Cyber Training Group International (CTGI)

Blog

  • Grubhub says hack on third-party exposed information on campus customers

    The delivery service Grubhub said a hacker stole personal data and partial payment card information from customers through a third-party contractor.

    In a statement published on Monday evening, the company said it recently identified a security incident that “originated with an account belonging to a third-party service provider that provided support services to Grubhub.”

    The information stolen includes names, email addresses, phone numbers, card types and the last four digits of card numbers. The hackers also stole hashed passwords for some legacy systems used by Grubhub. 

    The company did not respond to requests for comment about how many people were affected, when the incident happened and who was behind the attack. 

    “We recently detected unusual activity within our environment traced to a third-party service provider for our Support Team. Upon discovery, we promptly launched an investigation, identifying unauthorized access to an account associated with this provider. We immediately terminated the account’s access and removed the service provider from our systems altogether,” the company said.

    Also Read: US Treasury says Chinese hackers stole documents in ‘major incident’

    “The unauthorized individual accessed contact information of campus diners, as well as diners, merchants and drivers who interacted with our customer care service.”

    It is unclear what campus Grubhub is referring to. The company runs a service specifically for college students on campuses around the U.S. 

    The company said it “took immediate action” to contain the attack and worked with experts to investigate the incident. Grubhub added that it is “confident that the incident has been fully contained.” They have rotated any passwords that may have been leaked, according to the statement. 

    The company claimed it has taken several other steps to secure its systems but did not elaborate on what measures have been instituted. 

    Grubhub is one of the world’s most popular food delivery apps, with more than 375,000 merchants serving over 4,000 U.S. cities. In November, Grubhub was sold by its Dutch owner to a company named Wonder for $650 million. 

    The company recently paid a $25 million penalty to settle charges from the Federal Trade Commission that it hid the cost of delivery from some customers, deceived workers about how much they would make from deliveries and listed restaurants without their permission as a pressure tactic.  

    The settlement was originally for $140 million but it was partially suspended because Grubhub could not pay the full amount. 

    Several other food delivery platforms have dealt with cyberattacks involving customer information, including Asian and Hispanic grocery service Weee!, PurFoods and others.

    Credit: The Record

  • US Treasury says Chinese hackers stole documents in ‘major incident’

    US Treasury says Chinese hackers stole documents in ‘major incident’

    WASHINGTON (Reuters) -Chinese state-sponsored hackers breached the U.S. Treasury Department’s computer security guardrails this month and stole documents in what Treasury called a “major incident,” according to a letter to lawmakers that Treasury officials provided to Reuters on Monday.

    The hackers compromised third-party cybersecurity service provider BeyondTrust and were able to access unclassified documents, the letter said.

    According to the letter, hackers “gained access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users. With access to the stolen key, the threat actor was able to override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users.”

    “Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor,” the letter said.

    The Treasury Department said it was alerted to the breach by BeyondTrust on Dec. 8 and that it was working with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI to assess the hack’s impact.

    Treasury officials didn’t immediately respond to an email seeking further details about the hack. The FBI did not immediately respond to Reuters’ requests for comment, while CISA referred questions back to the Treasury Department.

    “China has always opposed all forms of hacker attacks,” Mao Ning, a spokesperson for China’s foreign ministry, told a regular news conference on Tuesday.

    A spokesperson for the Chinese Embassy in Washington rejected any responsibility for the hack, saying that Beijing “firmly opposes the U.S.’s smear attacks against China without any factual basis.”

    A spokesperson for BeyondTrust, based in Johns Creek, Georgia, told Reuters in an email that the company “previously identified and took measures to address a security incident in early December 2024” involving its remote support product. BeyondTrust “notified the limited number of customers who were involved,” and law enforcement was notified, the spokesperson said. “BeyondTrust has been supporting the investigative efforts.”

    The spokesperson referred to a statement posted on the company’s website on Dec. 8 sharing some details from the investigation, including that a digital key had been compromised in the incident and that an investigation was under way. That statement was last updated on Dec. 18.

    Tom Hegel, a threat researcher at cybersecurity company SentinelOne, said the reported security incident “fits a well-documented pattern of operations by PRC-linked groups, with a particular focus on abusing trusted third-party services – a method that has become increasingly prominent in recent years,” he said, using an acronym for the People’s Republic of China.”

    Credit: Reuters

  • How to tell if a USB cable is hiding malicious hacker hardware

    How to tell if a USB cable is hiding malicious hacker hardware

    Are your USB cables sending your data to hackers?

