Cyber Incident on iPay88

Another Cyber incident.

Unlike the Cyber attack on Cisco, there is no much information been disclosed by iPay88. As iPay88 is the largest online payment gateway and platform in Malaysia, some financial data could be leaked. 

Links:

• https://www.ipay88.com/ipay88-media-statement-on-cybersecurity-incident/
  

Cyber Attack on Cisco

The threat actors manage to gain access to corporate network even the VPN is protected with MFA. And 2.75GB of data are stolen from Cisco.

IMO, using push notification MFA can be insecure if it is mis-configured. Same for any 2FA or MFA, a mis-configured security controls is just a false sense of security. 

Here is the initial vector from Cisco Talos.

Initial access to the Cisco VPN was achieved via the successful compromise of a Cisco employee’s personal Google account. The user had enabled password syncing via Google Chrome and had stored their Cisco credentials in their browser, enabling that information to synchronize to their Google account. After obtaining the user’s credentials, the attacker attempted to bypass multifactor authentication (MFA) using a variety of techniques, including voice phishing (aka "vishing") and MFA fatigue, the process of sending a high volume of push requests to the target’s mobile device until the user accepts, either accidentally or simply to attempt to silence the repeated push notifications they are receiving. Vishing is an increasingly common social engineering technique whereby attackers try to trick employees into divulging sensitive information over the phone. In this instance, an employee reported that they received multiple calls over several days in which the callers – who spoke in English with various international accents and dialects – purported to be associated with support organizations trusted by the user.  

Once the attacker had obtained initial access, they enrolled a series of new devices for MFA and authenticated successfully to the Cisco VPN. The attacker then escalated to administrative privileges, allowing them to login to multiple systems, which alerted our Cisco Security Incident Response Team (CSIRT), who subsequently responded to the incident. The actor in question dropped a variety of tools, including remote access tools like LogMeIn and TeamViewer, offensive security tools such as Cobalt Strike, PowerSploit, Mimikatz, and Impacket, and added their own backdoor accounts and persistence mechanisms. 

We all can learn more TTP (tactics, techniques, and procedures) from this Cisco breach at Cisco Talos.

Links:

• https://www.bleepingcomputer.com/news/security/cisco-hacked-by-yanluowang-ransomware-gang-28gb-allegedly-stolen/
• Cisco Talos shares insights related to recent cyber attack on Cisco
  

SonyPictures.com is Hacked via sqli

Sony Pictures web site is hacked, via SQL injection. All the user ID, emails, and password are shown in plaintext (and available for download).

RSA (March), PSN (April~May), Sony Pictures (June), what's next?

A good write up on Sony PSN attack at Deciphering the Sony PSN Attack.

Exploit-DB Owned and Exposed

Exploit Database was owned and exposed in Christmas morning.

Hacked by B0ogle

This morning, at http://merdekareview.com/news/n/16062.html

http://merdekareview.com/news/n/16062.html

The website has published a notice about this at http://merdekareview.com/news/n/16063.html

MI5 Website Hacked

The website of the UK counter-intelligence and security agency MI5, has been hacked with the result that the identity of visitors could be stolen and viruses downloaded to their computers.

According to the source, it was hacked by a group of hackers, known as Team Elite, who has previously hacked into the WHO's website and attacked VISA's computer systems.

Read more on:

• EXCLUSIVE: HACKERS BREAK INTO MI5’S WEBSITE
• MI5 website hacked.

It is Time for Network Solutions

>>>> Half a million customers' credit card data stolen from Network Solutions

Unknown criminals have stolen more than 500,000 data sets containing credit card numbers from registrar and hosting provider Network Solutions. Apparently, the criminals managed to inject special code, designed to intercept transaction data, into 4,343 Network Solutions hosted merchant websites.

The injected code appears to have been activated on March 12 and was not discovered until June 8. During the period in which the code was active, details of 573,928 purchases, from web sites using the Network Solutions infrastructure, were intercepted. Details of how the attackers penetrated the system have yet to be disclosed.

Laws in many US states requiring customers affected by such cases to be informed have created an organizational nightmare for many small shop operators; not least, because the laws governing such cases vary from state to state. Network Solutions has extended these operators a helping hand, however, offering to handle informing shop owners' customers for free through a company called Trans Union that specialises in such matters.

For customers whose credit card data was stolen, Network Solutions has offered to monitor transactions for suspicious activity for 12 months, free of charge. According to the company's information page, the offer only applies to customers located within the United States. It is still not clear whether customers in other countries have been affected. While the customer FAQ states that Trans Union will also inform foreign customers, the dealers' information page specifically mentions only "US-based customers."

Security Breach on Twitter

Twitter has now confirmed that there was unauthorised access to its administration interface. The French blog Korben has published screen-shots which show details of the accounts belonging to Ashton Kutcher, Lily Allen, Britney Spears and Barack Obama.

See more detail at Twitter blog and here.

Does PCI Works?

This is a news from Computer World.

Payment card industry's data security rules aren't working, critics say; (and of course ) VISA, PCI council continue to defend stand.

Some evidences:

• Hannaford was certified as PCI-compliant by a 3rd-party assessor in Feb 2008, just 1 day after the company was informed of the system intrusions (which had begun 2 months ago).
• RBS WorldPay was certified as PCI-compliant prior to breaches that the payment processors disclosed in Dec 2007 and Jan 2008 respectively.

Interesting?