company was comprehensively owned. Employees initially thought it was a joke before screenshots were posted online of admin dashboards for, well, pretty much everything: Domain admin, AWS console, vSphere admin, Google Workspace admin, even their HackerOne bug bounty account. The source of the compromise appears to be a single 18-year-old spamming an employee with multi-factor authentication push notifications. Once in, the individual allegedly found hardcoded admin credentials in a Powershell script for Uber’s privilege access management (PAM) solution from Thycotic. It will have been a tough 72 hours by this point for everyone at Uber, and while a single user account shouldn’t be able to result in this level of compromise, this isn’t the product of a single failure. (Those are Group-IB, Darktrace and Beyond Trust, whose sales/marketing teams have positioned themselves inches from the back of the ambulance — poor show, folks.) theguardian.com, arstechnica.com, cyberscoop.com
-
Joe Tidy has a scoop for the BBC on the recent attack against Intercontinental Hotels Group (IHG), which owns the Holiday Inn, Crown Plaza and eponymous Intercontinental brands. Last week the FTSE 100 company warned investors about the compromise over disruption to reservation systems and mobile apps. A couple of Vietnam, calling themselves TeaPea, has claimed responsibility and said they originally intended to ransomware the company before being spotted and resorting to a wiper-style attack instead. TeaPea gained access by tricking an employee into opening a malicious attachment before finding a password vault that used the password ‘Qwerty1234’ (imagine what the passwords inside the vault must have been!) In their conversation over Telegram, the attackers explained they didn’t feel guilty: “We prefer to have a legal job here in Vietnam but the wage is average $300 per month. I’m sure our hack won’t hurt the company a lot.” The latter is untrue: this type of incident will cost IHG millions; however, their complaint about wage inequality is at the core of what I see the cybercrime problem to be. The internet has levelled the playing field and brought the world closer together, but macro-level economic differences and lagging legal frameworks present a tempting opportunity to get rich quick. bbc.co.uk
-
But it’s not always about making a quick buck: A related long-read from ProPublica on how victims of human trafficking in Asia are being forced into cybercrime and working on romance and investment scams. It also gives a painful insight into how these scams unfold. propublica.org
Interesting stats
- 40% of ‘industry professionals’ say their organisations have reduced their use of open source software, citing security concerns, says a report from data science firm Anaconda theregister.com
Other newsy bits
-
Yurii Shchyol, head of Ukraine’s Derzhspetsviazok (akin to CISA or NCSC), has been interviewed by Wired. In it, Shchyol talks about repelling Russian aggression in cyberspace, with preparations having begun following the NotPetya attack in 2017, including heavy profiling of other attacks to understand the intent and capabilities of different Russian intelligence and military threat actors. wired.com
-
Meanwhile, pro-Ukraine hacktivists from a group calling themselves ‘hdr0’ have compromised television broadcasts around St Petersburg, with a video posted to Twitter showing many channels in the electronic programme guide all showing the same message equating President Putin to a terrorist therecord.media, @igorsushko
-
Cisco Talos reports that a new info stealer malware has been discovered as part of campaigns targeting the Ukraine government. The malware is attributed to Gamaredon, a Russian state-backed group, is delivered via a PowerShell script and exfiltrates documents, photos and archive files via HTTP post bleepingcomputer.com
-
‘Hundreds’ of organisations — businesses, public sector and nonprofits — were targeted by Iranian threat actors in October 2020, according to the US Department of Justice. The DOJ indictment accompanied sanctions on ten Iranian individuals and two Iranian companies and offers of up to $10 million through the ‘Rewards for Justice’ programme. cyberscoop.com
-
The US Senate has confirmed Nathaniel Fick as the first ‘cyber ambassador’. Heading up the State Department’s Bureau of Cyberspace and Digital Policy, Fick will “modernize diplomacy and lead, coordinate, and elevate US foreign policy on cyberspace and digital technologies,” according to Deputy Secretary of State Wendy Sherman therecord.media
-
