AWS misconfigurations and a risk to privacy. Subscription scams and data theft.

Summary

By the CyberWire staff

At a glance.

AWS misconfigurations expose private data.
Scam subscription come-on leads to data theft.

AWS Systems Manager user misconception exposes private data.

Check Point Software examines the troubling trend of user “misconception” in the Amazon Web Services (AWS) Systems Manager, and how it can lead to the exposure of private data. Analysts at Check Point Research (CPR) discovered 5 million AWS records containing personally identifiable information and credit card transactions as a result of the misuse of the AWS Systems Manager. The Systems Manager allows users to automate functions across AWS products by creating Systems Manager (SSM) documents that specify the Systems Manager’s processes.

CPR found that many users (including an unnamed leading international sportswear manufacturer) are overlooking parameters and misunderstanding what data should be included in these SSM documents. For instance, they detected many SSM documents containing hardcoded usernames, passwords, or access keys, essentially handing an intruder an invitation to the inner workings of the company’s AWS systems. Furthermore, too often the SSM document names chosen by the user too clearly indicate the personal data contained therein, like neon signs directing an attacker right to the most valuable documents.

CPR has worked with AWS to outline some basic guidelines for securing the systems manager. They recommend users be more cautious about the data they include in public SSM documents, use parameters to restrict where activation keys and usernames appear, and avoid sharing deploy processes and backup procedures.

Subscribing to data theft.

Avanan looks at a phishing operation that capitalizes on the boring but necessary task of renewing software subscriptions. Most users are all too familiar with the standard reminder email software providers distribute to notify subscribers that their subscription needs to be updated. The attackers take advantage of user trust in this process by sending the target an email branded as a familiar software vendor, in this case Microsoft Office 365, stating that the user’s subscription has expired and must be renewed. It includes a link to the “service portal,” a site where the user can supposedly sign in and re-up their account. Despite the legitimate appearance of the spoof, the service portal is of course actually a credential harvesting site, and the only service it provides is to send the victim’s login data directly to the scammers.

Selected Reading

Ransomware gang leaks data from Metropolitan Police Department (BleepingComputer) Babuk ransomware operators have leaked what they claim are personal files belongin to police officers from the Metropolitan Police Department after negotiations went stale.

Scripps Health patients frustrated after May 1 cyber attack (cbs8.com) Scripps Health is saying very little about its security measures and only issued a written statement saying the network outage was caused by malware.

Hackers Stole Data On Nearly 200,000 Veterans Seeking Disability Benefits (Forbes) The database, Fowler discovered, belonged to North Carolina-based United Valor Solutions.

Lessons learned from the iPhone call recording app vulnerability (Security Magazine) News quickly spread about a vulnerable call recording app for iPhone named “Call Recorder,” or “Acr call recorder,” as its listing in the Apple App Store states. TechCrunch was the first outlet to flag a design flaw with the mobile application’s API when it obtained call recordings from AWS S3 cloud storage to prove it was insecure and therefore open to API-based attacks.

Now ransomware is inundating public school systems (Security Magazine) Almost every American adult knows that cyberattacks and breaches are ubiquitous and have primarily targeted companies and government entities. They might even know that the single most common breach these days is ransomware, a malicious process by which hackers dismantle computer systems and don’t fix them until a ransom is paid. Few, however, are aware that ransomware is targeting a new set of highly vulnerable victims en masse. In recent months, the majority of successful ransomware attacks have struck K-12 schools nationwide, casting a whole new light on the number of Americans highly susceptible to a cyberattack.

The New Ransomware Threat: Triple Extortion - Check Point Software (Check Point Software) Global surge in ransomware attacks hits 102% increase this year compared to the beginning of 2020, and shows no sign of slowing down Number of

Ransomware tracker: Threat groups focus on vulnerable targets (The Record by Recorded Future) As the recent attack against Colonial Pipeline shows, ransomware groups consider just about any organization to be fair game.

Aqua Security Researchers Discover 90% of Companies Are Vulnerable to Security Breaches Due to Cloud Misconfigurations | Aqua (Aqua) Latest research from Team Nautilus reveals majority of organizations fail to fix cloud misconfiguration issues in a timely manner

Security at risk as PC users continue to use end-of-life Windows 7 (Security Brief) Updating your OS is an essential element of security that should not be overlooked.