Tag Archives: Cyberwarfare

Business

The No-Fly List Has Been Leaked, Pokemon Briefly Involved

Leave a comment

The Transportation Security Administration’s No-Fly List is one of the most important ledgers in the United States, containing as it does the names of people who are perceived to be of such a threat to national security that they’re not allowed on airplanes. You’d have been forgiven then for thinking that list was a tightly-guarded state secret, but lol, nope.

A Swiss hacker known as “maia arson crimew” has got hold of a copy of the list—albeit a version from a few years ago—not by getting past fortress-like layers of cybersecurity, but by…finding a regional airline that had its data lying around in unprotected servers. They announced the discovery with the photo and screenshot above, in which the Pokémon Sprigatito is looking awfully pleased with themselves.

As they explain in a blog post detailing the process, crimew was poking around online when they found that CommuteAir’s servers were just sitting there:

like so many other of my hacks this story starts with me being bored and browsing shodan (or well, technically zoomeye, chinese shodan), looking for exposed jenkins servers that may contain some interesting goods. at this point i’ve probably clicked through about 20 boring exposed servers with very little of any interest, when i suddenly start seeing some familar words. “ACARS”, lots of mentions of “crew” and so on. lots of words i’ve heard before, most likely while binge watching Mentour Pilot YouTube videos. jackpot. an exposed jenkins server belonging to CommuteAir.

Among other “sensitive” information on the servers was “NOFLY.CSV”, which hilariously was exactly what it says on the box: “The server contained data from a 2019 version of the federal no-fly list that included first and last names and dates of birth,” CommuteAir Corporate Communications Manager Erik Kane told the Daily Dot, who worked with crimew to sift through the data. “In addition, certain CommuteAir employee and flight information was accessible. We have submitted notification to the Cybersecurity and Infrastructure Security Agency and we are continuing with a full investigation.”

That “employee and flight information” includes, as crimew writes:

grabbing sample documents from various s3 buckets, going through flight plans and dumping some dynamodb tables. at this point i had found pretty much all PII imaginable for each of their crew members. full names, addresses, phone numbers, passport numbers, pilot’s license numbers, when their next linecheck is due and much more. i had trip sheets for every flight, the potential to access every flight plan ever, a whole bunch of image attachments to bookings for reimbursement flights containing yet again more PII, airplane maintenance data, you name it.

G/O Media may get a commission

Up to $100 credit

Samsung Reserve

Reserve the next gen Samsung device
All you need to do is sign up with your email and boom: credit for your preorder on a new Samsung device.

The government is now investigating the leak, with the TSA telling the Daily Dot they are “aware of a potential cybersecurity incident, and we are investigating in coordination with our federal partners”.

If you’re wondering just how many names are on the list, it’s hard to tell. Crimew tells Kotaku that in this version of the records “there are about 1.5 million entries, but given a lot are different aliases for different people it’s very hard to know the actual number of unique people on it” (a 2016 estimate had the numbers at “2,484,442 records, consisting of 1,877,133 individual identities”).

Interestingly, given the list was uploaded to CommuteAir’s servers in 2022, it was assumed that was the year the records were from. Instead, crimew tells me “the only reason we [now] know [it] is from 2019 is because the airline keeps confirming so in all their press statements, before that we assumed it was from 2022.”

You can check out crimew’s blog here, while the Daily Dot post—which says names on the list include members of the IRA and an eight year-old—is here.

Read original article here

Technology

Walk-Through Metal Detectors Can Be Hacked, New Research Finds

Leave a comment

Photo: VALERY HACHE/AFP (Getty Images)

Researchers have discovered a total of nine software vulnerabilities in a commonly used metal detector product. If exploited, the security flaws could allow a hacker to take detectors offline, read or alter their data, or just generally mess with their functionality, the research reveals.

The product in question is produced by Garrett , a well-known U.S.-based metal detector manufacturer that sells its product to schools, court houses, prisons, airports, sports and entertainment venues, and an assortment of government buildings, according to its website and other sites. In other words, their products are pretty much everywhere.