    We expect USB-C cables to perform a specific task: transferring either data or files between devices. We give little more thought to the matter, but malicious USB-C cables can do much more than what we expect.

    These cables hide malicious hardware that can intercept data, eavesdrop on phone calls and messages, or, in the worst cases, take complete control of your PC or cellphone. The first of these appeared in 2008 — but back then they were very rare and expensive — which meant the average user was largely safeguarded.

    Since then, their availability has increased 100-fold and now with both specialist spy retailers selling them as “spy cables” as well as unscrupulous sellers passing them off as legitimate products, it’s all too easy to buy one by accident and get hacked. So, how do you know if your USB-C cable is malicious?

    Identifying malicious USB-C cables

    Identifying malicious USB-C cables is no easy task since they are designed to look just like regular cables. Scanning techniques have been largely thought of as the best way to sort the wheat from the chaff, which is what industrial scanning company, Lumafield of the Lumafield Neptune industrial scanner fame, recently set out to show.

    Also Read: Secure Our World Software Updates Tips

    The company employed both 2D and 3D scanning techniques on the O.MG USB-C cable — a well-known hacked cable built for covert field-use and research. It hides an embedded Wi-Fi server and a keylogger in its USB connector. PCWorld Executive Editor Gordon Ung covered it back in 2021, and it sounds scary as hell.

    What Lumafield discovered is interesting to say the least. A 2D X-ray image could identify the cable’s antenna and microcontroller, but only the 3D CT scan could reveal another band of wires connected to a die stacked on top of the cable’s microcontroller. You can explore a 3D model of the scan yourself on Lumafield’s website.

    It confirms the worst — that you can only unequivocally confirm that a USB-C cable harbors malicious hardware with a 3D CT scanner, which unless you’re a medical radiographer or 3D industrial scientist is going to be impossible for you to do. That being so, here are some tips to avoid and identify suspicious USB-C cables without high-tech gear:

    • Buy from a reputable seller: If you don’t know and trust the brand, simply don’t buy. Manufacturers like Anker, Apple, Belkin, and Ugreen have rigorous quality-control processes that prevent malicious hardware parts from making it into cables. Of course, the other reason is simply that you’ll get a better product — 3D scans have similarly revealed how less reputable brands can lack normal USB-C componentry, which can result in substandard performance. If you’re in the market for a new cable right now, see our top picks for USB-C cables.
    • Look for the warning signs: Look for brand names or logos that don’t look right. Strange markings, cords that are inconsistent lengths or widths, and USB-C connectors with heat emanating from them when not plugged in can all be giveaways that a USB-C cable is malicious.
    • Use the O.MG malicious cable detector: This detector by O.MG claims to detect all malicious USB cables.
    • Use data blockers: If you’re just charging and not transferring data, a blocker will ensure no data is extracted. Apart from detecting malicious USB-C cables, the O.MG malicious cable detector functions as such a data blocker.
    • Use a detection service: If you’re dealing with extremely sensitive data for a business or governmental organization, you might want to employ the services of a company like Lumafield to detect malicious cables with 100 percent accuracy. Any such service will come with a fee, but it could be a small price to pay for security and peace of mind.

    If this article has been an eye-opener about the dodgy tactics hackers employ to steal your data, you’re not alone. Malicious USB-C cables are still not widely known about. That being so, be sure to share the tips above with your family and friends. The more people that take time to safeguard their data, the safer we will all be in the long run.

    Credit: PC World

  • Hackers Using Sitting Ducks Attack To Hijack Domains, 1 Million Domains Vulnerable

    Hackers Using Sitting Ducks Attack To Hijack Domains, 1 Million Domains Vulnerable

    Over 1 million registered domains could be vulnerable to a cyberattack method known as “Sitting Ducks,” as recently unveiled in a new report from Infoblox Threat Intel.

    This relatively unknown attack vector allows malicious actors to hijack legitimate domains by exploiting misconfigurations in DNS settings.

    The Sitting Ducks attack, which has been active since 2018, enables threat actors to gain full control of a domain by taking over its DNS configurations.

    Infoblox’s monitoring initiative identified approximately 800,000 vulnerable domains, with about 70,000 of those already hijacked.

    Threat Groups

    Several threat actor groups have been exploiting this attack vector:

    1. Vacant Viper: Active since December 2019, hijacking an estimated 2,500 domains annually to augment their malicious traffic distribution system called 404TDS.
    2. Vextrio Viper: Operating since early 2020, using hijacked domains as part of a massive traffic distribution system infrastructure.
    3. Horrid Hawk: Active since February 2023, using hijacked domains for investment fraud schemes across multiple languages and continents.
    4. Hasty Hawk: Since March 2022, has hijacked over 200 domains for phishing campaigns, primarily spoofing DHL shipping pages and fake donation sites.

