April 2020 - BoWare IT Services

April 16, 2020December 14, 2020

@RISK: The Consensus Security Vulnerability Alert: Vol. 20, Num. 16

@RISK: The Consensus Security Vulnerability Alert
April 16, 2020 – Vol. 20, Num. 16

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES April 9 – 16, 2020
=========================================================
TOP VULNERABILITY THIS WEEK: 18 critical vulnerabilities disclosed as part of Microsoft Patch Tuesday
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Microsoft releases monthly security update
Description: Microsoft released its monthly security update this week, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month’s Patch Tuesday covers 113 vulnerabilities. Eighteen of the flaws Microsoft disclosed are considered critical, while one is considered “moderate.” The remainders are scored as being “important” updates. This month’s security update covers security issues in a variety of Microsoft services and software, including SharePoint, the Windows font library and the Windows kernel.
Reference: https://blog.talosintelligence.com/2020/04/microsoft-patch-tuesday-april-2020.html
Snort SIDs: 53489 – 53492, 53619 – 53630, 53652 – 53655

Title: DrayTek routers, switches open to attack
Description: Tech company DrayTek recently patched two zero-day vulnerabilities in some of its routers and switches that could allow malicious actors to monitor traffic and install backdoors on affected networks. DrayTek worked with security researchers to discover the vulnerabilities and active exploitations in December, and patches were made available in late March. Users are encouraged to patch their devices as soon as possible or disable remote admin access.
Reference: https://www.scmagazine.com/home/security-news/vulnerabilities/zero-day-vulnerabilities-used-against-draytek-routers-and-switches/
Snort SIDs: 53591, 53592

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Apple and Google announced plans to jointly develop a service that will alert users if they’ve been near someone who’s been diagnosed with COVID-19.
https://techcrunch.com/2020/04/10/apple-and-google-are-launching-a-joint-covid-19-tracing-tool/

This “contact tracing” service has raised some concerns over privacy, however, and potential inequalities over individuals’ access to wireless networks.
https://www.cnet.com/news/how-youll-get-apple-and-googles-contact-tracing-update-for-your-phone/

Cisco Talos researchers discovered many devices’ fingerprint scanners can be tricked using 3-D printed models and resin copies of users’ fingerprints.
https://blog.talosintelligence.com/2020/04/fingerprint-research.html

Foreign currency exchange company Travelex paid a $2.3 million ransomware demand in January. (Please note that this story is behind a paywall.)
https://www.wsj.com/articles/travelex-paid-hackers-multimillion-dollar-ransom-before-hitting-new-obstacles-11586440800

Teleconferencing platform Zoom has taken steps to address some of the privacy and security concerns raised by experts.
https://www.fastcompany.com/90488717/can-you-trust-zoom

Microsoft says every country in the world has now seen at least one COVID-19-themed cyber attack, many of them utilizing the Emotet and Trickbot families.
https://www.microsoft.com/security/blog/2020/04/08/microsoft-shares-new-threat-intelligence-security-guidance-during-global-crisis/

Individuals working from home are looking toward upgrading to mesh Wi-Fi networks to improve their wireless internet speed while more employees work from home during the pandemic.
https://arstechnica.com/gadgets/2020/04/remote-work-lagging-if-you-cant-plug-it-in-upgrade-to-mesh/

Scammers are attempting to capitalize on the COVID-19 pandemic by offering phony services and health products through “gig economy” apps like Fiverr.
https://www.vice.com/en_us/article/v74ay9/fiverr-coronavirus-healers-mask-sellers

Online casino magnate SBTech is setting aside $30 million to respond to a cyber attack from last month part of an acquisition agreement.
https://zdnet.com/article/gambling-company-to-set-aside-30-million-to-deal-with-cyber-attack-fallout/

MOST PREVALENT MALWARE FILES April 9 – 16, 2020
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: a545df34334b39522b9cc8cc0c11a1591e016539b209ca1d4ab8626d70a54776
MD5: 5d34464531ddbdc7b0a4dba5b4c1cfea
VirusTotal: scan analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::in03.talos

SHA 256: 589d9977a5b0420d29acc0c1968a2ff48102ac3ddc0a1f3188be79d0a4949c82
MD5: bf1d79fad6471fcf50e38a9ea1f646a5
VirusTotal: scan analysis
Typical Filename: wupxarch.exe
Claimed Product: N/A
Detection Name: W32.Auto:589d99.in03.Talos

SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
VirusTotal: scan analysis
Typical Filename: Eternalblue-2.2.0.exe
Claimed Product: N/A
Detection Name: W32.85B936960F.5A5226262.auto.Talos

SHA 256: 518a8844dae953d7f2510d38ba916f1c4ccc01cfba58f69290938b6ddde8b472
MD5: 9b47b9f19455bf56138ddb81c93b6c0c
VirusTotal: scan analysis
Typical Filename: updateprofile.exe
Claimed Product: N/A
Detection Name: Win.Dropper.Generic::tpd

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
VirusTotal: scan analysis
Typical Filename: SegurazoIC.exe
Claimed Product: Segurazo IC
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

April 9, 2020December 14, 2020

@RISK: The Consensus Security Vulnerability Alert: Vol. 20, Num. 15

@RISK: The Consensus Security Vulnerability Alert
April 09, 2020 – Vol. 20, Num. 15

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES April 2 – 9, 2020
=========================================================
TOP VULNERABILITY THIS WEEK: Mozilla Firefox patches two use-after-free vulnerabilities exploited in the wild
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Mozilla releases fixes for two use-after-free vulnerabilities in Firefox
Description: Mozilla released patches for two use-after-free vulnerabilities in its Firefox web browser. The company said it saw attackers actively exploiting bugs in the wild, which caused them to release the emergency updates. In both cases, a race condition in the browser can cause a use-after-free condition, though Mozilla has not provided information on how, exactly, these vulnerabilities were used in attacks.
Reference: https://duo.com/decipher/mozilla-fixes-two-firefox-flaws-under-active-attack
Snort SIDs: 53580, 53581

Title: Critical CODESYS vulnerability could allow attacker to crash server, execute remote code
Description: A critical bug in 3S’ CODESYS automation software could allow an attacker to crash an affected server or execute remote code on the web server. 3S released a patch for the vulnerability, identified as CVE-2020-10245, which received a severity score of 10 out of 10. The bug is a heap-based buffer overflow in the software that could cause a denial of service.
Reference: https://threatpost.com/critical-codesys-bug-remote-code-execution/154213/
Snort SIDs: 53557, 53558

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Marriott disclosed that hackers used login credential belonging to two employees of a franchise company to access customer data, compromising the information of more than 5 million customers.
https://www.cnet.com/news/marriott-discloses-new-data-breach-impacting-5-point-2-million-guests/

Researchers discovered potential security flaws in video conference platform Zoom’s encryption method, including sending some encryption keys through servers in China.
https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/

After a wave of negative headlines concerning Zoom and its security features, the Taiwanese government informed employees they should not be using the conferencing app while they work from home during the COVID-19 crisis.
https://www.bloomberg.com/news/articles/2020-04-07/taiwan-bans-government-use-of-zoom-over-cybersecurity-concerns

A critical vulnerability in a popular WordPress plugin could allow attackers to completely lock admins out of their sites, the latest in a string of bugs for plugins for the popular content management system.
https://threatpost.com/critical-wordpress-plugin-bug-lock-admins-out/154354/

A new COVID-19-themed malware family can totally wipe victim’s computers and in some cases, rewrite MBR sectors.
https://www.zdnet.com/article/theres-now-covid-19-malware-that-will-wipe-your-pc-and-rewrite-your-mbr/

Microsoft purchased controversial domain corp[.]com with the goal of keeping it out of bad actors’ hands.
https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-so-bad-guys-cant/

While the vast majority of individuals across the globe are staying home during the COVID-19 crisis, their internet usage has changed, including spending an increasing amount of time on streaming sites while seeing a reduction in mobile device usage.
https://www.nytimes.com/interactive/2020/04/07/technology/coronavirus-internet-use.html

With more college classes moving completely online for the remainder of the semester, some schools have started using online proctor services, which students and professors say is an invasion of privacy.
https://www.washingtonpost.com/technology/2020/04/01/online-proctoring-college-exams-coronavirus/

NASA says its seen an “exponential” increase in attempted cyber attacks as more of its employees began working remotely due to COVID-19 pandemic.
https://arstechnica.com/information-technology/2020/04/nasa-sees-an-exponential-jump-in-malware-attacks-as-personnel-work-from-home/

A cyber attack on Italy’s Social Security website took down its services, temporarily preventing individuals from receiving government stimulus checks connected to a COVID-19 relief package.
https://www.forbes.com/sites/daveywinder/2020/04/02/covid-19-payouts-disrupted-as-heartless-hackers-attack-italian-crisis-benefits-site/