Unfortunately, according to researchers with Cisco Talos, Garrett’s widely used iC module is in trouble. The product, which provides network connectivity to two of the company’s popular walk-through detectors (the Garrett PD 6500i and the Garrett MZ 6100), basically acts as a control center for the detector’s human operator: using a laptop or other interface, an operator can use the module to remotely control a detector, as well as engage in “real-time monitoring and diagnostics,” according to a website selling the product.

In a blog post published Tuesday, Talos researchers said that the vulnerabilities in iC, which are officially being tracked as a bevy of CVEs, could allow for somebody to hack into specific metal detectors, knock them offline, execute arbitrary code, and generally just make a real mess of things.

“An attacker could manipulate this module to remotely monitor statistics on the metal detector, such as whether the alarm has been triggered or how many visitors have walked through,” researchers write. “They could also make configuration changes, such as altering the sensitivity level of a device, which potentially poses a security risk to users who rely on these metal detectors.”

In short: This is bad news. Generally speaking, nobody really wants to walk through a metal detector. But, if you’re going to walk through one, it might as well work, right? While the scenarios in which an attacker would actually go to the trouble to hack into these systems seem slim to probably fantastical, having functional security systems at important locations like airports and government agencies seems like a good idea.

Fortunately, Talos says that users of these devices can mitigate the security flaws by updating their iC modules to the latest version of its firmware. Cisco apparently disclosed the vulnerabilities to Garrett in August and the vendor just fixed the flaws on Dec. 13, Talos writes.

We reached out to Garrett’s security division for comment and will update this story if they respond.

Read original article here

Technology

Microsoft’s Failed Patch Puts All Windows Versions at Risk

Leave a comment

Photo: Sam Rutherford

Every version of Windows is at risk due to a scary zero-day vulnerability after Microsoft failed to properly patch a similar flaw, a cybersecurity researcher claims.

The newly discovered exploit is currently a proof-of-concept, but researchers believe ongoing small-scale testing and tweaking is setting the stage for a wider-reaching attack.

“During our investigation, we looked at recent malware samples and were able to identify several [bad actors] that were already attempting to leverage the exploit,” Nic Biasini, Cisco Talos’ head of outreach, told BleepingComputer. “Since the volume is low, this is likely people working with the proof of concept code or testing for future campaigns.”

The vulnerability takes advantage of a Windows Installer bug (tracked as CVE-2021-41379) that Microsoft claims to have patched earlier this month. This new variant gives users the ability to elevate local privileges to SYSTEM privileges, the highest user rights available on Windows. Once in place, malware creators can use those privileges to replace any executable file on the system with an MSI file to run code as an admin. In short, they can take over the system.

Over the weekend, security researcher Abdelhamid Naceri, who discovered the initial flaw, published to Github a proof-of-concept exploit code that works despite Microsoft’s patch release. Even worse, Naceri believes this new version is even more dangerous because it bypasses the group policy included in the admin install of Windows.

“This variant was discovered during the analysis of CVE-2021-41379 patch. the bug was not fixed correctly, however, instead of dropping the bypass. I have chosen to actually drop this variant as it is more powerful than the original one,” Naceri wrote.

BleepingComputer tested Naceri’s exploit and, within “a few seconds,” used it to open a command prompt with SYSTEM permissions from an account with “standard” privileges.

While you shouldn’t be too worried just yet, this vulnerability could put billions of systems at risk if it’s allowed to spread. It’s worth reiterating that this exploit gives attackers admin privileges on the latest Windows OS versions, including Windows 10 and Windows 11–we’re talking about more than 1 billion systems. This isn’t a remote exploit though, so bad actors would need physical access to your device to carry out the attack.

Microsoft labeled the initial vulnerability as medium-severity, but Jaeson Schultz, a technical leader for Cisco’s Talos Security Intelligence & Research Group, stressed in a blog post that the existence of functional proof-of-concept code means the clock is ticking on Microsoft releasing a patch that actually works. As it stands, there is no fix or workaround for this flaw.

Naseri, who told BleepingComputer that he didn’t give Microsoft notice about the vulnerability before going public as a way to petition against smaller payouts in Microsoft’s bug bounty program, advises against third-party companies releasing their own patches because doing so could break the Windows installer.