    The attack is particularly dangerous due to its stealthy nature. Hijacked domains often retain their positive reputation which allows them to evade detection by security tools.

    This makes it challenging for security teams to identify and mitigate the threat. The impact of Sitting Ducks attacks is far-reaching, affecting organizations, individuals, and security teams.

    Businesses face reputational damage, while individuals risk malware infections, credential theft, and fraud.

    Security teams struggle to defend against these attacks due to the use of trusted domains in malicious infrastructure.

    To protect against Sitting Ducks attacks, domain holders, registrars, and DNS providers must ensure correct configurations and implement proper ownership verification processes.

    Increased awareness and vigilance within the cybersecurity community are crucial to addressing this growing threat.

    Credit: Cybersecurity News

  • New LightSpy Spyware Version Targets iPhones with Increased Surveillance Tactics

    New LightSpy Spyware Version Targets iPhones with Increased Surveillance Tactics

    Cybersecurity researchers have discovered an improved version of an Apple iOS spyware called LightSpy that not only expands on its functionality, but also incorporates destructive capabilities to prevent the compromised device from booting up.

    “While the iOS implant delivery method closely mirrors that of the macOS version, the post-exploitation and privilege escalation stages differ significantly due to platform differences,” ThreatFabric said in an analysis published this week.

    LightSpy, first documented in 2020 as targeting users in Hong Kong, is a modular implant that employs a plugin-based architecture to augment its capabilities and allow it to capture a wide range of sensitive information from an infected device.

    Attack chains distributing the malware leverage known security flaws in Apple iOS and macOS to trigger a WebKit exploit that drops a file with the extension “.PNG,” but is actually a Mach-O binary responsible for retrieving next-stage payloads from a remote server by abusing a memory corruption flaw tracked as CVE-2020-3837.

    This includes a component dubbed FrameworkLoader that, in turn, downloads LightSpy’s Core module and its assorted plugins, which have gone up significantly from 12 to 28 in the latest version (7.9.0).

    “After the Core starts up, it will perform an Internet connectivity check using Baidu.com domain, and then it will check the arguments that were passed from FrameworkLoader as the [command-and-control] data and working directory,” the Dutch security company said.

    “Using the working directory path /var/containers/Bundle/AppleAppLit/, the Core will create subfolders for logs, database, and exfiltrated data.”

    The plugins can capture a wide range of data, including Wi-Fi network information, screenshots, location, iCloud Keychain, sound recordings, photos, browser history, contacts, call history, and SMS messages, as well as gather information from apps like Files, LINE, Mail Master, Telegram, Tencent QQ, WeChat, and WhatsApp.

    Some of the newly added plugins also boast destructive features that can delete media files, SMS messages, Wi-Fi network configuration profiles, contacts, and browser history, and even freeze the device and prevent it from starting again. Furthermore, LightSpy plugins can generate fake push notifications containing a specific URL.

    The exact distribution vehicle for the spyware is unclear, although it’s believed to be orchestrated via watering hole attacks. The campaigns have not been attributed to a known threat actor or group to date.

    Some of the newly added plugins also boast destructive features that can delete media files, SMS messages, Wi-Fi network configuration profiles, contacts, and browser history, and even freeze the device and prevent it from starting again. Furthermore, LightSpy plugins can generate fake push notifications containing a specific URL.

    The exact distribution vehicle for the spyware is unclear, although it’s believed to be orchestrated via watering hole attacks. The campaigns have not been attributed to a known threat actor or group to date.

    Credit: The Hacker News

  • Secure Our World Software Updates Tips

    Secure Our World Software Updates Tips

    Secure-Our-World-Software-Updates-Tip-SheetDownload

  • Secure Our World Passwords Tips

    Secure-Our-World-Passwords-Tip-SheetDownload

  • Microsoft Reveals macOS Vulnerability that Bypasses Privacy Controls in Safari Browser

    Microsoft has disclosed details about a now-patched security flaw in Apple’s Transparency, Consent, and Control (TCC) framework in macOS that has likely come under exploitation to get around a user’s privacy preferences and access data.

    The shortcoming, codenamed HM Surf by the tech giant, is tracked as CVE-2024-44133 (CVSS score: 5.5). It was addressed by Apple as part of macOS Sequoia 15 by removing the vulnerable code.

