News Wrap: Infosecurity Europe Highlights and BlueKeep Anxiety

This week, the focus was on Infosecurity Europe, which took place in London and showcased a myriad of sessions, threat research and trends in the cybersecurity space. During the Threatpost news wrap for the week ended June 7, the team breaks down the top news from the show, as well as other...

POS Malware Found at 102 Checkers Restaurant Locations

The popular Checkers and Rally’s drive-through restaurant chain was attacked by Point of Sale POS malware impacting 15 percent of its stores across the U.S. Checkers is one of the largest drive-through restaurants in the U.S., operating in 28 states and headquartered in Tampa, Florida. The securi...

LokiBot Trojan Spotted Hitching a Ride Inside .PNG Files

A spam campaign pushing the info-stealing LokiBot trojan leverages a novel technique to avoid detection. According to researchers, the spam messages include malicious .zipx attachment hidden inside a .PNG file that can slip past some email security gateways. According to Trustwave SpiderLabs, tha...

Three Ways DNS is Weaponized and How to Mitigate the Risk

In the early stages of the “Net” each computer system participating in this network could only be contacted by knowing it’s unique 32bit IP address. As the Net grew into the Internet that we know today, some changes had to be made to allow this system of interconnected computers to communicate wi...

ThreatList: Porn-Focused Malware Triples, Dark Web Loves It

Credential-stealing malware targeting premium accounts on adult websites almost tripled in 2018, corresponding with a rise in the number of offers related to stolen porn credentials on Dark Web markets. That’s according to Thursday research from Kaspersky Lab, which found that the malware is...

Siemens Patches Authentication Bypass Flaw in SiPass Server

A handful of vulnerabilities in Siemens’ SiPass integrated server have been patched, including one that allows an attacker to bypass authentication on the box. SiPass is the company’s integrated access control server managing physical access in a number of industries and use cases. The product...

Microsoft Mistakenly Leaks Secure Boot Key

Update Opponents of the government’s constant talk about intentional backdoors and exceptional access finally may have their case study as to why it’s such a bad idea. Two researchers operating under aliases my123 and slipstream this week posted a report—accompanied by a relentless chiptune—that...

Four Zero Days Disclosed in Internet Explorer

UPDATE–As if all of the vulnerabilities in Flash and Windows discovered in the Hacking Team document cache and the 193 bugs Oracle fixed last week weren’t enough for organizations to deal with, HP’s Zero Day Initiative has released four new zero days in Internet Explorer Mobile that can lead to...

Microsoft Data Shows Drop in Remote Code Execution Bugs Being Exploited

SAN FRANCISCO–One of the downsides to being a software company with a huge customer base is that your products are going to be prime targets for attackers. But the flip side to that coin is that you’re going to gather a lot of data about vulnerabilities and attacks. Microsoft has been collecting...

Researchers Investing in EMET Bypasses More than Hackers

Exploits bypassing Microsoft’s Enhanced Mitigation Experience Toolkit, or EMET, are quickly becoming a parlor game for security researchers. With increasing frequency, white hats are poking holes in EMET, and to its credit, Microsoft has been quick to not only address those issues but challenge a...

Microsoft Publishes New FixIt Tool For DLL Bug

Microsoft has released some updated guidance on the recent DLL-hijacking bug, including a new FixIt tool that enables the workaround for the vulnerability that Microsoft shipped late last month. The new guidance includes a detailed explanation of the bug itself as well as how potential attacks...

Researcher Shows Killbit is No Defense on MsVidCtl Flaw

Ryan Smith, one of the researchers who found the bug in the Microsoft MsVidCtl DLL that the vendor is rushing to patch this week, has posted a short video demonstration of a technique that bypasses the stop-gap solution of preventing the vulnerable ActiveX control from loading. In the demo, Smith...

Microsoft Takedown Domains Used in Cyberattack Against Ukraine

Microsoft seized seven domains it claims were part of ongoing cyberattacks by what it said are state-sponsored Russian advanced persistent threat actors that targeted Ukrainian-related digital assets. The company obtained court orders to take control of the domains it said were used by Strontium,...