Microsoft is aware of the vulnerability but didn’t provide a timeline for when it will release a fix.

“We are aware of the disclosure and will do what is necessary to keep our customers safe and protected. An attacker using the methods described must already have access and the ability to run code on a target victim’s machine,” Microsoft told BleepingComputer.

The company usually pushes out patches on “Patch Tuesday,” or the second Tuesday of each month.

Update 2:00 AM ET: We’ve updated the headline and lede to specify the source of these cybersecurity flaw claims (that source being cybersecurity researcher Abdelhamid Naceri). Microsoft has responded to Gizmodo’s story by clarifying that the company did fix the original flaw. Naceri believes Microsoft didn’t “correctly” make that fix; he claims to have found a bypass for the patch. We’ve adjusted our headline accordingly. From Microsoft:

“[The] vulnerability disclosed is a separate vulnerability. It is inaccurate to say that Microsoft did not fix CVE-2021-41379.”

The company has not provided an update on the newer variant Naceri revealed.

Read original article here

Technology

Google Sends 50,000 Warnings to Users Targeted by State Hackers

Leave a comment

Photo: Kenzo Tribouillard / AFP (Getty Images)

If the internet is a digital Wild West, it’s time to lock your doors and close your windows. While the amount of cyber attackers and activity alone is alarming, in this episode, the featured villain is a hacker group backed by the Iranian government.

In a blog post published Thursday, Google’s Threat Analysis Group, also known as TAG, revealed that it had sent more than 50,000 warnings to users whose accounts had been targeted by government-backed hacker groups carrying out phishing and malware campaigns so far this year. Receiving a warning does not necessarily mean your Google account has been hacked—Google does manage to stop some of the attacks—but rather that the company has identified you as a target.

Google stated that this amounted to a nearly 33% increase when compared to the same time last year and attributed the activity to a large campaign launched by the Russian-sponsored group Fancy Bear, which U.S. and UK security agencies found had been on a worldwide password guessing spree since at least mid-2019, according to a report published in July.

Russia’s not alone though. More than 50 countries have hacker groups working “on any given day,” Google explained.

“We intentionally send these warnings in batches to all users who may be at risk, rather than at the moment we detect the threat itself, so that attackers cannot track our defense strategies,” Google said. “On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries. This means that there is typically more than one threat actor behind the warnings.”

G/O Media may get a commission

While that statistic alone is mind-boggling, the company also put a spotlight on APT35, a cyber attacker backed by Iran that has hijacked accounts, deployed malware, and spied on users using “novel techniques” in recent years. In particular, Google highlighted four of the “most notable” APT35 campaigns it’s disrupted in 2021.

One of APT35’s regular activities is phishing for credentials of so-called high-value accounts, or those belonging to people in government, academia, journalism, NGOs, foreign policy, and national security. The group uses a technique in which it compromises a legitimate website and then deploys a phishing kit.

In early 2021, Google said APT35 used this technique to hijack a website affiliated with a UK university. The hackers then wrote emails to users on Gmail, Hotmail, and Yahoo with an invitation link to a fake webinar and even sent second-factor identification codes to targets’ devices.

As you may be able to infer, legitimacy appears to be important to APT35, so it’s no surprise that another one of its trademarks is impersonating conference officials to carry out phishing attacks.

This year, members of APT35 pretended to be representatives from the Munich Security and the Think-20 Italy conferences, which are actually real events. After sending a non-malicious first contact email, APT35 sent users who responded follow-up emails with phishing links.

APT35 has also carried out its evil deeds via apps. In May 2020, it attempted to upload a fake VPN app to the Google Play Store that was in fact spyware and could steal users’ call logs, text messages, contacts, and location data. Google said it detected the app and removed it from the Play Store before anyone installed it but added that APT35 had tried to distribute this spyware on other platforms as recently as July.

The group even misused Telegram for its phishing attacks, leveraging the messaging app’s API to create a bot that notified it when a user loaded one of its phishing pages. This tactic allowed the group to obtain device-based data in real-time of the users on the phishing site, such as IP, useragent, and locales. Google said it had reported the bot to Telegram and that the messaging app had taken steps to remove it.

