Blog

Hey Guys It’s your host Lauro with Exploit Brokers. I’m happy to say the Show Will Go On!

So let’s start with a quick intro! Malware is being disguised as Textbooks, the Marriott Hotels had a data breach which means more than just a mint on your pillow, we discuss the top 10 application vulnerabilities for 2019, and we wrap up this episode by going over the anatomy of Magecart malware. Some of you may remember Magecart as previously mentioned in another episode. This time we’ll be covering a general anatomy of it, so let’s login.

 

Malware Ridden Textbooks and Educational Related Content

So in an article by kaspersky.com titled as “Student surprise: Malware masked as textbooks and essays”, Kaspersky shares their findings of Malware being disguised as educational content such as essays, books, and more. So let’s break that down here.

So the article opens up by pointing out that malware can come as TV Shows, and game sheets. Now for some of my listeners who have come across malicious file hidden as some other file, I would like to give a quick explanation as to why. Windows will generally identify a file not by the contents but by the ending file type, the dot jpg for example. Windows by default doesn’t show the file type ending so you may see something.jpg but you won’t see it’s really something.jpg.exe and the .exe means windows will try to execute it. So with this in mind let’s keep going.

Here is a breakdown of the numbers. It’s important to note the numbers and articles only represent the individuals who used Kaspersky as their AntiVirus. The numbers reflect data gathered by Kaspersky using their Anti Virus Software.

Kaspersky noted 356,000 attacks on users. 74,000 users attempted to downloaded 233,000 malware ridden essays but the malware was blocked by kaspersky. If these numbers reflect the users correctly  then each user on average attempted to download a malware disguised as an essay roughly 3 times.

Furthermore, 30,000 users attempted to download malware disguised as textbooks about 122,000 times. Which comes out roughly to 4 malicious textbook download attempts per user.

So now that we know the textbook attempts we can break down the textbook subjects. The highest infection attempts were primarily English textbooks at around 2,000 attempted downloads. This is followed by around 1,200 attempted downloads of Math textbooks. Lastly Literature is the 3rd highest download attempt at around 870 attacks. There were also 18 Natural Science and an undisclosed amount in foreign language textbooks.

We’ve covered the numbers but we haven’t covered the types of malware that was found in Kaspersky’s finding. Let’s go over that.

So the 4th most found malware in their study is the MediaGet torrent application. This download a torrent client instead of the file they were originally looking for. You can find this on download sites usually hidden as another Download button.

Next, the 3rd most found malware is WinLNK.Agen.gen. The malware hides itself in a compressed file like a RAR or ZIP Archive. When you unzip the malware and open it then the malware displays the document and begins executing the malicious code that came with the payload. This is sometimes accomplished with a LNK, Shortcut, file that pretends to be another file like an image or pdf but is really just code to display and execute malicious actions. The trojan can download various malicious software like Adware, cryptominers, botnet software, you name it.

Furthermore, the second most found malware is Win32.Agent.ifdx. This malware acts very similarly to WinLink.Agen.gen and is primarily a downloader for other malware such as cryptominers. This malware does spoof itself as a PDF, DOC, or DOCX document but is just a trojan to download other malware.

Lastly, the most found malware was the Stalk worm. The stalk worm, also known as Worm.Win32 Stalk.a, has the highest number of victims and is primarily used to infect educational related users and networks. The Stalk worm infects devices and distributes itself via email found on the victim computer.

So if any system, network, or admin of any kind is listening remember to keep your network and devices as up to date as possible.

src: https://www.kaspersky.com/blog/back-to-school-malware-2019/28316/

Magecart Attack Toolkit: Anatomy of Skimming-as-a-Service

So some of you may remember Magecart from a previous episode. For those of you who don’t let me explain. MageCart is a hacker group that creates malicious software to infect checkout carts and skim, also known as stealing the information by sniffing it during a transaction, credit cards from victims. The PerimeterX research team published an article titled as “Skimming-as-a-Service: Anatomy of a Magecart Attack Toolkit”, that goes into their findings, dissects part of how the Inter toolkit works,  and their conversation with one of the Toolkit developers.

