The LastPass Hack Lasted Four Days, Uber Data Breach Shows Problems with 2FA, Putty is being
used to backdoor victims, and a HUGE giveaway you won’t wanna miss!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for September 20 2022 - this is your summary
of the threats to our security, privacy and Internet freedom.
Want early access to the show every week?
Check out my Patreon page to get all sorts of bonus perks.
Let’s jump right into the news this week but stick around for a HUGE giveaway worth
over $1000.
Ok lets get started.
Back in August, LastPass was hacked, and now the company has disclosed that the attacker
had access to internal systems for four days before finally being kicked out.
LastPass and cybersecurity firm Mandiant investigated the breach and said customer data and encrypted
vaults weren’t accessed, and the attacker didn’t drop malicious payloads, but the
attacker did gain access to the development environment.
In an updated blog post from the 15th, LastPass noted that they discovered the attacker was
able to gain access by impersonating a developer and successfully authenticating via multi
factor authentication.
This gave the attacker persistent access for four days.
One question that remains unsolved is how the attacker gained initial endpoint compromise,
and their blog states this is still inconclusive.
Even though this environment was accessed, it is physically separate and has no direct
connection to the LastPass production environment.
LastPass explained that the only people who can push a release build to the production
environment is the Build Release team, and even then any production code goes through
a process of code review, testing, and validation.
LastPass took two weeks to disclose this breach to customers, with their August 25th notification,
and stated that after this four day period, there is no evidence of any threat actor activity
beyond this timeline in their servers.
Uber vaguely posted about investigating a cybersecurity incident on Twitter on Thursday
last week, at which time the company took their internal systems for communications
and engineering offline.
According to reports, the attack happened due to a compromised employee Slack account.
This employee was social engineered by the attacker who posed as a corporate IT person,
getting them access to the employee’s password.
From there, the attacker started posting messages throughout the company’s Slack, saying Uber
experienced a data breach, and spreading a lewd photo on an internal information page.
2FA was enabled on this employee’s account, but the attacker bypassed it by mass spamming
the employee with push alerts and sending them prompts on WhatsApp at the posted Uber
IT department.
From there, the attacker found credentials just chillin’ on a network file share, stole
those and used them to access the corp EDR console (for endpoint detection and response),
production systems, the slack management, and more.
Of note, the attacker claimed to also have access to the company’s HackerOne account
and vulnerability disclosures and reports which are usually kept confidential until
a patch is in place.
Uber posted a bulletin on their website about the breach, and at the time stated this didn’t
involve any access to sensitive user data like trip history, all apps are operational,
and law enforcement was notified.
Security experts believe this attack is bigger than the one that happened in 2016, which
at the time Uber tried to cover up by paying the hackers $100,000 and not disclosing, but
it eventually became public knowledge.
This one is worse because the attacker had access to internal systems, as well as their
AWS and Google Cloud systems.
Interestingly, the attacker claimed they are an 18 year old who was straight forward about
most questions pertaining to the attack, and they went so far as to send screenshots to
the New York Times and disclose the company was hacked on the Uber Slack.
This attack shows a flaw in push notifications for multi factor authentication - MFA fatigue.
In this case, the attack sent so many notifications that eventually the employee got tired of
seeing them and finally accepted and approved the new device.
A better option, posed by many cybersecurity experts, is physical tokens for 2FA or sending
codes to an app that doesn’t continually pop up notifications on a phone.
But for what it’s worth, if you’re experiencing continuous MFA notifications to approve or
deny a new device, you may be a target of an attack.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patrons including Voodoo, Kris, and Eddie for joining the alliance on
Patreon.com/threatwire.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
Let’s talk about this giveaway.
Today on ThreatWire I’m giving away this Wifi Pineapple Enterprise Edition, this is
the exact one that Darren and I unboxed on the video that was posted to the Hak5 channel
yesterday, valued at over $1000.
The winner will get hands on with one of the very first Enterprise wifi pineapple’s that’ll
be shipping.
Watch the announcement video to learn all about this beast of a wifi pineapple, and
enter by doing the following.
First: subscribe to Hak5’s youtube channel.
Then, comment below about why you’d love to win one of these.
I’ll be picking the winning comment in one week and will announce it in the next ThreatWire
episode!
This is open to anyone with a US shipping address, for international folks as long as
you have a US address I can ship it to, you can enter.
This giveaway is sponsored by Hak5 and you have until Monday, September 26 to enter.
Good luck!
Let’s finish out today’s episode with my last top story, about putty!
PuTTY, an open source SSH tool, is being weaponized by threat actors.
In a technical paper published by Mandiant, the North Korean hacker group called UNC4034
is using a trojaned version of the PuTTY SSH client to infect victims with backdoors called
AirDry.V2.
Specifically, the group is using PuTTY and KiTTY SSH utilities (kitty being a fork of
putty) to drop payloads, luring in victims with a phishing email offering a great job
at Amazon, in which they move the talks over to WhatApp, then share an ISO file called
Amazon Assessment . iso.
The ISO file has a README.text file with a server IP address, a username and password,
and a download for the malicious putty.exe.
The Putty executable looks super legit, but the connect to host functionality deploys
malicious shellcode when a successful SSH connection is made.
The shellcode drops the AirDry.v2 payload to backdoor the victim machine.
Once infected, AirDry attempts to make a connection to 3 hard coded addresses and can allow the
attacker to obtain system info, configuration info, stay alive, download and execute a plugin
from memory and more.
The threat group, UNC4034, is suspected due to their use of specific URLs seen before
by North Korean actors.
Mandiant believes this is a part of Operation Dream Job which is a campaign that legerages
attacks using ISO files and trojanized binaries.
Most recently, this op was also quoted as the campaign used for attacks targeting cryptocurrency
developers.
Mandiant provided technical indicators and detection options in their post.
I'm Shannon Morse, I'll see you on the Internet!