US Customs and Border Protection has come under fire for downloading copies of photos, text messages and other personal information from phones and laptops during border searches. The data is stored centrally for fifteen years and can be accessed by around 2,700 staff without reason or warrant. zdnet.com
-
Truck rental company U-Haul has notified an unknown number of customers with contracts between 5th November 2021 and 5th April 2022 that attackers had compromised their driver’s licence or state ID. The breach was discovered on 12th July, and investigation and analysis took almost two months bleepingcomputer.com
-
A report from cyber company Arctic Wolf suggests that an Initial Access Broker (IAB) is supplying an exploit for a Mitel VOIP phone system vulnerability patched in April this year. It’s interesting because there is no public exploit for the vulnerability (CVE-2022-29499), suggesting it was developed for profit and then supplied to cybercriminals behind the Lorenz ransomware. With IABs firmly established, this hints at specialisation in their services and a willingness to go after what may traditionally have been perceived as ‘obscure’ bugs that wouldn’t be mass-exploited. therecord.media
-
A campaign linked by Proofpoint to Iran’s state-sponsored Charming Kitten group is using multiple personas in their email attacks to add ‘social proof’ and encourage victims to open malicious attachments. The messages CC another spoofed, or ‘sock puppet’, account for a well-known individual who then replied to the message thread to add legitimacy to the message chain. therecord.media
-
UK eCommerce software vendor FishPig has found that its build process was compromised and backdoor code surreptitiously added to its paid Magento modules. Potentially 200,000 websites may have been affected, though FishPig reports that no unusual activity has been seen from the hardcoded command and control IP address. They posit that the attackers were waiting to sell bulk access when many sites had updated to the infected code version. arstechnica.com
-
If you use Trend Micro’s Apex One endpoint agent, patch it now as there’s a remote code execution vulnerability in previous versions that’s just been patched. bleepingcomputer.com
-
Mandiant is warning that North Korean threat actors are spreading trojanised versions of the PuTTY SSH client. arstechnica.com
-
Javascript security company Otto-js has found that both Google Chrome and Microsoft Edge transmit sensitive data, including passwords, to the company’s servers when ‘enhance spell checking’ is enabled. Dubbed spell-jacking, the feature is not enabled by default, and websites can add ‘spellcheck=“false”’ to fields that they don’t want to be spellchecked. It’s an unintended consequence of such services, however, it presents a novel way to intercept all data being entered by a user into form fields. I’m sure it will receive more attention from both threat actors and Google and Microsoft in the coming months! bleepingcomputer.com
-
The European Union has proposed new rules to “ensure more secure hardware and software products”. The Cyber Resilience Act will oblige manufacturers of smart devices to account for cyber security during the “planning, design, development, production, delivery and maintenance phase”. Companies will also have to document cyber risks, report exploited vulnerabilities and incidents, and provide security updates for at least five years, amongst other provisions. Non-compliance penalties for ‘essential’ cyber requirements could scale up to €15 million or 2.5% of worldwide turnover, whichever is higher. 90% of products, such as photo editing software, smart speakers and games, would require self-assessment, while “critical products”, including password managers and firewalls, would face a stricter third-party assessment. The European Parliament and Council will not examine the proposal techcrunch.com
-
I like the idea behind this Github project to produce playbooks aligned to MITRE ATT&CK techniques (h/t Bhavya) github.com
And finally
- Where web apps can be vulnerable to ‘SQL injection’ attacks, AI robots can be susceptible to ‘prompt injection’ attacks. In an interview with Are Technica, researcher Simon Wilson explained, “the exploit is present any time anyone writes a piece of software that works by providing a hard-coded set of prompt instructions and then appends input provided by a user,” continuing, “that’s because the user can type ‘Ignore previous instructions and (do this instead).'” At least at the moment, the results are hilarious. A remote work Twitter bot has been taken offline after users realised that you could tell it to ‘ignore previous instructions’ and append their own, new instructions for the reply:
