Oktacron - Cyber Security RSS Feeds History

Cyber Intrusion Alert: University of Hyderabad Grapples with High-Stakes Data Compromise

cyberexpress Jun 03, 2024 Cybersecurity News

The University of Hyderabad (UoH), a prominent academic institution in India, finds itself entangled in a cybersecurity challenge as a recent data breach seems to have affected the top management and students of the institution. Speaking to The Cyber Express, senior faculty members and top management expressed show more ...

surprise over the University of Hyderabad data breach, which has left students worried over the repercussions. The university is situated in Telangana, a state in southern India and had recently achieved a prestigious ranking of being among the top 12 per cent of universities worldwide for international students. Decoding University of Hyderabad Data Breach The UoH data breach was first reported in the last week of May 2024. A Threat Actor (TA), who used the alias "nik20", shared a post on the data breach site BreachForums. The TA claimed to possess a database stolen from the university, allegedly in SQL format, a common database language used by many websites and applications. What Was Leaked? User ID: A unique identifier assigned to each user within the UoH system. User Login: The username or credential used by users to access UoH online services. Hashed User Password: Passwords are typically stored in a hashed format, a one-way encryption process that makes it difficult, but not impossible, for attackers to decipher the original password. User Nickname: An optional field that users may choose to display instead of their full name. User Email Address: The primary email address associated with the user's account in the university. This is a critical piece of information often used for communication and account verification purposes. User URL: Potentially a link to a user's profile page or other online presence associated with the UoH account. User Registration Date: The date the user created their account within the UoH system. User Activation Key: A unique code used to verify a user's email address during the account registration process. User Status: An indicator of the user's account status, such as active, inactive, or suspended. Display Name: The name a user chooses to be displayed within the UoH system which may differ from their actual name. Access to spam and deleted messages’ folders of the users. The TA shared that few of the users whose accounts were reportedly compromised included the UoH’s Admin, Public Relations Officer (PRO), UoH Herald-newsletter of the university and Vasuki Belavadi- a former dean and professor at the Department of Communications. The post by the TA also suggested that the database was originally dumped on BreachForums in March 2023. There is a possibility that “nik20” obtained the data from a previous breach that wasn't widely publicized or that the information is outdated. University of Hyderabad Database Leak: University Puzzled but Promises Action When The Cyber Express spoke to stakeholders at the university regarding the data breach, they initially expressed shock but later accepted the possibility of a breach owing to their previous experiences. A student named Balakrishna, who is currently pursuing PhD at the university, was apprehensive and shared that he was concerned over his research papers being compromised due to the data breach. However, Sanjay Kumar Sharma, Director, Computer Network Facility, UoH, who is responsible for all technology related undertakings at the institute, was confident that the breach was not alarming as sensitive data was not compromised. “Previously there was a similar hack in the School of Life Sciences. So there is a possibility of this data being breached too. However, I can assure you that the data that could be breached is not that sensitive since it could only contain research material from students, which is publicly available anyway,” he said. “We will be constantly checking what is happening. There have been many data breach attempts previously, and our security is such that the attempt was rendered disabled in the initial stages itself. I agree there could be deficiencies and we will keep improving. We will cross-check this data breach and alert all our users. We will not take it casually,” Sanjay added. User Vigilance Can Help Avoid Cyber Incidents While the University of Hyderabad investigates the situation, users outside can take cue from this breach and take a few healthy steps to protect themselves. This includes being wary of phishing attempts by hackers, monitoring suspicious links and keeping an eye out for any unusual activity on their accounts, such as unauthorized login attempts or changes to their profile information. They can also enhance their security measures by enabling Two-Factor Authentication (2FA) and change their passwords regularly.

Ticketmaster Data Breach Confirmed; Stolen Data Hosted on Snowflake’s Cloud Storage

cyberexpress Jun 03, 2024 Firewall Daily

Live Nation, the parent company of Ticketmaster, has confirmed "unauthorized activity" on its database after hackers claimed to have stolen the personal details of 560 million customers. The revelation of the Ticketmaster data breach came through a filing to the U.S. Securities and Exchange Commission (SEC), show more ...

where Live Nation disclosed that a criminal actor had offered what was purported to be company user data for sale on the dark web. In a filing to the US SEC, Live Nation said that on 27 May "a criminal threat actor offered what it alleged to be Company user data for sale via the dark web", and that it was investigating. Company Mitigating Ticketmaster Data Breach The company further informed in the filing that they are working to mitigate risk to their users and the Company, and have notified and are cooperating with law enforcement. "As appropriate, we are also notifying regulatory authorities and users with respect to unauthorized access to personal information," reads the filling. The Ticketmaster data breach was initially identified on May 20, 2024. This is when Live Nation detected unauthorized activity within a third-party cloud database environment primarily housing data from its subsidiary, Ticketmaster L.L.C. On knowing this, Live Nation immediately launched an investigation with forensic investigators to determine the extent and nature of the data breach. According to the filing, the company is working diligently to mitigate risks to both its users and its overall operations. The company said in the filing that as of the date of this filing, the incident has not had, and we do not believe it is reasonably likely to have, a material impact on our overall business operations or on our financial condition or results of operations. “We continue to evaluate the risks and our remediation efforts are ongoing,” said the Officials of Live Nations in the filling. Snowflake Coming Into Picture What is more interesting is that a spokesperson for Ticketmaster told TechCrunch that its stolen database was hosted on a Boston-based cloud storage and analytics company, Snowflake. The Cyber Express earlier reported that a threat actor had allegedly taken responsibility for data breaches of Ticketmaster and Santander Bank, claiming they stole data after hacking an employee account at Snowflake. However, at that time, Snowflake shot down these data breach claims, attributing the breaches to poor credential hygiene in customer accounts instead. But now in light of the data breach, Snowflake and third-party cybersecurity experts, CrowdStrike and Mandiant, provided a joint statement related to their ongoing investigation involving a targeted threat campaign against some Snowflake customer accounts. Snowflake said in a post that it had informed a “limited number of customers who we believe may have been impacted” by attacks “targeting some of our customers’ accounts.” However, Snowflake did not describe the nature of the cyberattacks, or if data had been stolen from customer accounts. “We believe this is the result of ongoing industry-wide, identity-based attacks with the intent to obtain customer data. Research indicates that these types of attacks are performed with our customers’ user credentials that were exposed through unrelated cyber threat activity. To date, we do not believe this activity is caused by any vulnerability, misconfiguration, or malicious activity within the Snowflake product,” reads the Snowflakes bog. Some of the Key Findings of Snowflake’s Investigation No evidence suggests that the activity was caused by a vulnerability, misconfiguration, or breach of Snowflake’s platform. There is no evidence pointing to compromised credentials of current or former Snowflake personnel. The campaign appears to be targeted at users with single-factor authentication. Threat actors have leveraged credentials obtained through infostealing malware. A threat actor accessed demo accounts of a former Snowflake employee, which did not contain sensitive data and were not connected to Snowflake’s production or corporate systems. The accounts were not protected by Multi-Factor Authentication (MFA). Along with the findings, they have also suggested some of the steps that affected organization need to take: Recommendations for Enhanced Security Enforce Multi-Factor Authentication (MFA) on all accounts. Set up Network Policy Rules to allow access only to authorized users or from trusted locations (e.g., VPN, Cloud workload NAT). Reset and rotate Snowflake credentials for impacted organizations. Live Nation’s infrastructure, including that of Ticketmaster, is primarily hosted on Amazon Web Services (AWS). Although AWS had not commented on the breach, a customer case study mentioning their involvement was recently removed from Amazon’s website. Before this, Australian authorities, the Department of Home Affairs announced that it is investigating a cyber incident impacting Ticketmaster customers, “working with Ticketmaster to understand the incident,” said a spokesperson from the department

Spanish Police Bust €5.3 Million Illegal Streaming Network

cyberexpress Jun 03, 2024 Cybersecurity News

Spanish police have dismantled an illegal media content distribution network that had generated over 5.3 million euros since it began operations in 2015. The network, which illegally distributed audio-visual content, was brought down following an extensive investigation initiated in November 2022. This investigation show more ...

was carried out when a complaint from the Alliance for Creativity and Entertainment (ACE) was registered. ACE is the world’s leading anti-piracy coalition firm. The investigation into illegal media content was launched after ACE reported two websites for violating intellectual property (IP) rights. These sites hosted the illegal IPTV service 'TVMucho,' also known as 'Teeveeing.' According to ACE, TVMucho/Teeveeing had over 4 million visits in 2023 alone and offered more than 125 channels. These channels included major networks like BBC, ITV, Sky, and RTL. Arrest During Spanish Police Operation Within the framework of this Spanish police operation, eight individuals were arrested in various locations including Las Palmas de Gran Canaria, Madrid, Oviedo, and Málaga. The operation also involved two home searches, resulting in the seizure of a vehicle, and two computers, and the freezing of 80,000 euros in bank accounts. Furthermore, authorities blocked 16 web pages associated with the distribution and storage of IPTV content. Specialists from the Central Cybercrime Unit found out that a Dutch national was involved in this. While investigating the inspected websites it was found that they were registered, controlled, and operated by several companies directed by Dutch citizens. This individual allegedly led a criminal network comprised mainly of residents from Gran Canaria, which posed as a legitimate business structure. The network utilized advanced technology to capture satellite signals from various countries, decrypt the multimedia content, and distribute it illegally to their subscribers. Spanish Police Illegal Media Content Crackdown This criminal organization provided access to more than 130 international television channels and thousands of movies and series to users worldwide. The service charged its 14,000 subscribers between 10 and 19 euros per month, or between 90 and 169 euros annually, depending on the subscription type. This operation caused significant financial damage to the rights of authors, producers, and distributors of the pirated content. The servers of the online platforms investigated were also seized and blocked. Consequently, when users attempt to access the previously operational illegal sites, they are redirected to a National Police website displaying a message that the page has been intercepted. This crackdown represents a major success in the ongoing battle against digital piracy. By disrupting the operations of such a vast network, Spanish authorities have dealt a significant blow to the illicit distribution of copyrighted content. The operation underlines the effectiveness of international cooperation and advanced investigative techniques in combating cybercrime.

Spoofing Shein for Credential Harvesting

cyberexpress Jun 03, 2024 Features

By Jeremy Fuchs, Cybersecurity Researcher/Analyst Check Point Software LTD Shein is one of the most popular shopping apps in the world. In fact, it’s the second most downloaded shopping app globally, with over 251 million downloads. The e-commerce platform is Googled more frequently than major brands like Nike and show more ...

Adidas. Shein gained popularity for its inexpensive clothing and low prices. However, the company has faced significant criticism for its poor human rights record. Additionally, according to a TIME report, Shein has been exploited by scammers in various ways, including the use of fake gift cards on Instagram and counterfeit websites. That brings us to the focus of today’s report. Researchers from Harmony Email will discuss how hackers are impersonating Shein in an effort to steal user credentials. Over the last month, they have identified more than 1,000 of these fraudulent emails. Email Example of Shein The email arrives with a tempting subject line: "Order Verification SHEIN" – claiming to be from Shein customer service. But a closer look reveals a red flag – the sender's email address doesn't match Shein's official one. The email excitedly announces you've received a mystery box from Shein. However, the included link won't bring you a surprise gift; it leads to a fake website designed to steal your personal information (a credential harvesting site). This phishing attempt is quite transparent. It preys on your excitement by claiming you've won a prize and uses the trusted brand name "Shein" to gain your trust. However, a vigilant user can easily spot the scam: check the sender's email address (it shouldn't be random letters) and verify that any links lead to legitimate Shein web pages. Techniques Just like other phishing attempts, scammers are trying to capitalize on popular brands and current trends to trick you. This time, they're using Shein. There are several red flags that this email isn't legitimate. First, there's a strong sense of urgency surrounding the "mystery box" offer, which is designed to create excitement and pressure you into clicking. Another clue? The email address itself is a jumble of random letters, not a recognizable Shein address. You won't find any Shein branding or logos in the email either. Finally, the link in the email won't take you to an official Shein webpage, but to a fraudulent website designed to steal your information. Over the last month, we’ve seen over 1,000 of these attacks. Make sure you don't click on links from websites whose address isn't the official one and check the email's source. Check the address of the website and the sender's name for spelling and punctuation errors on websites that look real. Ensure the email is free of spelling errors. Pay attention to the language in the email: are you expecting to be addressed in this language by your shipping company? Disclaimer: The views and opinions expressed in this guest post are solely those of the author(s) and do not necessarily reflect the official policy or position of The Cyber Express. Any content provided by the author is of their opinion and is not intended to malign any religion, ethnic group, club, organization, company, individual, or anyone or anything.

