Tag Archive for Social engineering

What You Need to Know About MailChimp Security

What You Need to Know About MailChimp SecurityJust in time for Data Privacy Day. Mailchimp, one of the largest email service-providers worldwide with 13 million active customers. suffered a security breach. On January 11, 2023 the Mailchimp security team reported that an unauthorized actor download the data of 133 customers of the Mailchimp service.

Mailchimp data leak

Data privacy day The Mailchimp security team identified an unauthorized actor had accessed tools used by Mailchimp customer-facing teams for customer support and account administration. The unauthorized actor conducted a social engineering attack on Mailchimp employees and contractors, and obtained access to Mailchimp accounts using employee credentials compromised in that attack.

Impacted organizations include WooCommerce, online gambling site FanDuel, Crypto darlings Yuga Labs and the Solana Foundation.

CSC405: Introduction to Computer SecurityMailchimp says they temporarily suspended account access for Mailchimp accounts where they detected suspicious activity to protect our users’ data. They have notified the primary contacts for all affected accounts on January 12. Mailchimp has been working with their customers to help them reinstate their accounts.

Recent data breaches

MailChimp has announced several data breaches in recent months. In August 2022, a cyberattack targeted its cryptocurrency-related customers. Mailchimp also revealed a security incident in March 2022.

data leakSpeculation is swirling online about the security of parent company Intuit other product lines (which includes TurboTax, Credit Karma and Quickbooks). TurboTax suffered its own security breach in 2021. Questions are also being raised about a possible central backdoor into Intuit, which the company denies.

If you have questions regarding a notice you received or the incident in general, please reach out you can email ciso@mailchimp.com. The company has not announced the appointment of a new CISO since Siobhan Smyth left the position in August 2022 shortly after the August 2022 was announced.

rb-

multi-factor authenticationInformation exposed in data breaches like this is commonly used by attackers to target users with phishing attacks or attempt to reset passwords to gain account authorization. This is why multi-factor authentication (MFA) can help. Even if the bogus password resets were successful the MFA can prevent the attacker from going further.

How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Seven Social Engineering Classics

Seven Social Engineering ClassicsSocial engineering describes various non-technical attack techniques cybercriminals use to manipulate users. The attackers hope the user will bypass security or other business process protocols, perform harmful actions, or disclose sensitive information. Beware of these social engineering classics.

Business Email Compromise

Business Email CompromiseDon’t get fooled by official-looking emails even though the email appears to be work-related. Subject lines such as “Invoice Attached” or “Here’s the file you needed” might be a social engineering classic. To be sure, you should hover your cursor over email addresses and links before clicking to see if the sender and type of file are legitimate. BEC is the most costly form of cybercrime. It stems from faked emails called “Business Email Compromise” or BEC scams. A typical BEC scam involves phony emails in which the attacker spoofs a message from an executive at a company and tricks someone into wiring funds to the fraudsters.

VishingVishing

Corporate phone systems are often set up to forward voice mail audio files to employees’ inboxes. While this is convenient, forwarding the files can be risky. It makes it harder to determine if the email is phony or legit. Since 2014, scammers have been installing malicious software through emails designed to look like internal voicemail messages, making vishing a social engineering classic.

With vishing, cybercriminals use an urgent or alarming voicemail message to try to get potential victims to call back with their personal information. Fake caller ID information is often used to make the calls appear to be from a legitimate organization or business.

Free Stuff, a social engineering classic

Free pizzaFree Stuff is one of the oldest social engineering classics. Most people can’t resist free Stuff, from pizza to software downloads, and they will click just about any link to get it. Of course, nothing is truly free. Sophisticated attackers might send a link to genuine free software, but they’re sending you through their website, which means you may get infected or compromised.

Baiting

Baiting is a variant of “Free Stuff.” The attacker hopes to trick their victims into executing code by piquing their curiosity or convincing them to run hardware or software with hidden malware. For example, innocent-looking USB sticks handed out at a conference or casually “dropped” in the parking could contain malware. They then detonate when the curious user plugs it into their PC. This is how Stuxnet attacked the Iranian nuclear program.

