Comments on: Cyber security news November 2022

By: Tomi Engdahl

Tomi Engdahl — Thu, 01 Dec 2022 08:45:08 +0000

Hackers Dump Australian Health Data Online, Declare ‘Case Closed’
https://www.securityweek.com/hackers-dump-australian-health-data-online-declare-case-closed

The hackers leaking stolen Australian health records to the dark web on Thursday appeared to end their extortion attempt by dumping a final batch of data online and declaring:”Case closed.”

In November the hackers demanded health insurer Medibank pay US$9.7 million to keep the records off the internet — or one dollar for each of the company’s impacted customers, which included Prime Minister Anthony Albanese.

Medibank refused to pay at the urging of the federal government, which at the height of the crisis considered making it illegal for hacked companies to hand over ransoms.

On Thursday morning the hackers said they had posted the last of the data online, deliberately coinciding with International Computer Security Day.

“Happy Cyber Security Day,” they wrote.

“Added folder full. Case closed.”

By: Tomi Engdahl

Tomi Engdahl — Thu, 01 Dec 2022 08:41:33 +0000

Whos swimming in South Korean waters? Meet ScarCrufts Dolphin https://www.welivesecurity.com/2022/11/30/whos-swimming-south-korean-waters-meet-scarcrufts-dolphin/
ESET researchers have analyzed a previously unreported backdoor used by the ScarCruft APT group. The backdoor, which we named Dolphin, has a wide range of spying capabilities, including monitoring drives and portable devices and exfiltrating files of interest, keylogging and taking screenshots, and stealing credentials from browsers. Its functionality is reserved for selected targets, to which the backdoor is deployed after initial compromise using less advanced malware. In line with other ScarCruft tools, Dolphin abuses cloud storage services specifically Google Drive for C&C communication. During our investigation, we saw continued development of the backdoor and attempts by the malware authors to evade detection. A notable feature of earlier Dolphin versions we analyzed is the ability to modify the settings of victims signed-in Google and Gmail accounts to lower their security, most likely to maintain access to victims email inboxes.

By: Tomi Engdahl

Tomi Engdahl — Thu, 01 Dec 2022 08:38:57 +0000

Trigona ransomware spotted in increasing attacks worldwide https://www.bleepingcomputer.com/news/security/trigona-ransomware-spotted-in-increasing-attacks-worldwide/
A previously unnamed ransomware has rebranded under the name ‘Trigona,’ launching a new Tor negotiation site where they accept Monero as ransom payments. Trigona has been active for some time, with samples seen at the beginning of the year. However, those samples utilized email for negotiations and were not branded under a specific name. As discovered by MalwareHunterTeam, starting in late October 2022, the ransomware operation launched a new Tor negotiation site where they officially named themselves ‘Trigona.’

By: Tomi Engdahl

Tomi Engdahl — Thu, 01 Dec 2022 08:37:47 +0000

Researchers Find a Way Malicious NPM Libraries Can Evade Vulnerability Detection https://thehackernews.com/2022/11/researchers-find-way-malicious-npm.html
New findings from cybersecurity firm JFrog show that malware targeting the npm ecosystem can evade security checks by taking advantage of an “unexpected behavior” in the npm command line interface (CLI) tool.
npm CLI’s install and audit commands have built-in capabilities to check a package and all of its dependencies for known vulnerabilities, effectively acting as a warning mechanism for developers by highlighting the flaws. But as JFrog established, the security advisories are not displayed when the packages follow certain version formats, creating a scenario where critical flaws could be introduced into their systems either directly or via the package’s dependencies.

By: Tomi Engdahl

Tomi Engdahl — Thu, 01 Dec 2022 08:34:09 +0000

Submarine cable damage brings internet pain to Asia, Africa https://www.theregister.com/2022/11/30/seamewe5_cut_outage_apac_africa/
Internet users across Asia appear to be suffering from degraded performance after a major submarine cable was severed. Pakistan’s telecoms authority flagged the cable cut. Internet-watching outfit Netblocks also spotted something amiss in Pakistan, other Asian nations, and parts of Africa. SEA-ME-WE-5 runs from France to Singapore with landings in Turkey, Saudi Arabia, Yemen, Djibouti, Oman, United Arab Emirates, Pakistan, Sri Lanka, Bangladesh, Myanmar, Malaysia, and Indonesia along the way. The cable is 20,000km in length and can carry 12.2Tb per fibre pair of which there are four from Egypt to France and three for the rest of the span.