So let’s dive into the toolkit first. The Inter toolkit was originally found in 2018 and was being marketed as an easier way for hackers, who had access to compromised shopping carts, to steal credit cards. At the time in 2018, paying $1,300 meant you had a way to take data from your compromised sites, no coding skills needed. The PerimeterX research later found a post in another public forum that hinted the Inter developers were still building and maintaining the toolkit.

So what did the researchers actually find?

The Inter toolkit has an easy to recognize control panel login with a logo of a red square in a blue circle. The PerimeterX team note this made it easier to track the control panels as they found them in the wild. The server they came upon showed not the panel but the directory tree of the app. This essentially means when they went to the site they could see how everything was organized and access the files of the app instead of the actual app contents. This is very useful because you can see the source files instead of the output generated when you go to a URL.

The PerimeterX team found what appeared to be a staging site with open login and found a text file that the developer left on by accident used for debugging.

The Inter toolkit has functionality as follows:

• An admin panel with CAPTCHA
• A Command and Control drop zone url, used to collection the stolen card data
• A Pipeline for the stolen credit card numbers to add geolocation data of the victim IP and adjusting names for an easy way to aggregate the data
• Filter and export functions for the credit card data
• Creation of a loader and a skimmer script (great for non-developer oriented hackers)
• The skimmer fields can be adjusted to customize for the need of every checkout page.
• The loader has Obfuscation to evade Anti-Malware scanners.

A notable feature is that the Obfuscation provided includes the Caesar obfuscator which is worth around $100 on it’s own but is included as part of the toolkit.

Cleverly, the toolkit generates loaders with obfuscation and anti-forensic features such as preventing loading of the skimmer if the loader detects a debugger is open.If you have devtools or firebug the loader won’t fetch the skimmer so you won’t see it execute the skimming code.

Now we have spoken about the technical aspect of this skimmer but onto why the article refers to it as Skimming-as-a-service. The developers treat this as a commercial software, albeit a malicious software. At the time of the article’s writing the toolkit retails for $1000 and includes 24/7 support. If you need help setting it up the developers offer malicious clients a 30/70 split of revenue. This bring software as a service model to the criminal side as malicious developers bring their skillsets to the blackhat side.The PerimeterX team indicate this article is part of a series so I do encourage you to go check them out. Link is in the shownotes at https://exploitbrokers.com/podcasts/hn07 .

I can’t agree with the developers writing software for nefarious purposes but as a developer I can understand how code can fill a need, again a malicious need. So it’s interesting that a team of security researchers not only talked to the developers of this malware but shared their research and part of their conversation with the security community and the world.

src: https://www.perimeterx.com/resources/blog/2020/skimming-as-a-service-anatomy-of-a-magecart-attack-toolkit/

COVID-19 IRS Scam

So we’ve gone over Malware Textbooks and Skimming-As-A-Service, but time to give out some good security info on social engineering. In an article by Sophos.com’s NakedSecurity titled “Watch out for the new wave of COVID-19 scams, warns IRS”, Sophos describes a new wave of COVID-19 Scams.

Many American listeners are probably aware that a stimulus bill was passed where most American adults will receive $1,200 , there are conditions of-course.

The article outlies the following IRS warned red flags:

• If someone emphasizes the words “Stimulus Check” or “Stimulus Payment”, run. Economic Impact Payment is the proper term being used.
• If someone says they can get your tax refund or economic payment faster by working on your behalf, run.
• If someone asks for personal banking info or any Personal Identifiable Information (PII) and they say it’s to help receive or speed up the economic payment or stimulus, you guessed it RUN!
• If you get a check in an odd amount and there are instructions to call a number to verify information online to cash it, run.
• Lastly, if they ask you to sign over your economic impact payment to them, run.

The IRS will not call, email, or contact you to get information to process your payment faster, that’s just not how they operate.

Although the IRS Criminal Investigation Division is hard at work trying to shut down these scammers there will be many scammers who fall through the cracks.

Here are some important highlights to note.