Dark Web Actor Claims to Pilfer 2TB of Compressed Data from QuoteWizard

cyberexpress Jun 03, 2024 Firewall Daily

Sp1d3r, a dark web actor, allegedly stole 2 TB of compressed data from QuoteWizard, a US-based insurance business. According to the threat actor’s post, over 190 million people's sensitive personal data was compromised in this alleged QuoteWizard data breach, which was made public on the dark web forum nuovo show more ...

BreachForums. The threat actor also claim that the cyberattack on QuoteWizard produced stolen data that included a variety of documents including personally identifiable information (PII), including complete names, partially completed credit card numbers, driving records, and other background information. Furthermore, it was reported that the stolen dataset included more than 3 billion tracking pixel data entries, including addresses, ages, mobile information, and accident at-fault details. Sp1d3r provided a few sample entries from the database and suggested a high asking price of USD 2 million for prospective customers in order to support the assertions. The Overview of QuoteWizard Data Breach Claims [caption id="attachment_74008" align="alignnone" width="1332"] Source: Dark Web[/caption] The firm has not disclosed any notice regarding the authenticity of the QuoteWizard data breach, despite the claims of intrusion and the data being auctioned for USD 2 million. However, the dire implications of this breach extend not only to QuoteWizard but also to the broader insurance industry, especially the parent company LendingTree, LLC. Moreover, the threat doesn’t stop here nor does the list of long claims. As Sp1d3r suggests the data stolen from QuoteWizard also includes information from other insurance carriers as well. A huge amount of private information in the wrong hands presents an immediate threat to people's security and privacy. QuoteWizard Faces Connectivity Issues In an attempt to find out more about this QuoteWizard data breach, The Cyber Express tried to make contact with the company. However, QuoteWizard's website displays a "403 Forbidden" error notice, suggesting that the company is experiencing difficulties connecting to the internet. This error typically indicates that the server is preventing access to particular resources or portions of the website because it has detected threats or unauthorized activity on the website. This is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the alleged Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Hugging Face Discloses Unauthorized Access to Spaces Platform

cyberexpress Jun 03, 2024 Data Breach News

Hackers penetrated artificial intelligence (AI) company Hugging Face's platform to access its user secrets, the company revealed in a blog post. The Google and Amazon-funded Hugging Face detected unauthorized access to its Spaces platform, which is a hosting service for showcasing AI/machine learning (ML) show more ...

applications and collaborative model development. In short, the platform allows users to create, host, and share AI and ML applications, as well as discover AI apps made by others. Hugging Face Hack Exploited Tokens Hugging Face suspects that a subset of Spaces' secrets may have been accessed without authorization. In response to this security event, the company revoked several HF tokens present in those secrets and notified affected users via email. "We recommend you refresh any key or token and consider switching your HF tokens to fine-grained access tokens which are the new default," Hugging Face said. The company has not disclosed the number of users impacted by the incident, which remains under investigation. Hugging Face said it has made "significant" improvements to tighten Spaces' security in the past few days, including org tokens that offer better traceability and audit capabilities, implementing key management service, and expanding its systems' ability to identify leaked tokens and invalidate them. It is also investigating the breach with external cybersecurity experts and reported the incident to law enforcement and data protection agencies. Growing Threats Against AI-as-a-Service Providers Risks faced by AI-as-a-service (AIaaS) providers like Hugging Face are increasing rapidly, as the explosive growth of this sector makes them a lucrative target for attackers who seek to exploit the platforms for malicious purposes. In early April, cloud security firm Wiz detailed two security issues in Hugging Face that could allow adversaries to gain cross-tenant access and poison AI/ML models by taking over the continuous integration and continuous deployment (CI/CD) pipelines. “If a malicious actor were to compromise Hugging Face's platform, they could potentially gain access to private AI models, datasets and critical applications, leading to widespread damage and potential supply chain risk," Wiz said in a report detailing the threat. One of the security issues that the Wiz researchers identified was related to the Hugging Face Spaces platform. Wiz found that an attacker could execute arbitrary code during application build time, enabling them to scrutinize network connections from their machine. Its examination revealed a connection to a shared container registry that housed images belonging to other customers, which the researchers could manipulate. Previous research by HiddenLayer identified flaws in the Hugging Face Safetensors conversion service, which could enable attackers to hijack AI models submitted by users and stage supply chain attacks. Hugging Face also confirmed in December that it fixed critical API flaws that were reported by Lasso Security. Hugging Face said it is actively addressing these security concerns and continues to investigate the recent unauthorized access to ensure the safety and integrity of its platform and users.

Alleged Heineken Data Breach Potentially Impacts Over 8,000 Employees

cyberexpress Jun 03, 2024 Firewall Daily

Dark web actor 888 on BreachForums has alleged a Heineken data breach. The cyber intrusion, according to the threat actor’s post, surfaced on the dark web forum on Monday and alleged leaked databases containing information about “8,174 employees from several countries”. The Cyber Express has analyzed parts of show more ...

