In today’s cybersecurity news…
Authorities unmask criminals behind malware loaders
As part of Operation Endgame, law enforcement agencies in 13 countries have revealed the identities of eight Russians linked to the distribution and administration of malware loaders including Bumblebee, IcedID, Pikabot, Smokeloader, SystemBC, and Trickbot. The loaders have been used for years to steal user data, distribute other malware, and propagate phishing campaigns. Forty-two-year-old Airat Rustemovich Gruber, has been identified as the administrator of the Smokeloader botnet, which first appeared in 2011. Seven other Russian nationals (Oleg Vyacheslavovich Kucherov, Sergey Valerievich Polyak, Fedor Aleksandrovich Andreev, Georgy Sergeevich Tesman, Anton Alexandrovich Bragin, Nikolaevich Chereshnev, and Andrei Andreyevich) are wanted for their ties with the TrickBot operation. Germany’s federal police authorities (BKA) have listed the suspects on their website along with information about the harmful loaders and the joint operation.
3 billion records stolen from background check firm
The criminal gang named USDoD appears to be selling just under 3 billion records on nearly all US, Canadian, and British citizens for $3.5 million on a Dark Web forum. The data was allegedly stolen from Florida-based background check firm, National Public Data. It’s believed that USDoD is acting as a broker for the gang that actually stole the data (using the handle SXUL) which included full names, address history, social security numbers, and names of parents, siblings, and relatives. According to the VX-Underground team, there is a small silver lining, which is that “The database DOES NOT contain information from individuals who use data opt-out services.”
Creds for 361 million accounts added to HIBP
A massive trove of 361 million stolen email addresses and passwords has been added to Troy Hunt’s Have I Been Pwned data breach notification service. Cybersecurity researchers, who asked to remain anonymous, collected the credentials from numerous Telegram cybercrime channels. Hunt said he utilized site password reset forms to confirm many leaked email addresses are legitimate but did not test the passwords because it would be considered a felony. Further, Hunt said 151 million of the addresses are brand new to the data breach notification service. Users can check whether their accounts have been affected at https://haveibeenpwned.com/
Cox fixed an API bug exposing millions of modems
The largest private broadband company in the U.S., ​Cox Communications has fixed an authorization bypass vulnerability that could allow remote attackers to abuse roughly 700 exposed APIs. Bug bounty hunter Sam Curry discovered the flaw which coughs up admin permissions after repeatedly replaying HTTP requests. This access could have allowed for reconfiguration of millions of company-supplied modems and theft of customer data including MAC addresses, email, phone numbers, and addresses. The company took down the exposed API calls within six hours of Curry’s report on March 3 and patched the vulnerability the next day. Cox also investigated the attack vector and said it found no evidence of previous abuse attempts.
Thanks to today’s episode sponsor, Conveyor
A director of GRC told us the most direct value for their CEO was showing the efficiencies and the dollars that security has been able to bring in from enabling sales through the security review.
See how best in class infosec teams measure their performance in Conveyor’s ultimate guide to the security review KPIs that matter. Go to www.conveyor.com and click the banner at the top.
Atlassian Confluence bug allows code execution
Researchers at SonicWall Capture Labs have discovered a remote code execution vulnerability (CVE-2024-21683) in the Atlassian Confluence Data Center and Server. The bug is assigned a CVSS score of 8.3 out of 10, and can be exploited by uploading a forged JavaScript language file containing malicious code. A proof-of-concept (PoC) exploit code has already been made available so admins should upgrade to the latest versions of Confluence as soon as possible. The researchers have published the indicators of compromise (IoCs) for the bug so admins can check for signs of exploitation.
Experts say new Windows AI feature could be a security ‘disaster’
Microsoft is about to launch a new AI-powered Recall feature that screenshots everything a user does on their PC and allows them to search and retrieve anything in seconds. Recall is part of the new Copilot Plus PCs that are debuting on June 18. Security researcher, Kevin Beaumont, who helped test the feature, discovered that the feature stores data locally in plain text which could allow an attacker to use malware to easily extract the database and its contents. Further, Recall doesn’t hide sensitive info like passwords or financial account numbers in its screenshots. Microsoft points out that stored Recall information is encrypted using Bitlocker while stored locally. But that would only protect the data from theft from a physically stolen device. Beaumont said he’s withholding technical details to give Microsoft time to take action. The UK’s Information Commissioner’s Office has also stepped in to make inquiries with Microsoft over its use of the AI-powered feature.
NIST turns to consultants to clear NVD backlog
Late last month, NIST amended its 5-year contract with security firm, Analygence, to help clear its National Vulnerability Database (NVD) backlog. The NVD backlog has been steadily building up since February when NIST announced it was working to improve its tools and methods which could result in delays in its vulnerability analysis efforts. According to VulnCheck, as of May 23, there were 12,720 vulnerabilities still pending analysis since February. NIST predicted it should be caught up and back to processing current CVEs by the end of the fiscal year.
Utah student floods hackers with false info to thwart Phishing
A Davis County high school junior, Charles Mortensen, developed a program dubbed VEGA (Victims’ Empowerment Guard against Attacks), which aims to take down phishing sites by flooding them with fake usernames and passwords. Mortensen said the program can send about half a million requests to a hacker site within a night, typically taking the site offline by the morning. Mortensen was motivated to create VEGA when a friend residing in foster care fell victim to an Instagram phishing attempt, jeopardizing her only means of contacting her mom. Mortensen said VEGA has enabled him to take down thirty phishing sites within a month. He is seeking a sponsor to help him to scale the operation to potentially dismantle much larger volumes of phishing sites.