Skip to content

Monthly Archives: July 2018

Open Amazon S3 buckets open online now: US election autodialers

Who are these idiots hiring for security? AWS plainly warns when a bucket is open.

Quote

Security biz Kromtech has unearthed two more embarrassing – and potentially dangerous – cases of groups leaving mass data caches unguarded on the public internet.

In the first case, the culprit was an improperly configured AWS S3 bucket owned and operated by Robocent, a political robocalling company based in Virginia Beach, VA.

According to Kromtech head of comms Bob Diachenko, the storage bucket contained 2,594 files, including the audio files to be used in robocalls to voters and spreadsheets containing hundreds of thousands of US voters’ contact details.

These records included voters’ names, addresses, year of birth, phone number, political affiliation, and demographic info such as ethnicity and education level, all pieces of data that would be valuable to use in a spear phishing or social engineering scam.

Unfortunately, Diachenko said, it gets worse. It appears other sites have already collected and indexed the exposed data.

“What’s more disturbing is that company’s self-titled bucket has been indexed by GrayhatWarfare, a searchable database where a current list of 48,623 open S3 buckets can be found,” Diachenko explained.

The second case exposed by Kromtech could land a few people behind bars, if convicted, of course.

Researchers uncovered an exposed mongoDB instance that contained both credit card numbers and payment details. A bit more digging lead the researchers to a dump of Facebook and stolen email account data and info from freemium games that offer in-app purchases through virtual currency.

Eventually, the researchers were able to piece together what was going on. The stolen credit cards were being combined with the lifted data to set up Apple IDs on hundreds of jailbroken iPhones that could then be automated to create user accounts on installations of the free-to-play games. The fake game accounts then purchased in-app currency for the games and were re-sold to other players for cryptocoins or real-world currency.

In other words, the scammers were using fake game accounts on jailbroken phones to launder money from the stolen payment cards via the freemium games, and the criminals operating the scam had left the entire operation wide open to the public by not securing the database.

Kromtech said it had reported all of its findings to the US Department of Justice so that a criminal investigation could be opened

Microsoft: The Kremlin’s hackers are already sniffing, probing around America’s 2018 elections

Why wouldn’t it be them?

QUOTE

Microsoft says it has already uncovered evidence of Russian government-backed hacking gangs attempting to interfere in the 2018 US mid-term elections.

“Earlier this year we did discover that a fake Microsoft domain had been established as the landing page for phishing attacks, and we saw metadata that suggested those phishing attacks were being directed at three candidates that were all standing for election this year,” Burt said.

“These are all people who, because of their positions, might be interesting targets from an espionage standpoint as well as an election disruption standpoint.”

Burt declined to name the candidates being targeted, citing Microsoft’s policy of preserving the anonymity of its clients. In the past, Fancy Bear largely focused its efforts on targeting computers belonging to the Democrats and Hillary Clinton’s campaign, and leaking the Dems’ internal emails in the hope of swinging the balance of Congress for the GOP, and the White House race for Donald Trump.
Redmond is a tool for Russia

Microsoft’s services play a prominent role in Fancy Bear’s meddling, Burt said. To help make its phishing pages more believable, the GRU-backed hacking crew often registers domains whose names resemble Microsoft services and then uses those to create fake login or download pages impersonating Redmond’s own. These pages can trick victims into installing malware, or handing over the usernames and passwords for their email inboxes and other sensitive accounts. Additionally, the domains are used for the command and control servers for data-harvesting spyware.

Because of that, Burt explained, Microsoft has made a habit of tracking the group, and using its legal team to have those domains seized and either shut down or handed over to Microsoft’s security team, who then use them to gather information about the inner-workings of the operation.

Burt said that, after two years of tracking the gang, Microsoft has become efficient enough that a new domain can be challenged and seized in as little as 24 to 48 hours. “The goal here is to say stop using Microsoft domain names,” Burt said. “If you keep using them, we are going to make it more costly for you.”

This is also why securing your Microsoft Office 365 accounts with multi-factor authentication is crucial, to help thwart password phishing attempts.

Burt’s comments also come as the US Department of Justice issued a report warning that attacks on the mid-term elections are all but assured. The report notes that the government has created a task force, including multiple agencies and states attorney generals, that will focus on detecting and prosecuting attempts to affect the outcome of the mid-term vote.

IoT Vacuum Spying

Quote

Vulnerabilities in a range of robot vacuum cleaners allow miscreants to access the gadgets’ camera, and remote-control the gizmos.

Security researchers at Positive Technologies (PT) this week disclosed that Dongguan Diqee 360 smart vacuum cleaners contain security flaws that hackers can exploit to snoop on people through the night-vision camera and mic, and take control of the Roomba rip-off.

Think of it as a handy little spy-on-wheels.