Home Blog Page 268

TrueDialog Database Exposes Tens of Millions of SMS Data

Bait attacks, Email Attacks

Around ten million text messages were exposed by an unprotected database run by an American-based communications company, TrueDialog.

Security experts Noam Rotem and Ran Locar from VPNMentor discovered that a leaky database exposed millions of users’ data, including text messages, names, addresses, and other private information.

TrueDialog provides bulk SMS services to U.S.-based companies, colleges, and Universities. The company took down the unprotected database after the researchers notified the incident.

The researchers observed the database which hosted 604 GB of data and contained around one billion entries of TrueDialog’s customers. Apart from private text messages, millions of account usernames and passwords, years of information on TrueDialog’s business model, conversations with its customers, and account details were exposed in the incident.

“It’s difficult to put the size of this data leak into context. Tens of millions of people were potentially exposed in several ways. It’s rare for one database to contain such a huge volume of information that’s also incredibly varied. The database contained entries that were related to many aspects of TrueDialog’s business model,” the report stated.

The report also added, “The company itself was exposed, along with its client base, and the customers of those clients. The information contained in this database could have been used in myriad ways against the people whose information was exposed.”

In a similar security incident, Security researchers discovered an open Elasticsearch server that contains unique data records of around 1.2 billion users. According to the security analysts Bob Diachenko and Vinny Troia, the server holds more than 4 terabytes of data, without password protection or authentication.

The exposed data included names, email addresses, phone numbers, LinkedIn, and Facebook profile information. It’s believed that the exposed data appear to have originated from two different data enrichment companies namely People Data Labs (PDL) and OxyData.Io (OXY).

Iranian Hackers Deploy New Data-Wiping Malware: IBM

BotenaGo, malware over encrypted connections

Security analysts from IBM recently discovered a data-wiping malware dubbed as ZeroCleare.

IBM claims that the malware was developed by Iranian state-sponsored hackers and used in cyber-attacks against energy companies in the Middle East region. However, the company didn’t mention the companies’ names that have been targeted by ZeroCleare malware.

In its research report, IBM stated the malware is the creation of two hacking groups namely xHunt and APT34.

Describing the ZeroCleare attack, IBM stated that ZeroCleare is a Wiper malware designed to delete information from an infected host. The attackers can use this Wiper malware to hide their intrusions by deleting crucial forensic evidence.

 ZeroCleare’s Infection Flow

Researchers said that the hackers launch brute-force attacks to gain access to weakly secured network systems. Once attackers infect the target device, they spread the malware across the company’s network as the last step of infection.

“The ZeroCleare wiper is part of the final stage of the overall attack. It is designed to deploy two different ways, adapted to 32-bit and 64-bit systems. The general flow of events on 64-bit machines includes using a vulnerable, signed driver and then exploiting it on the target device to allow ZeroCleare to bypass the Windows hardware abstraction layer and avoid some operating system safeguards that prevent unsigned drivers from running on 64-bit machines,” reads IBM’s report.

In January this year, a report from FireEye claimed that an undetected hacker group from Iran allegedly stole travel and mobile data of individuals in the Middle East region.

According to FireEye, the Iranian group dubbed APT39 has targeted several people in the Middle East, especially in the Gulf region. It’s believed that the espionage group is allegedly providing information to the Iranian government. FireEye stated that they had been tracking APT39 activities since 2014 to protect organizations from cyber incidents.

FireEye also observed that the group uses Persian language words in encrypting data. APT39’s activities are reportedly focused on the telecommunications sector, the travel, and the IT industry, and allegedly represent Iran’s potential global operational reach and how it collects key data.

Attackers Using Facebook’s Ads Manager as Cyberespionage Tool

Facebook copyright complaint

A newly discovered Trojan, dubbed Socelars, allows bad actors to access Facebook advertisements, the Bleeping Computer reported.

The issue came to light after a security researcher Vitali Kremez found that Socelars Trojan was distributed through a fake PDF editing app “PDFreader”. It’s said that attackers are using this Trojan to dig information from Facebook ads.

What’s the Risk?

According to MalwareHunterTeam, the Socelars Trojan tries to steal Facebook session cookies from Chrome and Firefox and then use them to connect to other Facebook URLs.

The stolen data includes advertising email address, session cookies, access tokens, account ids, associated pages, credit card details, PayPal email, ad balances, and spending limits. The data then transferred to the attacker’s Command & Control server.