    HM Surf “involves removing the TCC protection for the Safari browser directory and modifying a configuration file in the said directory to gain access to the user’s data, including browsed pages, the device’s camera, microphone, and location, without the user’s consent,” Jonathan Bar Or of the Microsoft Threat Intelligence team said.

    Microsoft said the new protections are limited to Apple’s Safari browser, and that it’s working with other major browser vendors to further explore the benefits of hardening local configuration files.

    HM Surf follows Microsoft’s discovery of Apple macOS flaws like Shrootless, powerdir, Achilles, and Migraine that could enable malicious actors to sidestep security enforcements.

    While TCC is a security framework that prevents apps from accessing users’ personal information without their consent, the newly discovered bug could enable attackers to bypass this requirement and gain access to location services, address book, camera, microphone, downloads directory, and others in an unauthorized manner.

    The access is governed by a set of entitlements, with Apple’s own apps like Safari having the ability to completely sidestep TCC using the “com.apple.private.tcc.allow” entitlement.

    While this allows Safari to freely access sensitive permissions, it also incorporates a new security mechanism called Hardened Runtime that makes it challenging to execute arbitrary code in the context of the web browser.

    That said, when users visit a website that requests location or camera access for the first time, Safari prompts for access via a TCC-like popup. These entitlements are stored on a per-website basis within various files located in the “~/Library/Safari” directory.

    The HM Surf exploit devised by Microsoft hinges on performing the following steps –

    • Changing the home directory of the current user with the dscl utility, a step that does not require TCC access in macOS Sonoma
    • Modifying the sensitive files (e.g., PerSitePreferences.db) within “~/Library/Safari” under the user’s real home directory
    • Changing the home directory back to the original directory causing Safari to use the modified files
    • Launching Safari to open a web page that takes a snapshot via the device’s camera and grab the location

    The attack could be extended further to save an entire camera stream or stealthily capture audio through the Mac’s microphone, Microsoft said. Third-party web browsers don’t suffer from this problem as they do not have the same private entitlements as Apple applications.

    Microsoft noted it observed suspicious activity associated with a known macOS adware threat named AdLoad likely exploiting the vulnerability, making it imperative that users take steps to apply the latest updates.

    “Since we weren’t able to observe the steps taken leading to the activity, we can’t fully determine if the AdLoad campaign is exploiting the HM surf vulnerability itself,” Bar Or said. “Attackers using a similar method to deploy a prevalent threat raises the importance of having protection against attacks using this technique.”

    Credit: The Hacker News

  • AI girlfriend site breached, user fantasies stolen

    AI girlfriend site breached, user fantasies stolen

    A hacker has stolen a massive database of users’ interactions with their sexual partner chatbots, according to 404 Media.

    The breached service, Muah.ai, describes itself as a platform that lets people engage in AI-powered companion NSFW chat, exchange photos, and even have voice chats.

    As you can imagine, data like this is very sensitive, so the site assures customers that communications are encrypted and says it doesn’t sell any data to third parties.

    The stolen data, however, tells a different story. It includes chatbot prompts that reveal users’ sexual fantasies. These prompts are in turn linked to email addresses, many of which appear to be personal accounts with users’ real names.

    Mauh.ai says it believes in freedom of speech and to uphold that right, it says:

    “AI technology should be for everyone, and its use case to be decided by each mature, individual adult. So that means we don’t actively censor or filter AI. So any topic can be discussed without running into a wall.”

    Unfortunately, that means that filth is created to satisfy the needs of some sick users, and some of the data contains horrifying explicit references to children.

    Presumably those users in particular don’t want their fantasies to be discovered, which is exactly what might happen if they are connected to your email address.

    The hacker describes the platform as “a handful of open-source projects duct-taped together.” Apparently, it was no trouble at all to find a vulnerability that provided access to the platform’s database.

    The administrator of Muah.ai says the hack was noticed a week ago and claims that it must be sponsored by the competitors in the “uncensored AI industry.” Which, who knew, seems to be the next big thing.

    The administrator also said that Muah.ai employs a team of moderation staff that suspend and delete ALL child-related chatbots on its card gallery (where users share their creations), Discord, Reddit, etc, But in reality, when two people posted about a reportedly underage AI character on the site’s Discord server, 404 Media claims a moderator told the users to not “post that shit” here, but to go “DM each other or something.”

    Muah.ai is just one example of a new breed of uncensored AI apps that offer hundreds of role-play scenarios with chatbots, and others designed to behave like a long-term romantic companion.

