Ticketmaster Snafu Only Tip of the Iceberg

After last month’s Ticketmaster breach, a follow-up investigation found it to be part of a larger payment card compromising campaign affecting more than 800 online retail sites worldwide. The cause of the breach appears to stem from the third-party breaches of several Ticketmaster suppliers, which allowed hackers to integrate their own code within the software to compromise a far larger audience than originally realized.

Adobe Issues Patches for Over 100 Vulnerabilities

This month’s Patch Tuesday for Adobe introduced more than 100 unique fixes for vulnerabilities related to both Acrobat and Reader. Among the patches are fixes for unauthorized read issues that were allowing for the disclosure of sensitive information. Additionally, a patch was released for Flash Player that resolved a flaw allowing for unauthorized remote code execution, which could have had resulted in serious harm to any affected system.

Fitness Tracker App Reveals Locations of Military Personnel

Fitness app Polar Flow has recently come under scrutiny after the identity and locations of thousands of military personnel were easily revealed using the fitness map functionality. By displaying the activity map, users were could be traced to highly secretive locations, such as the White House and several other military bases around the world. The issue was caused by users swapping between public and private sessions closely tied to their individual user ID numbers when tracking fitness activities within the app.

Rahkni Ransomware Now Comes with a Choice

A longtime ransomware variant known as “Rahkni” was recently spotted in the wild with new functionality. The latest update has allowed Rahkni to decide between completely encrypting a system and deploying a crypto-miner. While mainly targeting Russian users, the ransomware is spread through malicious email attachments posing as a legitimate version of Adobe. In addition to its main operations, Rahkni also completes a thorough system scan and checks for virtualization and antivirus software before shutting down any OS-based defenses.

Chinese Hackers Compromise Australian University

After months of fending off cyberattacks, the Australian National University finally fell victim to a major data breach that has since been traced back to China. While the university believes that no student or staff information was stolen, the university serves as the main location for several national defense research organizations. This attack comes shortly after Australia implemented multiple new laws designed to reduce foreign intrusion.

Canadian college breach targets thousands

Last Friday, Algonquin College officials announced that an earlier data breachpotentially affected thousands of current and former students, as well as employees. While it is still unclear exactly what systems were affected, the officials have been working to contact all potential victims and inform them of the situation. What’s more interesting is Algonquin’s CISO’s comment in the article. You’d think that after the university’s first attack in 2014, they would have been better prepared this time around. At the very least, they could address the measures you’ve taken and plan on taking moving forward to prevent breaches.

Tinder implements major security upgrades

Tinder recently introduced fixes for two security vulnerabilitiesrelating to pictures insecurely stored on their servers and the ability to encrypt swipe responses. Those are pretty big vulnerabilities, considering Tinder has more than 50 million active users. The first fix involved Tinder securing their storage servers to keep hackers from accessing them through an unsecured WiFi network. The second fix revolved around making all swipe data the same size, as that was the differentiating factor between “likes” and “dislikes.”

Exactis data leak exposes info on 340 million users

A Florida-based marketing firm is currently under fire after the data for over 340 million customers was found on a publicly accessible server. It has not yet been determined for how long the information was publically accessible. The article title reads “Worse than Equifax.” I’d say. That’s all of America. Fortunately, Exactis was quick to lock down the server once they were alerted to the exposure. It has been confirmed that the data includes everything from names and addresses to types of pets and specific religious affiliations.

Adidas website falls victim to hackers

Adidas’ US website was breached this week, with sensitive data for millions of customers being stolen by unknown hackers. The company has since confirmed that no payment card information was included in the leak, only site usernames and passwords, which Adidas did properly store with strong levels of encryption. The company is still suggesting anyone who has ever made purchases from their website to change their password, regardless of whether it has been used for other sites or not. Take this as an opportunity to update all of your passwords—especially passwords on sites that you use as the same for your Adidas account.

Ticketmaster waits months to reveal data breach

Ticketmaster United Kingdom has finally released a breach statementmonths after Monzo bank, a UK-based mobile bank, informed the tickets sales giant of dozens of fraudulent charges. Even after being informed, the company wasn’t able to properly identify any data breach for over 2 months. I guess the bright side is that Ticketmaster has begun offering identity monitoring services to affected customers.

