VPN server credentials compromised. Interpol reports on cybercrime trends. Oilrig gets stealthy. NSA's privacy advice.

Plaintext usernames, passwords, and IP addresses for more than nine-hundred Pulse Secure VPN enterprise servers are being shared on a Russian language hacker forum, a ZDNet investigation has found. All the compromised servers were running firmware vulnerable to CVE-2019-11510. The forum to which the data were posted is frequented by ransomware gangs.

Interpol yesterday released a report on cybercrime trends observed during the COVID-19 pandemic. There’s been a shift in targeting. Initially individuals and smaller organizations were the preferred targets, but more recently large companies, government agencies, and infrastructure have been the focus of threat actors.

ZDNet reports that Kaspersky has found that the Iranian threat group Oilrig (APT34) is using DNSExfiltrator, a utility that uses DNS-over-HTTPS (DoH) as an exfiltration channel that enables attackers to move data in more surreptitious ways.

The US National Security Agency has released an advisory on the risks associated with the geolocation data many systems and apps routinely collect. “Location data can be extremely valuable and must be protected. It can reveal details about the number of users in a location, user and supply movements, daily routines (user and organizational), and can expose otherwise unknown associations between users and locations,” NSA’s warning said. The agency’s recommendations are addressed in the first instance to Government personnel, but they’re presented as applicable to anyone concerned about privacy: turn off location-sharing services, give apps minimal privileges, set browser options to prevent use of location data, turn off advertising permissions, and even disenabling features that track lost devices.