Over 500 e commerce sites were hacked, Google auto enrolled 150 million users in 2FA, and
are you laundering bitcoin?
Well, ya might get caught!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for February 15 2022 - this is your summary
of the threats to our security, privacy and Internet freedom.
We have a pretty bad ecommerce skimmer y’all should know about this week, so, onto the
first story.
One domain was found to have breached over 500 different e-commerce websites running
the Magento 1 platform in order to install a credit card skimmer on them.
This was discovered by the security firm Sansec when they found 374 infections all on the
same day and all using the same malware.
In one case, they found a site infected with 19 backdoors, possibly for redundancy or to
test attacks.
They found this evidence of a potential hack last month.
All of the attacks came from a domain called naturalfreshmall DOT com, and the skimmer
was set up to steal the information of customers going to these legitimate sites.
While the attackers are currently unknown at this time, Sansec was able to confirm that
they used a known vulnerability found in a Quickview plugin that could be used to add
fake Magento admin user accounts that would be able to run code with administrative privileges
on the websites.
This was a cross between a SQL injection exploit and a PHP object injection attack.
Put them together and you get a MageCart baby.
A backdoor is created when the host application is made to craft a malicious object using
a new rule added to the script.
The malicious script is added to the new customer sign up page.
In this case, according to Sansec, the Natural Fresh skimmer shows a fake payment popup which
defeats the purpose of a PCI compliant hosted payment form, then those payments are sent
to the natural fresh mall domain, which is attacker controlled.
Attackers are also able to execute commands, completely takeover the site, and steal credit
card data using this MageCart attack (which reminder, Magecart is the term used to explain
this type of skimmer attack on e commerce sites).
[[screenshot6]] Even though Magento 1 is no longer supported by Adobe as of June 30, 2020,
plenty of sites still use it and never got updated.
BUT Adobe did respond on Sunday with a patch.
The best way for these sites to become disinfected is to find, identify and remove the backdoors,
then update the CMS to a version that is no longer vulnerable to infection.
By the way, do you want free stuff?
If you join or upgrade to an annual pledge on Patreon in February, you’ll get two free
months of perks - which equals about a 16% discount.
Doing tech shows is my full time job, so if you find value in the work I do, and you wanna
show your support, check out patreon.com/threatwire!
Google announced back in October 2021 that they planned to auto enroll 150 million users
in 2 factor authentication (or two step verification) by the end of that year.
This was just months after they’d originally announced their initiative to push more adoption
of 2FA in May of 2021.
Google just announced that they’ve successfully auto enrolled that user count in 2 step verification
and by doing so, they also decreased the number of accounts hijacked by password theft by
50%.
This also includes requiring 2 million Youtube creators to enable two step verification.
In a blog post published on February 8, Google points out that they’re aware people use
Gmail and their Google accounts to link up with non-Google accounts for sites like banks,
social media and shopping, so keeping Gmail secure is fundamental to their work to keep
users safe online.
They use the major decrease in account hijackings as a crucial point in showing how important
2 step verification is to protect your data and personal info.
But this isn’t all.
Google used this news to also point out the work they’re doing to eliminate the reliance
we have on passwords.
For example, leading the way on adoption of security hardware keys - the kinds that you
plug into your device and tap on in order to verify your login.
This is also built into Android phones and via the Google Smart Lock app on iOS devices,
so most modern devices in the world have this capability.
But of course, trusting that a business will keep you safe online is a tiny fraction of
the practices that we should all be taking.
Google also recommends users check out the Security Checkup step by step guide in your
settings to ensure accounts are secure, enabling 2 Factor Authentication or 2 Step Verification
on your accounts if it’s not enabled by default, and using a password manager (google
recommends the Google password manager) to ensure passwords are strong and aren’t reused.
Google intends to continue auto enrolling users in 2SV in 2022.
If you want to take the initiative into your own hands, you can totally do so by going
into your settings to the Security Checkup feature, looking for 2FA settings and enabling
it for your account.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for
the support.
THANK YOU to KL, Sarah, Noah, and Steven for joining on Patreon.com/threatwire and shoutout
to everyone who chose to upgrade their perk level this month.
Let’s finish out today’s episode with my last top story about all about more crypto
being stolen!
More than $3.6 billion dollars worth of cryptocurrency was seized by the US Department of Justice
about 5 years after it was stolen from the cryptocurrency called Bitfinex waaaaay back
in August of 2016.
During this seizure of crypto, the DOJ also arrested a couple from New York, after they’d
tried to launder some of the money on a Hong Kong exchange.
They attempted to launder 119,754 bitcoin.
Bitcoin that was stolen during that attack.
The total stolen was $4.5 billion.
But interestingly, they aren’t accused of hacking into Bitfinex and stealing the money.
They’re being accused of conspiracy to launder it.
Given that they haven’t been handed a verdict yet, disclaimer - all of this is alleged.
How did the DOJ find out?
Apparently the couple made more than 2000 transactions, and those bitcoin were sent
to a digital wallet under their control.
Slowly, over these five years, they transferred about 25,000 of the bitcoin from their wallet
through a complicated process of money laundering that ended with funds deposited in a bank
account controlled by them.
Their process of money laundering involved using fake identities to open accounts, automation
of transactions, and depositing funds into currency exchanges and darknet markets to
wash it.
They would turn the bitcoin into other currencies, and they used US bank accounts to keep everything
looking legit.
The defendants used over 2000 digital wallets and they face a slew of charges, and could
face up to 25 years in jail total.
The rest of the bitcoin was still in the wallet and was used to receive and store illegal
proceeds from the hack.
The DOJ got a warrant and found some files that had private keys allowing access to the
digital wallet that the stolen bitcoin was deposited into from Bitfinex, so at that point,
they were able to seize the rest of the bitcoin, totalling 94,000, valued at $3.6 billion.
When bitcoin gets seized, who would it get returned to?
Bitfinex stated that they’re working with law enforcement to “establish [their] right
to a return of the stolen bitcoin”, but that process could take years.
Any victims or claimants can file legal action to make a claim on the funds.
Want to see more tech videos from me?
Check out my youtube channel - youtube.com/ShannonMorse for everything from tech reviews to security
tutorials.
I’ve got a networking tutorial coming up soon!
And with that, don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!