Categories
internet IoT security

Whistleblower: Ubiquiti Breach “Catastrophic” — Krebs on Security

This is serious. If you have Ubiquiti equipment do change your credentials immediately and check for signs of compromise.

Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies.

Source: Whistleblower: Ubiquiti Breach “Catastrophic” — Krebs on Security

Categories
IoT security

‘This is dangerous stuff’: Hacker increased chemical level at Oldsmar’s water system, sheriff says

This is why you should secure your endpoints, especially if you are operating a critical infrastructure. This seems to be one of those supervisory interface that is exposed over the internet. Thank goodness no real harm was done.

And this time, Gualtieri says, the hacker did more than just remote in. According to the sheriff, the hacker spent up to five minutes in the system and adjusted the amount of sodium hydroxide in the water from 100 parts per million to 11,100.

“This is obviously a significant and potentially dangerous increase. Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaners,” Gualtieri added.

Source: ‘This is dangerous stuff’: Hacker increased chemical level at Oldsmar’s water system, sheriff says

Categories
security

Google discloses spearphishing targeting security researchers | SC Media

We are all familiar with spearphishing attacks against high value targets. But this is bold. A group of hackers are apparently targetting cyber security researchers, whose main job is to study them (the hackers) and their works. It’s like the thief stealing from the police. And the thief succeeded – in some cases.

Depending on how widespread the compromises were, it could potentially taint some research and defensive strategies that threat intelligence firms share with businesses and other organizations.

Source: Google discloses spearphishing targeting security researchers | SC Media

Categories
security

FireEye Shares Details of Recent Cyber Attack, Actions to Protect Community

One of the world’s leading cyber security companies was breached, likely through a state-sponsored attack. One of the side effects of this attack is that FireEye’s own red-team tools will now be effectively “useless” for pentesting.

FireEye was recently attacked by a nation-state adversary and here are the actions we are taking to protect the community.

Consistent with a nation-state cyber-espionage effort, the attacker primarily sought information related to certain government customers. While the attacker was able to access some of our internal systems, at this point in our investigation, we have seen no evidence that the attacker exfiltrated data from our primary systems that store customer information from our incident response or consulting engagements, or the metadata collected by our products in our dynamic threat intelligence systems. If we discover that customer information was taken, we will contact them directly.

Source: FireEye Shares Details of Recent Cyber Attack, Actions to Protect Community

Update (2020-12-10): FireEye shares (NASDAQ: FEYE) is down more than 13% after news broke.

Categories
privacy security

Samy Kamkar – NAT Slipstreaming

Another impressive hack from Samy. In this article, he introduces a novel technique to gain remote connection to any TCP/UDP service on your machine simply by having you visit a malicious website (with some conditions). To be clear, this isn’t remote code execution or remote shell – the exploit is at the networking level – but it could serve as a first step towards that. For example, the hacker could connect to the victim’s RDP port and start password brute-forcing.

exploit NAT/firewalls to access TCP/UDP services bound on a victim machine

Source: Samy Kamkar – NAT Slipstreaming

Categories
privacy security

Private data gone public: Razer leaks 100,000+ gamers’ personal info | Ars Technica

Yet another data leak incident due to service misconfiguration. The usual suspects include Elasticsearch, MongoDB, AWS S3.

No need to breach any systems when the vendor gives the data away for free.

Source: Private data gone public: Razer leaks 100,000+ gamers’ personal info | Ars Technica

Categories
cloud security

New ‘Meow’ attack has deleted almost 4,000 unsecured databases

A worm has been going around destroying unsecured databases. The intention of the attacker is not clear, but it could be similar to that of BrickerBot.

Dozens of unsecured databases exposed on the public web are the target of an automated ‘meow’ attack that wipes data without any explanation.

Source: New ‘Meow’ attack has deleted almost 4,000 unsecured databases

Categories
security

Garmin global outage caused by ransomware attack, sources say | TechCrunch

Presumably a company like Garmin would have BCP in place, and yet the outage is still ongoing. A post-mortem will be interesting to see.

The WastedLocker ransomware, used by a notorious Russian hacking group, is said to be to blame.

Source: Garmin global outage caused by ransomware attack, sources say | TechCrunch

Categories
phishing security

Who’s Behind Wednesday’s Epic Twitter Hack? — Krebs on Security

Twitter is being used for a cryptocurrency scam by using several high profile hijacked user accounts. It’s not hard to imagine far more nefarious things that could have happen – from stock market manipulation to political warfare.

Twitter was thrown into chaos on Wednesday after accounts for some of the world’s most recognizable public figures, executives and celebrities starting tweeting out links to bitcoin scams. Twitter says the attack happened because someone tricked or coerced an employee into providing access to internal Twitter administrative tools. This post is an attempt to lay…

Source: Who’s Behind Wednesday’s Epic Twitter Hack? — Krebs on Security

Categories
privacy security

Ebay is port scanning visitors to their website – and they aren’t the only ones – nem.ec

Ebay – and others – have been caught deploying port scanning on your machine when you visit their website. We’re not talking about scanning your gateway. We’re talking about scanning the very machine that you’re using to visit their website. How is this possible? Well, modern browsers support a technology known as WebRTC that makes it possible to do video conferencing – among others – without installing software. This technology is what enables port scanning to be done by the website. To protect yourself, you should install browser add-ons to disable WebRTC when not in use.

Websites are scanning for open ports on your PC to help fight fraud, but this data also flows into a massive, global tracking database.

Source: Ebay is port scanning visitors to their website – and they aren’t the only ones – nem.ec