Russia Issues Its Own TLS Certs

Russia is offering its own trusted Transport Layer Security TLS certificate authority CA to replace certificates that need to be renewed by foreign countries. As it is, a pile of sanctions imposed in the wake of Russia’s invasion of Ukraine is gumming up its citizen’s access to websites. As it is...

‘Long Live Log4Shell’: CVE-2021-44228 Not Dead Yet

Jen Easterly, the director of the Cybersecurity and Infrastructure Security Agency CISA, stated in a public news interview that the now-infamous Log4j flaw is the “the most serious vulnerability that she has seen in her career.” It’s not a stretch to say the whole security industry would agree...

Criminal, Domestic Violence Case Info Exposed in Cook County Leak

A non-password protected database, belonging to a county in Illinois, exposed 323,000 court records for at least four months, according to researchers. The database exposed the names of various people involved in sensitive criminal, domestic-abuse or child-custody court cases. Researchers from...

Researchers Warn of Flaw Affecting Millions of IoT Devices

Researchers are urging connected-device manufacturers to ensure they have applied patches addressing a flaw in a module used by millions of Internet-of-Things IoT devices. If exploited, researchers speculated that the flaw could allow attackers to knock out a city’s electricity or even overdose a...

ReVoLTE Attack Allows Hackers to Listen in on Mobile Calls

Researchers have discovered an attack on the Voice over LTE VoLTE mobile communications protocol that can break its encryption and allow attackers to listen in on phone calls. Dubbed ReVoLTE, the attack — detailed by a group of academic researchers from Ruhr University Bochum and New York...

Chris Eng: Patch Management Challenges Drive 'Security Debt'

Companies are lagging when it comes to keeping up with software security patches – causing them to fall into “security debt,” Chris Eng, chief research officer with Veracode said. Today, challenges around patch management are being worsened by applications using third-party code and open source...

TP-Link Routers Give Cyberattackers an Open Door to Business Networks

A firmware vulnerability in TP-Link Archer C5 v4 routers used in enterprise and home environments could allow unauthorized, remote access to the device with administrative privileges. The bug CVE-2017-7405 affects models that run firmware version 3.16.0 0.9.1 v600c.0 Build 180124 Rel.28919n. Firs...

The Unhappiest Subscribers on Earth? Disney+ Accounts Hacked & Hijacked

The highly anticipated Disney+ streaming service launched last week – and was promptly targeted by hackers looking to compromise users’ accounts. Around 4,000 customer account credentials have shown up for sale on hacking forums for around $3 each, according to reports. An investigation by ZDNet...

Gamers Warned of High-Severity Intel, Nvidia Flaws

Chip giants Intel and Nvidia have stomped out high-severity flaws in two popular products, both commonly used by gamers. Impacted are the Nvidia Shield TV and Intel NUC short for Next Unit of Computing mini-PC kit. Nvidia Shield TV is a media streaming box powered by Nvidia’s Tegra X1...

Dangerous Cryptomining Worm Racks Up 850K Infections, Self-Destructs

A French and U.S. law-enforcement effort has neutralized 850,000 infections by a cryptomining worm known as Retadup, by causing the threat to destroy itself. The worm has been distributing the malicious XMRig cryptocurrency miner to computers running the Windows operating system, mostly in Latin...

Facebook Records User Audio, Sparking Privacy Questions

Facebook has admitted that it has been transcribing audio chats between its users on its Messenger platform. Sources said that it’s paying hundreds to third-party outside contractors to do so. The latter calls into question Facebook’s data-handling practices when it comes to being open with its...

AT&T, T-Mobile, Sprint, Verizon Blasted For Data Privacy Policies

A U.S. senator has put telecommunication companies – AT&T, T-Mobile, Sprint and Verizon – on notice for their data-collection and retention policies. Last week, U.S. senator Ron Wyden D-Ore. sent an open letter to the CEOs of the four major telecom providers urging them to limit the data they...