the sample data provided by the threat actor and found that it contains sensitive information about the company’s employees, including ID numbers, emails, and roles of employees within the organization. This dataset is highly sensitive as threat actors could use this data for various malpractices including phishing, blackmailing, and impersonating employees and managers. Decoding the Heineken Data Breach Claims The threat actor, identified as 888 has claimed similar breaches in the past and for this cyber intrusion, the hackers have listed the names of several employees, along with their email addresses and their work profiles. The employee names and related email addresses, together with their responsibilities at Heineken, were identified as "sample" in the shared data. [caption id="attachment_74095" align="alignnone" width="1740"] Source: Dark Web[/caption] The Cyber Express has contacted Heineken to find out additional information regarding the veracity of the data breach. However, at the time of writing this, no official statement or response has been received, thus the allegations regarding the Heineken data leak remain unsubstantiated. Heineken's website seems to be operating regularly in spite of the purported Heineken data leak. This suggests that the attack may have been directed at particular datasets or databases rather than the company's websites. This observation points to a more focused strategy on the part of the threat actor, who may be trying to obtain confidential employee data without wreaking havoc on the system by deploying techniques like DDoS attacks or website vandalism. Previous Cybersecurity Incident Heineken has faced cybersecurity issues before, prior to this event. Over 1.5 million people were impacted by a significant Dutch data breach that the organization was involved in in March 2023. This specific Heineken data leak, which involves the software provider for a market research agency, compromised information from multiple sources, including respondents to surveys for Heineken-sponsored events. Personal information such as gender, age, education, province, and email addresses were among the data leaked in the previous incident. Heineken, along with other affected entities, promptly notified individuals impacted by the breach and reported the incident to the relevant authorities, including the Dutch Data Protection Authority. As for the current claims by TA 888, this is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the alleged breach by 888 or any official confirmation regarding the authenticity or the denial of the intrusion. Media Disclaimer: The information presented on this website is sourced from various internal and external research. While we strive for accuracy, the information is provided for reference purposes only and is not independently verified..

Dkhoon Emirates Faces Data Breach Concerns: Over 1.1 Million Customers Potentially at Risk

cyberexpress Jun 03, 2024 Firewall Daily

Dkhoon Emirates, a well-known fragrance brand recognized for previous partnerships with Mariaceleste Lombardo and Dominique Moellhausen, has fallen victim to a significant data breach. A cybercriminal has openly taken credit for the attack and is allegedly selling the compromised databases on the dark web. The Dkhoon show more ...

Emirates data breach potentially exposes personal information from approximately 1,187,492 customer records. The threat actor, Ddarknotevil, also denoted that these documents are said to contain sensitive information such as complete identities, phone numbers, email addresses, and physical addresses. The asking price for this data is set to $4,800 for a one time deal with transactions limited to XMR and BTC. Dkhoon Emirates Data Breach Claims Surfaces on Dark Web [caption id="attachment_74222" align="alignnone" width="873"] Source: Dark Web[/caption] If there are no buyers for the information, the cybercriminal responsible for the possible Dkhoon Emirates data breach has made claims, threatening to make the data public. Although the authenticity of these accusations is still unknown, Dkhoon Emirates users need to be on the lookout for any potential phishing attacks. The Cyber Express has reached out to Dkhoon Emirates for clarification and further information regarding the alleged breach. But as of this writing, no formal answer or comment has been received. As a result, the assertions regarding the Dkhoon Emirates data leak are now unsubstantiated. Interestingly, Dkhoon Emirates is relatively new to the market and has a collection of 22 perfumes in its fragrance base. The threat actor has not disclosed how they obtained the information or whether they plan to negotiate a ransom deal. Rather, the databases are being sold directly on a well-known dark web forum. Cyberattack on Fashion and Lifestyle Brands The Dkhoon Emirates cyberattack joins a trend of targeting fashion and lifestyle brands. One of the most well-known examples of this threat is the hack that happened barely a year ago against Estée Lauder Companies (ELC). Estée Lauder had to take down sections of their network to prevent further data theft, while Dkhoon Emirates is allegedly coping with an issue involving a persistent threat actor. Notably, the threat actor linked to the Dkhoon Emirates data leak has a history of involvement in prior cyberattacks. The same threat actor claimed responsibility for a breach that in March 2024 affected 3,800 users of cloud solutions provider Okta. On closer inspection, however, contradictions in the claims were found, refuting the allegation that the breach was merely a renaming of previously stolen content. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Utah Student Gives Hackers False Information to Thwart Phishing

cyberexpress Jun 03, 2024 Cybersecurity News

A group of Utah students have taken it upon themselves to counter phishing attempts by using their computer skills to bring down fraudulent websites, thereby protecting potential victims. One of the Davis County high school juniors, Charles Mortensen, developed VEGA. This system aims to protect phishing victims and show more ...

outsmarting hackers by feeding them false information and rendering their phishing pages useless. Utah Student Motivated By Personal Connection to Hacking Victims "All my friends and peers around me got hacked," Mortensen told a local reporter. Mortensen, a student at Davis County High School, said he witnessed a rising tide of hacking incidents within his community. He cited an incident where a friend of his residing in foster care fell victim to an Instagram phishing attempt, jeopardizing her only means of maintaining contact with her mom. Affected by these hacking incidents among his peers, Mortensen took it upon himself to create VEGA (Victims' Empowerment Guard against Attacks). As phishing websites expect victims to enter legitimate information or credentials for compromise, VEGA attempts to subvert these attempts by feeding them fake details such as fake usernames and fake passwords. [caption id="attachment_74527" align="alignnone" width="996"] Source: kslnewsradio.com (Credit: Charles Mortensen)[/caption] Mortensen has stated that he has observed success with the VEGA system's attempts to feed hackers with streams of false information. He was quoted by KSL News Radio as saying, “I can send about half a million requests to one hacker within a night. I just let VEGA run overnight and then normally when I wake up … the website [is] shut down.” Student Sought Help From Peers With Anti-Phishing System While Mortensen is limited to running the program on his own personal system for now, he expressed his hopes to get VEGA running on 'a whole bunch of computers.' He claims that VEGA is able to take down thirty phishing sites within a month, and access to more computer systems could allow him to take down thousands of phishing sites in a month. Mortensen is seeking a sponsor to enable him to access more computers systems, allowing him to develop a bigger system that could potentially dismantle much larger volumes of phishing sites. Mortensen is a high school junior at the Davis Catalyst Center and sought help from his friends Regan Hosea and Jordan Kingston in helping him make this system work better after developing the first release of VEGA. If Mortensen's claims of taking down phishing sites are as claimed, they could potentially serve an example of the initial stages of an innovative system to counter phishing, which remains a significant security challenge affecting organizations of all sizes. Mortensen's VEGA system could offer hope to the phishing victims among his peers while fostering further collaboration in developing similar defenses against rising security threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Researcher Uncovers Exploited Flaw in Cox Modems That May Have Impacted Millions of Customers

cyberexpress Jun 03, 2024 Cybersecurity News

Cybersecurity researcher Sam Curry discovered that his home network had been compromised while experimenting with his HTTP traffic setup. The researcher discovered that the intrusion was not limited to specific devices, affecting both his PC and iPhone. Upon further investigation, Curry concluded that the intrusion show more ...

