Cerebral was leaking personal info, security folks are being targeted in attacks, and GitHub
will now require 2FA!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for March 14, 2023 - this is your summary
of the threats to our security, privacy and Internet freedom!
Let’s jump right into the news this week.
Telehealth businesses have risen in popularity over the past 3 years, but they also serve
as a cautionary tale.
Last week the FTC fined BetterHelp $7.8 million in a settlement for sharing sensitive medical
data with advertisers such as Pinterest, Facebook, and Snapchat.
Another one is Cerebral, a remote telehealth company, who focuses on providing online therapy
and mediation for mental health conditions like ADHD, substance abuse, anxiety, and depression.
The company just published a Notice of HIPAA Privacy Breach for it’s 3.18 million customers
due to invisible pixel trackers they’ve been using from several third parties on their
websites, apps, and other telehealth services.
These kind of trackers embedded on websites allow businesses like Cerebral to analyze
how users interact with ads on other platforms, but it also gives third parties access to
information, too.
The invisible pixel trackers are from Google, Meta, TikTok and others.
These log data including sensitive medical information without patient consent.
They have used these pixel trackers since October 12, 2019, and discovered the HIPAA
breach on January 3, 2023, meaning the data could’ve been shared with these third parties
for almost 4 years.
Leaked info varies depending on how much info you had shared with Cerebral, so it could
be as little as your name and email address to as much as self assessment info, treatment
details, and health insurance.
Payment data, SSNs, and banking info were not impacted.
Cerebral included a full list of what kind of data could’ve been shared with these
third parties depending on if you just created an account, if you completed any surveys or
form fills, or if you’ve signed up for a subscription plan.
Cerebral removed or reconfigured any tracking pixels that didn’t meet those HIPAA requirements
and recommends users change their passwords and sign up for credit monitoring which they’re
offering for free.
Mandiant has shared details about an ongoing hacking campaign that is connected to the
North Korean government, and is currently targeting security researchers.
The attacks started in June of 2022, and use phishing techniques to try and get inside
the networks of companies the researchers work for, with the first of these targeting
a US based technology company.
Attackers are using new malware dubbed Touchmove, Sideshow, and Touchshift which they try to
infect companies with, and they’re using novel countermeasures to evade detection.
In Mandiants blog, they name UNC2970 as the threat actor group suspected of attribution.
The group uses fake job recruitments on LinkedIn to lure security researchers into moving the
conversation over to WhatsApp or email, to then deliver a backdoor called Plankwalk.
Plankwalk uses macros in word docs to download additional payloads from a CNC server.
Furthermore, the payload allows the attackers to deliver legitimate tools like Microsoft's
InTune, which allows them to bypass normal endpoint protections.
They can then deploy the new malware families - Touchmove, Sideshow, and Touchshift - which
are so new they have never been attributed to a threat group.
Mandiant believes this new information means the group is either evolving or expanding
their target landscape.
Some takeaways from this info include: making sure your team uses MFA, use cloud only accounts
to access Azure Active Directory, and use separate accounts for email and browsing,
and an admin account for the sensitive uses.
Blocking macros and setting up restrictions for access can help as well.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
THANK YOU to John, Kirk, Edward, Kate, Aaron, Veronica Explains, Okau Whatt, and Homie!
for being a part of the Smores at Patreon.com/shannonmorse.
That’s my new Patreon page for the show, where I’ll be posting all the perks for
patrons, including early access to this video.
If you’re currently a patron on the ThreatWire page, switch over to the new page so you don’t
lose access to your perks.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials, like my newest video about my favorite password managers.
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about GitHub!
GitHub is making 2FA a requirement as of yesterday March 13th for some users, with continuous
rollout to the rest of their user base by the end of the year.
This plan has been in the works for a while.
Back in May last year, GitHub announced their plans to require 2FA on all developer accounts
for anyone who contributes code to GitHub .com.
They planned this move to combat the constant attacks on supply chains we’ve seen recently.
While not perfect, MFA is a strong defensive tool to combat social engineering attacks.
According to their post, only about 16.5% of users were using 2FA.
In December, GitHub announced the rollout would begin requirements in March 2023.
First, they’ll require users to set up 2FA if they are enterprise or org members or contribute
code to critical repos.
GitHub is doing this rollout in multiple stages.
First, users will start getting notifications 45 days before required to add 2FA.
Then, when the deadline to set it up lands, they’ll get daily reminders for a week.
After that week, some GitHub features will be disabled.
Then, after 28 days, GitHub will prompt that user with a 2FA Check Up to ensure they can
still access their account.
GitHub has offered 2FA for a long time as an optional setting, and requirements have
already rolled out for some maintainers.
This isn’t the first company to require 2FA on accounts either.
Apple started required 2FA for icloud backup and drive about a month ago.
I'm Shannon Morse, I'll see you on the Internet!