Hats off to Google for publishing this valuable information—knowledge is power, especially in cybersecurity—but dang is it nerve-racking. Let’s be clear, nobody is entirely safe online, but there are things you can do to reduce the possibilities of being hacked, such as enacting two-factor authentication and using a security key.

You can check out our full guide of safe online practices here, or just, you know, never use anything with a screen ever again. The guide is probably easier. Your call, though.

Read original article here

Technology

Acer Reportedly Hit With $50 Million Ransomware Attack

Leave a comment

Acer has reportedly been hit with a $50 million ransomware attack, the largest attempted ransom to date.
Photo: Sam YEH / AFP (Getty Images)

Acer has purportedly become the victim of a massive ransomware attack, in which hackers are asking for $50 million to release the company’s stolen data, Bleeping Computer reported on Friday. Nonetheless, the company has not publicly confirmed the attack, vaguely stating that, “companies like us are constantly under attack.”

According to Bleeping Computer, the attack was carried out by the REvil hacker group, which announced on its data leak site that it had breached Acer. As proof, the group shared images of the alleged files they had stolen, which include financial spreadsheets, bank balances, and bank communications. If true, this would be the largest attempted ransom ever demanded. In 2020, the highest attempted ransom to date was $30 million, ZDNet reported.

REvil is the same group linked to the Travelex attack in 2020. Reports from that time stated the group had asked for a $6 million ransom. In the end, the company supposedly paid the REvil group roughly $2.3 million worth of bitcoin.

Gizmodo reached out to Acer to confirm the report and ask for comment. The company did not acknowledge whether it had been the victim of an attack. It did acknowledge that it had reported recent “abnormal situations” to authorities.

“Acer routinely monitors its IT systems, and most cyberattacks are well defensed. Companies like us are constantly under attack, and we have reported recent abnormal situations observed to the relevant law enforcement and data protection authorities in multiple countries,” Acer said. “We have been continuously enhancing our cybersecurity infrastructure to protect business continuity and our information integrity.”

G/O Media may get a commission

Acer added that it urged companies and organizations to adhere to cybersecurity best practices and to “be vigilant to any network activity abnormalities.”

Bleeping Computer reported that it, as well as the French outlet LeMagIT, discovered the ransomware sample REvil used in the Acer attack. The outlet also analyzed the ransom note and the victim’s conversation with the hackers, which Bleeping Computer says confirm the attack was on Acer. Hackers have reportedly given Acer until March 28 to pay the ransom.

Some experts told the outlet that the breach could be related to a Microsoft Exchange server on Acer’s domain, which the REvil hackers recently targeted. It’s not clear whether the hackers exploited the Microsoft Exchange security vulnerabilities revealed earlier this month, which early estimates state have compromised around 30,000 U.S. organizations.

Nonetheless, the number of entities compromised worldwide could be much larger, with some reports stating that there are at least 60,000 known victims around the globe.

Read original article here

Business

Chinese Hackers Have Been Exploiting A Microsoft Email Product to Steal Data

Leave a comment

Photo: Drew Angerer (Getty Images)

In the latest in a string of security-related headaches for Microsoft, the company warned customers Tuesday that state sponsored hackers from China have been exploiting flaws in one of its widely used email products, Exchange, in order to target American companies for data theft.

In several recently published blog posts, the company listed four newly discovered zero-day vulnerabilities associated with the attacks, as well as patches and a list of compromise indicators. Users of Exchange have been urged to update to avoid getting hacked.

Microsoft researchers have dubbed the main hacker group behind the attacks “HAFNIUM,” describing it as a “highly skilled and sophisticated actor” focused on conducting espionage via data theft. In past campaigns, HAFNIUM has been known to target a wide variety of entities throughout the U.S., including “infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and NGOs,” they said.

In the case of Exchange, these attacks have meant data exfiltration from email accounts. Exchange works with mail clients like Microsoft Office, synchronizing updates to devices and computers, and is widely used by companies, universities, and other large organizations.

