Ring patches a video spying vulnerability, a linux crypto miner malware was found, and
a cybercrime group is using fake reservation emails to steal info!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for August 23 2022 - this is your summary
of the threats to our security, privacy and Internet freedom.
This week I added 14 additional important news stories to the Patreon page for easy
access to action alerts and stuff you should know, and that roundup includes a few wrap
up stories from DEF CON, (which side note, did have a mask policy, but as you can see,
I came home healthy and ready to do more shows).
That’s extremely important when you’re self employed and you don’t get PTO, so
if you’re interested and you want to see this show keep going, please consider becoming
an alliance member at patreon.com/threatwire.
Thank you for supporting my content in whichever way you do it.
Let’s get started with today’s news.
Researchers with security firm Checkmarx discovered a flaw in the Amazon Ring Android app that
could have allowed an attacker to access camera video recordings, geolocation information,
and personal information through a malicious app.
With over 10 million downloads of the Android app alone, this is considered a severe vulnerability
for users of these home security cameras and devices.
This was disclosed to Amazon on May 1 and fixed on May 27, with public disclosure happening
now.
The problem resides in a deeplink activity which is exported in the Android Manifest.
This means it’s accessible to other apps on the smartphone and could be launched said
apps, so if a malicious application was sneakily downloaded onto a user’s phone, that app
could be used to creep on users' Ring data.
“Activities” on Android phones are components of a program that users can interact with
on the display.
If activities are added to an app manifest file, they can be used to interact with other
installed apps.
There are two main parts: first, that activity allows for execution of web content from servers
as long as the server includes a URI string with the words “better-neighborhoods”,
but only webpages on ring.com or a2z.com could interact.
So the researchers took it a step further by finding a cross site scripting vulnerability
on another URL which allowed for interaction.
That allowed the researchers to steal login cookies via the authentication token and hardware
ID for a user’s account via the Ring APIs.
That access to the Ring APIs allowed them to steal a customer’s full name, email,
phone number, device geolocation, address and recordings.
Checkmarx determined that an attacker with tons of video recording access could use it
to find videos of interest be it persons of interest or documents easily viewed through
the camera lens.
Amazon makes this easier to do with their machine learning that is built right into
their products.
Or someone could just go super stalker, rob a home, or use recordings for blackmail.
Luckily this problem was fixed and there aren’t any signs it was used in the wild.
But moral of the story?
Either set up a localized option for home security and monitoring, or set up your cameras
in places that won’t open you up to potential harm if video data is stolen.
Typosquatting happens when someone takes advantage of accidental typos to trick users into thinking
they’re visiting a legitimate site, like google.com instead of a typo link, like goggle.com
(this is a hypothetical example).
A researcher at Sonatype discovered that at least 241 malicious packages are being used
to drop cryptominers on Linux machines by using typosquatting within the PyPI or Python
Package Index and NPM open source repositories.
These repositories are legitimate ways to find and publish third party software and
they are officially used for many distros.
Many of the registries are widely used libraries and each of the malicious packages appears
to download a bash script to run cryptominers.
The legitimate open source libraries that are being targeted include ones like React,
AIOHTTP, and argparse.
The malicious links would launch XMRig which is a Monero crypto miner.
Each of the packages, written in Python, downloads Bash scripts from the attackers server and
this notifies the attacker of the IP address for the now infected machine, while also letting
them know if the cryptominer deployment worked.
At first, the researcher who found these malicious packages reported 33 of them to PyPI, and
they were removed quickly, but the threat actor published 22 more at the same time.
Sonatype discovered another 186 npm typosquatting packages, equalling that total of over 200.
This isn’t the only time PyPi has been targeted with malicious packages.
Another discovery was made of about a dozen packages that hosted malware, in this case
the attacker was using malware that modified Discord into a backdoor to steal data from
browsers and Roblox.
The package can steal info from Google Chrome, Chromium, Edge, Firefox and Opera including
passwords, history, cookies, and search info.
All of that data is uploaded to the attacker via a Discord webhook, while also modifying
the Javascript file for Discord to add a backdoor, allowing the attacker to also steal info about
your Discord account.
The second part of this malware focuses on Roblox, and steals account cookies, the user
ID, Robux balance, and status for the gaming platform.
From both of these cases, we can tell that PyPi and other open source repos are being
used to host malicious libraries which are used to install crypto miners and steal data.
In some cases, like the former, the repository itself acts quickly to remove the malicious
packages, but in other cases, like the latter, the files were still accessible at time of
reporting.
With open source products, oftentimes they are managed by volunteers, so checking for
typos when searching for libraries and practicing skepticism with downloads is a crucial part
to protecting yourself from potential infection.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patrons Jakoby, Jonathan, Frank V and Frank S for joining the alliance
on Patreon.com/threatwire.
Let’s finish out today’s episode with my last top story, about attacks on the hospitality
industry.
Security firm Proofpoint reports that a cybercriminal group called TA558 who apparently never disappeared,
but experienced a slowdown in attacks during the pandemic, is once again targeting the
travel and hospitality industry with exploits that focus on hotel reservations and airlines.
These attacks originally stem from 2018, when TA558 was using fake reservation emails to
trick users into clicking on malicious links which would then download malware payloads.
They are financially motivated attackers, who use pretty consistent techniques including
attempts to install Loda RAT, Vj w0rm, and Revenge RAT.
They focus on Portuguese and Spanish speaker targets of Latin American origin, with some
targets found in Western Europe or North America.
What makes them unique is their use of RAR and ISO files.
The group started using URLs in their phishing emails more often in 2022, with 27 campaigns
reported, compared to 5 campaigns previously seen from 2018 to 2021.
The URLs contain ISOs or zipped RAR files with executables.
When including non-ISO and RAR attacks (as in, ones that used microsoft word or macros
instead), the group has carried out 51 campaigns this year.
Their schemes would require user interaction - a user would need to decompress the file
archive from the “reservation link”.
The embedded batch file executes a PowerShell helper script that then installs a payload.This
can allow the group to steal credit card details and customer data.
TA558 used to focus on malicious word docs, but since Microsoft started auto disabling
macros, the theory is that this hacker group shifted to ISOs and RARs.
Proofpoint recommends organizations in the hospitality and travel industry, as well as
frequent travelers, keep an eye out for potential phishing emails, especially ones that require
you to click a link to access or make a reservation.
Almost all emails from TA558 pretend to come from a conference organizer, tourism agent,
or similar and ask the user to click the link to make a reservation.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
Don't forget to like and subscribe to Hak5 as well!
I'm Shannon Morse, I'll see you on the Internet!