• If you have direct deposit setup for your 2019 and/or your 2019 tax return the IRS should be using that.
• If you don’t have direct deposit they will mail it to you and anyone offering to submit your direct deposit or banking info is not to be believed.
• Retirees will be receiving their payment automatically and the IRS won’t be reaching out to them. If someone reaches out to a retiree claiming to be IRS and wants to help them, RUN.

There are two things I hope my listeners will do.

1. Share this information with loved ones and anyone in older age they know. At times like this many non-security oriented people are most vulnerable and it’s important security oriented or security interested people help those they can.
2. If you or someone you know gets swindled, report it so the IRS can try to stop the scammers in their tracks. If you get any text messages, social media messages, unsolicited emails that seem to be from the IRS or systems like the Electronic Federal Tax Payment System (EFTPS) then forward as much of the info as you can to [email protected]

I know some people like to mess with scammers but I feel I also have to share that it appears the IRS does not want anyone interacting with the potential scammers and prefers people report the scammers to them.

src: https://nakedsecurity.sophos.com/2020/04/03/watch-out-for-the-new-wave-of-covid-19-scams-warns-irs/

Marriott data breach

Moving on, our show is has discussed breaches in the past and this is another breach. This time it appears the large hotel chain Marriott has informed the public that 5.2 million hotel guest’s information has been hacked in a recent data breach. Zdnet.com’s article titled “Marriott discloses new data breach impacting 5.2 million hotel guests”, shares some of the details.

The 5.2 million users affected are hotel guests who used the company’s loyalty app. The hotel discovered the breach late February. Login credentials from two employees from a franchine property had access to the app’s backend system. It’s thought the breach can be dated from mid-January but nothing has been released on how the credentials were swiped.

Here is the information believed to have been pulled:

• Contact details such as Name, Mailing Address, Email Address, and Phone number.
• Loyalty Info such as Account Number and Point Balance
• Personal Details such as Company, Gender, Birth-day, and Birth-month
• Affiliations such as any linked accounts including airline loyalty programs and their respective account numbers
• Personal Preferences such as language and room preferences.

Now it does state that Marriott does not believe passwords, pins, payment info, passport info, national id, nor driver’s license info was pulled from their system.

It’s also interesting to note this is the second breach Marriott has had in the past year or so. Back in November they had their Starwood Hotels reservation system compromised and 383 million guest details stolen as well.

We will see how much further this goes and how many more details are disclosed by Marriott

src: https://www.zdnet.com/article/marriott-discloses-new-data-breach-impacting-5-2-million-hotel-guests/

Wrap-Up

So guy’s thank you for tuning in. Remember to stay safe and secure and always keep learning. This has been your host Lauro, signing off!

Hey guys the Croatian government has been hacked, malware developers are stepping up their game, cloud flare crashed and more in this hacking news segment. Let’s login.

Croatian Government Cyber Attack

So in a new article by zdnet.com titled “Croatian government targeted by mysterious hackers”, ZDNet discusses a series of spear phishing attacks against the Croatian government. Let’s break that down.

As it currently stands an unknown hacking group has been targeting Croatian government employees. The hacking group is thought to be government-sponsored and the attack follows a spear-phishing style campaign to infect users.

A spear-phishing campaign, for my listeners who are curious, is generally an email based attacked that sends malicious payloads to specific types of individuals in the hopes the victim downloads malware.

The spear-phishing email contained an excel sheet with an embedded macro. When a user opens the email, downloads and opens the file they are prompted with enabling macros. Once the macros are turned on then a malware payload is downloaded to the computer to infect the victim. Two variants of downloadable malware were found when examining the campaign.

The first malware is known as the ‘Empire backdoor’ that is a backdoor that is part of the Empire post-exploitation framework.

A post-exploitation framework is pretty much what it sounds like. A framework meant to be used once you have exploited a target. Once a hacker is within the victim machines then they usually do things similar to the following:

1. Plant a backdoor for future access
2. Patch the way in to prevent others from hacking in and kicking them out
3. Download their payloads, such as a botnet, miner, or other resources for their gain
4. Clean records and traces of their activity
5. Repeat the process with new machines sometimes using the newly infected machine in the attack.

