Monthly Archives: April 2017

A database of thousands of credit cards was left exposed on the open internet

A US online pet store has exposed the details of more than 110,400 credit cards used to make purchases through its website, researchers have found.

In a stunning show of poor security, the Austin, Texas-based company FuturePets.com exposed its entire customer database, including names, postal and email addresses, phone numbers, credit card information, and plain-text passwords.

 

The database was exposed because of the company’s own insecure server and use of “rsync,” a common protocol used for synchronizing copies of files between two different computers, which wasn’t protected with a password.

Researchers at the Kromtech Security Research Center found the database in November. But after numerous efforts to contact the company by phone and email, the database was only secured this week.

It’s not clear who’s to blame for the breach. The pet store is understood to have been developed by DataWeb Inc., which has built dozens of other similar pet-related sites and owns PegasusCart, an ecommerce platform, used on all of DataWeb’s sites.

Kromtech researcher Bob Diachenko found that the leaked data wasn’t limited to just FuturePets.com, but also appeared to contain several folders, including one that shows several backup files and databases of transactions within the DataWeb network.

“They have everything in there — from ad campaigns to thousands of orders details, with full customer payment details exposed, with IP addresses tracked down for milliseconds,” said Diachenko, who also blogged about the discovery.

However, there’s no evidence to suggest that any PegasusCart data had been exposed.

Microsoft reveals it received a secret FBI subpoena

Microsoft has disclosed that it received a secret subpoena from the FBI, which demanded the company turn over personal information on a customer.

The company confirmed in a Thursday blog post that it received the subpoena, a so-called “national security letter” filed in 2014, but came with a gag order preventing the company or anyone else from disclosing the contents — even to the customer in question.

The subpoena doesn’t require a judge or a court to approve the turning over of the customer’s data.

It’s not known exactly what the FBI wanted from this customer’s accounts. Under existing law, national security letters can get access to all kinds of metadata — but not contents of calls, emails, and other messages, which do require a court order.

Microsoft said that the national security letter was included in the aggregate data of an earlier transparency report.

Provisions in the Freedom Act, passed in 2015 as an intelligence community reform effortafter the Snowden revelations, compel the FBI to periodically review the gag orders that are attached to national security letters. That in part resulted in details of the letters becoming public for the first time, including challenges from Facebook, Yahoo, and Cloudflare.

“There are times when secrecy is vital to an investigation, but too often secrecy orders are unnecessarily used, or are needlessly indefinite and prevent us from telling customers of intrusions even after investigations are long over,” said Steve Lippman, Microsoft’s director of corporate responsibility.

CIA tools exposed by Wikileaks linked to hacking across 16 countries

glowing-keyboard-hacker-security-620x465.jpg

Those carrying out the attacks against Middle Eastern, Africa, European and Asian targets have nation-state level abilities

Image: iStock

Security researchers have confirmed that the CIA hacking tools exposed by Wikileaks have been used against targets in at least 16 different countries.

Last month WikiLeaks published a over 8,000 documents – apparently internal CIA files – detailing the intelligence agency’s hacking programmes. And now security company Symantec said it has tied the documents to the activities of a sophisticated cyberespionage operation it has been tracking for some time, which it dubs ‘Longhorn’.

For example it said the makers of the tools and this group shares cryptographic protocols specified in the Vault 7 documents published by Wikileaks.

The tools haven’t been picked up by attackers following the Vault 7 leak – which detailed secret CIA files for hacking iPhones, Android, smart TVs and more – but rather used as part of longstanding cyberespionage campaigns. Symantec said it “couldn’t speculate” as to the real identity of the group, which is advanced group and apparently not running campaigns against North America targets.

Longhorn has been active since at least 2011, using a variety of backdoor Trojans and zero-day vulnerabilities to infiltrate governments and international organisations, as well as targets in the financial, telecoms, energy, aerospace, information technology, education, and natural resources sectors.

