CyberSecure Specialist

18 Apr

Giving a Face to the Malware Proxy Service ‘Faceless’

Information, Insights

For the past seven years, a malware-based proxy service known as “Faceless” has sold anonymity to countless cybercriminals. For less than a dollar per day, Faceless customers can route their malicious traffic through tens of thousands of compromised systems advertised on the service. In this post we’ll examine clues left behind over the past decade by the proprietor of Faceless, including some that may help put a face to the name. The proxy lookup page…

Read More
14 Apr

Why is ‘Juice Jacking’ Suddenly Back in the News?

Information, Insights

KrebsOnSecurity received a nice bump in traffic this week thanks to tweets from the Federal Bureau of Investigation (FBI) and the Federal Communications Commission (FCC) about “juice jacking,” a term first coined here in 2011 to describe a potential threat of data theft when one plugs their mobile device into a public charging kiosk. It remains unclear what may have prompted the alerts, but the good news is that there are some fairly basic things…

Read More
12 Apr

Nokoyawa Ransomware Attacks Leveraging Windows Zero Day

Attacks, Malware

A report recently released by Kaspersky Labs has detailed a threat actor making use of a CLFS (Common Log File System) exploit to escalate privileges. The group Kaspersky attributed to this attack is well known for its many distinct but similar CLFS driver exploits that likely come from the same exploit developer. Kaspersky’s working theory is that the privilege escalation was used to dump the contents of the HKEY_LOCAL_MACHINESAM registry hive to continue their attack.…

Read More
12 Apr

Two Critical-Severity Vulnerabilities Patched in Latest Security Updates from SAP

Attacks, Malware

The enterprise software vendor SAP has released several security updates for its products, two of which concern critical-severity vulnerabilities that impact the SAP Diagnostics Agent and the SAP BusinessObjects Business Intelligence Platform. SAP is the largest Enterprise Resource Planning (ERP) vendor in the world with over 425,000 customers in 180 countries. Over 90% of the Fortune 2000 companies utilize SAP. In the past, vulnerabilities in SAP software have been seen being exploited in the wild.…

Read More
12 Apr

Deluge of Fake Packages Cause DoS Attack on npm

Attacks, Malware

Last week Checkmarx Security detailed the attack that led to a temporary Denial of Service (DoS) on the Node.js package repository npm in March. Threat actors uploaded hundreds of thousands of fake packages in a type of SEO-poisoning attack that relies on the reputation of package managers to place the bogus packages at the top of search results. The packages are empty, only containing a README with further instructions for infection. The sheer number of…

Read More
12 Apr

Evading Google Play Store Defenses: Criminals Trading Malicious Android Loaders

Attacks, Malware

According to a recent report from Kaspersky, criminals are trading malicious loader programs that can trojanize Android applications to evade Google Play Store defenses. These loader programs are particularly popular for hiding malware and unwanted software in certain application categories, including cryptocurrency trackers, financial apps, QR-code scanners, and dating apps. Dropper apps are the primary means for threat actors to sneak malware via the Google Play Store. These apps often appear to be innocent, but…

Read More
12 Apr

KFC owner suffers data breach following ransomware attack

Attacks, Data Breaches

Note: This article was updated on April 12, 2023, to reflect the fact that employee data, not customer data, was accessed during the cyber attack against Yum! Brands US fast-food corporation Yum! Brands, which owns franchises including KFC, Pizza Hut and Taco Bell, has suffered a data breach following a ransomware attack. The cyber attack, which took place on January 18, 2023, involved a malicious actor gaining unauthorized access to Yum! Brands’ network. The ransomware…

Read More
11 Apr

Microsoft (& Apple) Patch Tuesday, April 2023 Edition

Information, Insights

Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day vulnerabilities that are being used to attack iPhones, iPads and Macs. On April 7, Apple issued emergency security updates to fix two weaknesses that are being actively exploited, including CVE-2023-28206,…

Read More
11 Apr

Yum Brands Reports Breach After Ransomware Attack

Attacks, Malware, Uncategorized

Yum Brands, the parent company of popular fast-food chains KFC, Pizza Hut, and Taco Bell, has disclosed a data breach after a ransomware attack on its systems. The company, which operates more than 50,000 restaurants in over 150 countries, said the breach occurred in late May 2021 and was discovered during an investigation into the ransomware attack. The attackers were able to access certain information, including the payment card information of some customers who made…

Read More
11 Apr

Apple Releases Emergency Updates For Older iOS Devices After Recent Discovery Of Zero-Day Vulnerabilities

Attacks, Malware, Uncategorized

In order to address two actively exploited zero-day vulnerabilities discovered by Google’s Threat Analysis Group and Amnesty International’s Security Lab that also affect earlier iPhones, iPads, and Macs, Apple has published emergency updates to backport security patches that were announced on Friday. Apple stated in security advisories posted on Monday that it was “aware of a report that this problem may have been actively exploited.” The first is an out-of-bounds write vulnerability in IOSurfaceAccelerator that…

Read More