T-Mobile US exposes some customer data – but don't call it a breach

PLUS: Trojan hidden in PoC; cyber insurance surge; pig butchering's new cuts; and the week's critical vulns

Infosec in brief T-Mobile US has had another bad week on the infosec front – this time stemming from a system glitch that exposed customer account data, followed by allegations of another breach the carrier denied.…

The Shocking Data on Kia and Hyundai Thefts in the US

Plus: MGM hackers hit more than just casinos, Microsoft researchers accidentally leak terabytes of data, and China goes on the PR offensive over cyberespionage.

Deadglyph: New Advanced Backdoor with Distinctive Malware Tactics

Cybersecurity researchers have discovered a previously undocumented advanced backdoor dubbed Deadglyph employed by a threat actor known as Stealth Falcon as part of a cyber espionage campaign. "Deadglyph's architecture is unusual as it consists of cooperating components – one a native x64 binary, the other a .NET assembly," ESET said in a new report shared with The Hacker News. "This combination

New Apple Zero-Days Exploited to Target Egyptian ex-MP with Predator Spyware

The three zero-day flaws addressed by Apple on September 21, 2023, were leveraged as part of an iPhone exploit chain in an attempt to deliver a spyware strain called Predator targeting former Egyptian member of parliament Ahmed Eltantawy between May and September 2023. "The targeting took place after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections," the

LastPass: ‘Horse Gone Barn Bolted’ is Strong Password

The password manager service LastPass is now forcing some of its users to pick longer master passwords. LastPass says the changes are needed to ensure all customers are protected by their latest security improvements. But critics say the move is little more than a public relations stunt that will do nothing to help countless early adopters whose password vaults were exposed in a 2022 breach at LastPass.

LastPass told customers this week they would be forced to update their master password if it was less than 12 characters. LastPass officially instituted this change back in 2018, but some undisclosed number of the company’s earlier customers were never required to increase the length of their master passwords.

This is significant because in November 2022, LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users.

Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults.

KrebsOnSecurity last month interviewed a victim who recently saw more than three million dollars worth of cryptocurrency siphoned from his account. That user signed up with LastPass nearly a decade ago, stored their cryptocurrency seed phrase there, and yet never changed his master password — which was just eight characters. Nor was he ever forced to improve his master password.

That story cited research from Adblock Plus creator Wladimir Palant, who said LastPass failed to upgrade many older, original customers to more secure encryption protections that were offered to newer customers over the years.

For example, another important default setting in LastPass is the number of “iterations,” or how many times your master password is run through the company’s encryption routines. The more iterations, the longer it takes an offline attacker to crack your master password.

Palant said that for many older LastPass users, the initial default setting for iterations was anywhere from “1” to “500.” By 2013, new LastPass customers were given 5,000 iterations by default. In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000. Still, Palant and others impacted by the 2022 breach at LastPass say their account security settings were never forcibly upgraded.

Palant called this latest action by LastPass a PR stunt.

“They sent this message to everyone, whether they have a weak master password or not – this way they can again blame the users for not respecting their policies,” Palant said. “But I just logged in with my weak password, and I am not forced to change it. Sending emails is cheap, but they once again didn’t implement any technical measures to enforce this policy change.”

Either way, Palant said, the changes won’t help people affected by the 2022 breach.

“These people need to change all their passwords, something that LastPass still won’t recommend,” Palant said. “But it will somewhat help with the breaches to come.”

LastPass CEO Karim Toubba said changing master password length (or even the master password itself) is not designed to address already stolen vaults that are offline.

“This is meant to better protect customers’ online vaults and encourage them to bring their accounts up to the 2018 LastPass standard default setting of a 12-character minimum (but could opt out from),” Toubba said in an emailed statement. “We know that some customers may have chosen convenience over security and utilized less complex master passwords despite encouragement to use our (or others) password generator to do otherwise.”

A basic functionality of LastPass is that it will pick and remember lengthy, complex passwords for each of your websites or online services. To automatically populate the appropriate credentials at any website going forward, you simply authenticate to LastPass using your master password.

LastPass has always emphasized that if you lose this master password, that’s too bad because they don’t store it and their encryption is so strong that even they can’t help you recover it.

But experts say all bets are off when cybercrooks can get their hands on the encrypted vault data itself — as opposed to having to interact with LastPass via its website. These so-called “offline” attacks allow the bad guys to conduct unlimited and unfettered “brute force” password cracking attempts against the encrypted data using powerful computers that can each try millions of password guesses per second.

