DoD says no involvement in police surveillance. ActionSpy used against Android devices. D-Link fixes six vulnerabilities.

Summary

By the CyberWire staff

At a glance.

Pentagon says it offered no intelligence support to police during protests.
ActionSpy Android spyware in circulation.
D-Link patches six privacy-threatening vulnerabilties in home routers.

Pentagon says no military surveillance used during protests.

According to the Washington Post, the US Undersecretary of Defense for Intelligence and Security responded to an inquiry from the Chair of the House Intelligence Committee with a letter assuring the Committee that the Department of Defense didn't provide intelligence or surveillance to law enforcement agencies during recent unrest. Undersecretary Kernan, said no one asked him to “undertake any unlawful or inappropriate intelligence activities that could violate civil liberties” in response to the protests, that he himself directed no agency to do so, and that the Directors of the National Security Agency, the Defense Intelligence Agency, and the National Geospatial Intelligence Agency all assured him that they've also not engaged in such activities.

New Android spyware may have wider application.

Trend Micro is tracking a new campaign by Earth Empusa (also known as Poison Carp, a group believed to be linked to the Chinese government) against Uyghurs in Tibet. The campaign uses a new strain of Android spyware, ActionSpy. Modularized and typically distributed in watering hole attacks, ActionSpy has also been used against a travel agency in Taiwan and political and media organizations in Turkey. The Muslim Uyghur minority in China has long been a target of domestic surveillance, but ActionSpy is clearly adaptable to multiple uses and multiple targets. Its use in Taiwan and Turkey suggest that it's already finding such application.

D-Link patches home router vulnerabilities.

Palo Alto Networks' Unit 42 research shop disclosed Friday that it had found six vulnerabilities in D-Link wireless routers:

CVE-2020-13782: Improper Neutralization of Special Elements Used in a Command (Command Injection)
CVE-2020-13786: Cross-Site Request Forgery (CSRF)
CVE-2020-13785: Inadequate Encryption Strength
CVE-2020-13784: Predictable seed in pseudo-random number generator
CVE-2020-13783: Cleartext storage of sensitive information
CVE-2020-13787: Cleartext transmission of sensitive information

D-Link has issued patches for each of the vulnerabilities.

Selected Reading

Military spy agencies did not monitor protesters, Pentagon official says (Washington Post) The assurance by the undersecretary for intelligence and security came in response to questions from Rep. Adam Schiff (D-Calif.).

Hacked: Aussie websites for sale on dark web (Australian Financial Review) ASX-listed companies, financial services firms and law firms are among hundreds of Australian websites for sale on the dark web.

Accessories store Claire’s hit by Magecart credit card fraudsters (ComputerWeekly) Attackers gained access to retailer’s website as long ago as March.

As Final Calif. Privacy Regs Drop, Enforcement Fights Loom (Law360) The California attorney general declined to clarify several key ambiguities in his final rules for implementing the state's landmark privacy law, leaving businesses bracing for enforcement battles and putting the spotlight on a likely ballot initiative that is poised to further complicate matters.

Botnet threat: 100,000 wireless cameras in UK vulnerable to hackers (SC Magazine) More than 100,000 wireless active cameras in UK businesses and homes may be vulnerable to hackers due to a combination of security flaws, an investigation has found.

Palo Alto Networks reveals D-Link home router vulnerabilities (CyberScoop) Taiwanese consumer technology manufacturer D-Link has issued security fixes for a series of bugs that, if exploited, could have enabled hackers to steal passwords and other sensitive data from home internet routers during the coronavirus pandemic.

Hackers spotting exposed Elasticsearch servers faster than search engines (SC Magazine) Hackers have been finding unprotected Elasticsearch servers exposed on the internet quicker than search engines can index them, new research from Comparitech has found.

Hackers are quick to notice exposed Elasticsearch servers (BleepingComputer) Bad guys find unprotected Elasticsearch servers exposed on the web faster than search engines can index them. A study found that threat actors are mainly going for cryptocurrency mining and credential theft.

Earth Empusa threat group distributing Android 'ActionSpy' spyware to target minority group in Tibet and Turkey (Computing) ActionSpy supports numerous modules which enable hackers to collect confidential information from compromised devices, including device IMEI, user phone number and contacts