Threat report for 2018-09-26

DATA BREACH

1. Uber Agrees to $148M Settlement With States Over Data Breach
2. Uber to pay $148 million to states for 2016 data breach
3. Firefox Notifies Users of Compromised Accounts
4. Uber to pay $148 million in settlment over 2016 data breach and cover-up
5. Ex-NSA employee sentenced to 5.5 years in prison for leaking confidential data
6. United Nations data found exposed on web: researcher
7. United Nations data found exposed on web: researcher
8. Former NSA TAO hacker sentenced to 66 months in prison over Kaspersky Leak
9. SHEIN Data Breach Impacts Over 6.4 Million Customers
10. SMBs face costs of up to $2.5 million after a data breach
11. United Nations data found exposed on web: researcher
12. Millions of Twitter DMs may have been exposed by year-long bug
13. Firefox Monitor tells you whether your email was compromised in a data breach
14. Alert: A remote code execution vulnerability is discovered in Microsoft Windows Jet database engine
15. United Nations Mistakenly Exposed Sensitive Data to The Public
16. oPatch community released micro patches for Microsoft JET Database Zero-Day
17. Malware campaign attacks freelancers

DENIAL-OF-SERVICE

18. Hide and Seek (HNS) IoT Botnet targets Android devices with ADB option enabled
19. Bitcoin Core Team fixes a critical DDoS flaw in wallet software
20. Bad bots are stealing data and ruining the customer experience
21. DDoS Attack on German Energy Company RWE
22. DDoS Attack on German Energy Company RWE
23. Bots at the Gate: A Human Rights Analysis of Automated Decision Making in Canada’s Immigration and Refugee System
24. Vulnerability in Cisco routers could allow DoS attacks
25. DDoS attack on education vendor hinders access to districts’ online portals
26. Microsoft Adds New Tools to Azure DDoS Protection
27. Viro Botnet Ransomware
28. Infinite Campus DDoS attack impedes access to student data
29. Hide and Seek Botnet Adds Infection Vector for Android Devices
30. Hide and Seek IoT Botnet Learns New Tricks: Uses ADB over Internet to Exploit Thousands of Android Devices
31. Bitcoin Core Team Releases Critical Security Update to Fix DDoS Attack Vulnerability

MALVERTISING

Nothing to report

PHISHING

32. Chegg to reset passwords for 40 million users after April 2018 hack
33. Android password managers can be tricked into believing that evil apps are good
34. User login notifications
35. Beware of payroll-themed phishing. Here’s one example.
36. SHEIN breach exposes emails, encrypted passwords of 6.42M customers
37. Counter Phishing Attacks with These Five Tricks
38. Password managers can be tricked into believing that malicious Android apps are legitimate
39. Cisco patches critical default password vulnerability
40. 11:30 AM ET today: @AlexanderGTster and @illena_a from @SCmagazine share the scoop on #spearphishing and how you can go beyond the obvious defenses to protect users from email attacks.
41. Password Tips from a Pen Tester: Are 12-Character Passwords Really Stronger, or Just a Dime a Dozen?
42. #SecurityNews: Popular news aggregation site #NewsNow has been notifying its users of a potential password #breach after it found evidence of an #intrusion. Read more about this #databreach here:
43. Looking for a enterprise grade password vault solution but MUST be hosted onsite
44. #SecurityNews: New #Ofcom rules "could help tackle #vishing" (voice #phishing) scams. They come into force on Oct 1st and will ban phone companies for charging for the Caller ID service that helps users screen their calls. Read more abut this here:
45. 156 million #phishing emails are sent out every day and email users receive up to 20 phishing emails each month. Learn more about modern phishing techniques and how to address them in the @ironscales #whitepaper.
46. Microsoft is killing passwords one announcement at a time
47. Aggregate this: NewsNow has spilt a bunch of 'encrypted' passwords
48. NewsNow Ditches Passwords After Possible Breach
49. Malware steals passwords from SHEIN, 6.4 million customers impacted
50. Malware steals passwords from 6.4 million SHEIN customers
51. Backlash sees change in Chrome login and Google account behaviour
52. Chrome 70 Lets you Control Automatic Login and Deletes Google Cookies

