The Biggest Hacks of 2022! Coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for December 20 2022 - this is your
summary of the threats to our security, privacy and Internet freedom. Today we’re wrapping up the
year with the top 5 biggest hacks of 2022! These were chosen based not necessarily on data size,
but also on financial or privacy impact as well. Let’s start with number 5:
The DeFi platform Wormhole was attacked way back in February and an attacker stole about $325
million worth of cryptocurrency. It happened due to an update that occurred on the project’s GitHub
repository in which a known vulnerability update had not yet been applied to production code,
but was uploaded to the GitHub account. Since it wasn’t applied, the attacker was
able to exploit the vulnerability and forge a valid signature for a transaction on Wormhole,
which allowed them to freely mint Ethereum on the Solana blockchain valued at $325 million.
The attack happened on the 2nd, and Wormhole posted about it the same
day. They took their network offline for a short outage, saying it was “down for
maintenance”. Wormhole offered the attack a $10 million bounty to return the funds.
This caused a 10% drop in the value of Solana cryptocurrency,
and Wormhole added more Ethereum to replace the collateral funds 1:1. At the time,
this was the second largest DeFi hack ever, and the biggest one to hit in 2022.
While not the “biggest” hack in scope, this one did affect highly vulnerable people, and
as such this puts it on my list. The International Committee of the Red Cross announced that data for
more than 515,000 highly vulnerable people was compromised in an attack which likely stemmed
from state sponsored attackers. Technically, the initial intrusion began in late 2021,
but wasn’t disclosed or discovered until 2022, when they found further information about the data
breach. The attackers spent about 70 days with access to the servers before they were discovered.
The breach happened due to a known, but unpatched,
highly critical vulnerability in the single sign on tool called Zoho which was used by
the organization. Attackers were able to gain a foothold on their servers, where web shells
and exploitation activities happened, allowing them to steal admin creds and exfiltrate data.
People affected were in the Restoring Family Links program,
which reconnects missing people and children to their families after being
separated due to war or violence. Data like names, locations, and more were impacted.
Number 3 gets a place on this list because it affected nearly 1 in 3 Australians and
put them at risk of major identity theft and financial issues like fraud. In September,
Australia’s second largest mobile operator, Optus, disclosed the security breach,
saying an attacker “might” have had access to customer data. That included names,
dates of birth, phone numbers, physical and email addresses, driver licenses and passport
numbers. In total, this affected 11 million customers of the telecommunications giant.
According to the attacker, they used an unsecured API endpoint to steal the data. They then posted
a small sample of data on a hacking forum, demanding a $1 million USD ransom. Optus didn’t
reply to the ransom. About 10,000 customers had their data leaked on the forum for free,
which led to many customers getting phishing and ransom messages sent to them.
The Australian Federal Police launched an operation to identify the malicious actor,
and shortly after, a user on the forum stated they wouldn’t be selling any of
the data due to the law enforcement activity and a target on their back.
But even with this change, Optus still had nearly 2.1 million customers affected in the leak,
with each of those people having at least one form of identification number exposed.
Another 7.7 million customers had no valid or current ID numbers exposed,
but the leaks did contain email addresses, phone numbers, and dates of birth.
Number 2 is the Los Angeles Unified School District, the second largest school district
in the USA, who suffered a ransomware attack earlier this year in the fall.
The Russian speaking Vice Society hacking group claimed responsibility and hit the LAUSD email,
computer systems and apps with an attack. The group demanded a ransom,
but district officials refused to pay it, saying the funds should go to students and education.
When their extortion was ignored, the group published stolen data amounting
to over 500 GB worth, including personally identifiable information
like passports, social security numbers, and tax forms, contracts and legal documents,
financial data, health and covid testing data, conviction reports and psychological
assessments for students. In total, this was almost 300,000 files of information.
LAUSD has more than 1000 schools and 600,000 students in the district,
so this affected a huge amount of young people and minors.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby
photos and for the support. My youtube channel is youtube.com/ShannonMorse for
everything from tech reviews to security tutorials. If you’re traveling for the
holidays make sure to check out my newest video all about privacy pro
tips when you travel. Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with the biggest hack of the year, the Lapsus hacks!
I lumped all of these in together because they were all blamed on the same group,
Lapsus. In 2022 alone, this hacking group attacked Microsoft, Cisco, Samsung, Nvidia,
Okta, Rockstar Games and Uber, each time using similar techniques to gain access to systems.
According to Uber, the attackers gained access via a compromised device owned by a contractor,
who had their corporate account credentials stolen and used. The
attackers used repeated attempts to log into the contractors Uber account,
which eventually gave the contractor 2FA code notification fatigue, so they finally
accepted one of the 2fa requests. Even though the impact of this attack was minimal - the
malicious actor didn’t change any code but instead trolled employees on Slack.
Unlike the Uber hack, Microsoft also was hit by the same group,
but in their case Bing, Bing Maps, and Cortana data was stolen and partially
uploaded as a torrent file. The group also leaked source code from Samsung and Nvidia.
These attacks proved that MFA isn’t a silver bullet for security, and MFA fatique from
notification prompt bombing is absolutely a thing used in attacks. Offering employees
phishing resistant methods like hardware keys or passkeys for security can be more efficient.
HUGE thank you to all my Alliance patreon supporters this year and to everyone who
subscribed and watched the show! I’ll be back after the new year with all the security and
privacy news. I'm Shannon Morse, Happy holidays, I'll see you on the Internet!