Threat Source newsletter (Feb. 23, 2023) — Social media sites are making extra security a paid

Thursday, February 23, 2023 14:02

Welcome to this week’s edition of the Threat Source newsletter.

Social media’s latest business plan seems to be charging for security.

Twitter recently announced a plan to make SMS-based two-factor authentication a paid service as part of Twitter Blue — asking users to pay either $8 or $11 monthly for the feature set. Meta, Facebook’s parent company, also announced a new pay-for-verification service on Facebook and Instagram that will allow users to pay up to $14 a month for “a verified badge that authenticates your account with government ID, proactive account protection, access to account support, and increased visibility and reach.”

The Twitter plan falls into a gray area for me. I’ve talked to experts who pointed out that app-based multi-factor authentication — which is still free on Twitter — is safer than SMS MFA. So in theory, forcing people to pay for it would make them less likely to use it and switch to the free option.

However, among all Twitter users who utilize MFA, more than 74 percent of them opt into SMS-based authentication. Based on the estimated number of Twitter users (more than 353 million) and the total amount of users who use any type of MFA (2.6 percent), that means about 6,845,841 accounts will be forced to pay to continue their use of SMS-based authentication or switch to an app-based method.

Many of these users may switch to Twitter Blue or find a new way to keep MFA on their accounts. Many of them will just drop the feature altogether. I would argue any good social media company needs to keep its users’ safety a priority no matter what.

Things like making sure you can’t be impersonated on a site seem like it would be a basic expectation when you give up the amount of personal information you already must to sign up. And many consumers (especially someone who’d be considered the “Average Joe”) do not want to spend time downloading a new MFA app and completing the setup process.

Even the security savvy are growing tired of having to download multiple MFA apps for various uses, leaving password managers as the clearest path to a safe login (but those aren’t foolproof, either).

Meta and Twitter users who don’t want to pay for the additional protections have a few other options to improve their account’s security:

• Purchase a physical security key that generates a unique code each time you go to log into your account.
• Enroll in app-based multi-factor authentication (like Cisco Duo), which is still free to use on Twitter.
• If you’re setting up an MFA app for the first time, follow the U.S. Cybersecurity and Infrastructure Security Agency’s guidelines for implementing phishing-resistant MFA.
• If you opt to not enroll in any sort of MFA, use a password management program to generate a new, random password with a mix of characters and cases and store it securely using the program. But app-based MFA is always the safest option.

The one big thing

An unknown actor is deploying the new MortalKombat ransomware a GO variant of the Laplas Clipper malware, to steal cryptocurrency from victims. Talos researchers have seen several campaigns targeting individuals, small businesses and large organizations that aim to steal or demand ransom payments in cryptocurrency.

Why do I care?

MortalKombat (yes, a reference to that “Mortal Kombat”) is a new ransomware that just appeared in January, so we still know relatively little about this malware family, though new protections are now available from Talos. While cryptocurrency’s value is down across the board, that doesn’t mean attackers have stopped caring about it, and it’s still the safest way for attackers to make money without being tracked.

So now what?

Talos released several new Snort rules and ClamAV signatures to protect against the threats we outlined in last week’s blog post. Cisco Secure Endpoint users can also use Orbital Advanced Search to run complex OSqueries to see if their endpoints are infected with this specific threat.

Top security headlines of the week

The Clop ransomware gang claims its recently breached more than 130 organizations, many of them related to health care, with a large chunk affecting CHS Healthcare patients. CHS reported the breach to the U.S. Securities and Exchange Commission, saying that the attack targeted GoAnywhere MFT, a managed file transfer product. The filing stated the breach affected up to 1 million individuals. Members of Clop said it exploited the security flaw, CVE-2023-0669, which enables them to gain remote code execution on unpatched GoAnywhere MFT instances with their administrative console exposed to the internet. The breaches took place over the course of 10 days earlier this year. (Bleeping Computer, Ars Technica)

The FBI said it recently “contained” a security incident on its computer network, offering sparse details otherwise. “The FBI is aware of the incident and is working to gain additional information,” the bureau said in a statement to news network CNN. “This is an isolated incident that has been contained. As this is an ongoing investigation the FBI does not have further comment to provide at this time.” The report also indicates that the attack specifically targeted the portion of the FBI’s network it uses in investigations of images of child sexual exploitation. (CNN, InfoSecurity)

Data brokers are increasingly relying on information from virtual therapy apps to profit from users’ information. A new study from Duke University found that one firm even charged $100,000 a year for a “subscription” service to data that included information on individuals’ mental health conditions. This data included highly sensitive information, such as a person’s demographics, and what ailments they’ve reported, including depression, OCD, bipolar disorder and strokes. Virtual therapy apps have become increasingly popular among the American population, especially during the COVID-19 pandemic. They offer a cheaper and more accessible option to patients who often find it difficult to find therapy providers that accept insurance. (PBS, Washington Post, Duke University)

Can’t get enough Talos?

• Crypto investors under attack by new malware, reveals Cisco Talos
• Microsoft Patch Tuesday for February 2023 — Snort rules and prominent vulnerabilities
• Beers with Talos Ep. #130: Ransomware is a people problem (but getting rid of email helps)

Upcoming events where you can find Talos

WiCyS (March 16 - 18)

Denver, CO

RSA (April 24 - 27)

San Francisco, CA

Most prevalent malware files from Talos telemetry over the past week

SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934
MD5: 93fefc3e88ffb78abb36365fa5cf857c
Typical Filename: Wextract
Claimed Product: Internet Explorer
Detection Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg

SHA 256: e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c
MD5: a087b2e6ec57b08c0d0750c60f96a74c
Typical Filename: AAct.exe
Claimed Product: N/A
Detection Name: PUA.Win.Tool.Kmsauto::1201

SHA 256: 00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725
MD5: d47fa115154927113b05bd3c8a308201
Typical Filename: mssqlsrv.exe
Claimed Product: N/A
Detection Name: Trojan.GenericKD.65065311

SHA 256: de3908adc431d1e66656199063acbb83f2b2bfc4d21f02076fe381bb97afc423
MD5: 954a5fc664c23a7a97e09850accdfe8e
Typical Filename: teams15.exe
Claimed Product: teams15
Detection Name: Gen:Variant.MSILHeracles.59885

SHA 256: 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa
MD5: df11b3105df8d7c70e7b501e210e3cc3
Typical Filename: DOC001.exe
Claimed Product: N/A
Detection Name: Win.Worm.Coinminer::1201