may have stemmed from a massive breach of Cox modems rather than a localized attack. This intrusion may affect millions of individuals and entire networks, with the attacker being linked to a history of phishing campaigns and router attacks. Unfamiliar IP Address Replaying Cox Modems HTTP Requests Curry discovered that an unfamiliar IP address (159.65.76.209) had been intercepting web traffic requests on his home network while attempting to test out his network's HTTP traffic setup. This suspicious behavior was not tied to a single device, affecting the researcher's iPhone in addition to his computer. [caption id="attachment_74339" align="alignnone" width="2800"] Virus Total Scan of Suspected IP [159.65.76.209] (Source: samcurry.net)[/caption]This led him to believe the incident was much more complicated than a mere localized attack scenario. When the researcher attempted to isolate the intrusion by switching between cloud providers such as AWS (Amazon Web Services) and GCP (Google Cloud Platform), the suspicious activity remained. This led him to suspect that his modem had been compromised. Sam traced the suspicious IP address to Digital Ocean and shared his findings three years later on vacation with his friends, who worked for various threat intelligence companies - and together they proceeded to find out how big the problem was. The researchers were able to link this suspicious IP address to a history of malicious usage such as involvement in hosting content for targeted phishing campaigns on ISG Latam (a South American cybersecurity company), as well as Adidas. The IP address had been used to host over 1,000 domains, all of which followed a pattern of a name followed by six numbers and the top-level domain. This pattern suggests the usage of a domain generation algorithm by the malware operators to rotate C&C server addresses for additional obfuscation. [caption id="attachment_74327" align="alignnone" width="1478"] Source: samcurry.net[/caption] The researcher said it was challenging to understand the attacker's intent, as they had targeted ISG Latam, Adidas and his own modem through the use of the same IP address. Hidden API Calls and Extent of Compromise Diving further, the researcher looked for publicly known vulnerabilities in the model of the Cox modem that he owned, but discovered that even three years later there were no known exploits. The researcher confirmed remote management facility within the router while helping a friend set up their Cox Modem, calling the ISP's support number and inquiring if they would be able to remotely push an update to the device in the new location. The support agent disclosed this remote management ability included updating device settings, changing WiFi passwords, and information on connected devices. The researcher theorized a potential backdoor in the router's remote management, focusing on the TR-069 protocol that allows ISPs to remotely administer devices. The researcher had a strong suspicion that this feature or tools that were utilized by the ISP's support teams were being exploited. Upon examination of Cox Business portal’s API, the researcher uncovered numerous unprotected endpoints with potential for extensive unauthorized access from attackers. The researcher believed that the vulnerable API may have access to both residential and business services offered by Cox. [caption id="attachment_74342" align="alignnone" width="2800"] Exposed Hidden API Calls of COX Modems (Source: samcurry.net)[/caption] The researcher was able to exploit the router configuration page to load hidden API documentation, exposing an underlying vulnerability that could theoretically grant hackers control over the modems of millions of Cox customers. Curry disclosed these findings to Cox through their responsible disclosure page. The disclosure led Cox to take down the vulnerable API calls within six hours, with the researcher confirming that they were no longer able to reproduce any of the discovered vulnerabilities the day after. Cox stated that the reported API vector was not observed being exploited in the past, but confirmed that they had no affiliation with the reported DigitalOcean IP address. The researcher stated that this indicated that his device had been compromised through an alternative method than disclosed in his blog and to the ISP service. The compromise of the researcher's device along with his own disclosure after discovering vulnerabilities in the modem's hidden API calls are examples of the inherent risks in remotely managed systems. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

China Increasingly Targeting Canadians with Cyber Operations

cyberexpress Jun 03, 2024 Firewall Daily

China is increasingly targeting Canadian citizens and organizations through the scale and scope of its cyber operations, warned the Canadian Centre for Cyber Security (Cyber Centre) in a cyber threat bulletin issued Monday. The Cyber Centre said China's cyber operations surpass other nation-state cyber threats in show more ...