Weaponized USB Drives Targeting Japan and South Korea

In an effort to target air-gapped internal systems, a new wave of weaponized USB drives has been found throughout Japanese and South Korean organizations. While these attacks are relatively uncommon, that only heightens the threat as most companies are ill-prepared for such an attack and have created their air-gapped network systems in hopes of deterring them. As the systems utilizing this security method are typically extremely sensitive, this type of attack becomes increasingly focused on organizations or industry processes.

Hotel Booking Software Compromised

This week, officials for FastBooking, a Paris-based software companythat sells booking software to hundreds of hotels around the world, announced they had fallen victim to a data breach. The actual breach occurred over a week ago, and it took FastBooking employees nearly a week to discover the malicious software running on their servers. Unfortunately for customers, the data stolen seems to vary from hotel to hotel, as they all store data differently. The breach could affect millions of clients worldwide.

PythonBot Delivers Ads and Cryptominers to Windows Users

Researchers have recently discovered a new adware variant,written exclusively in Python, that not only spams your device with various ads, but also installs a cryptominer on the system for added financial gain. Ads are displayed by PBot using a malicious browser extension that attempts to redirect users to revenue-generating ad sites. In addition to its malicious activities, PBot also contains functionality to constantly receive updates to stay a step ahead of security software trying to remove it.

Flight-tracking Service Suffers Data Breach

Over the last few days, FlightRadar24, one of the largest flight tracking servicesin the world, suffered a data breach that could affect all of its 230,000 users. The breach only contained email addresses and hashed passwords, with the company swiftly pushing out password reset links to all affected customers along with disabling all current passwords. Fortunately, this breach contained no other personally identifying information or payment card data.

Nintendo Switch Hacked After DevMenu Leak

Recently, users of the Nintendo Switch have discovered illicit photos being used as profile pictures within games targeted at younger players. After an internal developer menu for the Switch was leaked, users could upload any small JPG file to an SD card and use the menu to change the avatar picture to anything they choose, including pornographic images. Unfortunately, Nintendo doesn’t currently moderate user profile pictures, but will likely have to make some changes if this behavior continues.

The Cyber News Rundown brings you the latest happenings in cybersecurity news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst and a guy with a passion for all things security. Any questions? Just ask.

92 Million Genealogy Site Accounts Compromised

Earlier this week, genealogy and DNA testing site MyHeritage revealed it had suffered a breach that affects all 92 million of its users, making it the largest reported breach of 2018. The breach itself appears to have occurred in October of last year and affected the systems that store user emails and hashed variants of their passwords. Fortunately, neither DNA results nor payment systems were affected, as they are both stored separately from online account info. Following the breach, MyHeritage has begun implementing two-factor authentication and has strongly suggested that all users update their current passwords.

Apple’s Latest Beta Release Features Enhanced Security Measures

At this year’s Worldwide Developers Conference, Apple unveiled iOS 12 which includes several quality of life improvements for current apps along with new additions. Among the new features, Apple has hinted at one that forces users who are transferring data using a USB device to unlock their Apple device once per hour, to keep the transfer active. This feature is likely part of their continued response to the FBI and several security companies developing methods to bypass local device security to gain unauthorized access to the device.

Australian HR Firm Falls Victim to Data Breach

In the past two weeks, officials at Australian HR firm PageUp have been working to determine the scale of a data breach that occurred in the last week of May. The systems affected contained sensitive user information, minus payment data or written contracts, which are stored elsewhere. The company has since informed all affected customers of the issue and has taken several steps to ensure the malware that caused the breach has been removed.

Facebook Allowed Untrustworthy Chinese Firm to Access User Data

Following Facebook’s ongoing stream of litigation, they are once again under fire for allowing China-based Huawei to gather not only user data but also data from that user’s friend list, often without consent. Huawei and dozens of other developers were given access to Facebook’s API to assist in improving the user experience on various operating systems, though it is impossible to account for any misuse of the data from that point on.

Financial Sector Sees Major Increase in Keyloggers

Researchers analyzed the 100 malware infections that most recently affected the financial sector and found high volumes of keyloggers, as well as Emotet and Ursnif Trojans, which are commonly dropped from malicious Microsoft® Office documents. While it’s not unusual for keylogging software be used to steal sensitive financial info, the sheer quantity of variants indicates that, as these institutions have worked to increase their security, attackers have also been working to improve their own methods.

