Scammers Already Taking Advantage of Hurricane Harvey, Registering Domains

The physical damage from Tropical Storm Harvey is expected to spread further in the coming week as the storm continues to move along the Gulf Coast. At least 10 people in Texas have been killed related to the storm, local officials said, and the continuing rainfall could total as much as 50 inches in some areas by the end of the week. On Monday, a day after Louisiana Gov. John Bel Edwards called on the federal government for assistance, President Donald Trump declared a state of emergency in Louisiana. Texas Gov. Greg Abbot described the storm as “one of the largest disasters America has ever faced,” and FEMA administrator Brock Long said the agency is gearing up for the years-long recovery process that will follow.

Naturally, people want to help the victims with that recovery process, and scammers are already capitalizing on that goodwill to defraud individuals and carry out other malicious activity, several agencies have warned.

The Better Business Bureau said it has already seen sketchy crowdfunding efforts and expects the coming months to see the usual flood of “storm chasers” — ranging from legitimate contractors looking for business to scammers attempting to take advantage of those who’ve already been victimized by the storm. In addition, US-CERT is warning users “to remain vigilant for malicious cyber activity seeking to capitalize on interest in Hurricane Harvey.”

SurfWatch Labs also noted in a recent customer alert that we have observed hundreds of new domains being registered containing “harvey,” many of which will likely be used for scams related to the storm.

2017-08-29_SWHarveyAlert.png
SurfWatch Labs alert on Hurricane Harvey scams.

Scams following national disasters like Harvey have come to be the norm, as malicious actors will attempt to exploit any event or news story that grabs the collective consciousness of a large group of people. For example, researchers recently discovered that the Chinese group APT 17 was leveraging the popularity of Game of Thrones in spear phishing emails designed to infect their targets with malware by teasing potential victims with the headline, “Wanna see the Game of Thrones in advance?”

Similar attack vectors leveraging users’ natural curiosity tend to follow nearly every major news story; however, with natural disasters people are more willing to hand over their payment information and make a donation, so there is more profit — and more incentive — for fraudsters to capitalize on such events. These attack vectors include:

  • email phishing designed to steal personal and financial information;
  • fake websites and crowdfunding pages impersonating legitimate charities;
  • in-person and phone scammers, such as fake contractors or government officials that offer services or aid with no intention of following through;
  • and social media posts designed to entice users to either visit a malicious site, download malware, provide personal information, or perform acts that will earn the fraudster money.
2017-08-29_AirlinesFacebookScam.png
Fake videos like this one observed by Malwarebytes following the disappearance of a Malaysian Airlines flight are often spread via social media and lead to surveys that harvest personal information or earn affiliate cash for the scammers.

With the National Weather Service describing Harvey as “unprecedented” and “beyond anything experienced,” it is likely that relief efforts will continue for years into the future. As SurfWatch Labs noted after Hurricane Matthew, those who wish to help or are seeking aid should be cautious about who they provide information to in order to avoid falling victim to these social engineering scams. Some tips include:

  • Never click on links or open attachments unless you know who sent it and what it is. Malicious email attachments and links are among the most common ways for cybercriminals to spread malware and steal information.
  • Never reply to emails, text messages, or pop-ups that ask for personal information.
  • Cybercriminals may use a combination of fraudulent emails and phone numbers to increase their appearance of authority. Always verify that communication is valid by contacting the organization directly before providing any sensitive information.
  • If donating to a charity, make sure it is one you know and trust. The FTC recommends checking out charities via the Better Business Bureau’s (BBB) Wise Giving AllianceCharity NavigatorCharity Watch or GuideStar.

Weekly Cyber Risk Roundup: JobLink, $100 Million BEC Scam and Other Breaches

Third-party cybersecurity issues were once again front and center this past week as America’s JobLink, a web-based system that links jobs seekers with employers, was compromised by a malicious actor, leading to a series of data breach announcements from states that use the system.

2017-03-24_ITT.png“On February 20, 2017, a hacker created a job seeker account in an America’s JobLink (AJL) system,” the company wrote. “The hacker then exploited a misconfiguration in the application code to gain unauthorized access to certain information of other job seekers.”

Millions of individuals may have been affected by the vulnerability, which was introduced in an AJL system update in October 2016. When exploited, it allowed the malicious actor to view the names, Social Security numbers, and dates of birth of job seekers in the AJL systems of up to ten states: Alabama (600,000), Arizona, Arkansas (19,000), Delaware (200,000), Idaho (170,000), Illinois (1.4 million), Kansas, Maine (conflicting media reports on total number affected), Oklahoma (430,000), and Vermont (186,000).

Vermont Gov. Phil Scott said at a Thursday press conference that the state was looking into the contract with ALJ, which has been in effect for about 16 years, and may potentially pursue legal recourse. At the same press conference Vermont Department of Labor Secretary Lindsay Kurrle noted potential AJL issues that may have compounded the breach, such as older Joblink accounts not being deleted.

Third-party cybersecurity issues continue to be one of the most pressing challenges facing organizations, as the numerous breaches in this roundup each week demonstrate. Despite the challenges, the digital footprints of organizations continue to grow: an issue that Adam Meyer, chief security strategist with SurfWatch Labs, and Kristi Horton, senior risk analyst with Gate 15 & Real Estate ISAC, will discuss on a Webinar tomorrow.

2017-03-24_ITTGroups

Other trending cybercrime events from the week include:

  • WikiLeaks’ dump brings legal issues, more CIA documents:  Julian Assange criticized companies for not responding to WikiLeaks’ request that they comply with certain conditions in order to receive technical information on the leaked CIA exploits; however, multiple tech companies said the issue is caught up in their legal departments. WikiLeaks also continued to leak more CIA data by publishing documents that “explain the techniques used by CIA to gain ‘persistence’ on Apple Mac devices, including Macs and iPhones and demonstrate their use of EFI/UEFI and firmware malware.” The documents are mostly from the last decade, except for a couple that are dated 2012 and 2013.
  • Variety of issues lead to oversharing, data breaches: The UK’s Information Commissioner’s Office is investigating reports that data sharing options in SystmOne may have exposed the medical records of up to 26 million patients. The system’s “enhanced data sharing” option, which doctors turned on so that medical records could be seen by local hospitals, also allowed those records to be accessed by thousands of other workers. Mobile phone company Three is investigating a technical issue that led to some customers who logged into their accounts seeing the personal data of other customers. Med Center Health in Kentucky announced a data breach due to a former employee accessing encrypted patient billing information by falsely implying it was needed for job-related reasons.
  • Bots lead to gift card fraud, stock manipulation: Nearly 1,000 customer websites were targeted by a bot named “GiftGhostBot” that automatically checks millions of gift card numbers to determine which card numbers exist and contain balances. Recent pump-and-dump spam messages from the Necurs botnet falsely claimed that InCapta was about to be bought out for $1.37 per share and that people could buy shares for less than 20 cents before the buyout would be announced.
  • Malware spread via Ask.com toolbar: For the second time in a one month period, malicious actors were able to compromise the Ask Partner Network (APN), creators of the Ask.com toolbar, in order to spread malware that was signed and distributed as though it were a legitimate Ask software update. The first attack was discovered in November 2016, and in December 2016 researchers discovered that the “sophisticated adversary” was continuing its earlier activity “to deliver targeted attacks using signed updates containing malicious content.”
  • Other notable cybercrime events: Hackers going by the name ‘Turkish Crime Family’ claim to have access to a large cache of iCloud and other Apple email accounts and say they will reset accounts and remotely wipe devices on April 7 unless Apple pays a ransom. The McDonald’s India app leaked the personal information of more than 2.2 million users, and data is still allegedly being leaked despite the company’s claims that it fixed the issue. Lane Community College health clinic is notifying approximately 2,500 patients that their personal information may have been compromised due to one of its computers being infected with malware. A gang of hackers-for-hire tried to steal Baidu’s driverless car technology. The FBI believes that North Korea is responsible for the February 2016 theft of $81 million from Bangladesh Bank, and U.S. prosecutors are building potential cases that may both formally accuse North Korea of directing the theft and charge alleged Chinese middlemen

SurfWatch Labs collected data on many different companies tied to cybercrime over the past week. Some of those “newly seen” targets, meaning they either appeared in SurfWatch Labs’ data for the first time or else reappeared after being absent for several weeks, are shown in the chart below.

2017-03-24_ITTNew

Cyber Risk Trends From the Past Week

2017-03-24_RiskScoresOne of the most profitable cybercriminal tactics is business email compromise scams, which has accounted for several billion dollars worth of actual and attempted losses over the past few years.

A reminder of that ongoing threat surfaced this past week when the Department of Justice announced the arrest of a Lithuanian man on charges that he had successfully duped two U.S.-based companies into wiring a total of over $100 million to bank accounts that he controlled.

The DOJ noted in its press release that the case “should serve as a wake-up call” to even the most sophisticated companies that they may be the target of advanced phishing attempts from malicious actors.

Evaldas Rimasauskas, the arrested Lithuanian man, allegedly registered and incorporated a company in Latvia with the same name as an Asian-based computer hardware manufacturer, and then opened and maintained various bank accounts using that copycat company name. He then is alleged to have sent fraudulent phishing emails to employees of companies that regularly conducted multimillion-dollar transactions with the hardware manufacturer, asking that those companies direct payments for legitimate goods and services to the bank accounts using the copycat name. The indictment also alleges that Rimasauskas submitted forged invoices, contracts, and letters that falsely appeared to have been executed and signed by executives and agents of the victim companies to banks in support of the large volume of funds that were fraudulently transmitted via wire transfer.

As the FBI and others have repeatedly warned, the lure of multi-million dollar payout leads to cybercriminals going to great lengths to successfully social engineer companies. This includes more time spent researching things such as the roles of employees and their language in written communications, as well as company authority figures, policies and procedures, and supply chains. This allows the social engineers to craft a message, or series of messages, that fits within the expected culture and communication patterns of an organization — increasing their chances of a large, fraudulent payday.

Weekly Cyber Risk Roundup: Massive Leaks Expose CIA Secrets and Alleged Spam Operation

The week’s top trending cybercrime story was WikiLeaks’ release of more than 8,000 documents related to the U.S. Central Intelligence Agency. The dump, called “Vault 7,” contains information on the CIA’s hacking tools and methods and is “the largest ever publication of confidential documents on the agency,” according to WikiLeaks.

2017-03-11_ITT.png“Recently, the CIA lost control of the majority of its hacking arsenal including malware, viruses, trojans, weaponized ‘zero day’ exploits, malware remote control systems and associated documentation,” WikiLeaks wrote in a press release. “This extraordinary collection, which amounts to more than several hundred million lines of code, gives its possessor the entire hacking capacity of the CIA. The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.”

The leak has led to widespread reports on the CIA’s hacking capabilities, including tools to compromise Windows, OS X, iOS, and Android devices; ways to circumvent popular antivirus programs; an exploit that uses a USB stick to turn smart TVs into bugging devices; and efforts to infect vehicle control systems. The U.S. is investigating the source of the leaks, which a CIA spokesperson described as deeply troubling and “designed to damage the intelligence community’s ability to protect America against terrorists and other adversaries.”

WikiLeaks said it carefully reviewed the published documents and has avoided “the distribution of ‘armed’ cyberweapons until a consensus emerges on the technical and political nature of the CIA’s program and how such ‘weapons’ should analyzed, disarmed and published.” On Thursday, WikiLeaks founder Julian Assange held a press conference where he said WikiLeaks would give technology companies “exclusive access” to the details of the exploits so that they could patch any software flaws; however, Thomas Fox-Brewster of Forbes reported that as of Saturday morning companies such as Google and Microsoft had yet to receive those technical details from WikiLeaks.

2017-03-11_ITTGroups

Other trending cybercrime events from the week include:

  • Verifone investigating data breach: Verifone, the largest maker of credit card terminals used in the U.S., is investigating a breach after being alerted in January by Visa and MasterCard that malicious actors appeared to have been inside of Verifone’s network since mid-2016, a source told KrebsOnSecurity. “According to the forensic information to-date, the cyber attempt was limited to controllers at approximately two dozen gas stations, and occurred over a short time frame,” Verifone wrote in a statement to Brian Krebs. “We believe that no other merchants were targeted and the integrity of our networks and merchants’ payment terminals remain secure and fully operational.”
  • TalkTalk responds to scam center report: Two days after the BBC reported on an industrial-scale Indian scam call center targeting TalkTalk customers, the UK-based Internet service provider temporarily banned TeamViewer and other similar remote control software programs over security issues related the scammers. Teamviewer said that it is “in extensive talks to find a comprehensive joint solution to better address this scamming issue.”
  • Tax information continues to be targeted: Daytona State College is notifying employees that their W-2 information may have been stolen after some employee W-2 statements were discovered being sold on cybercriminal markets. A glitch in Rhode Island’s Department of Human Services’ computer system resulted in more than 1,000 people receiving tax forms with the wrong information. Malicious actors are sharing concerns about government efforts to combat tax fraud, as well as tips on how those protections can be circumvented, on various dark web forums.
  • Organizations face extortion demands: Since the U.S. presidential election, at least a dozen progressive groups have faced extortion attacks where malicious actors search organizations’ emails for embarrassing details and then threaten to release that information if blackmail demands ranging from $30,000 to $150,000 are not paid. A Florida man was charged with intentionally damaging computers that hosted a San Diego software company’s website. The Pennsylvania Senate Democratic Caucus computer system was shut down after a ransomware infection made the system inaccessible to caucus members and employees. Fake extortion demands and empty threats are on the rise as cybercriminals capitalize on the growing number of ransom-related attacks.

SurfWatch Labs collected data on many different companies tied to cybercrime over the past week. Some of those “newly seen” targets, meaning they either appeared in SurfWatch Labs’ data for the first time or else reappeared after being absent for several weeks, are shown in the chart below.

2017-03-11_ITTNew

Cyber Risk Trends From the Past Week

2017-03-11_RiskScoresNearly every week researchers discover new data breaches due to publicly exposed databases that require no authentication, and this past week insecure Rync backups exposed the entire operation of River City Media (RCM), providing a rare glimpse inside what security researcher Chris Vickery described as “a massive, illegal spam operation.”

The discovery led to a months-long investigation as MacKeeper Security Research Center, CSO Online, and Spamhaus came together to examine the data, which included everything from Hipchat logs to accounting details to infrastructure planning and more. Vickery said that there are enough spreadsheets, hard drive backups, and chat logs leaked to fill a book, and both CSO Online and MacKeeper have already teased future stories peeling back additional layers of the operation.

But perhaps the most alarming discovery — along with details of  abusive scripts and techniques that have been forwarded to Google, Microsoft, Apple, and others — is a database of nearly 1.4 billion email accounts combined with real names, user IP addresses, and often physical address. Those email lists are used by RCM, which masquerades as a legitimate marketing firm, to send up to a billion emails a day, much of which can be classified as spam, according to the researchers.

On Thursday RCM issued a press release addressing the “numerous false and defamatory” statements made by the researchers and news outlets. The company said that the researchers did not find RCM’s “confidential and proprietary information through an unprotected rsync backup” and that if the researchers had contacted them prior to publication “they would have realized that a number of the statements in their articles were false and easily disprovable.” However, the press release did not provide an alternative explanation for how the researchers accessed the data, and Vickery said the company was not alerted since “it was decided that we should approach law enforcement and the affected companies (like Microsoft and Yahoo) before making any attempts at contacting the spammers directly.”

“What was legal and illegal isn’t for me to decide,” said Vickery. “But there are plenty of logs where they discuss illegal scripts and research into basically attacking mail servers and tricking the mail servers into doing things that would be against the law.”

Expect additional information to be reported in the coming weeks as the researchers and reporters comb through all of the data that was exposed.