terms of volume, sophistication, and breadth of targeting. China's cyber threat actors have targeted a wide range of sectors in Canada, including all levels of government, critical infrastructure, and the Canadian research and development sector. “The threat from China [to Canadian organizations] is very likely the most significant by volume, capability, and assessed intent. China-sponsored cyber threat actors will very likely continue targeting industries and technologies in Canada that contribute to the state’s strategic priorities.” - Canada's National Cyber Threat Assessment 2023-2024 China Increasingly Targeting Canadians through Cyberespionage Chinese cyber threat actors often operate under the directives of PRC intelligence services, targeting information that aligns with the national policy objectives of the PRC. This includes economic and diplomatic intelligence relevant to the PRC-Canada bilateral relationship and technologies prioritized in PRC's central planning, Canada said. Government of Canada networks have been compromised multiple times by Chinese actors, the Cyber Centre said. With all known compromises addressed, Chinese cyber threat actors still frequently conduct reconnaissance against federal networks, and other government organizations should be aware of the espionage risk. Last month, British Columbia, the westernmost province in Canada, reported facing multiple “sophisticated cybersecurity incidents” on government networks. Public Safety Minister and Solicitor General Mike Farnworth later told reporters that an unnamed state actor made three attempts to breach B.C. government networks. Chinese threat actors also target large datasets containing personal information for bulk data analysis and profiling, the Cyber Centre warned. Online services often collect personal information from their users to function. When personal information is exposed through data breaches or willingly released by the user, it can be used by cyber threat actors to facilitate identity theft or targeted fraud against the user. Cyber threat actors can collect financial details and social information, information on habits, health, and home security, and location and travel data. The targets include: Government entities at all levels, including federal, provincial, territorial, municipal, and Indigenous. Organizations or individuals in close partnership with government entities. Universities, labs, and technology companies involved in research and development of PRC-prioritized technologies. Individuals or organizations perceived as threats by the PRC, especially those advocating for Taiwan and Hong Kong independence and Chinese democracy. [caption id="attachment_74511" align="aligncenter" width="1024"] Source: Canadian National Threat Assessment Report 2023-24[/caption] Elections, Critical Infrastructure Targeted Canada recently revealed unsuccessful Chinese attempts to interfere in past elections too. Beijing has refuted these allegations but the Canadian Security Intelligence Service (CSIS) recently published an annual report warning of ongoing Chinese interference in Canadian political affairs, risking democratic integrity. “Canada’s strong democratic institutions, advanced economy, innovative research sectors, and leading academic institutions make Canada an attractive target for cyber-enabled espionage, sabotage, and foreign influenced activities, all of which pose significant threats to Canada’s national security,” the report said. The report identified China as a state-based threat conducting widespread cyber espionage across various sectors, including government, academia, private industry, and civil society organizations. The Cyber Centre also shares concerns with the U.S. about PRC cyber threat groups pre-positioning network access for potential attacks on North American critical infrastructure in case of conflict in the Indo-Pacific. "The Cyber Centre assesses that the direct threat to Canada’s critical infrastructure from PRC state-sponsored actors is likely lower than that to U.S. infrastructure, but should U.S. infrastructure be disrupted, Canada would likely be affected as well due to interoperability and interdependence in the sectors of greatest concern." Sectors of greatest concern include energy, telecommunications, and transportation. However, the prelude to the attacks on the provincial government networks also saw the targeting of the healthcare sector in the country, which makes it a cause of concern too. The first of the attacks in this sector was on the retail and pharmacy chain London Drugs, followed by a cyberattack on the First Nations Health Authority (FNHA), which compromised its employee information and limited personal data. Threat Tactics Detailed PRC cyber threat actors are known for several sophisticated techniques, the report said: Co-opting compromised small office and home office (SOHO) routers to conduct activity and avoid detection. Using built-in network administration tools for malicious activity, blending into normal system traffic. Compromising trusted service providers to access client information or networks. Rapidly weaponizing and proliferating exploits for newly revealed vulnerabilities, posing a continuous risk. Mitigating the Chinese Threat The Cyber Centre advises the Canadian cybersecurity community, especially provincial, territorial, and municipal governments, to enhance their awareness and protection against PRC cyber threats. Recommended measures include: Isolate Critical Infrastructure: Isolate critical components and services from the Internet and internal networks and test manual controls for operational continuity. Increase Vigilance: Monitor networks for tactics, techniques, and procedures (TTPs) reported by the Cyber Centre and partners. Focus on identifying and assessing unusual network behavior. Restrict Movement: Pay attention to vulnerable entry points, such as third-party systems. Disable remote access from third-party systems during incidents. Enhance Security Posture: Patch systems focusing on vulnerabilities identified by the U.S. Cybersecurity and Infrastructure Security Agency. Enable logging, deploy network and endpoint monitoring, and implement multi-factor authentication. Create and test offline backups. Incident Response Plan: Have a cyber incident response plan and continuity of operations and communications plans ready and tested. By adopting these measures, organizations can better defend against and mitigate PRC cyber threats, the report said.

Check Point Gateways Vulnerability: Australia Issues High Alert

cyberexpress Jun 03, 2024 Cybersecurity News

A high alert notification has been issued by the Australian Cyber Security Centre (ACSC) for vulnerabilities that affect Check Point Gateways with Mobile Access blades or IPsec VPN enabled. The zero-day vulnerability, identified as CVE-2024-24919, enables attackers to access private data on susceptible systems and may show more ...

also compromise large networks. Check Point Gateways Vulnerability CVE-2024-24919 Explained CVE-2024-24919 has been classified as an arbitrary file read vulnerability. This means that an attacker can read any infected file by exploiting the vulnerability without the need for prior authentication or special privileges. Attackers could exploit this flaw by reading any file on an affected device. Attackers might exploit the vulnerability to steal user credentials by cracking hashed passwords or using them for phishing attacks in the future. Attackers can also launch lateral attacks by using stolen credentials to move within a network and access more sensitive systems. They can also delete or modify critical data and disrupt operations by installing malware, thereby gaining access to launch attacks within the network in the future. The ACSC, in a high alert notice issued on May 31, confirmed the active exploitation attempts targeting unpatched Check Point devices. Check Point has released a hotfix to address the CVE-2024-24919 vulnerability. Exploiting the vulnerability could let attackers access sensitive information and allow them to move laterally within a network, potentially gaining complete control (including domain admin privileges). [caption id="attachment_74282" align="alignnone" width="2430"] Source: X[/caption] Check Point Gateways: Over 15,000 Devices Vulnerable Globally Research on ODIN, an Internet search engine built by Cyble for attack surface management and threat intelligence, found that more than 15,000 instances of Check Point devices globally are internet-facing and potentially vulnerable. ODIN users can use the query services modules http.title:“Check Point SSL Network Extender” to track the internet exposed Check Point devices on the platform. The affected Check Point products include: CloudGuard Network Quantum Maestro Quantum Scalable Chassis Quantum Security Gateways Quantum Spark Appliances Impacted software versions include: R80.20.x, R80.20SP (EOL), R80.40 (EOL), R81, R81.10, R81.10.x, and R81.20 Patch Now to Protect Against the Check Point Flaw The ACSC has strongly advised Australian organizations using Check Point Security Gateway devices to inspect their systems for the affected software versions and to apply the corresponding patches per Check Point's instructions. As an additional security measure, many organizations have been instructed to reset the local account credentials on patched systems to mitigate potential risks, especially since password hashes can be compromised. A Growing Threat While the ACSC's warning has been specifically issued for Australian organizations, the vulnerability poses a significant global threat. Organizations worldwide should take immediate action to identify and patch affected Check Point devices. The discovery and subsequent exploitation of CVE-2024-24919 is an evolving situation. In the next few days, we can expect: Further Analysis: Security researchers will continue to analyze the zero-day vulnerability and its corresponding impact. Detailed technical reports outlining the exploit mechanisms and potential attack vectors could be expected. Exploit Code Availability: Malicious actors could also release publicly available exploit code for CVE-2024-24919. This could substantially increase the number of attacks targeting vulnerable devices. Organizations should be prepared to detect and respond to such potential exploit attempts. Patch Updates and Guidance: Check Point is likely refine and update the security hotfixes based on the ongoing analysis. Organizations should stay alert for any updates or revised patching instructions from Check Point. Increased Attack Attempts: As news of the vulnerability spreads, there could be an expected rise in attempted attacks targeting unpatched Check Point devices. Organizations should prioritize patching and be on the lookout for any suspicious activity within their networks. Discovery of Related Vulnerabilities: The discovery of CVE-2024-24919 might lead to the identification of similar vulnerabilities in other Check Point products or security software from different vendors. Organizations should stay informed about any related vulnerabilities and take appropriate mitigation measures.

