A certificate authority was targeted in an attack, the US and UK ban Chinese telecoms,
and millions were affected in a Twitter data breach!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for November 29 2022 - this is your summary
of the threats to our security, privacy and Internet freedom.
This December, I’ll be doing my annual biggest hacks of the year episode - which hacks stood
out to you from this last year?
Let me know in the comments.
Let’s jump right into the news this week.
A digital certificate authority was targeted in an attack suspected to stem from a Chinese
state sponsored actor.
It affected government and defense agencies as well as the digital certificate authority
and appears to be an ongoing attack since its start in March of this year.
The hacking group is nicknamed Billbug, AKA Lotus Blossom, Lotus Panda, and Spring Dragon
just to name a few.
They’re an APT or advanced persistent threat group out of China that targets South East
Asian agencies and orgs.
Symantec was able to link these ongoing attacks to this group thanks to tools this group previously
used and similarities with the current campaign.
These tools were used in attacks back in 2019, when the APT group was installing persistent
backdoors called Hannotog and Sagerunex on networks in Hong Kong, Macau, Indonesia, Malaysia,
the Philippines, and Vietnam.
In some cases, Billbug used an info stealer called Catchamas in these attacks.
Targeting a digital certificate authority is noteworthy - as these are used to sign
software as legitimate.
The group could potentially used this to compromise certificates and intercept HTTPS traffic,
or they could sign their own malware with valid certificates, so it could avoid detection
from anti-malware and A/V tools.
Symantec stated there is no evidence the certificate authority was successfully hacked, and the
org was notified of the attacks.
Symantec found indicators that the attack chain starts with public facing internet applications
including WinRAR, Ping, Tracert, NBTscan, Port Scanner and more.
They believe files are used as loaders for the backdoor, which then creates persistence,
listens on port 5900, uploads data and can download files to the infected machine, like
one called Stowaway Proxy Tool, which is usually used by pentesters to proxy external traffic
to an intranet.
Technical details and indicators of compromise are included in Symantec's full blog post.
Chinese telecom and electronics companies including Huawei, ZTE, Hytera, Hikvision,
and Dahua were formally deemed an ‘unacceptable’ risk to national security by the US Federal
Communications Commission or FCC last week, after previously being listed in the Secure
Networks Act Covered List of risky equipment or services.
The FCC order banning these devices and brands was released on Friday of last week.
With this ban in place, Hytera, Hikvision, and Dahua will be required to document what
kind of safeguards are put in place for sales of devices for government use and surveillance
of critical infrastructure facilities.
This Report and Order applies to future authorizations of equipment, specifying such equipment can’t
be authorized under a Supplier’s Declaration of Conformity process or imported and marketed
under rules that could allow for exemption.
This rule implements a directive called the Secure Equipment Act of 2021 which was signed
into law by President Biden last November.
Two months ago, the FCC also added the Pacific Network Corp and China Unicom to the Covered
List.
This isn’t the only country banning Chinese-made equipment.
The UK also announced similar, now banning any installs of surveillance systems at sensitive
sites, citing China’s National Intelligence Law which requires that organizations and
citizens cooperate with China’s intelligence and security agencies.
In the UK ban statement, agencies and departments are also advised to consider removing and
replacing any equipment which falls under this scope rather than awaiting scheduled
upgrades.
I report on cybersecurity news every single week so if you want to hear more, check out
patreon.com/threatwire.
Thanks for listening, I’m Shannon Morse, I’ll see ya next time!
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
We have so many shoutouts this week!!
HUGE THANK YOU to Marshal, Jeremy, Orlando, Charlie and Orbis Alius LLS for being a part
of the Alliance at Patreon.com/threatwire.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials.
Last week I posted a comparison of the Pixel 7 Pro vs 6 Pro..
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about a Twitter data leak!
In July of 2021, a bunch of Twitter data ended up on dark web forums, with a threat actor
selling access for $30,000.
It was unknown if the data was sold or used, but it included twitter IDs, names, locations,
verified status, friend counts and PII like phone numbers and email addresses.
This was caused by an API vulnerability that was disclosed in the HackerOne bug bounty
program for Twitter, in which people could type in a phone number or email address to
find the associated Twitter ID.
Attackers found they could use the Twitter ID retrieval system to scrape both public
and private information from Twitter.
It was later revealed that the API bug was being used by multiple parties to scrape information.
Twitter was informed and fixed the API bug in January of 2022.
During the time the API bug was unpatched, Breached hacking forum owned Pompompurin exploited
it and scraped 5.4 million records of users' data.
They decided to dump all of it for free on the forum this month.
Additionally, 1.4 million records belonging to suspended users were collected and distributed,
so the total is actually about 7 million with private information.
Pompompurin wasn’t the only person who used this API bug.
Chad Loder, an activist and security researcher, also found a data breach including millions
of phone numbers and posted their findings on twitter, shortly after which they got suspended
from Twitter.
Loder disclosed this happened no earlier than 2021, and multiple sources obtained file samples
and confirmed the phone numbers and data was indeed accurate and real.
This data also is not duplicated from the previously leaks shared on forums.
The actual size of this dump is not confirmed, though numbers have been in new articles upwards
of 17 million.
The data consists of organized phone numbers for users in Europe, Israel, and the US.
If you never allowed your account to be discoverable using the API that can allow for searches
via email addresses or phone numbers, then your data was not affected.
Any user who allowed and enabled Discoverability via Phone Number in late 2021 was included
in the dataset according to reports.
This setting is on by default.
I'm Shannon Morse, I'll see you on the Internet!