Back to the story. The other malware that is downloaded is known as SilentTrinity, which is part of another post-exploitation tool like Empire. A major difference the article notes is that a presentation held at Positive Hack Days or PHDays has concluded the SilentTrinity tool has never before been weaponized for malware as this phishing campaign has.

The campaign was invisible for two months before the Information Systems Security Bureau issues two alerts about the attacks. The Information Systems Security Bureau distributed shared indicators of compromise with Croatian agencies and asked to verify they were not infected.

Now some speculation I would like to discuss. The articles discuss a possible related FireEye report that may point to Russian threat actors being behind these attacks. The report tries to tie hackers who used a WinRAR vulnerability together with the Empire backdoor against Ukraine government agencies to these attacks because they used the same Command and Control server.

My opinion, and just that my opinion is as follows:

If the command and control server of one malware is the same as another malware then generally it is safe to assume it is the same hacker or hacker group. There can be instances when the same IP is used because there are only a finite number of ipv4 addresses but that falls under a very small percentage of possibility. Again that is just my two cents.

 

src: https://www.zdnet.com/article/croatian-government-targeted-by-mysterious-hackers/

 

Golang Malware Hits Linux

So for all my Linux enthusiasts out there, I have some interesting and troubling news. Since mid-2018 and still active, a crypto miner malware has been targeting Linux servers. According to an article by infosecurity-magazine.com titled “Golang Malware Targets Linux-Based Servers” Two very interesting aspects of this malware are the fact it targets Linux servers and that it is written in Golang. A

For my listeners who aren’t familiar with Golang, Golang is a language from Google that was introduced almost 10 years ago and is popular among some developers but not actively used for malware.

The malware has currently infected several thousand machines and once a machine is infected the malware uses Cryptonight algorithm to mine XMR, which is also known as Monero. Cryptonight is a CPU based crypto mining algorithm that can mine altcoins such as Bytecoin, XMR, and Bitcoal.

The malware appears to be using the following vulnerabilities:

1. ThinkPHP or CVE-2019-9082
2. Atlassian Confluence Vulnerability or CVE-2019-3396
3. Drupal or CVE-2018-7600 which also goes by Druppalgeddon2

The malware also uses the following seven methods for spreading:

1. Four separate web application exploits
2. SSH credential enumeration
3. Redis database password  enumeration
4. Lastly, it uses SSH keys found in the infected machine

A very interesting aspect of Golang malware is that it is currently not detected by most Anti-Virus software. This leaves a very open avenue for creating malware that hackers can exploit with some ease. You do need to have programming language and learn to program in Golang but just the fact that a language makes the malware undetectable is a nice feature to have.

I find it very interesting that a programming language makes a malware invisible but it’s a development that I imagine will have anti-virus developers running to upgrade in their software. Well, it will have them running if we continue to see more malware written in Golang anyways.

 

src:https://www.infosecurity-magazine.com/news/golang-malware-targets-linuxbased/

 

The Cloud Crashed: Cloudflare Network Outage

I want to preface this story with 2 words: Bad Deployment. According to a notice by Cloudflare, there was a 30 minutes window when Cloudflare sites would display a 502 error. This error was not because Cloudflare was hacked but because a spike in CPU usage by their network meant that normal traffic could not be processed and was dropped.

You may be wondering, how did this happen? Well back to my 2 words Bad Deployment. The notice goes on to discuss a misconfigured rule within their Cloudflare WAF or Web Application Firewall.

Generally, a new deployment runs in a simulation mode so they can test, benchmark, and tweak the rules. This time a regular expression caused a massive CPU spike and created the outage.

For my listeners who are interested, a regular expression is a sequence of characters and/or symbols that are used to match a specific string within a larger text. To put it simply it’s a way to define a pattern to search text.

One simple example would be a regular expression that looks for two forward slashes, any characters up until a period and then either com, net, org. If you think a regular would match website URLs in documents or text then you guessed correct.