Primary Target on Facebook Ads Manager

Vitali Kremez stated that attackers using stolen information to extract the user’s account_ID and access token, which were later used in a Facebook Graph API call to steal data from the user’s Ads Manager settings.

If malicious actors access the information of the ads, they can create their own campaign ads, not only regular advertisements but the political posts, which could bring severe implications during elections.

Besides targeting on Facebook ads, the Trojan is also attempting to steal session cookies for Amazon.com and Amazon.co.uk, the researcher said.

With the U.S. elections approaching and bad actors abusing campaigns/ads in the past, it’s a heads-up for anyone running political campaigns.

Recently, Facebook stated that it is tightening its security for the 2020 U.S. elections after fresh signs of Russia meddling. The social media giant stated that it’s taking down accounts involved in illicit activities and stepping up searching state-controlled media trying to manipulate American voters.

Facebook pledged to use a variety of security measures, including artificial intelligence, to counter Russian attackers or other online intruders who use misleading strategies and false information to meddle in the 2020 U.S. elections.

The new steps announced by Facebook include, Fighting Foreign Interference, Preventing inauthentic behavior, Increasing transparency, Labeling state-controlled media on their Page and in the Ad Library, Preventing the spread of misinformation, and monitoring candidates accounts, elected officials through Facebook Protect.

TikTok Stealthily Transferring Users’ Data to China: Lawsuit

TikTok, TikTok data privacy, TikTok children's privacy

Popular video-sharing app TikTok recently hit with a class-action lawsuit in the U.S. claiming that the company has been surreptitiously transferring users’ data to Chinese servers, without the user’s consent.

The proposed class-action lawsuit was filed in California federal court by Misty Hong, a student from Palo Alto.

In her lawsuit, Misty Hong alleges that TikTok and its Beijing-based parent company ByteDance has failed to properly handle users’ data and knowingly violated the Right to Privacy act. The company is also accused of taking users’ draft videos and presenting uncertain privacy policies.

According to the lawsuit, Hong installed the TikTok app in April 2019 but never created an account. But she discovered that TikTok created an account for her, without her consent. Though Hong never saved or published her videos, TikTok secretly transferred her data to Chinese servers.

It’s said that TikTok collecting a set of users’ data, including phone and social network contacts, email addresses, IP addresses, and location.

Claimed to have around half a billion active users worldwide, TikTok previously said it does not store user’s data on Chinese servers. The incident raised severe concerns that data culled by TikTok could be used to identify, profile, and track users.

“TikTok clandestinely has vacuumed up and transferred to servers in China vast quantities of private and personally identifiable user data that can be employed to identify, profile and track the location and activities of users in the United States now and in the future. TikTok also has surreptitiously taken user content, such as draft videos never intended for publication, without user knowledge or consent. In short, TikTok’s lighthearted fun comes at a heavy cost,” the Lawsuit stated.

The proposed lawsuit also stated, “TikTok unjustly profits from its secret harvesting of private and personally identifiable user data by, among other things, using such data to derive vast targeted-advertising revenues and profits. Its conduct violates statutory, Constitutional, and common law privacy, data, and consumer protections.”

Japan Joins NATO’s Cooperative Cyber Defense Centre of Excellence

Japan restricts foreign equipment and tech, Japan Embraces AI Tools to Fight Cyberattacks with US$237 mn Investment

Shinzo Abe, the Prime Minister of Japan, recently announced the decision of Japan joining the North Atlantic Treaty Organization’s (NATO) accredited cyber defense hub in Tallinn, Estonia.

With this decision, Japan becomes a full-fledged participant in NATO’s Cooperative Cyber Defense Centre of Excellence (CCDCOE) program that focuses on cybersecurity research, training, and exercises. The country also upgrades its role from observer status, a position that Japan held between 2015 and 2018.

This move will further strengthen the knowledge base of the currently 20-nation-strong CCDCOE program. NATO’s Cyber Coalition exercises present different scenarios including cyberattacks during the cross-border conflict and compromised state computer systems.

“We welcome the decision of Japan to join CCDCOE as a Contributing Participant, membership status available to non-NATO nations. Japan is one of NATO’s key partners beyond the Euro-Atlantic area and a globally recognized technology and cybersecurity power. Joining the Centre will be a concrete step forward signaling the commitment in cyber defense cooperation between like-minded nations,” said Merle Maigre, Director of the NATO Cooperative Cyber Defence Centre of Excellence.

