Exploiting dependency confusion. More Iranian cyberespionage. Unpatched vulnerabilities in popular Android app.

Summary

By the CyberWire staff

At a glance.

Exploiting dependency confusion.
More Iranian cyberespionage.
Unpatched vulnerabilities in popular Android app.
Bazar phishing campaigns.

Exploiting dependency confusion.

Security researcher Alex Birsan describes how he exploited "dependency confusion" to hack into Apple, Microsoft, Netflix, PayPal, Uber, Yelp, and others (under the companies' bug bounty programs). Birsan took advantage of the fact that organizations often use a combination of open-source and custom-made packages in their code, and package managers will default to installing public packages. When he registered his own public dependencies with the same names as the private ones, the package manager would install those instead of the private ones.

Birsan first found a Node.js file from PayPal in a public GitHub repository that contained "a mix of public and private dependencies — public packages from npm, as well as non-public package names, most likely hosted internally by PayPal." He then created his own packages using the names of PayPal's non-public packages, and uploaded them to the public npm registry. As a result, Birsan's packages, which could run arbitrary code, overwrote PayPal's packages on the company's servers. Birsan then used DNS exfiltration to gather information about the compromised servers.

Birsan then searched for the names of private packages used by other companies, and found many of them exposed in package.json files used by JavaScript projects. Other sources included GitHub, major package hosting services, and posts on Internet forums:

"This type of vulnerability, which I have started calling dependency confusion, was detected inside more than 35 organizations to date, across all three tested programming languages. The vast majority of the affected companies fall into the 1000+ employees category, which most likely reflects the higher prevalence of internal library usage within larger organizations.

"Due to javascript dependency names being easier to find, almost 75% of all the logged callbacks came from npm packages — but this does not necessarily mean that Python and Ruby are less susceptible to the attack. In fact, despite only being able to identify internal Ruby gem names belonging to eight organizations during my searches, four of these companies turned out to be vulnerable to dependency confusion through RubyGems."

Birsan received $30,000 bug bounties from PayPal, Apple, Shopify, and a $40,000 bounty from Microsoft. He adds that "the majority of awarded bug bounties were set at the maximum amount allowed by each program’s policy, and sometimes even higher, confirming the generally high severity of dependency confusion bugs."

More Iranian cyberespionage.

Anomali says the suspected Iranian threat actor Static Kitten (also known as MuddyWater and Seedworm) is targeting the governments of Kuwait and the United Arab Emirates. The attackers delivered malicious ZIP files via URLs that spoofed the UAE National Council and the Ministry of Foreign Affairs (MOFA) of Kuwait. The purpose of the ZIP file is "to install a remote management tool called ScreenConnect (acquired by ConnectWise 2015) with unique launch parameters that have custom properties." The download URLs were contained in geopolitical-themed documents sent via phishing emails. Anomali believes data theft is the primary goal of the operation.

The researchers also speculate on possible motives for the campaign, writing, "In mid-2020, the UAE and Israel began the process of normalizing relations. Since then, tensions have further escalated in the region, as reported by numerous sources. The targeting of Kuwait could be tied to multiple factors, including Kuwait’s MOFA making a public statement that they were willing to lead mediation between Iran and Saudi Arabia. Furthermore, in October 2020, trade numbers for a peace deal between Israel and UAE included an estimate for the creation of 15,000 jobs and $2 billion in revenue on each side. In that same month, Static Kitten reportedly conducted Operation Quicksand, which targeted prominent Israeli organizations and included the use of file-storage service OneHub."

Unpatched vulnerabilities in popular Android app.

Researchers at Trend Micro uncovered vulnerabilities in SHAREit, an Android file-transfer app with more than one billion downloads from the Google Play Store. The vulnerabilities could lead to data theft or remote code execution. Malicious apps or attackers on the network can invoke SHAREit's internal components to extract data or overwrite files. Trend Micro adds, "SHAREit is also susceptible to a man-in-the-disk (MITD) attack. This Is because when a user downloads the app in the download center, it goes to the directory as shown in the sample code. The folder is an external directory, which means any app can access it with SDcard write permission."