Back to the story, Cloudflare rolled back the deployment and the incident was stopped. Although it took 30 minutes that could cost some businesses a large revenue and Cloudflare has apologized and taken steps to prevent this from happening again.

src: https://blog.cloudflare.com/cloudflare-outage/

Christmas Gaming Grinch Jailed

If any of my listeners have been gamers for a few years then you may have heard or remembered the DDoS attacks back in December 2013 and January 2014 that caused gaming services to be out. This was a major Grinch and troll move against gamers since certain games require online access to authenticate or downloads updates and services such as online play are non-existent without access to the wire.

Well, the Grinch has been caught and sentenced. According to an article by thehackernews.com titled “DDoS Attacker Who Ruined Gamers’ Christmas Gets 27 Months in Prison”, a 23-year-old hacker from Utah who launched the DDoS attacks has received a 27-month jail sentence.

A hacker going by DerpTroll has pleaded guilty November 2018. Along with his plead he confessed to be a part of a hacker group going by DerpTrolling. This was the actual hacker group behind the gaming DDoS attacks.

The Attacks caused at least $95,000 in damages according to a Department of Justice report. To add to the 27-month jail sentence. The hacker will also have to pay back the $95,000 as restitution to Daybreak Games which was previously Sony Online Entertainment.

Before we move on to the next story its important to note that this attack is different from the Lizard Squad attacks that also made headlines in 2014 due to Christmas attacks.

 

src:https://thehackernews.com/2019/07/christmas-ddos-attacks.html

 

Announcement:

So guys I really am thankful for the reviews and some feedback ive received. Due to some personal life issues ill be taking a haitus from the show but i intend to return back in the future. Please feel free to send me an email at [email protected] and as always show notes are at http://13.59.166.86/podcasts/hn06

 

this is lauro logging off.

Hey, Guys welcome back for another episode of Exploit Brokers Hacking News!

I’m your host Lauro, lets login!

 

NASA’s Raspberry Pi and Hacker Problems

So I would say it’s safe to assume most of my listeners are aware of the space agency NASA. What many of you may not be aware of is that NASA’s Jet Propulsion Laboratory, or the JPL, was the target of a year-long attack back in 2018.

According to a ZDNet.com article, “NASA hacked because of unauthorized Raspberry Pi connected to its network”, hackers were able to compromise the JPL’s network by planting a compromised raspberry pi onto the JPL’s internal network.

The lack of segmentation of the JPL’s network meant the attackers could pivot throughout the entire network without issue. For my listeners who may not be aware of the practice. It is a good security practice to segment or to create smaller network segments within the larget network by using devices like a switch, router, or some other network device. The purpose of segmenting a network is that you can prevent devices in one smaller network from connecting to a device in another network. If NASA’s JPL segmented their network it would have been harder for the hacker to move around.

This information comes from the NASA Office of Inspector General’s report. There was some information stolen.

About 500 Megabytes of data was stolen, some of which contained regulated information under ITAR or the International Traffic in Arms Regulations. The fact that ITAR related information was stolen is a major security concern. ITAR regulation was created to ensure that government and military defense tech does not fall into malicious hands.

Now the data in question belonged to NASA’s Mars Science Lab which is known for their Curiosity rover. There is a bit of concern because the hacker or hackers appeared to have accessed NASA’s Deep Space Network of satellites that communicates and controls with equipment and spacecraft. The report appears to point to JPL’s dedication to upkeeping security systems and protocols in place as the main reason for this attack.

So some of you may be wondering, do they know who hacked the JPL? Well, the article goes to point out that it could be the Chinese elite hacking group APT10. This is in connection to two Chinese nationals being charged by the US Department of Justice for hacking cloud providers, the US Navy, and NASA back in 2018. The two Chinese nationals are believed to be APT10 hackers.

src: https://www.zdnet.com/article/nasa-hacked-because-of-unauthorized-raspberry-pi-connected-to-its-network/

WeTransfer just to the wrong people

So if you use WeTransfer then unfortunately private wasn’t private for 2 days. According to  bleepingcomputer.com’s article, “WeTransfer Security Incident Sent Files to the Wrong People”, there was a period from June 16th to June 17th were files were sent to a designated people or group also resulted in other people receiving the files as well.