Apple Upgrades Bug Bounty Program: Adds Macs, $1M Reward

LAS VEGAS – Apple is giving its bug bounty program a much-needed makeover. The device manufacturer in a Thursday Black Hat USA 2019 session said it will open the historically private program to all researchers in the fall. In addition, it plans to drastically boost some rewards for vulnerabilitie...

Citrix Confirms Password-Spraying Heist of Reams of Internal IP

UPDATE Digital workspace and enterprise networks vendor Citrix has concluded its investigation into a 6TB data heist in March, which it said was the work of international cybercriminals who exploited weak passwords on an internal network. The attackers intermittently accessed Citrix’ infrastrucur...

Mozilla Patches Firefox Critical Flaw Under Active Attack

UPDATE Mozilla has released updates for the Firefox browser addressing a critical vulnerability that is being actively exploited in targeted attacks against Coinbase employees – and potentially other cryptocurrency organizations. The critical flaw CVE-2019-11707 is a type confusion vulnerability ...

Chinese Spy Group Mixes Up Its Malware Arsenal with Brand-New Loaders

The Chinese-language cyber-espionage group known as APT10 has apparently added to its malware bag of tricks, with two never-before-seen malware loader variants used in April campaigns against government and private organizations in Southeast Asia. Also, the campaigns featured modified versions of...

Spam Campaigns Spread Trickbot Malware with Tax Lure

Hackers pushing the TrickBot banking trojan are exploiting tax season by pushing malicious Microsoft Excel spreadsheet documents via spam campaigns. Researchers said that they discovered the malware in three different campaigns since Jan. 27, 2019. These campaigns target victims with emails...

Word-based Malware Attack Doesn’t Use Macros

Typically, inbox-based attacks that include malicious Microsoft Office attachments require adversaries to trick users into enabling macros. But researchers say they have identified a new malicious email campaign that uses booby-trapped Office attachments that are macro-free. The attacks do not...

Office Zero Day Delivering FINSPY Spyware to Victims in Russia

Since at least January, unidentified state-sponsored attackers have been targeting victims in Russia with FINSPY spyware delivered in exploits for an Office and WordPad zero-day vulnerability patched on Tuesday by Microsoft. Separately, the same zero-day has been leveraged in financially motivate...

EFF Blasts Microsoft Over Windows 10 Rollout

The Electronic Frontier Foundation is blasting Microsoft for its “malicious” and “annoying” tactics when it comes to prodding Windows users to update their operating system to Windows 10. The digital watchdog group says Microsoft’s strategy of pushing the Windows 10 upgrade application onto users...

Amazon Web Services Combing Third Parties for Credentials

Amazon Web Services is actively searching a number of sources, including code repositories and application stores, looking for exposed credentials that could put users’ accounts and services at risk. A week ago, a security consultant in Australia said that as many as 10,000 secret Amazon Web...

Black Hole Exploit Kit Targeting Java CVE-2012-1723 Flaw

A new fork of the Black Hole exploit kit is making quick work of a recently patched Java vulnerability and security researchers say that the attackers are registering new sites quickly to exploit users with vulnerable browsers. The CVE-2012-1723 Java vulnerability that the Black Hole exploit kit ...

Google Fixes Six High-Risk Bugs in Chrome, Pays Out $6k in Bounties

Google has fixed seven security vulnerabilities in its Chrome browser, including six high-priority flaws. The new release of Chrome is version 12.0.742.112 and also includes an updated version of Flash. The latest version of Chrome is the third major update from the company since just the end of...

MacOS Malware ‘DazzleSpy’ Used in Watering-Hole Attacks

A new family of cyber-espionage malware targeting macOS and delivered via a Safari exploit was used against politically active, pro-democracy residents of Hong Kong, in August watering-hole attacks initially discovered by Google TAG, researchers said on Tuesday. The watering-hole attacks – which...