The researchers conclude, "We reported these vulnerabilities to the vendor, who has not responded yet. We decided to disclose our research three months after reporting this since many users might be affected by this attack because the attacker can steal sensitive data and do anything with the apps’ permission. It is also not easily detectable."

Bazar phishing campaigns.

Fortinet warns that a new variant of the Bazar Trojan is being distributed via phishing emails with executable files disguised as PDFs. Researchers at Cofense are also tracking Bazar phishing campaigns, outlining a scheme that uses a phony Office Supply invoice to trick recipients into entering their order number, visiting a spoofed website, and finally downloading a malicious Excel document.

Selected Reading

ApoMacroSploit : Apocalyptical FUD race (Check Point Research) 1.1 Introduction At the end of November, Check Point Research detected a new Office malware builder called APOMacroSploit, which was implicated in multiple malicious emails to more than 80 customers worldwide. In our investigation, we found that this tool includes features to evade detection by Windows Defender and is updated daily to ensure low detection... Click to Read More

Cybereason vs. NetWalker Ransomware (Cybereason) The NetWalker ransomware has been targeting organizations in the US and Europe including several healthcare organizations, despite several known threat actors publicly claiming to abstain from targeting such organizations due to COVID-19.

()

HelloKitty ransomware group likely responsible for CD Projekt attack. Here’s why. (Emsisoft) In February 2021, video game company CD Projekt was hit by ransomware. A cybercrime group known as HelloKitty could be responsible for the attack.

SHAREit Flaw Could Lead to Remote Code Execution (Trend Micro) We discovered vulnerabilities in the SHAREit application. The vulns can be abused to leak a user’s sensitive data, execute arbitrary code, and possibly lead to remote code execution. The app has over 1 billion downloads.

New Bazar Trojan Variant is Being Spread in Recent Phishing Campaign – Part I (Fortinet Blog) FortiGuard Labs recently noticed a suspicious email through our SPAM monitoring system designed to entice victims into opening a web page to download an executable file. Learn more about our resear…

New Bazar Trojan Variant is Being Spread in Recent Phishing Campaign – Part II (Fortinet Blog) FortiGuard Labs recently detected a suspicious email found to be a new variant of the Bazar malware. Read the second part of our research analysis to find out additional details about anti-analysis…

Who is to blame for the malicious Barcode Scanner that got on the Google Play store? (Malwarebytes Labs) LavaBird claims it was not them who is responsible for uploading malicious versions of Barcode Scanner, but an account named The space team.

UCEPROTECT: When RBLs Go Bad (Sucuri) Realtime Blackhole Lists (RBLs) can be a great tool in your security arsenal. You may not know you’re using them, but all email providers and company email servers leverage these services to verify whether servers and IP addresses are sending spam or other abusive content against a known list of offenders.

DDoS attacks in Q4 2020 (Securelist) Q4 2020 in terms of DDoS attacks: DDoS market fall, bitcion rise, careful prognoses.

Spam and phishing in 2020 (Securelist) COVID-19 spam, corporate phishing, fake videoconferences and other trends and figures of 2020.

NHS Vaccine Scams: Criminals Still Targeting COVID-19 Anxiety (Akamai) It's 2021, but the anxiety, fear, uncertainty, and stress caused by the COVID-19 pandemic in 2020 is very much alive today. Criminals are targeting the most vulnerable among us, using the lure of COVID-19 vaccination in their most recent phishing...

BazarBackdoor’s Stealthy Infiltration Evades Multiple SEGs (Cofense) The Cofense PDC has been tracking a stealthy malware campaign that has recently become more active compromising enterprise endpoints.

Researchers Follow the Breadcrumbs: The Latest Vulnerabilities in Windows' Network Stack (McAfee Blogs) The concept of a trail of breadcrumbs in the offensive security community is nothing new; for many years, researchers on both sides of the ethical

Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies (Anomali) ScreenConnect Remote Access Tool Utilizing Ministry of Foreign Affairs-Themed EXEs and URLs: Static Kitten is likely using features of ScreenConnect to steal sensitive information or download malware for additional cyber operations targeting government agency employees.