And again with the W2s. This time it was the city of San Marcos that got scammed out of W2s. This impacts every city employee, about 800 of them and was only discovered after city employees found that their taxes had already been filed. As usual this was due to a phishing scam similar to the CEO Fraud emails (a.k.a. Business Email Compromise) which targets money transfers. Unfortunately, when a W2 is lost, it impacts the employee for a long time afterword.
To counter this, you need to train folks that have access to, or work with this sort of data to be very cautious what they send and to whom. When dealing with large amounts of money or sensitive data, it’s a good idea to implement a policy that requires a phone conversation (not recorded call) before sending anything.
Now this is a just a low blow. A new strain of ransomware called “Kirk” is in the wild. Unlike most strains, this one uses Monero instead of Bitcoin for payment. Once you do pay, it provides a decryptor called “Spock”. The bad news, it doesn’t look like the ransomware can actually do the decryption at this point, so they are effectively dragging poor Spock’s name through the mud. That’s just wrong! It does have a cool ASCI art ransom screen though
The good news? It looks like it’s being spread by passing itself along as a copy of LOIC (Low Orbit Ion Cannon), so if you aren’t dorking around with tools like that, you should be ok.
So help me, if they do something like this based on a Firefly theme, I’m going to hunt them down and smack them up side the melon by myself.
A hacker claims to have hacked some outdated vBulletin sites, resulting in about 800k accounts being collected. This was done by exploiting a SQL injection flaw in out-of-date vBulletin installs. While the data includes hashed passwords, and probably aren’t for super important stuff, the concern here is password reuse and the ability to use this data to get in to other accounts, or use it to socially engineer the folks on the list.
Imagine getting a phishing email from one of the domains, linking to the hack and asking for a password reset, but sending you to a credential phishing site. This is one scenario where the info could be used to collect reused passwords.
I strongly recommend using a password vault, like Lastpass or something similar to generate and store random passwords for websites. Protect this with a strong passphrase and 2-factor authentication, and you can go far in securing your online accounts.
FWIW, the domains that are claimed to be hacked are:
Just a reminder to businesses that there can be more cost to a data breach than your own recovery. In this case, Veridian Credit Union is suing Eddie Bauer for the cost of reissuing cards and other costs related to the breach. This is a class action suit, so others are likely to join in the party as well. The premise is that Eddie Bauer failed miserably in their security practices, took too long to notify those impacted and that they also failed to implement EMV chip technology.
It is entirely possible that due to the EMV chip liability shift, effective October of 2015, that they will have a good leg to stand on in the case of this lawsuit, especially if these were charges at POS systems in-store and the customers used an EMV-enabled card, but Eddie Bauer had not implemented EMV readers. That could get pretty expensive for them.
Keep this in mind if you operate a business and have not enable EMV chip processing. It could prove very costly in the long run.
Data such as names, dates of birth, National Insurance numbers and radiation doses for over a thousand people working for the Welsh NHS was stolen from a private contractor. While the breach was discovered back in October, it was not reported until January. Frankly, long delays like this in reporting is unacceptable. People need to know if their data is exposed so they can protect themselves.
Let this also be a lesson about the importance of 3rd party security and the risk you take when allowing data to be stored/used/collected by contractors or other 3rd parties.
Don’t have time to go out and find some mobile malware for that new phone of yours? Now you don’t have to! As a bonus, it can be installed with “System” permissions so you can’t get rid of it even if you wanted to! How cool is that? It kind of takes the fun out of poking around seedy internet sites while trying to get infected, but thanks to the supply chain injecting malware in to your pristine ROM, you don’t have to waste any time.
Check Point found that phones by Samsung, Google, Xiaomi, ZTE, Oppo, Vivo, Asus, and Lenovo have been sold with malware such as Loki (advertising) or Slocker (ransomware) already installed. Note, this does not mean that all phones are infected, but rather that somewhere in the supply chain, this has happened. A good reason to only buy from reputable sources and go ahead and run a malware check on any new phone.
This is the list of infections spotted so far by Check Point
A phishing campaign appearing to be from the The Australian Taxation Office (ATO) is targeting businesses right now. The email contains a link where folks are told they can review their Business Activity Statements (BAS) online, however the link downloads a trojan dropper that installs ransomware or some other malware. Keep an eye ope for emails saying they are from [email protected].