Earlier, the Japanese government was criticized for hacking the IoT devices of its citizens. The initiative was part of a unique survey the government undertook with the intention of securing IoT devices of its citizens. The survey will be carried by the National Institute of Information and Communications Technology (NICT) with an active involvement of the Ministry of Internal Affairs and Communications.

As part of the survey, employees of NICT will try to hack IoT devices of citizens using default passwords and password dictionaries. After this, they will prepare a list of insecure devices that uses default passwords or easy-to-guess passwords and will submit the list to relevant authorities, as well as internet service providers who will then alert the citizens and ask them to change passwords as well as secure their devices.

The Remote of Your Smart TV Could be in Hackers’ Hand!

Smart TV

Often dubbed as an idiot box, the television is no longer just a dumb gadget. It’s become smart, and is growing smarter, in-line to become one of the smartest household gadgets. From kids to adults, everyone loves to have the smart TV as a center piece in their living room. What you don’t know though, is that having it in your house might just give a free pass to the hackers inside your home, says FBI.

Smart TVs with internet connectivity allow users to browse the web and watch shows from their favorite streaming platforms. They also come with a range of customizable features in lieu of a remote control, including voice commands to flip through channels or to turn up the volume. A few new ones also come with integrated cameras and microphones to provide facial recognition and can be used instead of tablets or laptops for video calling.

Unlike other smart gadgets on offer, smart TVs have one of the most overlooked and neglected issues – security. For several smart TV manufacturers, security of these IoT devices are an afterthought. The result is inevitable, a smart device that is vulnerable to different kinds of threats.

Hackers can not only control your unsecured TV for changing channels or volume controls but also stalk your everyday movements and conversations using the integrated camera and microphone. FBI has asked smart TV users to take following precautionary measures:

  • Know exactly what features your TV has and how to control those features. Do a basic Internet search with your model number and the words “microphone,” “camera,” and “privacy.”
  • Don’t depend on the default security settings. Change passwords if you can – and know how to turn off the microphones, cameras, and collection of personal information if possible. If you can’t turn them off, consider whether you are willing to take the risk of buying that model or using that service.
  • If you can’t turn off a camera but want to, a simple piece of black tape over the camera eye is a back-to-basics option.
  • Check the manufacturer’s ability to update your device with security patches. Can they do this? Have they done it in the past?
  • Check the privacy policy for the TV manufacturer and the streaming services you use. Confirm what data they collect, how they store that data, and what they do with it.

A similar warning was given earlier by Vince Steckler, Chief Executive at security firm Avast. In a media statement he said, “The Internet-connected devices used in the home, like laptops, mobile phones, and other smart gadgets, aren’t secure as they allow hackers to use them to get hold of bank details and other personal information.” He further added, “Coffee machines are not designed for security. TVs are not designed for security. What they are is additional vectors to get into your network. And you can’t protect them.”

New Malware “PyXie” Uses Trojanized Tetris Game

Researchers have discovered a malware operation that uses a trojanized version of Tetris game to target healthcare and educational institutions for credential stealing.

Security pros at Blackberry Cylance stated that threat actors are trying to distribute ransomware with a malware named “PyXie”. It’s said that PyXie, which is written in Python programming language, has been in the wild since 2018.

According to a report from Blackberry Cylance, the Python-based trojan malware gives attackers the control of Windows systems to monitor actions and steal sensitive data.

PyXie is highly customizable and can be used to launch a variety of attacks like credential harvesting, man-in-the-middle, web-injection, keylogging, and video harvesting, suggested Ryan Tracey, a senior threat researcher at BlackBerry Cylance.

Spreading via Trojanized Tetris Game

The analysts observed that an unknown hacking group used a genuine software Cobalt Strike and a trojanized Tetris game to spread the malware.

Once the victim downloads the game, the trojanized Tetris app executes Cobalt Strike binaries, which escalates the privilege in the victim’s Windows OS. After the trojan injected, a malware downloader Cobalt Mode will also get installed in the system to help attackers perform tasks like communicating with the command-and-control server, downloading and decrypting the payload.

It’s still unclear on who’s behind the PyXie campaign.

“PyXie has been deployed in an ongoing campaign that targets a wide range of industries. It has been seen in conjunction with Cobalt Strike beacons as well as a downloader that has similarities to the Shifu banking Trojan. Analysts have observed evidence of the threat actors attempting to deliver ransomware to the healthcare and education industries with PyXie,” stated the report.