A chart on Palant’s blog post offers an idea of how increasing password iterations dramatically increases the costs and time needed by the attackers to crack someone’s master password. Palant said it would take a single high-powered graphics card about a year to crack a password of average complexity with 500 iterations, and about 10 years to crack the same password run through 5,000 iterations.

However, these numbers radically come down when a determined adversary also has other large-scale computational assets at their disposal, such as a bitcoin mining operation that can coordinate the password-cracking activity across multiple powerful systems simultaneously.

Meaning, LastPass users whose vaults were never upgraded to higher iterations and whose master passwords were weak (less than 12 characters) likely have been a primary target of distributed password-cracking attacks ever since the LastPass user vaults were stolen late last year.

Asked why some LastPass users were left behind on older security minimums, Toubba said a “small percentage” of customers had corrupted items in their password vaults that prevented those accounts from properly upgrading to the new requirements and settings.

“We have been able to determine that a small percentage of customers have items in their vaults that are corrupt and when we previously utilized automated scripts designed to re-encrypt vaults when the master password or iteration count is changed, they did not complete,” Toubba said. “These errors were not originally apparent as part of these efforts and, as we have discovered them, we have been working to be able to remedy this and finish the re-encryption.”

Nicholas Weaver, a researcher at University of California, Berkeley’s International Computer Science Institute (ICSI) and lecturer at UC Davis, said LastPass made a huge mistake years ago by not force-upgrading the iteration count for existing users.

“And now this is blaming the users — ‘you should have used a longer passphrase’ — not them for having weak defaults that were never upgraded for existing users,” Weaver said. “LastPass in my book is one step above snake-oil. I used to be, ‘Pick whichever password manager you want,’ but now I am very much, ‘Pick any password manager but LastPass.'”

Asked why LastPass isn’t recommending that users change all of the passwords secured by the encrypted master password that was stolen when the company got hacked last year, Toubba said it’s because “the data demonstrates that the majority of our customers follow our recommendations (or greater), and the probability of successfully brute forcing vault encryption is greatly reduced accordingly.”

“We’ve been telling customers since December of 2022 that they should be following recommended guidelines,” Toubba continued. “And if they haven’t followed the guidelines we recommended that they change their downstream passwords.”

ESET's cutting-edge threat research at LABScon – Week in security with Tony Anscombe

Two ESET malware researchers took to the LABScon stage this year to deconstruct sophisticated attacks conducted by two well-known APT groups

Stealth Falcon preying over Middle Eastern skies with Deadglyph

ESET researchers have discovered Deadglyph, a sophisticated backdoor used by the infamous Stealth Falcon group for espionage in the Middle East

Apple squashes security bugs after iPhone flaws exploited by Predator spyware

Holes in iOS, macOS and more fixed following tip off from Google, Citizen Lab

Apple emitted patches this week to close security holes that have been exploited in the wild by commercial spyware.…

Defeating Visual Studio Code embedded reverse shell

submitted by /u/ipfyx
[link] [comments]

New Sandman APT Group Hitting Telcos With Rare LuaJIT Malware

US Govt IT Help Desk Techie Leaked Top Secrets To Foreign Nation

Incomplete Disclosures By Apple And Google Create Huge Blindspot For 0-Day Hunters

Apple Patches 3 Zero Days Likely Exploited By Spyware Vendor To Hack iPhones

TransUnion Thinks Dump Of Stolen Customer Data Came From Someone Else

New Variant of Banking Trojan BBTok Targets Over 40 Latin American Banks

An active malware campaign targeting Latin America is dispensing a new variant of a banking trojan called BBTok, particularly users in Brazil and Mexico. "The BBTok banker has a dedicated functionality that replicates the interfaces of more than 40 Mexican and Brazilian banks, and tricks the victims into entering its 2FA code to their bank accounts or into entering their payment card number,"

Verisign Celebrates Hispanic Heritage Month

Celebrating National Hispanic Heritage Month reminds us how the wide range of perspectives and experiences among our employees makes us stronger both as a company and as a steward of the internet. In honor of this month, we are proud to recognize the stories of three of our Hispanic employees, and the positive impact they make at Verisign.

Carlos Ruesta

As Verisign’s director of information security, Carlos Ruesta draws inspiration from his father’s community commitment as an agricultural engineer in Peru, working to bring safe food and water to isolated communities. His father’s experiences inform Carlos’ belief in Verisign’s mission of enabling the world to connect online with reliability and confidence, anytime, anywhere and motivates his work as part of a team that ensures trust.

As a leader in our security compliance division, Carlos ensures that his team maintains a robust governance, risk, and compliance framework, translating applicable laws and regulations into security control requirements. “Being part of a team that emphasizes trust, motivates me,” he said. “Management trusts me to make decisions affecting large-scale projects that protect our company. This allows me to use my problem-solving skills and leadership abilities.”

