MenuDrive, Harbortouch, and InTouchPOS fell victim to a long Magecart infection that started in January and only ended days ago.
The post Malware spent months hoovering up credit card details from 300 US restaurants appeared first on Malwarebytes Labs.

Criminal hackers have been able to steal at least 50,000 credit cards from 300 restaurants in the US, after launching two Magecart campaigns that target the MenuDrive, Harbortouch, and InTouchPOS online payment platforms:

Magecart is a web-skimmer—malware that is injected onto a vulnerable website so it can steal credit card information as it’s entered into the site’s checkout. Because it does not interupt card payments, it just quietly siphons off users’ card details, it can be very difficult for both its victims and their users to spot.

Recorded Future’s Insikt Group recently identified two Magecart campaigns targeting the aforementioned online payment platforms. Stolen details were offered for sale in various underground marketplaces on the dark web.

“Online ordering platforms are a very attractive target since they deal with many vendors downstream, which also means a high number of customers are going to be entering payment data that could be skimmed,” said Jerome Segura, Senior Director of Malwarebytes’ Threat Intelligence Team, and an expert in web skimmers.

Although MenuDrive, Harbortouch, and InTouchPOS are not as popular as Uber Eats, Hungrrr, or DoorDash, many small, local restaurants across the US outsource their online ordering process to them as it’s cost-effective.

The Insikt Group discovered the first Magecart campaign on January 18 this year, affecting 80 restaurants via MenuDrive and 74 restaurants via Harbortouch. On both platforms, the skimmer was injected into the restaurant’s web pages, including the subdomain on the online payment service’s platform.

Skimmers deployed two scripts to MenuDrive, one built for stealing payment card details, the other made for stealing user details like the card holder’s name, email address, and phone number. On Harbortouch, however, only a single script is used to steal all personally identifiable information (PII) and card details.

The skimmer code use on MenuDrive with the exfiltration URL highlighted in orange.

The campaign against InTouchPOS started earlier than the other two—around November last year—but most skimmer injections didn’t happen until January 2022.

Instead of stealing data as it was entered into the site, the InTouchPOS skimmers overlaid the site with a fake payment form for users who are ready to checkout.

“Attackers routinely probe networks using automated tools or a more manual approach, especially if the target is deemed highly valuable,” Segura said. “Compromising a third-party site breaks the chain of trust already established between a provider and a merchant but on a scale of ‘one to many’.”

Malware spent months hoovering up credit card details from 300 US restaurants

Researchers at Intezer have published an analysis of a modular and versatile malware targeting Linux systems called Lightning Framework
The post Lightning Framework, modular Linux malware appeared first on Malwarebytes Labs.

Researchers at Intezer have published a technical analysis of Lightning Framework, a previously undocumented and undetected Linux threat. Lightning is a modular framework that is very versatile and something we don’t see very often in the Linux space.

The old argument that Linux systems (or Macs for that matter) don’t get malware has never been true. Linux servers often play a key role in corporate networks, and are also very popular in cloud-based systems, making them attractive targets for criminals.

**The Lightening Framework**

The Lightning Framework has a modular structure, consisting of a downloader (Lightning.Downloader) and a core module (Lightning.Core), with a number of plugins.

Image courtesy of Intezer

A modular architecture can make adding new capabilities or improvements easier, since an update to a plugin should not affect the core or any other plugins. It is also potentially useful to malware authors because if detection is based on one of the plugins then replacing the plugin that triggered the detection may allow the malware to go under the radar for a bit longer.

While some of the modules are known tools, it is rare to see such a complex and versatile framework target Linux systems.

**How Lightening hides**

The main function of the downloader module is to fetch the other components and execute the core module. The framework makes heavy use of typo-squatting and masquerading in order to remain undetected. Intezer reports that the downloader module is located in the working directory /usr/lib64/seahorses/ so anyone performing a quick inspection might think the directory belongs to the password and key manager software seahorse.

One of the tasks of the core module is to set up persistence. It does this by creating a script that gets executed upon system boot. The boot execution is achieved by first creating a file located at /etc/rc.d/init.d/elastisearch, an obvious attempt to typosquat elasticsearch.

The malware uses a timestomping technique to change the timestamp of the script so that it matches the timestamp of one of a few core Linux files. So that, without closer inspection an investigator might think it was created when the system was initially set up.

The framework also uses a rootkit to hide its Process ID (PID) and any related network ports. The rootkit can scrub any reference to files running in the framework.

**Communication**

Network communication in the core and downloader modules is performed over TCP sockets. The C2 server is stored in an encoded configuration file that is unique for every single creation.