Are You Guilty of These 8 Network-Security Bad Practices?

They say the first step in addressing a serious issue is admitting you have a problem. And so it is with network security. The ongoing explosion of ransomware events and breaches many of which the public never hears about is elevating network security to a top corporate priority. Employees are...

Adobe Snuffs Critical Bugs in Acrobat, Experience Manager

Adobe is urging its throngs of Acrobat Reader users to update their software to fix critical vulnerabilities that could allow adversaries to execute arbitrary code on unpatched versions. The warnings are part of the firm’s September monthly security update, which this month addresses 59 bugs foun...

Trend Micro Bugs Threaten Home Network Security

Three security vulnerabilities have been found in Trend Micro’s Home Network Security systems, which can allow denial of service DoS, privilege escalation, code execution and authentication bypass. The Home Network Security Station is an all-in-one device that scans for vulnerabilities for...

Cisco Patches Critical Flaw After PoC Exploit Code Release

A day after proof-of-concept PoC exploit code was published for a critical flaw in Cisco Security Manager, Cisco has hurried out a patch. Cisco Security Manager is an end-to-end security management application for enterprise administrators, which gives them the ability to enforce various security...

WordPress Sites Open to Code Injection Attacks via Welcart e-Commerce Bug

A security vulnerability in the Welcart e-Commerce plugin opens up websites to code injection. This can lead to payment skimmers being installed, crashing of the site or information retrieval via SQL injection, researchers said. Welcart e-Commerce is a free WordPress plugin that has more than...

Bitcoin Stealers Hide in 700+ Ruby Developer Libraries

About 760 malicious libraries, bent on stealing Bitcoin, have been identified so far in the open-source Ruby programming language code base. According to Tomislav Maljic, threat analyst at ReversingLabs, cybercriminals have been using simple typosquatting to carry out their plan – which is the...

Tokyo Olympics Postponed, But 5G Security Lessons Shine

The 2020 Summer Olympics in Tokyo were officially postponed this week amid the ongoing, pandemic spread of the coronavirus that causes COVID-19. The Games will be moved to 2021, but in the meantime, technological innovation around the event will continue. More specifically, postponed or not, the...

Trump, Sanders Are the Top Brands for Cybercriminals

Unwanted and malicious emails using political-themed lures has spiked as the presidential primary season cranks into high gear – with Donald Trump and Bernie Sanders representing the lion’s share of subject line themes. Since the beginning of the year, Proofpoint researchers have tracked subject...

Evil Corp Returns With New Malware Infection Tactic

Cybercrime group Evil Corp a.k.a. Dudear is back in action after a short hiatus, with a technique in its arsenal not previously used by the group to distribute malware. Microsoft on Thursday said that it observed emails from the cybercriminal gang utilizing HTML redirectors. Microsoft is unclear...

New Muhstik Botnet Attacks Target Tomato Routers

A new variant of the Muhstik botnet has appeared, this time with scanner technology that for the first time can brute-force web authentication to attack routers using Tomato open-source firmware, researchers have found. Researchers at Palo Alto Networks’ Unit 42 discovered the new variant...

TikTok Banned By U.S. Army Over China Security Concerns

With backlash swelling around TikTok’s relationship with China, the United States Army this week announced that U.S. soldiers can no longer have the social media app on government-owned phones. TikTok, a social media app used to create and share short form videos, is owned by Beijing-based parent...

Critical Bug in WordPress Plugins Open Sites to Hacker Takeovers

UPDATE Security researchers are warning users of two WordPress plugins – made by Brainstorm Force – that they need to patch a “major” vulnerability that could allow hackers to gain administrative access to any website using the plugins. According to Brainstorm Force, it is only aware of one...

Adult Content Site Exposed Personal Data of 1M Users

The personal information more than a million users of popular adult website Luscious, including email addresses that sometimes indicated full names, were found exposed in an unsecured Elasticsearch database. The website, which focuses on anime-themed, user-uploaded adult content, has over 1 milli...