German Opposition Party CDU Hit by Major Cyberattack

cyberexpress Jun 03, 2024 Firewall Daily

Germany’s Christian Democratic Union (CDU) found itself the target of a cyber assault over the weekend. The large-scale CDU cyberattack forced the prominent opposition party to temporarily shut down parts of its IT infrastructure, highlighting the growing vulnerability of political organizations in the digital age. show more ...

German authorities have promptly launched an investigation into this cyberattack on CDU to identify the ones behind this and to prevent more damage. In addition, The Federal Ministry of the Interior and Homeland (Bundesministerium des Innern und für Heimat) also informed on X, formerly known as Twitter, "There was a serious cyber attack on the CDU network. Security Agencies on CDU Cyberattack "Our security authorities @BSI_Bund and the Federal Office for the Protection of the Constitution are intensively involved in fending off the attack, investigating it and averting further damage," officials tweeted. The Bundesamt für Verfassungsschutz (BfV), Germany's domestic intelligence service, has taken proactive measures by issuing warnings to all political parties within the Bundestag, Germany’s federal parliament. The BfV emphasized strengthened defensive measures against both digital and hybrid threats, reflecting the heightened state of alert within the country’s political world. [caption id="attachment_73989" align="aligncenter" width="679"] Source: X[/caption] A spokesperson for the CDU told Reuters that it seemed a professional actor was behind the cyberattack on CDU but it remains unclear who did it. Amid all this, the attack on Germany's Christian Democrats is part of a larger pattern of politically based cyberattacks, especially with the European Union election season expected to kick into high gear later this month. Thousands of similar cyberattacks have been connected to Russian state-sponsored actors, deepening worries about the nature of democratic processes throughout Europe. Juhan Lepassaar, the head of the European Union Agency for Cybersecurity (ENISA), observed a concerning rise in attempted cyberattacks, with the number doubling from the last quarter of 2023 to the first quarter of 2024. Cyber Threats in Germany The German government has consistently expressed its suspicions about Moscow's involvement in a series of cyberattacks targeting lawmakers from the ruling Social Democrats (SPD), including Chancellor Olaf Scholz, last year. Foreign Minister Annalena Baerbock recently attributed these attacks to APT28, a group allegedly directed by Russia's military intelligence service. In a similar event, German officials claimed a big win in the fight against cybercrime by closing down the notorious dark web store Nemesis Market. The takedown of Nemesis Market, which was known for supporting criminal activities such as drug trafficking, data theft, and cybercrime services, resulted from a comprehensive international law enforcement operation involving agencies from Germany, Lithuania, and the United States. Further, the Nemesis Market shutdown marks a pivotal moment in the ongoing battle against cybercriminal networks operating on the dark web. Additionally, it also serves as a reminder of the extensive resources and coordination required to tackle such sophisticated threats. Germany's recent experiences with cyberattacks, whether targeting political parties or dark web marketplaces, highlight the pervasive and evolving nature of digital threats. The CDU cyberattack, in particular, highlights the vulnerability of political organizations to cyber espionage and sabotage, especially in the context of international tensions and election cycles. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Trend Micro Taps Nvidia for Next-Gen AI-powered Cybersecurity Tools

cyberexpress Jun 03, 2024 Firewall Daily

Trend Micro and Nvidia are collaborating to provide cutting-edge cybersecurity solutions driven by AI and tailored to stop cyber attacks on data centers. These AI-powered cybersecurity solutions are expected to make their debut at this week's COMPUTEX conference in Taiwan. The tools are designed to run smoothly show more ...

on Nvidia CPUs, making them accessible to users globally and especially those using Nvidia environments. The upcoming COMPUTEX conference in Taipei will include the unveiling of these AI-powered cybersecurity solutions. The three main products of the collaboration are Trend Vision One ASRM, Trend Vision One Companion, and Trend Vision One Sovereign Private Cloud (SPC). AI-Powered Cybersecurity Tools Will Be Revealed at Taipei's COMPUTEX Due to the growing integration of AI systems across industries, businesses are centralizing data from various sources into a single pool, a trend that aligns with the release of these AI-powered cybersecurity technologies. Kevin Simzer, the Chief Operating Officer of Trend Micro, said these data pools can also become a critical: "They work their way into the enterprise and they find this massive honeypot of information." Trend Micro's partnership with Nvidia, specifically through the use of Nvidia NIM (NVIDIA Inference Microservices), demonstrates the company's hopes to lead the way in AI-driven cybersecurity solutions. This partnership facilitates the development of better security measures tailored to next-generation data centers, optimizing performance while fortifying defenses against cyber threats. Highlights of the Trend Micro-Nvidia Collaboration Trend Micro will reveal the cutting-edge security solutions at COMPUTEX in Taipei, featuring the Trend Vision One suite. Among these tools, the Sovereign Private Cloud (SPC) uses the Nvidia NIM for data security and compliance. The Companion AI improves detection and automates incident response. As for the last product, ASRM uses predictive analytics to strengthen an organization's cybersecurity posture. Trend Micro claims the Trend Vision One platform will provide unmatched security and operational efficiency because of Nvidia's AI infrastructure. The keynote speakers at the event will address a variety of subjects, including leveraging AI for cybersecurity, safeguarding next-generation AI data centers, enhancing the productivity of the AI workforce, and securing business generative AI. Attendees can see Trend Micro's new AI-based tools at the company's booth and assess how they can be integrated into corporate security frameworks to address data security threats.

Fake tech support scams: what they are and how to stay safe | Kaspersky official blog

kaspersky Jun 03, 2024 Threats

According to the FBIs 2023 Internet Crime Report, more than 37,500 complaints about fake tech-support scams were reported in the U.S. last year alone — resulting in over $924 million in losses. In this post, we discuss how these scams work, the dangers they pose, and how to protect yourself from this type of fraud. show more ...