Carlos commends Verisign’s respectful and encouraging environment, which he considers vital in cultivating successful career paths for newcomers navigating the cybersecurity field. He says by recognizing individual contributions and supporting each other’s professional growth, Hispanic employees at Verisign feel a sense of belonging in the workplace and are able to excel in their career journeys.

Alejandro Gonzalez Roman

Alejandro Gonzalez Roman, a senior UX designer at Verisign, combines his artistic talent with technical expertise in his role, collaborating among various departments across Verisign. “My dad is an artist, and still one of my biggest role models,” he said. “He taught me that to be good at anything means to dedicate a lot of time to perfecting your craft. I see art as a way to inspire people to make the world a better place. In my job as a UX designer, I use art to make life a little easier for people.”

As a UX designer, Alejandro strives to make technology accessible to everyone, regardless of background or abilities. He believes that life experiences and cultural knowledge provide individuals with a unique perspective, which he considers an invaluable source of inspiration when designing. And with the Hispanic population being one of the largest minorities in the United States, cultural knowledge is crucial. Understanding how different people interact with technology and integrating cultural insights into the work is essential to good UX design.

Overall, Alejandro is motivated by the strong sense of teamwork at Verisign. “Day-to-day work with our strong team has helped me improve my work” he said. “With collaboration and encouragement, we push each other to be better UX designers. I couldn’t succeed as I have without this amazing team around me.”

Rebecca Bustamante

Rebecca Bustamante, senior manager of operations analysis, says Verisign’s “people-first” culture is part of her motivation, and she is grateful for the opportunities that allowed her to take on different roles within the company to learn and broaden her skills. “I’ve had opportunities because people believed in my potential and saw my work ethic,” she said. “These experiences have given me the understanding and skills to succeed at the job I have today.”

One of these experiences was joining the WIT@Verisign (Women in Technology) leadership team, which proved instrumental to her personal growth and led to valuable work friendships. In fact, one of her most cherished memories at Verisign includes leading a Verisign Cares team project in Virginia’s Great Falls Park, where she and her coworkers worked together to clear invasive plants and renovate walking paths.

Rebecca sees this type of camaraderie among employees as a crucial part of the people-first culture at Verisign. She particularly commends Verisign’s team leaders who value consistent communication and take the time to listen to people’s stories, which fosters an authentic understanding. This approach makes collaboration more natural and allows teamwork to develop organically. Rebecca emphasizes the significance of celebrating her culture, as it directly influences her job performance and effective communication. But she pointed out that the term “Hispanic” encompasses a wide diversity of peoples and nations. She advocates respect, practices active listening, and promotes a culture celebrating each other’s successes.

Joining the Verisign Team

These three individuals – as well as their many team members – contribute to Verisign’s efforts to enable and enhance the security, stability, and resiliency of key internet infrastructure every single day.

At Verisign, we recognize the importance of talent and culture in driving an environment that fosters high performance, inclusion, and integrity in all aspects of our work. It’s why recruiting and retaining the very best talent is our continual focus. If you would like to be part of the Verisign Team, please visit Verisign Careers.

The post Verisign Celebrates Hispanic Heritage Month appeared first on Verisign Blog.

Weekly Update 366

Well that's it, Europe is done! I've spent the week in Prague with highlights including catching up with Josef Prusa, keynoting at Experts Live EU and taking a "beer spa" complete with our own endless supply of tap beer. Life is good 🍻

That’s it - we’ve peaked - life is all downhill from here 🤣 🍻 #BeerSpa pic.twitter.com/ezCpUC6XEK

— Troy Hunt (@troyhunt) September 21, 2023

All that and more in this week's video, next week I'll come to you from back home in the sunshine 😎

References

1. Sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite
2. I caught up with Josef Prusa in Prague (what he has created at Prusa is massively impressive!)
3. Experts Live EU was an awesome event 😎 (felt a lot of love in Prague, thanks everyone 😊)
4. The dbForums data breach went into HIBP (and... that's me pwned again 😭)
5. The ApexSMS spam operation that exposed data a few years back also went into HIBP (it's one of those ones you really can't do anything about, think of it as an "FYI")

Cryptomining malware detected on a Russian thesaurus with 5 Million+ monthly visits

submitted by /u/nareksays
[link] [comments]

Critical DICOM Server Misconfigurations Lead to Exposure of 1.6M Medical Records

submitted by /u/ziyahanalbeniz
[link] [comments]

