Security

Link

Co-Founder of Swiss SMS Giant 'Mitto AG' Accused of Government Surveillance

Andrew Orr · · 1 Comment

Swiss tech company Mitto AG is trusted by companies such as Twitter and Google to deliver SMS security codes to users, appointment reminders, sales promotions, and more. It’s co-founder and COO Ilja Gorelik has been accused of selling access to Mitto’s networks for surveillance.

The existence of the alternate service was only known to a small number of people within the company, these former employees said. Gorelik sold the service to surveillance companies which in turn contracted with government agencies, according to the employees.

Link

Microsoft Seizes Domains From Chinese Group 'NICKEL' Used to Attack Governments

Andrew Orr · · Add Comment

NICKEL is a China-based threat actor that targets governments, diplomatic entities, and NGOs around the world. Microsoft’s Digital Crimes Unit has disrupted their operation.

MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. Upon successful intrusion, they have used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts. NICKEL actors created and deployed custom malware that allowed them to maintain persistence on victim networks over extended periods of time.

Link

Hundreds of Tor Servers From 'KAX17' Threaten to Deanonymize Users

Andrew Orr · · Add Comment

Security researcher ‘Nusenu’ has uncovered hundreds of Tor servers belonging to an entity tracked as KAX17.

Grouping these servers under the KAX17 umbrella, Nusenu says this threat actor has constantly added servers with no contact details to the Tor network in industrial quantities, operating servers in the realm of hundreds at any given point.

KAX17’s focus on Tor entry and middle relays led Nusenu to believe that the group, which he described as “non-amateur level and persistent,” is trying to collect information on users connecting to the Tor network and attempting to map their routes inside it.

Link

Cuba Ransomware Gang Made $43.9 Million in Ransom Payments

Andrew Orr · · Add Comment

The FBI also said it traced attacks with Cuba ransomware to systems infected with Hancitor. This is a malware operation to access Windows machines.

It is also worth mentioning that Cuba is also one of the ransomware groups that gather and steal sensitive files from compromised companies before encrypting their files. If companies don’t pay, the Cuba group will threaten to dump sensitive files on a website they have been operating on the dark web since January this year.

Link

Hackers Steal $119 Million From Web3 Project 'BadgerDAO'

Andrew Orr · · Add Comment

BadgerDAO reported on Wednesday that it lost about 2,100 bitcoin and 151 ether in a hacking attack.

Kryptobi, who said he is on the BadgerDAO support team and has been looking into the hack, told Motherboard that it appears someone injected a malicious script into BadgerDAO’s frontend after compromising an API key for BadgerDAO’s Cloudflare account. Cloudflare is a web infrastructure, content delivery network, and website security company, which is used by millions of sites on the internet.

Link

Planned Parenthood Hack Leaked Data for 400,000 Patients

Andrew Orr · · 1 Comment

In October, a Planned Parenthood facility in Los Angeles suffered a data breach. It affected about 400,000 patients.

Letters from PPLA to affected patients warned that “we identified files that contained your name and one or more of the following: address, insurance information, date of birth, and clinical information, such as diagnosis, procedure, and/or prescription information.”

Link

Facebook Requires More At-Risk Accounts to Use Two-Factor Authentication

Andrew Orr · · Add Comment

Wired writes that Facebook will require at-risk accounts to secure with two-factor authentication, an important security measure for users.

Facebook Protect started as a pilot project in the United States ahead of the 2018 midterm elections and expanded leading up to the 2020 presidential election. Facebook enrolls some prominent public figures in the program automatically, but the company has also been creating mechanisms for people to nominate themselves for inclusion, like enrolling whole newsrooms. Once users join Facebook Protect, they can’t opt out.

Link

Qualcomm's New Snapdragon Chip Aims to Defeat Cops and Robbers

Andrew Orr · · Add Comment

A report from PCMag today discusses Qualcomm’s latest chip, the Snapdragon 8 Gen 1. It has anti-spoofing technology to protect against Stingrays.

Spoof cell sites can now be run on small, widely available boxes that pass bad data and phishing messages, Qualcomm said at its Snapdragon Summit today. Otherwise known as “Stingrays,” these faux cells can be run by criminals, law enforcement, or security agencies to collect your personal data without your permission.

Link

'EWDoor' Malware Attacks Thousands of AT&T Internet Subscribers

Andrew Orr · · Add Comment

Hackers are exploiting a bug from 2017 to attack the EdgeMarc Enterprise Session Border Controller. This device is used by businesses to manage phone calls and video calls.

The vulnerability being exploited to infect the devices is tracked as CVE-2017-6079, a command-injection flaw that penetration tester Spencer Davis reported in 2017 after using it to successfully hack a customer’s network. The vulnerability stemmed from an account in the device that, as Davis learned from this document, had the username and password of “root” and “default.”

Link

Intel Stockpiles Legacy Hardware for Security Research at Costa Rica Facility

Andrew Orr · · Add Comment

The Wall Street Journal reports that Intel has a facility in Costa Rica where it stores legacy hardware for security research.

Intel’s issue reflects a wider concern: Legacy technology can introduce cybersecurity weaknesses. Tech makers constantly improve their products to take advantage of speed and power increases, but customers don’t always upgrade at the same pace. This creates a long tail of old products that remain in widespread use, vulnerable to attacks.

Link

Digital Marketing Agency 'Cronin' Leaks 92 Million Employee, Client Records

Andrew Orr · · 1 Comment

Security researcher Jeremiah Fowler in cooperation with the WebsitePlanet research team found an unprotected database from Cronin. It exposed 92 million database records from employees and clients.

The exposed server was named “Cronin-Main” and many of the records contained references to Cronin. These records included internal data such as employee and client information. Also included in the dataset was a “Master Mailing List” with direct physical names, addresses, Salesforce IDs, phone numbers, and references to where the leads came from.