The group has infected targets throughout the Middle East, Europe, Asia, and Africa; and although researchers detail how the group once infected a machine in the US, but an uninstaller was launched within hours, potentially indicating “this victim was infected unintentionally”.

Symantec has linked a number of malware variants and vulnerabilities disclosed by Wikileaks in the Vault 7 documents to Longhorn. For example, one of the documents details a changelog of dates for malware called Fluxwire, detailing when new features were incorporated.

The dates of these changes of Fluxwire correspond with developments of the Corentry Trojan tracked by Symantec. New features of Corentry appeared on the same dates listed in the Vault 7 documents, leading researchers to the conclusion the two forms of malware are one and the same.

 

That isn’t the only correlation between Vault 7 and Longhorn; the Vault 7 documents detail ‘Fire and Forget’ – a specification for user-mode injection of a payload by a tool called Archangel. The specification of this payload and the interface it used to load closely resembles a Longhorn Trojan horse called Plexor.

Longhorn’s cyberespionge tools also use techniques such as Real-time Transport Protocol as a means of command and control communications, employing wipe-on-use as standard practice, use of secure erase protocols involving renaming and overwriting and more.

All of these are also techniques detailed in the Vault 7 leaks and while other malware families are known to use these practices, Symantec researchers say that “the fact that so many of them are followed by Longhorn makes it noteworthy”

Ultimately, all of Longhorn’s malware is designed for cyberespionage, with the ability for detailed system fingerprinting and exfiltration capabilities. The malware is extremely stealthy, only communicating with its control server at random – times and with upload limits in order to avoid detection.

Cybersecurity researchers at Symantec had been monitoring Longhorn for some time prior to the Wikileaks breach. The group is described as well-resourced and working a standard Monday to Friday working week – behaviour which is consistent with the activity of state-sponsored groups – and operating in an American time zone.

Analysis of the group’s activity indicates that it’s from an English speaking North American country, with code words found in the malware referring, the band The Police with codewords including REDLIGHT and ROXANNE, as well as colloquial terms such as SCOOBYSNACK

“Longhorn has used advanced malware tools and zero-day vulnerabilities to infiltrate a string of targets worldwide. Taken in combination, the tools, techniques, and procedures employed by Longhorn are distinctive and unique to this group, leaving little doubt about its link to Vault 7,” the Symantec document on the group concludes.

VPN won’t save you For Long For Internet Security – See Why ?

Last week, Congress voted to gut proposed internet privacy rules set out by the outgoing Obama administration that would have prevented your internet provider from selling your browser history to advertisers. President Donald Trump signed the bill a day after, making it law.

 

Many turned to what appeared to be an obvious solution: A virtual private network (VPN).

 

The idea of using a VPN is simple enough. The good ones are designed to push your internet traffic through a protected and secured tunnel, which shields your browsing records — such as the websites you view — from your internet provider. (As a result, some VPNs push your internet traffic through servers in other countries to trick content providers, like Netflix, into thinking you’re in a different place — usually in order to gain access to content in other geographies.)

But VPNs, for the most part, are lousy, often over capacity, and almost always significantly reduce your internet speeds. And, sometimes services simply don’t work or load because they can detect you’re using a VPN, forcing you to jump off the VPN — effectively defeating the point of using the service on a long-term basis.

And, a lot of the time, the bad ones won’t protect your privacy as they promise.

But what compounds the problem is that some phony VPN services promise to protect your privacy, but they don’t and are simply cashing in on the news, said Motherboard.

The big question to ask yourself is: Should I trust this VPN provider? More often than not, you can’t and shouldn’t.

 

Why? Not least because VPN providers don’t always encrypt your web traffic, or don’t use their own domain name servers (which means your internet provider can still see the websites you’re accessing), and some are using their own in other countries, which means you’re beholden to their laws. As security researcher Troy Hunt said in a recent blog post, because VPN providers control your traffic, “they can inspect it, modify it, log it, and have a very good idea of what it is you’re up to.”

As security reporter Brian Krebs notes, many VPN providers “claim they keep zero records of customer activity,” but “this is almost always untrue if you take the time to read the fine print.”