How to Interpret the 2023 MITRE ATT&CK Evaluation Results

Thorough, independent tests are a vital resource for analyzing provider’s capabilities to guard against increasingly sophisticated threats to their organization. And perhaps no assessment is more widely trusted than the annual MITRE Engenuity ATT&CK Evaluation.  This testing is critical for evaluating vendors because it’s virtually impossible to evaluate cybersecurity vendors based on their own

Iranian Nation-State Actor OilRig Targets Israeli Organizations

Israeli organizations were targeted as part of two different campaigns orchestrated by the Iranian nation-state actor known as OilRig in 2021 and 2022. The campaigns, dubbed Outer Space and Juicy Mix, entailed the use of two previously documented first-stage backdoors called Solar and Mango, which were deployed to collect sensitive information from major browsers and the Windows Credential

High-Severity Flaws Uncovered in Atlassian Products and ISC BIND Server

Atlassian and the Internet Systems Consortium (ISC) have disclosed several security flaws impacting their products that could be exploited to achieve denial-of-service (DoS) and remote code execution. The Australian software services provider said that the four high-severity flaws were fixed in new versions shipped last month. This includes - CVE-2022-25647 (CVSS score: 7.5) - A deserialization

ESA gets the job of building Europe's secure satcomms network

IRIS² oversight deal signed as constellation’s schedule slips, and Ariane 6 hits another snag

The European Space Agency has signed up to build and launch the European Union's Infrastructure for Resilience, Interconnectivity and Security by Satellite constellation.…

Apple Rushes to Patch 3 New Zero-Day Flaws: iOS, macOS, Safari, and More Vulnerable

Apple has released yet another round of security patches to address three actively exploited zero-day flaws impacting iOS, iPadOS, macOS, watchOS, and Safari, taking the total tally of zero-day bugs discovered in its software this year to 16. The list of security vulnerabilities is as follows - CVE-2023-41991 - A certificate validation issue in the Security framework that could allow a

US govt IT help desk techie 'leaked top secrets' to foreign nation

National defense files can earn you $55K … and espionage charges

A US government worker has been arrested and charged with spying for Ethiopia, according to court documents unsealed Thursday.…

Mysterious 'Sandman' Threat Actor Targets Telecom Providers Across Three Continents

A previously undocumented threat actor dubbed Sandman has been attributed to a set of cyber attacks targeting telecommunic koation providers in the Middle East, Western Europe, and the South Asian subcontinent. Notably, the intrusions leverage a just-in-time (JIT) compiler for the Lua programming language known as LuaJIT as a vehicle to deploy a novel implant called LuaDream. "The activities we

The WebP 0day

submitted by /u/MegaManSec2
[link] [comments]

TransUnion reckons big dump of stolen customer data came from someone else

Prolific info-thief strikes again

Updated Days after a miscreant boasted leaking a 3GB-plus database from TransUnion containing financial information on 58,505 people, the credit-checking agency has claimed the info was actually swiped from a third party.…

OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes

ESET researchers document OilRig’s Outer Space and Juicy Mix campaigns, targeting Israeli organizations in 2021 and 2022

Poland Investigates OpenAI Over Privacy Concerns

Feds Issue Snatch Ransomware Warning

MGM Resorts Operations Resume 10 Days After Cyberattack

India's Biggest Tech Centers Named As Cyber Crime Hotspots

Cisco Beefs Up Cybersecurity Play With $28 Billion Splunk Deal

Cisco spends $28B on data cruncher Splunk in cybersecurity push

$157/share cash deal is the largest acquisition in networking titan's history

Cisco is making its most expensive acquisition ever – by far - with an announcement it's buying data crunching software firm Splunk for $157 per share, or approximately $28 billion (£22.8b).…

Researchers Raise Red Flag on P2PInfect Malware with 600x Activity Surge

The peer-to-peer (P2) worm known as P2PInfect has witnessed a surge in activity since late August 2023, witnessing a 600x jump between September 12 and 19, 2023. "This increase in P2PInfect traffic has coincided with a growing number of variants seen in the wild, suggesting that the malware's developers are operating at an extremely high development cadence," Cado Security researcher Matt Muir

New ways to inject system CA certificates in Android 14

submitted by /u/pimterry
[link] [comments]

The Rise of the Malicious App

Security teams are familiar with threats emanating from third-party applications that employees add to improve their productivity. These apps are inherently designed to deliver functionality to users by connecting to a “hub” app, such as Salesforce, Google Workspace, or Microsoft 365. Security concerns center on the permission scopes that are granted to the third party apps, and the potential

Menacing marketeers fined by ICO for 1.9M cold calls

Five businesses facing half a million in collective penalties for illegally phoning folk registered with TPS