The Linux.Plugin.Lightning.Sshd plugin is an OpenSSH daemon that includes hardcoded private and host keys, allowing the attacker to SSH into the machine with their own SSH key, creating a secondary backdoor.

For a deeper analysis of the malware and its plugins, and a list of IOCs, check out the full write up by Intezer.

Lightning Framework, modular Linux malware

Google has issued an update for the Chrome browser that includes 11 security fixes, including 5 with a high severity
The post Update Google Chrome now! New version includes 11 important security patches appeared first on Malwarebytes Labs.

The latest Google Chrome update includes 11 security fixes, some of which could be exploited by an attacker to take control of an affected system. Google Chrome’s Stable channel has been updated to 103.0.5060.134 for Windows, Mac, and Linux, and the new version will roll out over the coming days/weeks.

**Vulnerabilities**

Of the 11 security fixes five are use-after-free issues, including four that are marked with a severity of “high.” Use after free (UAF) vulnerabilities occur because of the incorrect use of dynamic memory during a program’s operation. If after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error to manipulate the program.

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) database. Its goal is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services). The four high-severity use-after-free vulnerabilities resolved with the latest Chrome update are tracked as follows:

**CVE-2022-2477** is a use-after-free vulnerability in Guest View that could allow arbitrary code execution following interaction by the victim.

**CVE-2022-2478** is a use-after-free vulnerability in Chrome’s PDF handling code. Not many details are available but the attacker needs the victim to engage in some kind of user interaction to exploit this vulnerability.

**CVE-2022-2479** is caused by insufficient validation of untrusted input in File. No further details were given but successful exploitation requires user interaction by the victim.

**CVE-2022-2480** is a use-after-free vulnerability in Chrome’s Service Worker API. (Service workers are specialized JavaScript assets that act as proxies between web browsers and web servers.)

**CVE-2022-2481** is a use-after-free vulnerability in Views. The Chrome user interface is constructed of a tree of components called Views. These Views are responsible for rendering, layout, and event handling.

**How to protect yourself**

If you’re a Chrome user on Windows, Mac, or Linux, you should update as soon as possible. Android users will also find an update waiting.

The easiest way to update Chrome is to allow it to update automatically, which basically uses the same method as outlined below but does not require your attention. But you can end up lagging behind if you never close the browser or if something goes wrong—such as an extension stopping you from updating the browser.

So, it doesn’t hurt to check now and then. And now would be a good time, given the severity of the vulnerabilities in this batch. My preferred method is to have Chrome open the page chrome://settings/help which you can also find by clicking **Settings > About Chrome**.

If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is relaunch the browser in order for the update to complete.

Chrome is up to date

After the update the version should be **103.0.5060.134** or later.

Stay safe, everyone!

Update Google Chrome now! New version includes 11 important security patches

The most important and interesting computer security stories from the last week.
The post A week in security (July 18 – July 24) appeared first on Malwarebytes Labs.

Posted: July 25, 2022 by

**RELATED ARTICLES**

July 21, 2022 - Governance, risk, and compliance (GRC) are top-of-mind for many cybersecurity decision-makers. Learn why GRC is important - and how it make it easier.

June 11, 2021 - Many US organizations are migrating from in-house, on-premises solutions to the Cloud. We look at what's driving the Cloud's ascendency.

November 6, 2020 - The financial industry has come to rely on RegTech. It helps financials comply with regulations and tightens up data safety and security. But what is it exactly?

February 24, 2020 - What many don’t realize is that SMBs need the same level of protection from threats that are usually only afforded to enterprises. Managed service providers (MSPs) are the key to getting the protection and service they need while staying on budget.

February 25, 2019 - Almost 10 years ago, privacy advocate Max Schrems and the European Union began separate efforts to change the way the world thinks about online privacy. Thanks to them, we now have GDPR.

**ABOUT THE AUTHOR**

A week in security (July 18 – July 24)

A 3-year old TikTok influencer has got parents talking about how to keep images of their kids away from online creeps.
The post The Wren Eleanor story: Why you should keep your kids off social media appeared first on Malwarebytes Labs.

TikTok moms have started a movement: Calling out potential creeps who follow child influencer accounts on the platform. The latest account in the spotlight is @wren.eleanor, a TikTok account with a massive 17.3 million followers. It’s an impressive number and one that got the attention of armchair sleuths.

@hashtagfacts, another account, posted a video about what other people on TikTok have observed about this account’s followers. They’ve noted the number of times specific clips of 3-year-old Wren have been saved. Perhaps, more surprisingly, they’ve taken note of the pre-filled texts that appear in TikTok’s search box when one starts searching for “wren”.