How fake tech-support scams work In this scheme, scammers typically impersonate technical or customer-support staff of major companies — most often in the tech industry. This allows the cybercriminals to use impressive-sounding terms and technical details that are incomprehensible to the average user. The most common pretext under which fake tech-support scammers initiate contact with potential victims is by claiming to have detected some problem on the latters computer. For example, fake employees of a software developer or well-known antivirus company call you with a made-up story about their having detected malware on your computer. Scammers thus overwhelm their victims, instilling panic and a sense of helplessness. The scammers then manipulate these emotions to build trust — these schemes are usually designed to ensure the victim has no choice but to trust the scammer. Its this trust that the scammers ultimately exploit to achieve their goals. How fake tech-support scammers find you To make initial contact with the potential victim, tech-support scammers use a variety of tricks. But in general there are three basic scenarios. Fake websites and social media accounts Some scammers create web pages or social media accounts that mimic those of legitimate companies. They may also use search engine or social media ads to promote these fake resources, hoping that potential victims will come to them looking for help with technical issues. To carry out the attack, the scammers need to be in continuous contact with the victim. For this reason, they usually come up with some pretext to switch communication to phone calls or messaging apps. Pop-up windows and problem detected notifications Another popular scenario for this scam involves using pop-up windows and notifications that mimic operating system or antivirus warnings. These notifications, usually alarmingly red or orange in color, warn that something is wrong with the victims computer — most often that theres a virus. Again, since the scammers need to actively communicate with the victim, they usually provide a phone number to call in order to resolve the detected problem. Phone calls Finally, the most popular method of contacting victims is direct phone calls. These can be roughly divided into cold and warm calls. In the former case, fake tech-support scammers simply dial random numbers, often posing as representatives of major companies whose products are widely used. For example, you dont have to try very hard to find a Windows user. Warm calls involve using information obtained through breaches or leaks of customer data from certain companies. Naturally, knowing the victims name and the products they use gives the scammers more credibility, increasing their chances of success. What is the main danger of fake tech-support scams? Looking closer at the figures we started this post with, youll notice that tech-support scams arent about small charges for non-existent services. The average reported loss is almost $25,000. This highlights the main danger of fake tech-support: scammers dont settle for small profits, but instead try to extract as much from their victims as possible. To do this they devise intricate schemes and utilize social engineering techniques. In particular, tech-support scammers often pressure victims into installing remote-access or screen-sharing software, disclosing or exposing passwords for financial accounts, and sharing one-time transaction confirmation codes. They might even stage elaborate performances involving multiple phone calls from various company employees, financial institutions, or government agencies. How to protect yourself from fake tech-support scammers If someone contacts you claiming to be from tech support, warns you of some danger, and asserts that action must be taken immediately — most likely its a fake tech-support scammer. Try not to panic, and avoid doing anything you might regret later. Its better to discuss whats happening with someone else, as this can help you identify inconsistencies and holes in the scammers story. To buy time, ask them to call you back — say that youre busy, you have another call, your phone has low battery, or simply pretend to get cut off. In addition, to protect against scammers, you can take the following measures: Install a reliable security solution on all your devices and trust its warnings. Never enter your login credentials while someone else is watching, for example while youre screen sharing or if someone has remote access to your computer. Avoid installing remote access software on your computer, and certainly never grant access to strangers. By the way, our protection can warn you about such dangers. Its also worth remembering that the people particularly vulnerable to tech-support scams are the elderly. They may not be particularly cyber-savvy, so they need reliable protection more than anyone.

Name That Edge Toon: Zonked Out

darkreading Jun 03, 2024 Feed

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Europol's Hunt Begins for Emotet Malware Mastermind

darkreading Jun 03, 2024 Feed

International law enforcement Operation Endgame shifts its crackdown to focus on individual adversaries.

Ockam and Redpanda Partner to Launch Zero-Trust Streaming Data Platform

darkreading Jun 03, 2024 Feed

Portkey Announces Integration of Zero-Knowledge Proofs for Enhanced Identity Management and Security

darkreading Jun 03, 2024 Feed

KnowBe4 and MobileMind Collaborate to Provide Cybersecurity Training for K12 School Districts

darkreading Jun 03, 2024 Feed

Ticketmaster Confirms Cloud Breach, Amid Murky Details

darkreading Jun 03, 2024 Feed

Ticketmaster parent Live Nation has filed a voluntary SEC data breach notification, while one of its cloud providers, Snowflake, also confirmed targeted cyberactivity against some of its customers.

As Allies, Kenya & US Aim to Bolster Digital Security in Africa

darkreading Jun 03, 2024 Feed

Amid surging attacks, Kenya aims to expand its technology sector and improve cybersecurity to protect the country's fast-growing digital economy.

Ways iOS Sideloading Can Be More Secure

darkreading Jun 03, 2024 Feed

Sideloading apps is now possible on iOS devices, forcing Apple to add some security features in an attempt to mitigate the dangers of loading unknown apps.

Atlassian Confluence High-Severity Bug Allows Code Execution

darkreading Jun 03, 2024 Feed

Because of the role the Confluence Server plays in managing documentation and knowledge data bases, the researchers recommend users upgrade to patch CVE-2024-21683 as soon as possible.

Russia Aims Cyber Operations at Summer Olympics

darkreading Jun 03, 2024 Feed

As always, Russian APTs are hoping to foment unrest by stoking existing societal divides and fears, this time around the Olympics and EU politics; and, concerns remain around physical disruption.

CISA's Secure by Design Initiative at 1: A Report Card

darkreading Jun 03, 2024 Feed

There is more that needs to be done, but, so far, the initiative is a success.

Snowflake Data Breach Impacts Ticketmaster, Other Organizations

packetstormsecurity Jun 03, 2024 headline,hacker,privacy,data loss,flaw

Secrets Exposed In Hugging Face Attack

packetstormsecurity Jun 03, 2024 headline,data loss,flaw,password

Baidu Robo-Cars Crashed With Tinfoil And Paint Daubed On Cardboard

packetstormsecurity Jun 03, 2024 headline,china,flaw