    404 Media says it tried to contact dozens of people included in the data, including users who wrote prompts that discuss having underage sex. Not surprisingly, none of those people responded to a request for comment.

    Update October 11

    There are reports that this information is in use for active extortion attempts. Whether these are based on actual activities on the platform or solely based on leaked email addresses is not yet known.

    Innovation before security

    Emerging platforms like these are often rushed into existence because there is money to be made. Unfortunately, that usually happens at the expense of security and privacy, so here are some things to bear in mind:

    • Don’t trust AI platforms that promise privacy and encryption just because they say so
    • Don’t login with your Google/Facebook/Microsoft credentials or by using your regular email address or phone number
    • Remember that anything you put online, including a service that promises privacy, has a risk of being made public

    Credit: Malwarebytes

  • LockBit Ransomware and Evil Corp Members Arrested and Sanctioned in Joint Global Effort

    LockBit Ransomware and Evil Corp Members Arrested and Sanctioned in Joint Global Effort

    A new wave of international law enforcement actions has led to four arrests and the takedown of nine servers linked to the LockBit (aka Bitwise Spider) ransomware operation, marking the latest salvo against what was once a prolific financially motivated group.

    This includes the arrest of a suspected LockBit developer in France while on holiday outside of Russia, two individuals in the U.K. who allegedly supported an affiliate, and an administrator of a bulletproof hosting service in Spain used by the ransomware group, Europol said in a statement.

    In conjunction, authorities outed a Russian national named Aleksandr Ryzhenkov (aka Beverley, Corbyn_Dallas, G, Guester, and Kotosel) as one of the high-ranking members of the Evil Corp cybercrime group, while simultaneously painting him as a LockBit affiliate. Sanctions have also been announced against seven individuals and two entities linked to the e-crime gang.

    “The United States, in close coordination with our allies and partners, including through the Counter Ransomware Initiative, will continue to expose and disrupt the criminal networks that seek personal profit from the pain and suffering of their victims,” said Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence, Bradley T. Smith.

    The development, part of a collaborative exercise dubbed Operation Cronos, comes nearly eight months after LockBit’s online infrastructure was seized. It also follows sanctions levied against Dmitry Yuryevich Khoroshev, who was revealed to be the administrator and individual behind the “LockBitSupp” persona.

    A total of 16 individuals who were part of Evil Corp have been sanctioned by the U.K. Also tracked as Gold Drake and Indrik Spider, the infamous hacking crew has been active since 2014, targeting banks and financial institutions with the ultimate goal of stealing users’ credentials and financial information in order to facilitate unauthorized fund transfers.

    The group, responsible for the development and distribution of the Dridex (aka Bugat) malware, has been previously observed deploying LockBit and other ransomware strains in 2022 in order to get around sanctions imposed against the group in December 2019, including key members Maksim Yakubets and Igor Turashev.

    Ryzhenkov has been described by the U.K. National Crime Agency (NCA) as Yakubets’ right-hand man, with the U.S. Department of Justice (DoJ) accusing him of deploying BitPaymer ransomware to target victims across the country since at least June 2017.

    “Ryzhenkov used the affiliate name Beverley, made over 60 LockBit ransomware builds and sought to extort at least $100 million from victims in ransom demands,” officials said. “Ryzhenkov additionally has been linked to the alias mx1r and associated with UNC2165 (an evolution of Evil Corp affiliated actors).”

    Additionally, Ryzhenkov’s brother Sergey Ryzhenkov, who is believed to use the online alias Epoch, has been linked to BitPaymer, per cybersecurity firm Crowdstrike, which assisted the NCA in the effort.

    “Throughout 2024, Indrik Spider gained initial access to multiple entities through the Fake Browser Update (FBU) malware-distribution service,” it noted. “The adversary was last seen deploying LockBit during an incident that occurred during Q2 2024.”

    Notable among the individuals subjected to sanctions are Yakubets’ father, Viktor Yakubets, and his father-in-law, Eduard Benderskiy, a former high-ranking FSB official, underscoring the deep connection between Russian cybercrime groups and the Kremlin.

    “The group were in a privileged position, with some members having close links to the Russian state,” the NCA said. “Benderskiy was a key enabler of their relationship with the Russian Intelligence Services who, prior to 2019, tasked Evil Corp to conduct cyber attacks and espionage operations against NATO allies.”

    “After the U.S. sanctions and indictments in December 2019, Benderskiy used his extensive influence with the Russian state to protect the group, both by providing senior members with security and by ensuring they were not pursued by Russian internal authorities.”

    Credit: The Hacker News