G/O Media may get a commission

Attacks on the product have unfolded like this: hackers will leverage zero days to gain entry to an Exchange server (they also sometimes used compromised credentials). They then typically will deploy a web shell (a malicious script), hijacking the server remotely. Hackers can then steal data from an associated network, including whole tranches of emails. The attacks were conducted from U.S.-based private servers, according to Microsoft.

Microsoft Corporate Vice President of Customer Security Tom Burt said Tuesday that customers should work quickly to update associated security flaws:

Even though we’ve worked quickly to deploy an update for the Hafnium exploits, we know that many nation-state actors and criminal groups will move quickly to take advantage of any unpatched systems. Promptly applying today’s patches is the best protection against this attack.

The situation was originally brought to Microsoft’s attention by researchers at two different security firms, Volexity and Dubex. According to KrebsOnSecurity, Volexity initially found evidence of the intrusion campaigns on Jan. 6. In a blog post Tuesday, Volexity researchers helped break down what the malicious activity looked like in one particular case:

Through its analysis of system memory, Volexity determined the attacker was exploiting a zero-day server-side request forgery (SSRF) vulnerability in Microsoft Exchange (CVE-2021-26855). The attacker was using the vulnerability to steal the full contents of several user mailboxes. This vulnerability is remotely exploitable and does not require authentication of any kind, nor does it require any special knowledge or access to a target environment. The attacker only needs to know the server running Exchange and what account from which they want to extract e-mail.

These recent hacking campaigns—which Microsoft has said are “limited and targeted” in nature—are unassociated with the ongoing “SolarWinds” attacks that the tech giant is also currently embroiled in. The company hasn’t said how many organizations were targeted or successfully compromised by the campaign, though other threat actors besides HAFNIUM may also be involved. Microsoft says it has briefed federal authorities on the incidents.

Read original article here

Business

Washington State Data Breach Could Affect 1.6 Million People

Leave a comment

A view of downtown Seattle.
Photo: John Moore (Getty Images)

The Washington state government has suffered a large data breach involving unemployment claims, potentially exposing data on more than 1.6 million people, officials admitted Monday.

The data appears to have been compromised through Accellion, a third-party vendor that was contracting with the state auditor’s office. In mid-December, the company suffered a cyberattack via a zero-day vulnerability in its legacy file transfer application.

The data exposed is quite sensitive, and includes names, bank account and routing information, social security numbers, place of employment, and driver’s license numbers.

This all happened, ironically, while the auditor’s office was looking to do a thorough investigation of the state’s ongoing problems with unemployment fraud—some of which has been linked to notorious cyber actors, like the Nigerian threat group Scattered Canary. SAO was using Accellion’s file transfer software as it sifted through unemployment claims filed in Washington over the past year, the auditor’s office said Monday:

SAO was reviewing all claims data as part of an audit of that fraud incident. The data involves about 1.6 million claims and included the person’s name, social security number and/or driver’s license or state identification number, bank information, and place of employment.

G/O Media may get a commission

The SAO’s office said they were only recently notified of the full extent of the breach, as the attack appears to have occurred on Dec. 25 and their office wasn’t notified about it until Jan. 12, after Accellion announced it had been hacked. The office further commented that they were “seeking a full understanding of the timeline of the incident and the status of Accellion’s investigation and the investigation by law enforcement” and that they didn’t currently “have enough information to draw conclusions about the timing or full scope of what took place.”

Accellion claims that it fixed the flaw within 72 hours of being made aware of it, but that the initial security incident was just the “beginning of a concerted cyberattack” on its FTA product that continued “into January.” The company subsequently “identified additional exploits in the ensuing weeks and rapidly developed and released patches to close each vulnerability,” it said.

Other prominent institutions have also been affected by this attack, including the large Australian law firm Allens and the Reserve Bank of New Zealand.

Accellion has announced it is contracting with a “industry-leading cybersecurity forensics firm” to produce an assessment of how the attack occurred. It has promised to share the findings of the report when it becomes available.

Updated, 02/01/2021 at 6:27pm: The original story misstated the number of people who were potentially affected and has since been corrected.

Read original article here