Regardless of the advanced capabilities of PyXie, the researchers stated that it can be prevented by application patching, endpoint-protection technology, auditing, logging, and monitoring of endpoint and network activity.

FBI Defines FaceApp as Counterintelligence Threat

apple face id

FaceApp, the AI-powered photo-morphing app that took the internet by storm for its unique features and controversial privacy policy has hit the headlines again.

The FBI recently slammed FaceApp as a counterintelligence threat and advised its users to be vigilant.  The comments come after the U.S. Senator Chuck Schumer wrote to the FBI and the U.S. Federal Trade Commission (FTC) stating concerns over FaceApp in July this year.

“A warning to share with your family & friends. This year when millions were downloading #FaceApp, I asked the FBI if the app was safe. Well, the FBI just responded. And they told me any app or product developed in Russia like FaceApp is a potential counterintelligence threat,” Chuck Schumer tweeted.

In its investigation report released on November 25, the FBI revealed the risks posed by the Russian-made face-editing application. The FBI stated that not only FaceApp but other mobile applications developed in Russia may also cause a potential counterintelligence threat.

In its letter to Chuck Schumer, the FBI said, “It considers any mobile application or similar product developed in Russia, such as FaceApp, to be a potential counterintelligence threat”.

It’s said that Russia’s intelligence services maintain robust cyber exploitation capabilities to remotely access all communications and servers on Russian networks.

FaceApp, which launched in 2017, rise to fame in 2019 with its #AgeChallenge viral movement. Millions have uploaded their photos of future aged versions using the application.

The mess began after several experts and users finally read the terms and conditions of the app. Over user content, it reads, “You grant FaceApp a perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable sub-license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display your User Content, and any name, username, or likeness provided in connection with your User Content in all media formats and channels now known or later developed, without compensation to you.”

Recently, security pros found that FaceApp collecting the list of users’ Facebook friends unnecessarily. According to an Indian security researcher Athul Jayaram, who flagged the issue, the app contains a feature that allows users to download and edit photos from their Facebook accounts. However, this option will only work when a user accesses the FaceApp account via “Login with Facebook” option.

Jayaram said whenever a user logs in to FaceApp with Facebook credentials, the app enables a feature called “Social Stylist,” designed to allow users to invite their Facebook friends to vote for their posts. However, the researcher clarified that the feature was discontinued after reporting the issue to FaceApp.

Gun Buyback Scheme of NZ Police Leaks 37,000 Citizens’ Data

Ransomware Attack on Azusa Police

The New Zealand Police have admitted a potential data breach on its online notification platform set up to buyback firearms.

The issue came into light after a dealer reported to the Police that he was able to see all firearm owners’ details on the gun buyback program website. The Deputy Commissioner of Police Mike Clement confirmed that they were notified about the breach by the dealer.

The details of around 37,000 firearm owners, including the guns they possess, and bank account information were accessible, the Council of Licensed Firearms Owners (Colfo) stated.

Under the firearm buy-back program, the government provides an opportunity for the citizens to let the police know their prohibited firearm possessions anonymously and exchange them for cash.

What Happened?

The online notification platform is maintained by a German-based software company SAP. The company stated that a new security profile was incorrectly provisioned in the platform due to a human error.

“We unreservedly apologize to New Zealand Police and the citizens of New Zealand for this error. A full internal investigation is already underway within SAP,” the company said in a statement.

It’s said that users were able to screenshot and download information related to other firearm owners. Security pros opined that criminal elements could have accessed the firearm owner’s information before the authorities found the breach.

The Police authorities stated that they’ve launched an investigation to identify how many people accessed the personal details of the gun owners in the incident.

Meanwhile, the Gun buybacks program is continuing using manual processes. The Police stated that the platform will remain offline until SAP ensures its security. The officials also urged affected citizens to monitor their bank accounts to find out any unusual transactions.

Just Another String

Earlier, the New Zealand Treasury office was hit with a cybersecurity scandal. It’s reported that hackers tried to infiltrate the documents of the upcoming budget, which has also been called the “wellbeing budget”.

The budget has been the limelight for being a bill that has been one of the first in the world where the wellbeing of citizens of New Zealand has been kept at the top-most priority. Two days before the document was scheduled to be released, the Treasury office found out that the systems were hacked with over 2,000 attempts recorded in a 48-hour period. The New Zealand police have been alerted over the incident that has occurred in the parliament, and investigations have begun into the incident.

1...267268269...410Page 268 of 410