The Cyber News Rundown brings you the latest happenings in cybersecurity news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst and a guy with a passion for all things security. Any questions? Just ask.

Comcast Router Bug Leaves Credentials Unsecured

Researchers recently found a flaw in the Comcast user authentication process that would allow anyone with an account number and partial address to illicitly access WiFi networks and alter any  credentials found there. Fortunately, Comcast was quick to take down the entire site and make the necessary changes so such detailed information can no longer be gathered without proper verification.

Scam Email Warns Users of Other Scammers

A new phishing campaign is gaining traction throughout the US, with users receiving emails regarding a bank transfer of several million dollars currently being held by the Bank of England. The email itself continues by listing off a respectable number of other “scammers,” warning the victim of potential fraud linked to the listed names. While bank transfers are relatively common, it should be clear that a suspiciously large amount of money offered without context should always be approached with caution.

Teen Monitoring Software Left Available Online

Recently, a mobile app that allows parents to monitor their child’s internet browsing has left two internal servers completely accessible to the internet. While the contained information did not include any payment data, it did have email addresses and passwords for nearly all the app’s clients. TeenSafe has since taken both servers offline, though the Amazon cloud buckets were available for an undocumented amount of time with no mention of unauthorized access during that period.

Fraudulent Fortnite Apps Preceding Official Launch

As Fortnite continues its steady rise in popularity following its latest release on iOS, hundreds of phony apps have already flooded the Google Play store in advance of the Android release. One specific was downloaded over 5,000 times before researchers reported the app to the Google Security team. By promising in-game currency for downloading and rating fake apps, the spyware-laden apps quickly begin gathering call and message logs from the device while simply displaying a Fortnite icon.

Sensitive Information Found on 200 Million Japanese Citizens

Likely accumulated from several data breaches over the last few years, a dataset has been found containing the personal information of at least 200 million individuals living in Japan. The data appears to have been gathered from dozens of websites with login credentials for up to 50 unique sites and stems back to 2013. While the source of the information is still unclear, researchers have found several previous attempts to sell smaller datasets on Chinese dark web pages.

Crypto Mining Makes the Jump to Excel

With the recent Microsoft release supporting JavaScript within Excel, it was only a matter of time before the scripting service was manipulated to mine cryptocurrency. Mere hours after the release, the first proof of concept appeared, with easy-to-replicate steps to get CoinHive functioning. While this proof of concept does require an Office Insider build to accomplish, it will likely be just as feasible when JavaScript is introduced into the publicly available version of Excel.

SynAck Ransomware Employs Unique Evasion Tactics

A relatively new ransomware variant, known as SynAck, has recently been spotted using an uncommon method for evading security measures. Using a procedure called Process Doppelganging, the malware can create a copy of a legitimate process and inject malicious code to be executed without running anything suspicious. Additionally, the malware is heavily obfuscated and targets numerous programs before encryption to shut down any running processes or tasks that may be necessary to encrypt.

Japanese Security Cameras Defaced

Over the past several weeks, Japanese officials have been dealing with complaints from victims whose security cameras have been hacked. These attacks arose due to negligence on the part of the camera owners, who disregarded proper security practices and failed to update the default passwords on the devices. To make matters worse, the frequency of these attacks has been steadily climbing in the last couple days, and have begun to include government-owned devices on secured networks.

Facebook Exploit Used for Crypto Mining

Researchers have recently discovered a malicious Chrome browser extension that attempts to steal account credentials for any cryptocurrency trading platform it finds on the system. By spreading through Facebook Messenger, FacexWorm can propagate quickly and begin any data gathering or cryptocurrency mining with relative ease. While most of its victims have been located in Southeast Asia, numerous occurrences have been spotted in Western European countries as well, demonstrating the extension’s reach and speed.

Phishing is Still Leading Mobile Infection Rates

In a recent report based on phishing statistics over the past year, officials found that Apple iOS® users had a significantly higher chance of receiving a phishing attempt than downloading malware. With over 4000 new phishing sites being created daily and over half of all internet usage occurring on mobile devices, it’s no surprise that attackers have shifted their focus to this immense group of users, who typically lack security software for their devices and typically don’t consider mobile security necessary.