The UK data watchdog has penalized five businesses it says collectively made 1.9 million cold calls to members of the public, illegally, as those people had opted out of being menaced at home by marketeers.…

China Accuses U.S. of Decade-Long Cyber Espionage Campaign Against Huawei Servers

China's Ministry of State Security (MSS) has accused the U.S. of breaking into Huawei's servers, stealing critical data, and implanting backdoors since 2009, amid mounting geopolitical tensions between the two countries. In a message posted on WeChat, the government authority said U.S. intelligence agencies have "done everything possible" to conduct surveillance, secret theft, and intrusions on

Cyber Group 'Gold Melody' Selling Compromised Access to Ransomware Attackers

A financially motivated threat actor has been outed as an initial access broker (IAB) that sells access to compromised organizations for other adversaries to conduct follow-on attacks such as ransomware. SecureWorks Counter Threat Unit (CTU) has dubbed the e-crime group Gold Melody, which is also known by the names Prophet Spider (CrowdStrike) and UNC961 (Mandiant). "This financially motivated

Ukrainian Hacker Suspected to be Behind "Free Download Manager" Malware Attack

The maintainers of Free Download Manager (FDM) have acknowledged a security incident dating back to 2020 that led to its website being used to distribute malicious Linux software. "It appears that a specific web page on our site was compromised by a Ukrainian hacker group, exploiting it to distribute malicious software," it said in an alert last week. "Only a small subset of users, specifically

India's biggest tech centers named as cyber crime hotspots

Global tech companies' Bharat offices attract the wrong sort of interest

India is grappling with a three-and-a-half year surge in cyber crime, with analysis suggesting cities like Bengaluru and Gurugram – centers of India's tech development – are hubs of this activity.…

Data breach reveals distressing info: People who order pineapple on pizza

Pizza Hut Australia says 190,000 customers' info – including order history – has been accessed

Pizza Hut's Australian outpost has suffered a data breach.…

Beware: Fake Exploit for WinRAR Vulnerability on GitHub Infects Users with Venom RAT

A malicious actor released a fake proof-of-concept (PoC) exploit for a recently disclosed WinRAR vulnerability on GitHub with an aim to infect users who downloaded the code with Venom RAT malware. "The fake PoC meant to exploit this WinRAR vulnerability was based on a publicly available PoC script that exploited a SQL injection vulnerability in an application called GeoServer, which is tracked

HDF5 - Multiple Memory Corruption Vulnerabilities

submitted by /u/MysteriousHotel3017
[link] [comments]

Feds raise alarm over Snatch ransomware as extortion crew brags of Veterans Affairs hit

Invasion of the data snatchers

The Snatch ransomware crew has listed on its dark-web site the Florida Department of Veterans Affairs as one of its latest victims – as the Feds warn organizations to be on the lookout for indicators of compromise linked to the extortionist gang.…

Signal adopts new alphabet jumble to protect chats from quantum computers

X3DH readied for retirement as PQXDH is rolled out

Signal has adopted a new key agreement protocol in an effort to keep encrypted Signal chat messages protected from any future quantum computers.…

International Criminal Court hit in cyber-attack amid Russia war crimes probe

Right as judges issued warrants against Putin

The International Criminal Court said crooks breached its IT systems last week, and that attack isn't over yet, with the ICC saying the "cybersecurity incident" is still ongoing.…

Pot calls the kettle hack as China claims Uncle Sam did digital sneak peek first

Beijing accuses US of breaking into Huawei servers in 2009

The ongoing face-off between Washington and Beijing over technology and security issues has taken a new twist, with China accusing the US of hacking into the servers of Huawei in 2009 and conducting other cyber-attacks to steal critical data.…

LUCR-3: Scattered Spider Getting SaaS-y in the Cloud

submitted by /u/permis0
[link] [comments]

RCE in Tutanota Desktop: How a single email could compromise your machine

submitted by /u/SonarPaul
[link] [comments]

Fake WinRAR Exploit PoC Drops VenomRAT Malware

Marvell Disputes Claim Cavium Backdoored Chips For Uncle Sam

The Signal Protocol Used By 1+ Billion People Is Getting A Post-Quantum Makeover

DHS Publishes New Recommendations On Cyber Incident Reporting

Robocall Scammers Sentenced In US After Netting $1.2 Million

Pizza Hut Australia Got Hacked

Vast Majority Of Bot Attacks Emanate From China And Russia

Robocall scammers sentenced in US after netting $1.2M via India-based call centers

Part of network of crims who used 'trickery and threats' to target elderly

Two Indian nationals have each received 41-month prison sentences in the United States for their involvement in a $1.2 million robocall scam targeting the elderly, according to New Jersey prosecutors on Tuesday.…