EA Source Code was Stolen, a 7 Year Old Linux Flaw was Discovered, and 1.2 Terabytes of
Data was Mysteriously Stolen from millions of Windows pcs!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for June 15, 2021!
This is your weekly summary of the threats to our security, privacy and Internet freedom.
Onto the news!!
In a data breach that apparently happened through stealing cookies and social engineering
an employee via a Slack channel, the gaming publisher Electronic Arts had about 780 GB
of data stolen.
This included source code and internal tools used by the company.
Actors claiming to be behind this attack reported they had stolen the FrostBite game engine
source code and debug tools (Frostbite is used to power FIFA, Madden, and Battlefield
for example), FIFA 21 matchmaking server code and source code, API keys and SDK related
to Xbox and Sony, as well as proprietary framework data.
A representative for the attackers provided screenshots showing some of the stolen data
to news outlets as proof of the breach.
EA later confirmed this information, but stated that it was not a ransomware attack, and they
didn’t expect impact to their games or business.
They also noted the hack didn’t affect player data or privacy.
An investigation is ongoing.
There is some speculation about the data and EA’s response.
If a threat actor has access to this kind of data, they could use it to find bugs or
vulnerabilities, pirate the games or software, create cheats, and monetize the data in various
ways.
It’s intellectual property, so it could have consequences down the road for EA.
The attackers are now trying to sell off the data to customers for $28 million through
hacking marketplaces and forums.
The original sales posts have been edited by the seller, with links to new sales on
alternative forums.
According to Vice, a representative for the attackers came forward speaking about how
the hack happened.
They were able to purchase stolen cookies for $10 and gained access to a Slack channel
for EA employees.
They then messaged the IT staff to say they’d lost their phone and needed a multi factor
code, allowing them access to the corporate network.
They discovered a developer section of the network where games are compiled, created
a VM, and started accessing and downloading source code.
EA did not attend E3 2021.
Probably a good thing.
A privilege escalation vulnerability was recently discovered in Linux distros that was introduced
7 years ago, back in 2013, and was never fixed.
This exists within PolicyKit AKA Polkit, which is a toolkit that handles authorizations in
Linux distros so unprivileged processes can still ‘talk’ to privileged processes.
The flaw could allow a threat actor to gain escalated privileges to a root user from unprivileged
access.
A fix is now available as of June 3, so upgrade your Linux installation ASAP if possible for
polkit version 0.119.
The vulnerability is tracked as CVE-2021-3560 with a score of 7.8, and it affects any systems
that have polkit version 0.113 or later installed on them, including Ubuntu 20.04 and RedHat
Enterprise Linux 8.
Security researcher Kevin Backhouse, who originally discovered this issue, posted a technical
analysis of this vulnerability and explained that it’s fairly easy to exploit, so it’s
crucial to update.
An attacker could open a terminal and use commands such as bash, kill, and triggering
the flaw with dbus-send, and terminating while polkit is in the middle of processing a request.
That causes an authentication bypass, treating this as if it has root privileges.
According to his post, this flaw was first introduced to polkit back in 2013 in a code
commit on November 9.
It affects versions 0.113 and 0.118, along with Debian based distros including polkit
0.105.
According to a RedHat advisory, this happens due to the process not being able to verify
privileges of a requesting process.
To quote, “When a requesting process disconnects from dbus-daemon just before the call to polkit_system_bus_name_get_creds_sync
starts, the process cannot get a unique uid and pid of the process and it cannot verify
the privileges of the requesting process.
The highest threat from this vulnerability is to data confidentiality and integrity as
well as system availability.”
Since an attacker has to trigger the flaw at the correct time, this can vary from machine
to machine.
And that may be a reason why it was never discovered previously.
A demo video was created via the Github youtube channel, and shows it takes less than three
minutes to accomplish along with very few terminal commands.
I’ve provided the link to the demo in the notes for this segment.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for
the support.
And a quick shoutout to Ryan for joining the ThreatWire alliance and as always, for supporting
the show!!
- Patreon exclusive merch was unlocked last month as a new perk for the ThreatWire alliance,
so now’s a great time to join the team as you’ll get the first round of art designs
for this year.
Check the Patreon page for more details and don’t forget - Patrons get exclusive access
to an audio only podcast version of this show.
Onto the third news story.
According to NordLocker, recently discovered malware made its way through PCs and stole
1.2 terabytes of data, including 26 million login credentials, 1.1 million unique email
addresses, 2 billion plus browser cookies, and 6.6 million files.
That includes, in some cases, passwords stored in clear text and saved in notepad files.
1 million images were stolen, along with 650,000 word and pdf files.
Data also included personal information from messaging, gaming, email, and file sharing
apps.
This malware took screenshots via victim webcams and screenshots of the infected computers.
All of this happened from 2018 to 2020 to 3.25 million PCs, all of which were running
Windows.
22% of the cookies found in this database were still valid when it was discovered.
The data could be sorted by unique device ID.
This included hundreds of thousands of credentials from social media accounts like Facebook and
Twitter, gaming platforms like Steam and EA logins, online retailer sites, job search
websites, even login credentials for cryptocurrency wallets and Paypal.
Cookies included sites like Amazon, Steam, Facebook, Youtube and lots more.
Autofill data was stolen for apps like Chrome and Firefox.
NordLocker worked with a third party data breach research company to analyze the data
found and determined that victims would likely not even know they were ever compromised.
The database of stolen files was revealed by the attackers accidentally, and the hosting
cloud provider was notified so it could be removed.
NordLocker explained that the screenshots from the database show it was spread through
illegal software like a pirated Photoshop 2018, Windows cracking tools, and pirated
games.
Since it’s newly discovered, the malware doesn’t have a name nor would it necessarily
be flagged by anti-virus software.
They do recommend using good internet hygiene like password managers, encrypting data, deleting
cookies, using legit software, and keeping AV up to date.
Not much is known at this time about who is behind this attack, but it could be as simple
as a malicious actor buying custom malware for $100 to infect PCs with a Trojan type
malware tool.
Other than the usual cyber hygiene, what can you do?
Troy Hunt of HaveIBeenPwned has added all compromised email addresses to the database,
so you can be verified if your email address is a part of this.
It’s a sensitive database, so you have to verify via your email inbox that you have
access to that email address before you’ll be notified of it being leaked.
This week on Morse Code I ran 10 gig ethernet in my new youtube studio!
Subscribe to my channel - youtube.com/shannonmorse - for more of that kind of content.
And with that, don't forget to like and subscribe to this channel as well!
I'm Shannon Morse, I'll see you on the Internet!