And that’s just the tip of the iceberg. Many also found a lot of “disgusting comments left by men” in certain videos about Wren.

“My daughter is 12 and a half,” @hashtagfacts said in her video post, “The issue with all of these saves and the follows are that people are watching your children. And doing disgusting things.”

**“Protect your children.”**

Regardless of your intentions when you post pictures and videos of your children publicly, realize and accept the fact that the Internet, with all its awesomeness, also harbors creeps who follow social media accounts featuring kids for disturbing reasons. It’s safe to assume they’re everywhere: Facebook, Instagram, YouTube, TikTok, Omegle, and others.

The simplest way to protect your children from the harms you know, and especially the harms you don’t, is to keep them off social media entirely. Let them decide how they want to use it when they are old enough to understand and navigate the risks they face. That means no social media accounts for them, and no posting images of them on your own accounts.

If that simply isn’t an option for you, for whatever reason, there are ways that you can still safely share photos and videos of your kids on social media while keeping them far away from the hawking eyes of online child predators. In reality, there are many things we can’t control when it comes to protecting our children. However, as one TikTok commenter correctly pointed out, we _can_ control what we post online about our kids.

So, parents and carers, let’s take control.

**Take your social media accounts private**

If you need to act quickly but don’t have the time now to weed through all the media to pick which ones to delete and keep, consider protecting your tweets or making your Instagram account private.

Doing this also gives you time to think about what to consider before deciding on where you stand with the sharing of your child’s photos and videos. Because at the end of the day, you, the responsible parents and carers, get to decide, not people on the internet.

**Limit access to the child’s photos and videos**

Even though your entire account is public, some social media platforms allow you to pick and choose who among your contacts can see specific things you share. Better yet, share to a Private group on Facebook and Instagram comprising only of close family members and friends you’ve known and trusted for long enough you consider them as family.

The smaller the circle of trust, the better.

**Yes, share via secure messengers and private albums**

Social media platforms aren’t the only places where you can safely share pictures and videos of your kids. Secure messengers like iMessage, WhatsApp, or Signal can also do this for you, so make good use of them.

If your family and friends all have Apple devices, or if you use Google Photos, you can also set up a private, shared photo album where you can share media of all family members safely.

**Prepare your kids for a life with social media**

Posting media of your kids on social media is one thing. Creating social media accounts for them, whether they meet a social network’s minimum age requirement or not, is quite another. Because for children, especially girls aged 11 to 13, who are targeted by online predators more than other groups, just being online is already a huge risk.

Don’t assume they know enough to look after themselves. Make sure they do. We suggest you adopt **T.A.L.K.**, a series of comprehensive and actionable steps parents and carers can take to help guide kids through a safe online experience as they grow up.

T.A.L.K. stands for:

*   **Talk to your child** about online sexual abuse. Start the conversation—and listen to their concerns.
*   **Agree on ground rules** about the way you use technology as a family.
*   **Learn about the platforms and apps** your child loves**.** Take an interest in their online life.
*   **Know how to use tools**, apps and settings that can help to keep your child safe online.

Age shouldn’t be the only indicator for when you can allow your kids to start exploring the wider Internet more. Maturity of mind should be considered, too.

We also believe that part of keeping kids secure online is developing their self-esteem. So no matter what negativity the online world throws at them, they will rise above it. An insecure child will easily succumb to criticisms, want to be famous, or feel the need to get approval and acceptance from everyone.

Putting them in front of the camera for millions of people to watch and look at won’t build up the self-esteem your child needs.

The Wren Eleanor story: Why you should keep your kids off social media

Governance, risk, and compliance (GRC) are top-of-mind for many cybersecurity decision-makers. Learn why GRC is important - and how it make it easier.
The post The winding road to compliance appeared first on Malwarebytes Labs.

“Here are the keys. Buy milk and bread. Drive safely.”

These are important instructions for a new driver tasked with running an errand. But unless the driver knows where they are going, a bit of guidance on how to get to the store can only help. Without it, the driver may complete the errand successfully, or at least make a good effort; but they might not complete the errand or be inefficient in the attempt.

For IT and security teams, aiming for compliance feels eerily similar to running errands without  
direction.

Like the driver, these users want to accomplish the task at hand (in this case, regulatory  
compliance) but are often stymied by the ambiguity or lack of direction on how to do so. Often,  
compliance standards define the ultimate objectives, but give organizations the flexibility to determine  
for themselves the path they take to get there.

Consequently, some users experience the equivalent of making three left turns when they didn’t know they could have just made a right.