Another crazy week in the Cyberz. This is my recap of the last week worth of fun (and not) related to the world of cyber. To get updates more often, subscribe to my blog on the right.
I’ll be down by Ft. Lauderdale Thursday and Friday while speaking at the South Florida ISSA Conference. If you are around and want to meet up for a cold one, let me know.
I’m just going to start with Vault 7
I mean, really, how could I not? On Tuesday WikiLeaks dropped a bomb on the infosec world (perhaps the world in general) when they published roughly eleventy-trillion pages of data related to CIA offensive cyber capabilities. It’s full of 0-days and different vulnerabilities/hack with fun little names like “SnowyOwl” and “Weeping Angel”. For example, Weeping Angel can use Samsung Smart TVs to covertly record audio conversations. If/when it’s confirmed that this is really a legit CIA info dump (which it appears to be), it won’t be pleasant. As it is, a lot of people int he US Government are probably creating new grey hair and ulcers at this very moment. I am not going to try to analyze the whole dump, but I will say that some of this stuff is a bit spooky. Just remember, Don’t Blink!
Over 1 Biiiiiiiiilion email addresses exposed by spammers misconfigured backups
Karma is a bitch. River City Media screwed up their Rsync configs and accidentally backed up their data to an internet-facing server, exposing all of the data where it was discovered by Chris Vickery, a security researcher for MacKeeper. He contacted the authorities and relevant orgs to help shut down the infrastructure. Hopefully that 1.3 billion records, some containing home addresses and IP’s, don’t drop in to the hands of other spamming orgs. Time will tell
TorrentLocker (aka Cryptolocker) is back and farming credentials as well.
After taking some time off, Cryptolocker appears to be back in a very aggressive campaign, and it has some new ‘features’. It’s sent via Word docs with a PowerShell script, infects and spreads via shared files, and it’s also grabbing credentials as well. Right now it appears to be targeting Europe, especially Italy, but we need to keep our eyes open regardless of where we live.
16 Senators and Staff In Pennsylvania Locked Out Of Their Systems By Ransomware
This happened to the Pennsylvania Senate Democratic Caucus on Friday and the website is still down as of the time of this post on Wednesday evening. This can’t be a fun day over there. As of Friday, Pennsylvania Democrats spokeswoman Stacey Witalec said, “At this point we are working with Microsoft to see where we’re at.”
Odds are, it was a phishing email some poor unsuspecting staffer clicked on. This is a good time to take them from unsuspecting, to a healthy level of paranoia by training them about the threat.
Dot ransomware – Coming soon to a network near you
Click to enlarge: Image thanks to Fortinet
I’ve mentioned Raas (Ransomware as a Service) before, but it’s really starting to show some growth potential. The “Dot” RaaS strainis currently being advertised on the dark web, so we can expect to see it hitting pretty soon. This one is a zero money down, profit-sharing strain with a 50/50 split. Expect more of this sort of thing to start rolling out in the near future. If it remains profitable, it will continue to grow.
Eyes Open Aussies – ASIC phishing email is spreading Cryptolocker
Shamoon 2 May Get a Ransomware Feature and StoneDrill Hides in Memory
This is a good read from DarkReading. In summary, Shamoon was Sha-sleep for quite Shum time (You see what I did there, right?) but returned last year to harass some folks in the Middle East. It is typically deployed as data wiping malware, but it seems as if the developer realized that there can be money in adding a ransomware feature in version 2. While it’s not in the wild yet, it’s a lesson that malware devs are starting to see the value in coding a ransomware option in to what they are already distributing.
Also, StoneDrill is injecting itself into the memory process of the user’s browser and doing a good job of ducking under sandbox radars. It appears to share code with NewsBeef and/or Charming Kitten APTs which are generally affiliated with Iranian State-Sanctioned options. Currently these are still focused on the Middle East, but it appears at least one European org has been infected with it.
Mystery Shopper Email Scams – Yeah, They Still Happen
It’s important that we help educate others that these scams do still happen. Lower income, unemployed and retired people are especially prone to this sort of scam. It sounds like easy money, and even appeals to the undercover 007 type in most of us, but it can do a number on your bank account.