WEB DEFACEMENT

Nothing to report

MALWARE

53. Cisco's probe of VPNFilter router malware uncovers several new hacking techniques
54. VPNFilter Malware Adds Seven New Tools For Exploiting Network Devices
55. Fraudulent shopping domain certificate issuance outstrips legitimate businesses
56. Businesses in Arkansas Hit with Ransomware
57. Malware in the Cloud: What You Need to Know
58. Businesses in Arkansas Hit with Ransomware
59. Air Gapped PCs are Still at Risk. The Rise of USB-based Crytojacking Malware
60. Crooks turn to Delphi packers to evade malware detection
61. USB malware and cryptominers are threat to emerging markets
62. DanaBot trojan sets sights on Europe, new features
63. Trojanized App In Google Play Steals Bank Customers' Euros
64. Password managers can be tricked into believing that malicious Android apps are legitimate
65. Crooks turn to Delphi packers to evade malware detection
66. Viro Botnet Ransomware
67. Freelancers baited with job offers to download malicious macros
68. Android Banking Trojan Found On Google Play with 10,000 Installs Steals User’s Banking Credentials
69. Domain flub leaves 30 million customers high and dry
70. USB malware and cryptominers are threat to emerging markets
71. WTB: Adwind Trojan Circumvents Antivirus Software To Infect Your PC
72. Android spyware in development plunders WhatsApp data, private conversations
73. The MITRE ATT&CK Framework: Exfiltration
74. Malware steals passwords from SHEIN, 6.4 million customers impacted
75. VPNFilter III: More Tools for the Swiss Army Knife of Malware
76. New Adwind RAT Attack Linux, Windows and Mac via DDE Code Injection Technique by Evading Antivirus Software
77. Malware steals passwords from 6.4 million SHEIN customers
78. Crooks leverages Kodi Media Player add-ons for malware distribution
79. Malware in the Cloud: What You Need to Know
80. Cryptocurrency mining malware increases 86%
81. 25 Malicious apps that Downloaded More Than 120,000 Times Contains Hidden Cryptomining Script
82. Malware campaign attacks freelancers
83. GandCrab v5 Ransomware Utilizing the ALPC Task Scheduler Exploit

EXPLOIT

84. VPNFilter Malware Adds Seven New Tools For Exploiting Network Devices
85. NSA dev in the clink for 5.5 years after letting Kaspersky, allegedly Russia slurp US exploits
86. Rockwell Automation Buffer Overflow Vulnerability
87. Hide and Seek IoT Botnet Learns New Tricks: Uses ADB over Internet to Exploit Thousands of Android Devices
88. GandCrab v5 Ransomware Utilizing the ALPC Task Scheduler Exploit

VULNERABILITY

89. Bitcoin Core Team fixes a critical DDoS flaw in wallet software
90. Vulnerability in Cisco routers could allow DoS attacks
91. Cisco patches critical default password vulnerability
92. New Linux Kernel “Mutagen Astronomy” Flaw Impacts Red Hat, CentOS, Debian Distributions.
93. Twitter fixes API bug that shared data with wrong developers
94. Cisco: Linux kernel FragmentSmack bug now affects 88 of our products
95. Bug? Feature? Power users baffled as BitLocker update switch-off continues
96. Braking bad: Mitsubishi recalls 68k SUVs over buggy software
97. Linux Kernel Vulnerability Affects Red Hat, CentOS, Debian
98. Millions of Twitter DMs may have been exposed by year-long bug
99. Apple pushes out Mojave 10.14, patches numerous vulnerabilities
100. Variant of patched IE vulnerability spotted in wild
101. Alert: A remote code execution vulnerability is discovered in Microsoft Windows Jet database engine
102. Rockwell Automation Buffer Overflow Vulnerability
103. Crowdfense launches Vulnerability Research Hub for top security researchers
104. oPatch community released micro patches for Microsoft JET Database Zero-Day
105. New Linux Kernel Bug Affects Red Hat, CentOS, and Debian Distributions
106. Vulnerability affects Cisco Video Surveillance Manager
107. Bitcoin Core Team Releases Critical Security Update to Fix DDoS Attack Vulnerability
108. Snyk raises $22 million to address security vulnerabilities in open source code
109. New security vulnerabilities (CVE-2018-14634) affects CentOS and Red Hat Linux
110. CVE-2018-0150: Cisco IOS XE Software Static Credential Vulnerability