**Navigating by the stars**

Freedom to define your own path has some benefits, of course. So, how do you reach the goal  
efficiently to optimally protect your organization against breaches?

If you’re working through this question, you’re not alone. In fact, data from earlier this year suggests more cybersecurity decision-makers are focused on ensuring governance and compliance standards are met (56%), topping the list of priority projects during the first quarter of 2022.

It’s no secret that complying with leading standards in your industry protects your business in several  
ways – some more obvious than others.

Immediately, there is the imperative protection for corporate data, personally identifiable information (PII), intellectual property, etc., and mandatory compliance with these protections to operate in certain industries or countries. Then there are the expanded values gained from compliance, such as assurances you can provide to executives and Boards about the organization’s cybersecurity posture, or your improved stance for cyber insurance.

Overriding all of these benefits is the primary reason compliance programs exist: to increase organizations’ level of prevention against an attack (akin to the “drive safely” instruction to a new driver).

**Help along the journey**

With the freedom to choose how you meet compliance requirements, a navigator who is easy to travel  
with and able to help guide you efficiently can be the best kind of travel companion. You need a solution  
partner who can help you check off some of those distance-markers along the compliance highway.

Malwarebytes EDR includes essential threat prevention capabilities to keep nefarious actors from  
entering your environment.

These are complimented by threat detection and remediation tools to help you identify threats that get past the gate, so your IT or security team can respond effectively and efficiently. The platform aligns nicely with NIST and ENISA attack response frameworks, which include guidelines for best practices that help you achieve compliance.

Compliance may not be the pinnacle of your journey, either; perhaps your organization’s focus is  
reinforcing specific attack surfaces. In cases like these, the value of an expandable, cloud-based platform becomes apparent.

Malwarebytes EDR is built to run in our Nebula cloud platform, which empowers you to easily add  
modules that fortify specific vectors. For example, adding our Vulnerability Assessment and Patch  
Management (VPM) modules to your Malwarebytes EDR deployment helps protect against software exploits.

Connecting our DNS Filtering module yields greater control over internet browsing and content  
access, providing end users a safer, more secure web experience. In addition to their inherent enhanced  
protection value, these modules help businesses with specific HIPAA, PCI and GDPR compliance criteria,  
and public sector entities meet additional requirements of CJIS compliance, for example.

The path to compliance is easier with an informed companion. Malwarebytes EDR helps you navigate  
the compliance highways and byways, like a travel companion with experience in and expert knowledge  
of the routes to optimal protection. Our platform is easy to learn and use and can effectively help you  
reach your compliance destination (and beyond). Get started with an EDR demo or trial today.

The winding road to compliance

Malwarebytes Endpoint Detection and Response can fight—and defeat—advanced ransomware that other security solutions miss. In this post, we’ll walk through what it looks like to deal with a ransomware attack using Malwarebytes EDR. 
The post Demo: Your data has been encrypted! Stopping ransomware attacks with Malwarebytes EDR appeared first on Malwarebytes Labs.

It’s no secret that ransomware is one of the most pressing cyber threats of our day. What worse, ransomware gangs have increased their attacks on a range of vulnerable industries, with disruptions to business operations, million-dollar ransom demands, data exfiltration, and extortion. 

With Malwarebytes Endpoint Detection and Response, however, you can fight—and defeat—advanced ransomware that other security solutions miss. 

In this post, we’ll walk through what it looks like to deal with a ransomware attack using Malwarebytes EDR.

*   Part 1: Your data has been encrypted!
*   Part 2: Pinpointing the ransomware
*   Part 3: Isolating the endpoint infected with ransomware
*   Part 4: Remediating the ransomware
*   Accelerate and simplify your ransomware defense with Malwarebytes EDR

**Part 1: Your data has been encrypted!**

Prior to this demo, we ran a ransomware sample on the virtual machine (VM) that we’ll be demonstrating from. Below, you’ll see that the VM is currently in an infected state.

As you can see, our files have in fact been encrypted by the ransomware across multiple directories with the “.**encrypt**” extension.

Let’s start a ping to Google’s DNS server. The reason that we’re going to do this is to help demonstrate some of the functionality that Malwarebytes has later. 

Just keep in mind that right now we can effectively communicate out to the internet. But we’ll come back to that later.

**Part 2: Pinpointing the ransomware**

Now, let’s switch to our Nebula console. Below, you’ll see the dashboard for Malwarebytes Nebula, our cloud-hosted security operations platform that allows you to manage control of any malware or ransomware incident. 

Click into the **Suspicious Activity** section of the console.

Right at the top, we can see that activity, a process that ran today at 9:31am.