By: Tomi Engdahl

Tomi Engdahl — Thu, 01 Dec 2022 07:31:37 +0000

https://techcrunch.com/2022/11/30/lastpass-goto-breached-customer-information/

By: Tomi Engdahl

Tomi Engdahl — Thu, 01 Dec 2022 07:26:49 +0000

Researchers find bugs allowing access, remote control of cars https://therecord.media/researchers-find-bugs-allowing-access-remote-control-of-cars/
Several major car brands have addressed vulnerabilities that would have allowed hackers to remotely control the locks, engine, horn, headlights, and trunk of certain cars made after 2012, according to a security researcher. Yuga Labs staff security engineer Sam Curry published two threads on Twitter detailing his research into the mobile apps for several car brands that give customers the ability to remotely start, stop, lock and unlock their vehicles. Curry and several other researchers started with Hyundai and Genesis, finding that much of the verification process for getting access to a vehicle relied on registered email addresses. They found a way to bypass the email verification feature and gain full control.

By: Tomi Engdahl

Tomi Engdahl — Wed, 30 Nov 2022 13:57:04 +0000

Chrome 108 Patches High-Severity Memory Safety Bugs
https://www.securityweek.com/chrome-108-patches-high-severity-memory-safety-bugs

Google this week announced the release of Chrome 108 in the stable channel with patches for 28 vulnerabilities, including 22 reported by external researchers.

Of the externally reported security defects, eight are high-severity issues and 14 are medium-severity flaws.

The most severe of these bugs, based on the paid bug bounty reward, is CVE-2022-4174, a type confusion issue in the web browser’s V8 JavaScript engine.

Google credited security researcher Zhenghang Xiao for reporting the vulnerability and says it paid a $15,000 reward for it.

By: Tomi Engdahl

Tomi Engdahl — Wed, 30 Nov 2022 13:56:09 +0000

Delta Electronics Patches Serious Flaws in Industrial Networking Devices
https://www.securityweek.com/delta-electronics-patches-serious-flaws-industrial-networking-devices

Taiwan-based Delta Electronics has patched potentially serious vulnerabilities in two of its industrial networking products.

The flaws were identified by researchers at CyberDanube, a new industrial cybersecurity company based in Austria, in Delta’s DX-2100-L1-CN 3G cloud router and the DVW-W02W2-E2 industrial wireless access point.

Delta Electronics router vulnerability The researchers conducted their analysis on so-called digital twins, which involve virtualization techniques, rather than by looking at the actual devices.

In the 3G router, they discovered an authenticated command injection issue and a stored cross-site scripting (XSS) flaw. The command injection vulnerability can allow an attacker who has credentials for the web service to execute system commands on the OS with root privileges.

By: Tomi Engdahl

Tomi Engdahl — Wed, 30 Nov 2022 13:55:38 +0000

Developers Warned of Critical Remote Code Execution Flaw in Quarkus Java Framework
https://www.securityweek.com/developers-warned-critical-remote-code-execution-flaw-quarkus-java-framework

Developers have been warned that the popular Quarkus framework is affected by a critical vulnerability that could lead to remote code execution.

Available since 2019, Quarkus is an open source Kubernetes-native Java framework designed for GraalVM and HotSpot virtual machines.

Tracked as CVE-2022-4116 (CVSS score of 9.8), the security defect was identified in the Dev UI Config Editor and can be exploited via drive-by localhost attacks.

“Exploiting the vulnerability isn’t difficult and can be done by a malicious actor without any privileges,” Contrast Security researcher Joseph Beeton, who discovered the bug, explains.

Contrast discovers zero-day flaw in popular Quarkus Java framework
https://www.contrastsecurity.com/security-influencers/localhost-attack-against-quarkus-developers-contrast-security