WeTransfer did release an email to users warning about the incident but have not released why the accidental distribution happened. They did take proactive measures by logging out some accounts, resetting passwords, and blocking transfer links for those accounts involved in the incident.

I do agree with bleepingcomputer’s statement at the end of the article. They question the incident being a simple bug in the code. Now from a software developer’s perspective, I don’t think this is a simple bug if they also went to the hassle of resetting accounts. If this was a bug then it’s understandable blocking the links but logging out and resetting passwords sound suspicious of something else they are not telling users.

Only time, another email or another security release will tell.

src: https://www.bleepingcomputer.com/news/security/wetransfer-security-incident-sent-files-to-the-wrong-people/

Ransomware Alert: LooCipher on the loose

So guys Ransomware has now become a prominent part of the cybersecurity threats out in the wild. This new ransomware is another addition. According to bleepingcomputer’s article,” New LooCipher Ransomware Spreads Its Evil Through Spam” the ransomware LooCiper, I may have butchered the name, uses a malicious word document with macros to spread.

The order of infection appears to be similar to the following:

1. The victim comes across and opens a word document called Info_BSV_2019.docm
2. Once it is open word will prompt to enable macros
3. Once the victim Enables Editing and allows the macros the macro connects to a Tor Server
4. The macro downloads a malicious executable at http[:]//hcwyo5rfapkytajg[.]onion[.]pet/3agpke31mk[.]exe
5. Once downloaded the executable is renamed to LooCipher.exe
6. At this point LooCipher.exe is auto-executed

 

Once the ransomware begins executing it appears to follow similar patterns as other ransomware. The encrypting appears to follow a particular order.

1. A file called c2056.ini is made on the Windows Desktop
   1. This file contains a unique ID, time limit, and bitcoin wallet address to pay the ransom
2. The encryption process then beings creating encrypted files with the .lcphr extension appended
3. Once all files are encrypted the executable creates the @Please_Read_Me.txt file that gives the ransom amount and instructions on how to pay the ransom
4. The wallpaper is then changed with a similar message to the @Please_Read_Me.txt
5. Lastly, the LooCipher’s decryptor window shows a countdown with a payment verification button
   1. There is an unverified process to decrypt once payment has been made

As a security precaution, it is important to keep offline backups in case any ransomware hits your system and always take precautions when opening files that are not from trusted sources.

The article notes that the LooCipher ransomware is using spam techniques to spread and it is not known yet how many have been infected with the ransomware.

src: https://www.bleepingcomputer.com/news/security/new-loocipher-ransomware-spreads-its-evil-through-spam/

Steam Phishing Website

A message to my avid gamer audience who like to hack, I got a warning and news for you. Beware those bearing gifts. A new Malwarebytes Lab report, “Fresh “video games” site welcomes new users with Steam phish” discuss a recent phishing campaign aimed toward gamers.

There has been several, what appear to be compromised, accounts sending out a message gifting 1 free game. The URL does some redirection to get to the real phishing page.

1. There is a twitter shortened t.co link
2. This takes the users to steamredirect[.]fun that redirects to the true phishing page

The phishing page masks itself as a place where you can win games. The site goes by the name “Gift4Keys” and has a roulette-style game where you can “win”, and I say win sarcastically a free game. To play all you have to do is press the play button on the middle of the site.

Once you “win”, again sarcastically, you are prompted with a timer that gives you 30 minutes to log in to steam and redeem the won game. Once you click login you are given a steam login page that shows gift4keys as a third party affiliate.

Normal third-party affiliates use the sign in at steamcommunity.com but the phishing site’s URL address is simply blank.

If you have supplied credentials then your account has been hacked and it’s important to try to recover it and change your password as soon as possible. If you haven’t had your credentials hijacked then remember this story to help make sure you stay that way.

src: https://blog.malwarebytes.com/social-engineering/2019/06/fresh-video-games-site-welcomes-new-users-with-steam-phish/

 

Conclusion

So guys to conclude this episode and a quick review. We have data being stolen from NASA by a malicious raspberry pi. We also have a new ransomware attack by the name LooCipher that is using spam techniques to spread. If you have a steam account then beware those bearing gifts and never click suspicious links. If it is too good to be true then it may not be true.

That wraps up another episode of Exploit Brokers Hacking New. The show notes can be found at exploitbrokers.com/podcasts/hn05. This has been your host Lauro, signing off until next time.

Hey, guys welcome back for another episode of Exploit Brokers Hacking News!

Lets login.

Magecart Skimmers on Amazon

We had previously in episode HN02 gone over Magecart infecting the popular magazine Forbes’s subscription website.

Well now, according to Malwarebyte’s article, “Magecart skimmers found on Amazon CloudFront CDN”, it appears that the E-commerce giant Amazon has a similar problem. Magecart’s skimmers were found on Amazon’s CDN CloudFront.

For my listener news to the show or to the web tech, a CDN or content delivery network is a way to speed up delivering resources when you request a website. Think multiple warehouses ready to deliver something to you as soon as possible as quickly as possible when you order from an online store. The closest store to you that has the item in stock will ship it to reduce the time needed to get to you. CDNs work the same.

The article explains that JavaScript libraries hosted on Amazon CloudFront were injected with web skimmers that were added on and obfuscated. The malware is injected into various JavaScript files in an attempt to broaden the malware’s reach as far as possible. The article also shows two examples, one where the malware is injected into multiple JavaScript files within the same folder or directory and another where the malware is at the end of the actual JavaScript code and has been obfuscated to make it harder to detect and reverse engineer.

The malware is using hex and Base64 encoding to hide the payload itself or the main malware code and the exfiltration mechanism pointing to “cdn-imgcloud dot com”. The stolen info is also reportedly encoded before being sent back to the hacker group over the wire.

According to the article, the following domains are strong signs that a compromised library or malware has infected a system:

• ww1-filecloud dot com or 45.114.8 dot 159
• cdn-imgcloud dot com or 45.114.8 dot 160
• font-assets dot com or 45.114.8 dot 161
• wix-cloud dot com 45.114.8 dot 162
• js-cloudhost dot com 45.114.8 dot 163

Malwarebytes also mentions that their users are already protected against these skimmers and continue to find new threads daily.

Conclusion:

So the malware is being spread as far and as wide as possible in hopes of farming useful information, payment credentials, logins, etc. This compromise is just the latest in a series of attack by Magecart. It would be worth noting what their next target or attack vector will be once we find out more.

src: https://blog.malwarebytes.com/threat-analysis/2019/06/magecart-skimmers-found-on-amazon-cloudfront-cdn/

Goldbrute botnet

In a recent report by researchers at SANS ISC named, “GoldBrute Botnet Brute Forcing 1.5 Million RDP Servers”, a new botnet is threatening RDP servers.

So some of you may be familiar with the RDP or remote desktop protocol and some of you may use it while working. Well, a recent vulnerability, CVE-2019-0708, was patched by Microsoft but that hasn’t stopped attacks from sniffing for the vulnerability to exploit unpatched servers. This vulnerability has been given the nickname “Bluekeep” and to hopefully shed light on the severity, it appears even the NSA is urging people to apply the patch.

The botnet is brute-forcing around 1.5 million RDP servers that are accessible by the internet. Shodan shows about 2.4 million vulnerable servers and GoldBrute is using its own list and continues to add to it.

There is currently only one command and controller or C&C server located at IP 104.156.249 dot 231. The bots are using port 8333 to exchanged AES encrypted data. The infection also follows an infection outline as follows:

1. First, the infected server downloads the bot program. The program is around 80 MegaBytes and includes a JRE or Java Runtime Environment.
2. The Bot then starts scanning IP addresses to send back to the C&C server
3. Once the bot reaches 80 reported vulnerable machines, then it is given a list of machines to brute force

Two interesting details to note about this bot are that each bot only tries one username and password per target and the bot itself has a Java class named GoldBrute which indicates how it got its name.