Let’s click on this executable and start diving into how an IT admin or security analyst could use Malwarebytes to help respond to a ransomware situation, as well as effectively contain it.

Up at the top here, we have categorization of rules to help a maybe newer or less savvy security expert understand what’s going on with this process.

At the bottom, we have a detailed process timeline as well.

Let’s expand here by clicking **Show rules**. 

What we see here is the actual categorization of behaviors that Malwarebytes witnessed in this process. Each of these little bubbles has been color coded to help you understand the severity of this issue. 

We follow a pretty simple mechanism: Red is high severity, orange is medium severity, yellow is low severity. All of these behaviors are things that Malwarebytes actually witnessed this process doing on our endpoint. 

As you can see, there’s a lot of questionable behavior here. Things like disabling Windows Firewall, turning off the control panel, turning off the desktop activity; lots of things that would be concerning to a security expert.

Now, for someone who is not as familiar with some of these behaviors, or maybe there’s a technique that you’re not aware of, you can hover over them for more details. 

So for example, if we hover over the disable Windows Firewall behavior that we saw, on the left, you’ll see that we’ve been partnering with the MITRE foundation and using its attack framework to give you context and a common set of terms that you can use to identify and understand these tactics.

On the right, we see the command line context for this process in our organization.

We can see the exact time that it ran and the file hashes, so if we needed to do further investigation, we have those available. And most importantly, we’ve highlighted below the command line actually used to execute this technique on our machine. 

So again, in the context of disabling the firewall, this might be something we do in testing or as part of our troubleshooting process.

We can use this context to help understand if this is something that we have done intentionally – or if it’s possibly something that an attacker is doing to compromise our environment.

Let’s navigate now down to the bottom half, where we can see the actual specific details of this process.

Clicking into any of these nodes, we get a lot of rich context information about what this process did. 

As a security analyst or an IT admin, the first question you typically ask when an incident occurs is: What happened? Do we know if it’s malicious? What is the actual extent of the potential damages? And so on.

So here, we can navigate through to see everything that’s happened on this machine. 

For example, if we click on **File Write**, we can see every artifact or file left behind by this process.

Similarly, we can click on **Reg values** to see what registry changes were made on that system. 

**Part 3: Isolating the endpoint infected with ransomware**

Now, as we’re continuing our investigation, we’re looking at this and deciding it looks pretty suspicious – it’s probably unwanted or a potentially damaging activity. So as a safeguard, we’re going to use the first response mechanism in Malwarebytes, which is our isolation capability.

From the **Actions** menu, let’s choose to isolate this machine with **Isolate Endpoint**.

We have three layers of isolation that we can provide: **network isolation**, **process isolation**, and **desktop** **isolation**. 

The network and process isolations are intended to give us the ability to quarantine that machine and prevent it from doing anything that is not authorized by Malwarebytes. 

What this means is, we can still use our Malwarebytes console to trigger scans to perform other tasks and to review data, but the machine otherwise can’t communicate or run anything else. 

For this demonstration, we’re just going to use network isolation so that we can simulate preventing this machine from spreading an infection laterally in the environment.

Notice as we send that isolation command, the ping to Google immediately begins to fail – showing that that machine can no longer communicate to the internet. 

Now that we’ve isolated this device, let’s continue our investigation further. 

Below, we see a process here with a large amount of file activity, namely file renames. 

Let’s click into this. This is where Malwarebytes witnessed the ransomware attack actually occurring—so we see those files changing to not their normal versions, but to the .**encrypted** versions of the same file. 

What makes Malwarebytes unique in our EDR capabilities is when we see behavior like this (something that could compromise your files due to encryption or deletion or other types of malicious activity) we’ve actually created backups of all of the files that were targeted by this process stored locally on this machine. 

Now that we’ve identified that this is unwanted and malicious behavior, what we’re going to do is initiate a rollback action. 

Effectively, we’re telling Malwarebytes that we did not want this activity: this is something that happened on our machine that we never authorized and that we did not want. So when we go to **Actions**, and then **Remediate**, this will send a customized script to this endpoint and it will look at all of the behavior we witnessed in this process graph here.

This will create a customized remediation plan for this machine, where it will iterate backwards through the behavior, resolving any potential issues that might have arisen. 

One of the things that it’s going to do in this process is look for those backup versions of the files we created and restore those to the end user.

We can see on the right that our virtual machine received the command and it needs to restart to finish the process. Let’s restart it now so that we can see it carry out the backup!

After the machine reboots, we can open these folders and actually see that all of our files have been returned to their original version. 

**Accelerate and simplify your ransomware defense with Malwarebytes EDR**

In this post, we seamlessly looked at the activity that ransomware exhibited, found a recovery plan for it, then implemented that plan. 

In short, this is not a tool where you’re going to have to devise a customer mediation plan, where you’re going to have to iterate through hundreds of IOCs or complex readouts with an EDR solution to build a manual recovery solution – you simply need to tell Malwarebytes to resolve the issue. 

When it comes to ransomware mitigation, we’ll take the wheel from you – freeing up a lot of time in your day as an admin or an analyst. Read about how a leading automotive manufacturer and distributor used Malwarebytes EDR to simplify their ransomware remediation.

Looking for more demos of Malwarebytes EDR? Watch the webinar!

_Read our eBook on_ _ransomware best practices to detect and block ransomware attacks before they happen_.

Demo: Your data has been encrypted! Stopping ransomware attacks with Malwarebytes EDR

Researchers have discovered six vulnerabilities in the MiCODUS MV720 GPS tracker, a popular automotive tracking device.
The post Vulnerabilities in GPS tracker could have “life-threatening” implications appeared first on Malwarebytes Labs.

Researchers at BitSight have discovered six vulnerabilities in the MiCODUS MV720 GPS tracker, a popular vehicle tracking device.

The vulnerabilities are severe enough for the Cybersecurity & Infrastructure Security Agency (CISA) to publish a Security Advisory titled ICSA-22-200-01: MiCODUS MV720 GPS Tracker.

**What’s happened?**

The MiCODUS MV720 is a hardwired GPS tracker that offers anti-theft, fuel cut off, remote control and geofencing capabilities. In total, there are 1.5 million of these devices in use today across 420,000 customers, including government, military, law enforcement agencies, and Fortune 1000 companies.

If the vulnerabilities are successfully exploited, an attacker could take control of the tracker, giving them access to location, routes, and fuel cutoff commands, as well as the ability to disarm various features like alarms. The found vulnerabilities are very diverse and would imply that the application was not built with security in mind. Or certainly not top of mind.

**The vulnerabilities****Hard coded credentials**

CVE-2022-2107: The API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.

**Improper authentication**

CVE-2022-2141: SMS-based GPS commands can be executed without authentication.

**Improper neutralization of input during web page generation**

CVE-2022-21999: The main web server has a reflected cross-site scripting (XSS) vulnerability that could allow an attacker to gain control by tricking a user into making a request.

**Authorization bypass through user-controlled key**

CVE-2022-34150: The main web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.

**Another authorization bypass through user-controlled key**

CVE-2022-33944: The main web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.

Exploiting these vulnerabilities could potentially put drivers in danger and disrupt supply chains. In fact, there are many possible scenarios which could result in loss of life, property damage, privacy intrusions, and threaten national security.

**Mitigation**

Since MiCODUS has not provided updates or patches to mitigate these vulnerabilities, users are advised to turn the vulnerable devices off.

The researchers first contacted MiCODUS about the vulnerabilities in September 2021, and due to a lack of response CISA and BitSight decided to publish their research.

Vulnerabilities in GPS tracker could have “life-threatening” implications

Scammers go mainstream by hijacking top Google searches and replacing them with malicious ads.
The post Google ads lead to major malvertising campaign appeared first on Malwarebytes Labs.

Fraudsters have long been leveraging the shady corners of the internet to place malicious adverts, leading users to various scams. However, every now and again we see a campaign that goes mainstream and targets some of the world’s top brands.

Case in point, we recently uncovered a malvertising chain abusing Google’s ad network to redirect visitors to an infrastructure of tech support scams. Unsuspecting users searching for popular keywords will click an advert and their browser will get hijacked with fake warnings urging them to call rogue Microsoft agents for support.

What makes this campaign stand out is the fact that it exploits a very common search behavior when it comes to navigating the web: looking up a website by name instead of entering its full URL in the address bar.

**Hijacking traffic from on a specific user flow**

The threat actors are abusing Google’s ad network by purchasing ad space for popular keywords and their associated typos. A common human behavior is to open up a browser and do a quick search to get to the website you want without entering its full URL. Typically a user will (blindly) click on the first link returned (whether it is an ad or an organic search result).

Let’s say you want to load YouTube and type ‘youtube’ instead of entering the full address ‘youtube.com’ in the browser’s address bar. The first result that appears shows ‘www.youtube.com’ so you are likely to trust it and click on it:

Hijacking traffic in such a way is a clever and likely profitable scheme outlining some of the issues and abuses associated with the placement of ads versus organic search results.

The top searches we have seen for malware-laden ads in this campaign are:

*   youtube
*   facebook
*   amazon
*   walmart

Victims were simply trying to visit those websites and relied on Google Search to take them there. Instead, they ended up with an annoying browser hijack trying to scam them.

**Cloaking and other violations**

The technique used to divert traffic for malicious purposes is known as cloaking and is based on two prerequisites:

*   User looks fake (non residential IP address, wrong user-agent string or simply a crawler)
    *   A redirect to the requested website will take place
*   User looks legitimate
    *   A redirect to a different site and different content happens

As per Google, “_Cloaking is considered a violation of Google’s Webmaster Guidelines because it provides our users with different results than they expected._” Again, based on Google’s policy violation a buyer that uses a creative (ad) containing malware can be suspended for a minimum of three months.

**Traffic and redirects**

There is a short chain of redirects leading to the browser locker. In this section we will take apart another malicious ad for Facebook this time. The ad is of course quite misleading as there is nothing that indicates that clicking on it would redirect anywhere else but to the requested website. Note how it appears before the top organic search result, guaranteeing a higher click rate.

The redirection mechanism is engineered in such a way that static analysis of the HTML code is difficult and does not give away the browser locker URL easily.

**First redirect**

This page determines whether to load decoy content (in this case the legitimate Facebook website) or a secondary script on the same attacker-controlled infrastructure.

**Second redirect**

This is where the browser locker URL is found and we can see that the threat actors don’t actually want to make a formal redirect but instead are loading it within an iframe.

When the page is rendered, the main address bar still shows the .com (cloaking domain) while the content is actually loaded from an iframe (100% width and height) from a disposable CloudFront URL.

**Multiple cloud platforms affected**

Below are examples of malvertising chains we have observed using slightly different variations but that we believe are related to the same threat actor. They used a clever approach by adopting different flows for the cloaking and browser locker such that detecting and taking down one would not impact the overall campaign.

Specifically, we see the threat actor using more expensive domains mixed with disposable domains on shady TLDs. For infrastructure, again they diversified between paid VPS on hosting companies and free cloud providers (PaaS).

**Traffic flow – case 1 : throwaway domains**

1.  **Google search**: google.com/search?q=walmart&{…}
2.  **DoubleClick ad network**: ad.doubleclick.net/ddm/clk/{…}
3.  **Cloaking domain**: ssgvbcxcc\[.\]ga/?url=https://www.walmart.com/ip/{…}
4.  **Browser locker**: prolesscodenet856\[.\]ml/erxczzxEr0rgdxvngEr0hjhvhhxEr0cbchk0252infoyxZdzc

**Traffic flow – case 2: IP address**

1.  **Google search**: google.com/search?q=walmart&{…}
2.  **Ad platform**: clickserve.dartsearch.net/link/click?\_v={…}
3.  **Cloaking domain**: gettouy\[.\]org/t2/?url=https://www.walmart.com/ip/{…}
4.  **Browser locker**: 159.203.183\[.\]136/windowsecurity/

**Traffic flow – case 3: Digital Ocean PaaS**

1.  **Google search**: google.com/search?q=facebook&{…}
2.  **Ad platform**: clickserve.dartsearch.net/link/click?\_v={…}
3.  **Cloaking domain**: playcrpm\[.\]com/?url=https://www.facebook.com/f{…}
4.  **Browser locker**: starfish-app-irxap.ondigitalocean\[.\]app/{…}&number=1-866-896-0189{…}

**Traffic flow – case 4: Azure cloud**

1.  **Google search**: google.com/search?q=zillow&{…}
2.  **Ad platform**: clickserve.dartsearch.net/link/click?\_v={…}
3.  **Cloaking domain**: vlt\[.\]me/.2zqd4/?url=https://www.zillow.com/?url={…}
4.  **Browser locker**: wdq23r2fdadqwdqwdfwedadasasd.azurewebsites\[.\]net/fC0deJdfd008f0d0CH888Err0r80dBG88/index.html

**Reporting and protection**

As far as we can tell, these different campaigns have been going on for several weeks already. Although we don’t have statistics to figure out how many people were exposed, we can infer that the number was high based on a couple of factors:

*   The ads target popular keywords (which also indicates that the threat actors are not opposed to paying a premium)
*   We were able to replay the malvertising chains in our lab multiple times (live replays of malvertising on high profile sites is usually difficult)

We reported the malicious ads and flagged them under the “_An ad/listing violates other Google Ads policies_” category.

We also shared and are currently sharing the cloaking domains infrastructure with relevant parties. The browlock domains themselves have such a short lifespan that it is practically useless to act upon them.

Meanwhile, Malwarebytes users were already protected against this campaign thanks to our heuristic detection of the browser locker pages that force a fullscreen and auto play an audio warning.

**Indicators of Compromise**

eauxedrill\[.\]com  
shopmealy\[.\]com  
aeowqpeqwpa924\[.\]ga  
ejdcvvdhsjdj\[.\]ml  
feopqwoeqw245\[.\]ga  
iowqepwoqe425\[.\]ga  
rasteringfileweb539\[.\]ga  
rsgdkffvsjkoavd\[.\]ml  
ssgvbcxcc\[.\]ga  
gettouy\[.\]org  
getcdprm\[.\]org  
playcrpm\[.\]com  
monhomedecore\[.\]com  
allnewz\[.\]site  
vlt\[.\]me  
youtubelinktrack\[.\]live  
morth\[.\]buzz  
abhihomeabh\[.\]com  
kalarahulshet\[.\]com  
tevarsingh\[.\]com  
bhtl\[.\]digital  
cduitiek\[.\]tk

Google ads lead to major malvertising campaign

The Justice Department announced it was able to forfeit ransomware payments made by health care organizations in Kansas and Colorado.
The post Another ransomware payment recovered by the Justice Department appeared first on Malwarebytes Labs.

The Justice Department today announced a complaint filed in the District of Kansas to forfeit cryptocurrency paid as ransom to North Korean hackers or otherwise used to launder such ransom payments. The seized funds amounting to half a million US dollars, include ransoms paid by health care providers in Kansas and Colorado.

**Maui ransomware**

Deputy Attorney General Lisa O. Monaco said at the International Conference on Cyber Security:

> “Thanks to rapid reporting and cooperation from a victim, the FBI and Justice Department prosecutors have disrupted the activities of a North Korean state-sponsored group deploying ransomware known as ‘Maui.’”

Malwarebytes recently reported on the North Korean APT that targets US healthcare sector with Maui ransomware. The FBI started responding to incidents involving Maui in May 2021. Unlike the ransomware we usually see that plagues organizations and regularly hits the news, Maui is never sold or offered to affiliates as a ransomware-as-a-service (RaaS) tool. It is, instead, developed and used privately for state-backed actors.

**New at the time**

According to court documents, in May 2021, North Korean hackers used a ransomware strain called Ransom.Maui to encrypt the files and servers of a medical center in the District of Kansas. After more than a week of being unable to access encrypted servers, the Kansas hospital paid approximately $100,000 in Bitcoin to regain the use of its computers and equipment. Because the Kansas medical center notified the FBI and cooperated with law enforcement, the FBI was able to identify the never-before-seen North Korean ransomware and trace the cryptocurrency to China-based money launderers.

**Follow the money**

In April 2022, the FBI observed a payment of approximately $120,000 in Bitcoin into one of the seized cryptocurrency accounts identified thanks to the cooperation of the Kansas hospital. The following investigation confirmed that a medical provider in Colorado had just paid a ransom after being hacked by actors using the same Maui ransomware strain. In May 2022, the FBI seized the contents of two cryptocurrency accounts that had received funds from the Kansas and Colorado health care providers. The District of Kansas then began proceedings to forfeit the hackers’ funds and return the stolen money to the victims.

**Not the first time**

We’ve seen ransomware recoveries in the past and we hope to see many more in the future. The most well known and probably one of the first was when the US Department of Justice recovered much of the ransomware payment that Colonial Pipeline paid to free itself from the attack that derailed the oil and gas supplier’s operations for several days.

Another example: The University of Maastricht in the Netherlands was hit by ransomware in December 2019 and paid a ransom of 197,000 Euro in Bitcoin. A part of this ransom was recovered in 2020 from a laundering operation in Ukraine. Due to the difference in Bitcoin prices, the University received a return payment of 500,000 Euro. The “profit” will be donated to disadvantaged students.

**Mitigation**

Even though ransom recovery is a good thing, it only happens on rare occasions and the general advice is to refrain from paying ransoms. It doesn’t guarantee you will get your data back, nor does it free you from recovery costs (because you still have to harden your system against the next attack), and it marks you as a target for repeat attacks.

Although Maui may be a little different from run-of-the-mill ransomware, the steps to protect against it are not:

*   Maintain offsite, offline backups of data and test them regularly.
*   Create a cybersecurity response plan.
*   Keep operating systems, applications, and firmware up to date.
*   Disable or harden remote desktop protocol (RDP).
*   Require multi-factor authentication (MFA) for as many services as possible.
*   Require administrator credentials to install software.
*   Report ransomware incidents to your local FBI field office.

Stay safe, everyone!

Source

Malwarebytes