Key thing to remember is, if someone sends you a check and asks you to send the change, it’s a scam. This doesn’t matter if it’s a car purchase on ebay or craigslist, or anything else, don’t do it. Checks can take a long time to clear, or be found to be fake, and you are held holding the bag.
Mystery shopping is the SCAM OF THE WEEK here at KnowBe4, and there is some good info on what to look for, and something you can copy/paste for friends and family. Check it out.
W2 Scams are off the charts right now
This week was just stupid, so I’m going to just group them together
Yet Another W2 Breach – 2,400 at Autoneum North America Inc.
Sadly the Swiss company disclosed about 2,400 employees W2’sto scammers. The employees were in Jeffersonville, Indiana; Oregon, Ohio; Bloomsburg, Pennsylvania; and Aiken, South Carolina; and at its North American headquarters in Farmington Hills, Michigan. At least 1 employee already found their taxes having been filed by the scammers.
Daytona State College W2 Breach
Hundreds of current and former employees could be affected by the breach, although they are being very vague on how it happened. Gee, I wonder, could it possibly be a W2 phishing scam? Go figure.
Yukon Public Schools Hit With Data Breach
And again I find myself reporting on a W2 scam. This time, It’s Yukon Public Schools that fell for a phishing scam and emailed W2’s to scammers. Superintendent Dr. Jason Simeroth said the email looked like it was sent from him, then later in the story it was mentioned that it was spoofed from an AOL email address. Really? AOL in this day and age? This is twice today I have heard of people using AOL email. I really thought it was dead.
Kids, today’s lesson is, if you are handling sensitive information or transferring money, you might want to pick up the phone BEFORE you hit send. Just sayin.
Groton Public Schools – Yet Another W2 Scam Victim
This is really getting stupid. School after school are sending the teacher’s W2 to scammers. Groton Public Schools in Connecticut is the focus of this post. You know, because teachers don’t have enough to deal with, what with miniature humans eating the all of the paste and creating mayhem by the truckload.
Glastonbury, CT Public Schools Hit By W2 Scam
Another day, another district reporting a breach. This time it was Glastonbury Public Schools who did it. It was everyone but the food service personnel (the district appears to know enough NOT to mess with the folks that handle their food). How does anyone in the school systems not know about this scam already? Sheesh!
Tyler Independent School District Falls For W2 Scam
From Tyler, TX. They found out about it on Wednesday. I like that they are taking steps though, as the district said they will “continue and improve upon our information security awareness and training programs for all employees.” Good, comprehensive awareness training IS how you combat this
1 Bitcoin is worth more than an ounce of gold
Pretty crazy that this unregulated vapor-currency is worth more than gold isn’t it?
Gas Pump Tamper Alarm May Have Foiled Skimmer Install
I am glad to see the new pumps have tamper alarms and that they may actually work. This one was an issue pretty close to home in Ocala, FL.
The tamper alarm went off and the clerk checked it out, possibly spooking a few guys that were acting weird. We need more of this sort of thing happening.
#MHN, #kippo and #Dionaea still cooking along. Now to capture binaries…
So, I’ve been playing with Kippo and Dionaea using the Modern Honey Network (MHN) tool and having some fun with it. At this point, I’m going to reload my Kippo box at home and deploy it with Dionaea as well rather than WordPot. I like being able to see the different types of attacks on FTP and HTTP, but I’m having some trouble with the config.
Currently, FTP will make a connection, but fails to send a directory listing. Likewise, I am not capturing any binaries right now. I tried making the folder wide open (777 & nobody:nogroup) but still no luck. If you have any ideas, let me know please. I want to start playing with captures. In the meantime, my pew pew map is about done collecting sources now. Few of the attacks come from a new place now.
Pew Pew Pew!
Mucho attacks, no binaries captured. I do have pcap’s, but I want some malware files! 🙂
Hundreds of current and former employees could be affected by the breach, although they are being very vague on how it happened. Gee, I wonder, could it possibly be a W2 phishing scam? Go figure.
I mean, really, how could I not? On Tuesday 
It’s important that we help educate others that these scams do still happen. Lower income, unemployed and retired people are especially prone to this sort of scam. It sounds like easy money, and even appeals to the undercover 007 type in most of us, but it can do a number on your bank account.
