The IT Nerd

Smartphone payment provider LINE Pay announced yesterday that around 133,000 users’ payment details were mistakenly published on GitHub between September and November of this year:

Files detailing participants in a LINE Pay promotional program staged between late December 2020 and April 2021 were accidentally uploaded to the collaborative coding creche by a research group employee. Among the leaked details were the date, time, and amount of transactions, plus user and franchise store identification numbers. Although names, addresses, telephone, credit card and bank account numbers were not shared, the names of the users and other details could be traced with a little effort. 

The information — which covered of over 51,000 Japanese users and almost 82,000 Taiwanese and Thai users — was accessed 11 times during the ten weeks it was available online. The information has since been removed, and LINE said users have been notified. The fintech division of the communication app company issued an apology and promised to train staff better.

An apology is not good enough. Not only do heads need to roll over this, the relevant government authorities need to investigate this company as they way they handle data is clearly suspect. Especially since they’ve had two other similar incidents in the past. Thus making this incident completely unacceptable by any standard.

A new report from SentinelOne details 27 vulnerabilities in the Eltima SDK, a USB-over-network library used by numerous cloud providers to remotely mount a local USB drive. The software and cloud platforms affected include Amazon WorkSpaces, FlexiHub and more. Exploiting these flaws would allow remote threat actors to gain elevated access on a cloud desktop to run code in kernel mode. 

Yan Michalevsky, CTO and Cofounder, Anjuna Security:

“The implication of this flaw is that remote attackers can gain privileged access on cloud instances and potentially compromise data.This is where Confidential Computing can further protect applications and data even when the infrastructure is compromised and attackers gain admin access.”

“This is just one example of what has been known for a while:  Today’s computing infrastructure isn’t safe. Any host data and security protection can be compromised via USB but also through multiple other software-based avenues that lead to the holy grail:  Unencrypted host memory.” 

There’s no sign of a widespread exploitation of the issues that SentinelOne has raised, and the vendors have been notified and taken action to mitigate them. But you can bet the bad guys are going to start to exploit this now that this report is out there if people don’t take the mitigation steps in the report.

Here’s a story that I thought I would never be writing. A Cuba Ransomware Gang Hauls in $44M in Payouts. That’s right. A ransomware gang in Cuba. The gang used a variety of tools and malware to carry out attacks in volume on critical sectors, warned the FBI in a flash alert.

Anurag Gurtu, CPO, StrikeReady (www.strikeready.co) had this to say:

Cuba ransomware is known to targets victims’ personal files such as photos, videos, and documents. This attack involves using CryptGenRandom API call to generate keys for encryption of files using a custom algorithm. It’s not uncommon to see this ransomware gang using a Russian linked malware –  Hancitor, aka Chanitor malware.  

Hancitor spreads via social engineering techniques mainly through phishing e-mails embedded with malicious links and weaponized Microsoft Office documents containing malicious macros in them. And its attack chain often begins with the threat actor sending out fake DocuSign malspam emails, which results in a victim unknowingly downloading a Trojanized Microsoft Word document. Once the fake DocuSign document is opened and its malicious macro code is allowed to run, Hancitor will reach out to its command and control (C2) infrastructure to receive a malicious URL containing a sample of Ficker to download.

Companies need to work on ensuring that their employees are equipped with the tools to avoid being phished. Because if the threat doesn’t get in, nothing bad will happen. And that’s the best form of protection.