Media Coverage

Last week, we took a look at Shodan results to try to determine which countries are the “richest” in the world when it comes to machines vulnerable to BlueKeep visible from the internet. Since the number of vulnerable machines Shodan detects grows every day (see the following chart), I thought it might be interesting to have another look at the numbers. But in a way which is a little different. It should be mentioned that the rise in the number of affected machines is most likely due to Shodan scanning previously unscanned IP ranges and not because there are actually more vulnerable machines out there. In fact it is quite probable that a not insignificant percentage of machines shown by Shodan as vulnerable have either been assigned different IP addresses since the detection (and could therefore have even been counted multiple times) of have been patched since the detection. If you’d like to see something closer to an actual “real-time” look at the number of machines which are still vulnerable to BlueKeep and accessible from the internet, Shadowserver will probably be a better place to look then Shodan.

In the beginning there were Google Dorks; as far back as 2002 security researches discovered that specific Google queries could reveal Internet connected devices. Seventeen years later it is still possible to find thousands of unsecured remotely accessible security cameras and printers via simple Google searches. In 2004 the Shadowserver was started by a group of volunteers. Working from the principle that sharing Internet Attack Data can only enhance the overall security of the Internet they quickly became a primary source for security researchers. Over the years they have been publishing reports, sharing cyber crime data and scanning the Internet. With a focus on cyber crime they share reports of C2 services, DDOS botnet services and other attack based infrastructure.

Together with Dutch internet providers, TU Delft sets up a honeypot network to map compromised Internet of Things devices. The honeypot network is specially developed to gain insight into infected IoT devices in the Netherlands. Information about contaminated IoT devices is shared with the relevant internet providers. This is done via the AbuseHUB of the Abuse Information Exchange . The project not only provides information about infected Dutch IoT devices, but also about foreign devices. It is possible that this information will be shared with a party such as the Shadowserver Foundation, that informs affiliated providers about infections in their network.

Late last week, we observed a number of compromises on Amazon CloudFront – a Content Delivery Network (CDN) – where hosted JavaScript libraries were tampered with and injected with web skimmers. The skimmer used in this attack looked eerily familiar. Indeed, by going back in time, we noted it used to have the same exfiltration gate (font-assets[.]com) identified by Yonathan Klijnsma in RiskIQ’s report on several recent supply-chain attacks. RiskIQ, in partnership with Abuse.ch and the Shadowserver Foundation, sinkholed both that domain and another (ww1-filecloud[.]com) in an effort to disrupt the criminal’s infrastructure.

“This will likely lead to an event as damaging as WannaCry and notPetya from 2017 — potentially worse, as hackers have since honed their skills exploiting these things for ransomware and other nastiness,” said a blog post by researchers at Errata Security. The flaw, dubbed Bluekeep, was found in Remote Desktop Services and affects older versions of Windows, including Windows 7, Windows XP, Server 2003 and Server 2008. Errata Security researcher Robert Graham carried out a scan of devices using a tool called Masscan, to find the port (3389) used by Remote Desktop, the one used by Remote Desktop. While this found all open ports, Graham then used a Remote Desktop Protocol scanning project created by The Shadowserver Foundation, to find the million devices vulnerable to Bluekeep.

Dark Deeds in the DNS. It is no secret to either the people who undertake dark deeds on the Internet or to those trying to catch them that the DNS is one of the few systems that is universally visible. So, it’s no surprise that domain names are used to control botnets. Much time and effort has been spent studying DNS and the ways in which the DNS has been coopted to control malware. Stewart Garrick of Shadowserver presented on the Avalanche investigation, a multi-year law enforcement effort that spanned a number of countries. Some 2.5M domain names were blocked or seized during the investigative process.

A complex transnational organized cybercrime network that used GozNym malware in an attempt to steal an estimated $100 million from unsuspecting victims in the United States and around the world has been dismantled as part of an international law enforcement operation.  GozNym infected tens of thousands of victim computers worldwide, primarily in the United States and Europe.  The operation was highlighted by the unprecedented initiation of criminal prosecutions against members of the network in four different countries as a result of cooperation between the United States, Georgia, Ukraine, Moldova, Germany, Bulgaria, Europol and Eurojust. Other agencies and organizations partnering in this effort include the United States Secret Service, the National Cyber-Forensics and Training Alliance (NCFTA) in Pittsburgh and the Shadowserver Foundation

A complex transnational organized cybercrime network that used GozNym malware in an attempt to steal an estimated $100 million from unsuspecting victims in the United States and around the world has been dismantled as part of an international law enforcement operation.  GozNym infected tens of thousands of victim computers worldwide, primarily in the United States and Europe.  The operation was highlighted by the unprecedented initiation of criminal prosecutions against members of the network in four different countries as a result of cooperation between the United States, Georgia, Ukraine, Moldova, Germany, Bulgaria, Europol and Eurojust. Other agencies and organizations partnering in this effort include the United States Secret Service, the National Cyber-Forensics and Training Alliance (NCFTA) in Pittsburgh and the Shadowserver Foundation.

Last weekend, security researchers surfaced new supply-chain attacks involving Magecart web-skimmers placed on several web-based suppliers, including AdMaxim, CloudCMS, and Picreel. The breaches were part of a large-scale attack that hit a breadth of providers simultaneously intending to access as many websites as possible.

Web-based supply-chain attacks, which compromise vendors that supply code that adds or improves website functionality, gives attackers access to a wide range of victims at once because the compromised code often integrates with thousands of sites. In this blog, we’ll break down the Magecart skimming activity on these seven providers and detail when and how the compromises occurred, including how some of them could have been far worse.

The same skimmer was used for attacks against both services, which indicates it was the same Magecart Group. The exfiltration domain where stolen card data would have been sent was font-assets.com, which is associated with ww1-filecloud.com, another domain owned by the same attackers.

Both domains have been taken down and/or sinkholed with the help of Abuse.CH and the Shadowserver Foundation.