The report also says that strong Indicators of Compromise are a file name bitcoin.dll and references to either 104[.]248[].167[.]114 the zip payload IP or port 8333 on 104[.]156[.]249[.]231 the Command and control server.

src: https://isc.sans.edu/forums/diary/GoldBrute+Botnet+Brute+Forcing+15+Million+RDP+Servers/25002/

 

GateHub Cryptocurrency Wallet Hacked

So if any of you guys are into Cryptocurrency I have news and if you aren’t into cryptocurrency well I still have news. According to tripwire’s article, “Cryptocurrency wallet GateHub hacked nearly $10 million worth of Ripple (XRP) stolen”.

According to the article, gatehub released a preliminary statement noting that over 100 customer’s wallets have had the funds stolen. The statement also reports beginning to monitor network activity and beginning an investigation.

The article also mentions a report that claims that about 23.2 million Ripple or about $9.7 million has been stolen from somewhere between 80 and 90 GateHub accounts.

It appears the attack did not involve brute-forcing accounts and the attacks flew mostly under the radar. The only notable thing GateHub has noted is that there has been an increase in API calls.

The valid API calls included valid access tokens and the understood theory is that the attackers were somehow able to access or steal encrypted secret keys to make valid API calls.

So for my listeners who may not understand the idea of secret keys or API calls I’m gonna explain it quick and simple.

A secret key is essentially a digital key to a digital lock that only the key can open. If an attacker steals the key they can unlock the lock.

An API stands for Application Programming Interface and it allows a program, in this case, the wallet, to ask the main system to do something. An API is just a way to accept requests from programs the same way you can browse to a website and send requests for the system to do something.

Now that we have explained that, it appears that the best course of action is to make sure your wallets are not located at the central server and always try to look into cryptocurrency best practices.

src: https://www.tripwire.com/state-of-security/featured/cryptocurrency-wallet-gatehub-hacked/

 

FIN8 Hackers Return

So some of you may be aware of a hacking group by the name FIN8 that fell off the radar about 2 years ago in 2017. Well according to a new article by ZDNet, “FIN8 hackers return after two years with attacks against hospitality sector”, the infamous group is back.

The last known report about FIN8 hacks was back in 2017. If you have seen FIN hacker group that is a separate group that only sounds similar, from what is known.

To give you a quick catch up, the FIN8 group used spear-phishing, a target phishing attack, and a zero-day in Windows to infect retailers in the US with the ShellTea backdoor. Once the backdoor was in place they later came in and installed PoSlurp malware to steal payment info from the point of sale system.

Well, a recent report by Morphisec states they detected and stopped a new FIN8 attack that was targeted toward hospitality businesses. The new attacks appear to have leveled up compared to before. FIN8’s malware has received a major upgrade in evasion and persistence functionality.

There appears to be some overlap with another similarly named hacker group FIN7 and the article mentions that there have been previous intersections between FIN6, FIN7, and FIN8 before.

The article does present the idea that the groups are different because current cybercrime has access to rentable resources, services, and hackers for hire.

Now I would like to shed some light on this.

There have been multiple forums, websites, and other avenues such as IRC that have allowed individuals to rent or buy anything from botnets to malware. So I do agree that this may be a serious of unrelated hackers with similar suppliers but I question this because of the newer and improved malware the FIN8 group is sporting. This could be a coincidence and the idea of a merchant, all be it a criminal merchant, updating their software to include newer, better, and improved functionality is actually close to reality.

src: https://www.zdnet.com/article/fin8-hackers-return-after-two-years-with-attacks-against-hospitality-sector/

 

Conclusion

So guys to conclude this episode and a quick review. We have Magecart infecting Amazon’s Cloud Delivery Network with credit card skimmers. We also have a new brute force attack by the name GoldBrute attempting to use Remote Desktop Protocol or RDP to build a botnet. If you have cryptocurrency wallets in the cloud it may be time to rethink it and if you had ripple its wise to be on the lookout over the recent GateHub breach. Lastly, if you have a point of sale be careful and look up more information because FIN8 has returned with stronger malware and is targeting Point of Sale systems in the hospitality industry.

That wraps up another episode of Exploit Brokers Hacking New. The show notes can be found at exploitbrokers.com/podcasts/hn04. This has been your host Lauro, signing off until next time.