Often, the reality most will face is that you’re paying for a VPN service that you have to trust more than your internet provider not to collect, monitor, or sell your data.

As famed security sensation Swift On Security said in a recent tweet:

(Source: Twitter)

It’s not to say that there aren’t good VPN providers out there, but you have to weigh up the reasons why you want to protect your browsing history and other data.

When push comes to shove, there are better ways to protect your browsing data than using a VPN.

And while nothing is perfect, and the web will never be completely secure (nothing ever is), you’re better off taking advantage of plugins like HTTPS Everywhere, which pushes for secure pages over non-secure pages where available.

Amazon, Google, Facebook, Twitter — and yes, even Pornhub and YouPorn, your favorite online adult destinations, all offer HTTPS by default, which masks the page and its content (albeit not the domain) from internet-browsing snoopers.

And when all else fails, your internet provider isn’t going to be able to monitor your activity on the Tor anonymity network any time soon.

And there’s almost never going to be a widespread adoption of a VPN service from the average internet user, nor should there be. And many will inherently choose convenience, ease, and faster speeds over security and slowdowns, defeating their point altogether.

Advanced Chinese hacking campaign infiltrates IT service providers across the globe

A Chinese hacking group with advanced cyber-espionage capabilities has been targeting managed IT services providers across the globe in a campaign to steal sensitive data.

The cybercriminal gang is using sophisticated phishing attacks and customised malware in order to infect victims’ machines and then gain access to IT providers and their customer networks.

Dubbed Operation Cloud Hopper, the cyber-espionage campaign has been uncovered by security researchers at PwC, BAE Systems, and the UK’s National Cyber Security Centre. The researchers say the campaign is “highly likely” to be the work of the China-based APT10 hacking group.

The group has been focusing on espionage since 2009 and has evolved from targeting US defence firms as well as the technology and telecommunications sectors to targeting organisations in multiple industries across the globe.

The group was behind the Poison Ivy malware family and has evolved its operations to include using custom tools capable of compromising high volumes of data from organisations and their customers, and stealthily moving it around the world.

It’s because of the sophisticated nature of the campaign that PwC’s Operation Cloud Hopper report describes how APT10 “almost certainly benefits from significant staffing and logistical resources, which have increased over the last three years”.

The group’s work shifted significantly during 2016, as it started to focus on managed service providers, following the significant enhancements to its operations. The move enabled APT10 to exfiltrate data from multiple victims around the world as part of a large scale campaign.

Managed service providers (MSPs) represent a particularly lucrative target for attackers, because as well as having access to their clients’ networks, they also store significant quantities of customer data, which can provide useful information or be sold for profit.

 

Researchers note that the spear phishing campaign undertaken by APT10 indicates that the group conducts significant research on targets, in order to have the best chance of tricking them into opening malicious documents attached to specially-crafted emails.

Once the hacking group has infiltrated a network, it conducts reconnaissance to ensure legitimate credentials have been gained, before deploying tools such as mimikatz or PwDump to steal additional credentials, administration credentials, and data from infected MSPs.

The shared nature of MSP infrastructure enables APT10’s success, allowing the hackers to stealthily move between the networks of MSPs and clients — hence the name Cloud Hopper.

Using this approach, the group has been able to target organisations in the US, Canada, the UK, France, Switzerland, Scandinavia, South Africa, India, and Australia.

“The indirect approach of this attack highlights the need for organisations to have a comprehensive view of the threats they’re exposed to — including those of their supply chain,” Kris McConkey, partner, cyber threat detection and response at PwC, said.

“This is a global campaign with the potential to affect a wide range of countries, so organisations around the world should work with their security teams and providers to check networks for the key warning signs of compromise and ensure they respond and protect themselves accordingly.”

The National Cyber Security Centre has issued guidelines following the global targeting of enterprises via managed service providers, and notes how the activity detected “likely represents only a small proportion of the total malicious activity”.