MOST PREVALENT MALWARE FILES April 2 – 9, 2020
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: scan analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: scan analysis
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: scan analysis
Typical Filename: f2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201

April 2, 2020December 14, 2020

@RISK: The Consensus Security Vulnerability Alert: Vol. 20, Num. 14

@RISK: The Consensus Security Vulnerability Alert
April 02, 2020 – Vol. 20, Num. 14

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES March 26 – April 2, 2020
=========================================================
TOP VULNERABILITY THIS WEEK: Storage devices targeted by new Mirai variant
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Zyxel devices exploited by critical vulnerability, now patched
Description: A variant of the Mirai botnet, known as Mukashi, targeted vulnerable Zyxel network-attached storage devices. CVE-2020-9054 was assigned a critical rating of 9.8 out of 10 and has since been patched. Attackers can exploit this vulnerability to compromise a device and then launch additional distributed denial-of-service attacks and attach the malware to specific TCP ports.
Reference: https://www.cisomag.com/mukashi-malware-exploits-zyxel-nas-device-vulnerabilities/
Snort SIDs: 53495, 53496, 53507 – 53510

Title: Ransomware families launch new sites to publish stolen data
Description: Attackers behind several different ransomware families are creating websites where they say they will publish information stolen in attacks if the victims do not pay the requested extortion payment. Malware like Sodinokibi, Nemty and DoppelPaymer are following the lead of the actors behind the Maze ransomware, who launched a similar site in early March. Cisco Talos released new Snort rules this week to prevent the Sodinokibi ransomware from being downloaded onto targeted machines.
Reference: https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/
Snort SIDs: 53511, 53512

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Democratic Congressional leaders are pushing for more states to move to vote-by-mail, and many governments are planning to use cyber security grants to change their plans.
https://www.cnbc.com/2020/03/31/coronavirus-update-pelosi-says-country-must-move-to-vote-by-mail-taking-aim-at-trump.html

Tech companies are preparing to detect and deflect election meddling efforts similar to those in 2016, but the bad actors are changing their tactics just as quickly.
https://www.nytimes.com/2020/03/29/technology/facebook-google-twitter-november-election.html

A new phishing campaign lures victims in by lying to them that they’ve been exposed to someone infected with the coronavirus.
https://www.bleepingcomputer.com/news/security/phishing-attack-says-youre-exposed-to-coronavirus-spreads-malware/

In another COVID-19 related attack, other attackers are using DNS hijacking to redirect users accessing coronavirus-related mobile apps, eventually taking over their wireless routers.
https://threatpost.com/hackers-hijack-routers-to-spread-malware-via-coronavirus-apps/154170/

So-called “Zoombombers” are taking advantage of the rise in virtual meetings and hangouts, jumping into calls and sharing unwanted vulgar content.
https://www.insidehighered.com/news/2020/03/26/zoombombers-disrupt-online-classes-racist-pornographic-content

More than 42 million Iranian users of the popular Telegram encrypted messaging app had their user IDs and phone numbers leaked online, as they were stored on an unprotected server.
https://www.comparitech.com/blog/information-security/iranian-telegram-accounts-leaked/

The FBI is holding talks with cybersecurity insurance companies to discuss how they can work together to help companies prevent and recover from ransomware attacks.
https://www.cyberscoop.com/ransomware-fbi-insurance-companies-data/

Saudi Arabia reportedly can track its citizens who travel to the U.S. through a vulnerability in the global messaging system known as SS7.
https://www.theguardian.com/world/2020/mar/29/revealed-saudis-suspected-of-phone-spying-campaign-in-us

A new report from Google’s Threat Analysis Group revealed it alerted 40,000 users of potential state-sponsored attacks against their accounts in 2019.
https://www.forbes.com/sites/daveywinder/2020/03/27/hacker-threat-google-confirms-40000-nation-state-cyber-attack-warnings-issued/#22f789b93b71

MOST PREVALENT MALWARE FILES March 26 – April 2, 2020
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 8e0aea169927ae791dbafe063a567485d33154198cd539ee7efcd81a734ea325
MD5: 5fb477098fc975fd1b314c8fb0e4ec06
VirusTotal: scan analysis
Typical Filename: upxarch.exe
Claimed Product: N/A
Detection Name: Win.Dropper.Ranumbot::in07.talos

SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8
MD5: 42143a53581e0304b08f61c2ef8032d7
VirusTotal: scan analysis
Typical Filename: myfile.exe
Claimed Product: N/A
Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos