Dentx
@dentxENTHUSIAST | Winning Attitude Wins! | Become a shareholder today!
📰 Around the Cyber World
Microsoft Previews Scareware Blocker in Edge — Microsoft said it's adding a new scareware blocker to its Edge browser to defend against tech support scams that use fake web pages to fool victims into thinking that their systems are infected with malware, and persuade them to either call a fake support number or gain unauthorized access to their systems. "Scareware blocker uses a machine learning model to recognize the tell-tale signs of scareware scams and puts users back in control of their computer," the company said. "The model uses computer vision to compare full screen pages to thousands of sample scams that the scam-fighting community shared with us. The model runs locally, without saving or sending images to the cloud." Last year, the U.S. Federal Trade Commission (FTC) fined two tech support firms Restoro and Reimage $26 million over charges that they lured consumers with fake Microsoft Windows pop-ups, stating their computers were compromised with viruses. The development comes as Microsoft said it's continuing to roll out safeguards against brand impersonation attempts in Teams, a technique adopted by various threat actors for malware propagation.
Brazil Bans Tools for Humanity From Paying People for Iris Scans — Brazilian data privacy regulators have prohibited Tools for Humanity (TFH), a biometric identity company co-founded by OpenAI CEO Sam Altman, from offering compensation to citizens for iris scans, saying such data collection practice interferes with a person's decision to grant consent for access to sensitive personal data. "Consent for the processing of sensitive personal data, such as biometric data, must be free, informed, unequivocal and provided in a specific and highlighted manner, for specific purposes," the National Data Protection Authority (ANPD) said. TFH told The Record that it follows all laws and regulations in the country. The ban coincided with a complaint filed by the European Consumer Organisation (BEUC), criticizing Meta for its pay or consent policy and for failing to give users a fair choice.
New Research Uncovers Intel TDX Vulnerability — Intel Trust Domain Extensions (TDX) has become a crucial CPU-level technology aimed at strengthening the isolation and security guarantees of virtual machines to protect sensitive data and applications from unauthorized access. This also means that vulnerabilities discovered in the technology can undermine its confidentiality and integrity objectives by breaching the isolation between the Virtual Machine Manager (VMM) and Trust Domains (TDs). A new study by a group of researchers from the Indian Institute of Technology Kharagpur and Intel has uncovered a critical flaw in TDX's Performance Monitoring Counters (PMC) virtualization that breaks the isolation between the VMM and TD, as well as between different TDs running concurrently on the same system. "In a particular scenario where the VMM and a TD are co-located on the same core, resource contention arises, exposing the TD’s computation patterns on PMCs collected by the VMM for its own processes making PMC virtualization ineffective," the study said.
Threat Actor Infects Over 18K Devices Using Trojanized RAT Builder — An unknown threat actor is going after script kiddies to trick them into downloading a trojanized version of the XWorm RAT builder via GitHub repositories, file-sharing services, Telegram channels, and YouTube videos to compromise over 18,459 devices globally. The top countries impacted include Russia, the U.S., India, Ukraine, and Turkey. "The malware uses Telegram as its command-and-control (C&C) infrastructure, leveraging bot tokens and API calls to issue commands to infected devices and exfiltrate stolen data," CloudSEK researcher Vikas Kundu said. The malicious operation, however, has been disrupted by taking advantage of the malware's kill switch to issue an "/uninstall" command over Telegram. It's worth noting that machines that were not online when the command was sent remain compromised.
Researchers Detail Browser Syncjacking Technique — A new attack method called Browser Syncjacking shows that it's possible to take control of a victim's device by installing a seemingly innocuous Chrome browser extension, highlighting how add-ons could become lucrative low-hanging fruits for attackers. It involves a series of steps that begins with the adversary creating a malicious Google Workspace domain and setting up several user profiles under it without any security features. The adversary then publishes an extension to the Web Store and tricks victims into installing it using social engineering techniques. Once installed, the extension is used to stealthily log the victim into a Chrome browser profile managed by the attacker using a hidden window, thus enabling the threat actor to push arbitrary Chrome policies on the profile. This includes urging victims to turn on Chrome Sync, allowing the attacker to access all of the victim's secrets via the hijacked profile. The end goal, per SquareX, is to turn the whole browser into a managed browser controlled by the attacker, granting them the ability to enforce custom extensions that can be hosted on private links and don't have to go through the Chrome Web Store vetting process. Installing one of these add-ons could be enough to harvest sensitive data and seize control of the system through a clandestine communication mechanism that makes use of Chrome's Native Messaging API. Separately, recent research undertaken by security researcher Wladimir Palant has found that third-party extension developers are abusing a language translation feature built into the extension description system to push sketchy add-ons users search for legitimate extensions on the Web Store. Also discovered were an additional set of Chrome extensions capable of injecting ads into web pages, tracking website visits, affiliate fraud, and cookie stuffing attacks.
Subaru Starlink Flaw Let Hackers Hijack Cars — A security vulnerability in Subaru's Starlink connected vehicle service that could have granted unrestricted targeted access to all vehicles and customer accounts in the United States, Canada, and Japan. Using the access provided by the vulnerability, an attacker who only knew the victim's last name and ZIP code, email address, phone number, or license plate could have remotely started, stopped, locked, or unlocked any vehicle. It could also have been abused to retrieve the current location, as well as the history from the past year, accurate to within 5 meters and updated each time the engine starts. The vulnerability could also have allowed access to sensitive personal information, call history, previous ownership details, sales history, and odometer readings. The vulnerability in the web portal was fixed on November 21, 2024, within 24 hours of responsible disclosure by researchers Sam Curry and Shubham Shah. There is no evidence it was ever maliciously exploited in the wild. The flaws are just the latest in a series of vulnerabilities that have affected other carmakers, such as Kia and Mercedes-Benz.
🔔 Top Security News
Law Enforcement Operation Takes Down Illicit Cybercrime Services — A series of law enforcement operations have taken down various online marketplaces such as Cracked, Nulled, Sellix, StarkRDP, and HeartSender that sold hack tools, illegal goods, and crimeware solutions. Millions of users are estimated to have been impacted, earning the threat actors hundreds of thousands of dollars in illegal revenues.
Apple Fixed an Actively Exploited Zero-Day — Apple released software updates for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to address a zero-day vulnerability (CVE-2025-24085) that it said has been exploited in the wild. The flaw is a use-after-free bug in the Core Media component that could permit a malicious application already installed on a device to elevate privileges. There are currently no details available on how it has been weaponized in real-word attacks, who may have been targeted, and the scale of the attacks.
New WhatsApp Spyware Campaign Targets 90 Individuals — Meta-owned WhatsApp disclosed it disrupted a campaign that involved the use of spyware owned by an Israeli company named Paragon Solutions to target about 90 journalists and civil society members. The attack chain is said to be zero-click, meaning the deployment of the spyware occurs without requiring any user interaction. The company noted the targets were spread across over two dozen countries, including several in Europe. The development marks the first time Paragon, which claims to provide "ethically based tools" to "disrupt intractable threats," has been linked to spyware misuse.
Patched Mitel Flaw Exploited by Aquabot — A Mirai botnet variant dubbed Aquabot is actively attempting to exploit a medium-severity security flaw impacting Mitel phones in order to ensnare them into a rogue network capable of mounting distributed denial-of-service (DDoS) attacks. The flaw (CVE-2024-41710), a command injection vulnerability that allows for arbitrary command execution within the context of the phone, was addressed by Mitel in July 2024.
UAC-0063 Uses Stolen Docs to Target Other Victims — A hacking group tracked as UAC-0063 has been linked to a series of attacks that involve the use of documents stolen from one victim as lures to target others and infect them with a known loader malware called HATVIBE. The attacks have also involved the deployment of a newly discovered USB data exfiltrator codenamed PyPlunderPlug in at least one incident targeting a German company in mid-January 2023.
📰 Around the Cyber World
India and the U.S. Sign Cybercrime MoU — India and the United States have signed a memorandum of understanding (MoU) to bolster cooperation in cybercrime investigations. "The MoU allows the respective agencies of the two countries to step up the level of cooperation and training with respect to the use of cyber threat intelligence and digital forensics in criminal investigations," the Indian Ministry of External Affairs (MEA) said in a statement.
Critical Security Flaws in ABB ASPECT-Enterprise, NEXUS, and MATRIX Products — More than a 100 security flaws have been disclosed in ABB ASPECT-Enterprise, NEXUS, and MATRIX series of products that could enable an attacker to disrupt operations or execute remote code. Gjoko Krstikj of Zero Science Lab has been credited with discovering and reporting the flaws.
91% of Exposed Exchange Server Instances Still Vulnerable to ProxyLogon — One of the vulnerabilities exploited by the China-linked Salt Typhoon hacking group for initial access is CVE-2021-26855 (aka ProxyLogon), a nearly four-year-old flaw in Microsoft Exchange Server. According to a new analysis from cybersecurity company Tenable, 91% of the nearly 30,000 external-facing instances of Exchange vulnerable to CVE-2021-26855 have not been updated to close the defect to date. "Salt Typhoon is known for maintaining a stealthy presence on victim networks and remaining undetected for a significant time period," it said.
IntelBroker Resigns from BreachForums — The threat actor known as IntelBroker has announced his resignation as the owner of an illicit cybercrime forum called BreachForums, citing a lack of time. The development marks the latest twist in the tumultuous history of the online criminal bazaar, which has been the subject of law enforcement scrutiny, resulting in a takedown of its infrastructure and the arrest of its previous administrators. Its original creator and owner Conor Brian Fitzpatrick (aka Pompompurin) was sentenced to time served and 20 years of supervised release exactly a year ago. However, newly filed court documents show that his sentence has been vacated -- i.e., declared void. "While released on bond awaiting sentencing, Fitzpatrick violated his conditions of release immediately by secretly downloading a virtual private network, which he then used virtually every day to access the Internet without the knowledge of his probation officer," the document reads. "Not only did Fitzpatrick commit serious offenses, but he also showed a lack of remorse, joking about committing additional crimes even after entering a guilty plea."
Cloudflare CDN Bug Leaks User Locations — A new piece of research from a 15-year-old security researcher who goes by the name Daniel has uncovered a novel "deanonymization attack" in the widely used Cloudflare content delivery network (CDN) that can expose someone's location by sending them an image on platforms like Signal, Discord, and X. The flaw allows an attacker to extract the location of any target within a 250-mile radius when a vulnerable app is installed on a target's phone, or as a background application on their laptop, simply by sending a specially-crafted payload. Using either a one-click or zero-click approach, the attack takes advantage of the fact that Cloudflare stores cache copies of frequently accessed content on data centers located in close proximity to the users to improve performance. The security researcher developed a Teleport tool that let them check which of Cloudflare's data centers had cached an image, which allowed them to triangulate the approximate location a Discord, Signal, or X user might be in. Although the specific issue was closed, Daniel noted that the fix could be bypassed using a VPN. While the geolocation capability of the attack is not precise, it can provide enough information to infer the geographic region where a person lives, and use it as a stepping stone for follow-on intelligence gathering. "The attack leverages fundamental design decisions in caching and push notification systems, demonstrating how infrastructure meant to enhance performance can be misused for invasive tracking," the researcher said.
Belsen Group Leaks Fortinet FortiGate Firewall Configs — A little-known hacking group named Belsen Group has leaked configuration data for over 15,000 Fortinet FortiGate firewalls on the dark web for free. This includes configurations and plaintext VPN user credentials, device serial numbers, models, and other data. An analysis of the data dump conducted by security researcher Kevin Beaumont has revealed that the configuration data has likely been put together by exploiting CVE-2022-40684, an authentication bypass zero-day vulnerability disclosed in October 2022, as a zero-day. Of the 15,469 distinct affected IP addresses, 8,469 IPs have been found to be still online and reachable in scans. As many as 5,086 IPs are continuing to expose the compromised FortiGate login interfaces. A majority of the exposures are in Mexico, Thailand, and the U.S. "If your organization has consistently adhered to routine best practices in regularly refreshing security credentials and taken the recommended actions in the preceding years, the risk of the organization's current config or credential detail in the threat actor’s disclosure is small," Fortinet said in response to the disclosure. The disclosure comes as another critical flaw in FortiGate devices (CVE-2024-55591 aka Console Chaos) has come under active exploitation in the wild since November 1, 2024.
🔔 Top Security News
Palo Alto Firewalls Found Vulnerable to Firmware Exploits — An analysis of three firewall models from Palo Alto Networks – PA-3260, PA-1410, and PA-415 – uncovered that they are vulnerable to known security flaws that could be exploited to achieve Secure Boot bypass and modify device firmware. In response to the findings, Palo Alto Networks said exploiting the flaws require an attacker to first compromise PAN-OS software through other means and obtain elevated privileges to access or modify the BIOS firmware. It also said it will be working with third-party vendors to develop firmware updates for some of them.
PlushDaemon Linked to Supply Chain Compromise of South Korean VPN Provider — A never-before-seen China-aligned hacking group named PlushDaemon carried out a supply chain attack targeting a South Korean virtual private network (VPN) provider in 2023 to deliver malware known as SlowStepper, a fully-featured backdoor with an extensive set of information gathering features. The threat actor is also said to have exploited an unknown vulnerability in Apache HTTP servers and conducted adversary-in-the-middle (AitM) attacks to breach other targets of interest. Active since at least 2019, the group has singled out individuals and entities in China, Taiwan, Hong Kong, South Korea, the United States, and New Zealand.
Mirai Botnet Launches Record 5.6 Tbps DDoS Attack — Cloudflare revealed that a Mirai botnet comprising over 13,000 IoT devices was responsible for a record-breaking 5.6 Terabit per second (Tbps) distributed denial-of-service (DDoS) attack aimed at an unnamed internet service provider (ISP) from Eastern Asia. The attack lasted about 80 seconds. The web infrastructure company said the average unique source IP address observed per second was 5,500, and the average contribution of each IP address per second was around 1 Gbps.
Over 100 Flaws in LTE and 5G Implementations — A group of academics has disclosed 119 security vulnerabilities impacting LTE and 5G implementations, Open5GS, Magma, OpenAirInterface, Athonet, SD-Core, NextEPC, srsRAN, that could be exploited by an attacker to disrupt access to service and even gain a foothold into the cellular core network. Some of the identified vulnerabilities could be weaponized to breach the cellular core network and leverage that access to monitor cellphone location and connection information for all subscribers at a city-wide level, carry out targeted attacks on specific subscribers, and perform further malicious actions on the network itself.
Ex-CIA Analyst Pleads Guilty to Sharing Top Secret Docs — Asif William Rahman, a former analyst working for the U.S. Central Intelligence Agency (CIA), pleaded guilty to transmitting top secret National Defense Information (NDI) to unauthorized personnel and attempted to cover up the activity. The incident, which took place in October 2024, involved Rahman sharing documents prepared by the National Geospatial-Intelligence Agency and the National Security Agency. They were related to Israel's plans to attack Iran, and were subsequently shared on Telegram by an account called Middle East Spectator. He has pleaded guilty to two counts of willful retention and transmission of classified information related to the national defense. He is expected to be sentenced on May 15, 2025, potentially facing a maximum penalty of 10 years in prison.