Quid pro quo social engineering classic

Seven Social Engineering ClassicsAnother version of “Free Stuff.” In Latin, Quid pro quo means “something for something.” In exchange, the attacker offers something of genuine worth to the victim and will work their way into the target’s network. An example: The attacker poses as tech support and solves a problem for you, then convinces you to type in a line of code that serves as a “backdoor.” On the other hand, it may be as simple as trading a candy bar in exchange for a password!

Waterholing

This attack plants malware on a website you and your colleagues frequently visit. The next time you surf the site, the malware—such as a remote-access Trojan or RAT—is downloaded to your computer. And just like that, the attacker can begin exfiltrating data from your employer’s network.

Pretexting

Pretexting is another form of social engineering in which attackers focus on creating a fabricated scenario that they can use to try to steal their information. It is a true con game. It relies on the crook fostering a sense of trust in the victim.

Pretexting

Pretexting can also impersonate co-workers, police, banks, or tax authorities. It pretends to be any individual who could have perceived authority or right-to-know in the targeted victim’s mind. In some cases, all that is needed is an authoritative voice, an earnest tone, and an ability to think on one’s feet to create a pretext scenario.

Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Is Yuzo on Your WordPress site?

Do You Yuzo?I am still busy unpacking and re-arranging the furniture at the new home of Bach Seat. One of the nicer things about my new host is that I can now get WordPress alerts. And I have been getting a ton of alerts from the firewall that it blocked “yuzo-related” attack attempts. So I decided to see WTF “yuzo-related” attack attempts were about and found an excellent explanation on the WordFence site.

60,000 WordPress websites

Unpatched vulnerabilityDan Moen at WordFence explains that the Yuzo Related Posts (YRP) plugin for WordPress has an unpatched vulnerability that was publicly disclosed by a security researcher on March 30, 2019. The flaw which allows stored cross-site scripting (XSS), is now being exploited in the wild. The buggy plugin is installed on over 60,000 websites and has been removed from the WordPress.org plugin directory.

WordFence recommends that all users remove the plugin from their sites immediately.

The blog’s author writes that the vulnerability in YRP stems from missing authentication checks in the plugin routines responsible for storing settings in the database. The code below is the crux of the problem. There is more in-depth coding tech-talk at WordFence.

8 }elseif( is_admin() ){ // only admin

He says developers often mistakenly use is_admin() to check if a piece of code that requires administrative privileges should be run, but as the WordPress documentation points out, that isn’t how the function should be used.

Injects malicious JavaScript

System administratorThe result is that an unauthenticated attacker can inject malicious content, such as a JavaScript payload, into the plugin settings. That payload is then inserted into HTML templates and executed by the web browser when users visit the compromised website. This security issue could be used to deface websites, redirect visitors to unsafe websites, or compromise WordPress administrator accounts, among other things.

As evidenced by the number of probes against my site, threat actors have begun exploiting sites with YRP installed. The exploits in the wild inject malicious JavaScript. When a visitor lands on a compromised website containing the malicious payload, they will be redirected to malicious tech support scam pages – like this example:

Fake tech support pageThe WordFence analysis shows that the attempts to exploit this vulnerability in YRP share a number of commonalities with attacks on two other vulnerabilities discovered in other plugins: Social Warfare and Easy WP SMTP.

The security researchers found all three campaigns so far have used these exploits:

  • A malicious script hosted on hellofromhony[.]org, which resolves to 176.123.9[.]53.
  • Involved exploitation of stored XSS injection vulnerabilities and have deployed malicious redirects.

WordFence is confident that the tactics, techniques and procedures in all three attacks point to a common threat actor.

WordFence recommends WordPress Site owners running the Yuzo Related Posts remove it from their sites immediately, at least until a fix has been published by the author.

rb-

What to do?

    • WordPressKeep your WordPress and plugins up to date.
    • Do you really need Yuzo Related Posts? Here is a list of alternatives from WordPress.
    • Make sure you have good backups of your WordPress site – and you can restore it.
    • Get a firewall on your WordPress site
    • Block the IP 176.123.9[.]53. From your site.
    • Harden your WordPress site.
Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Russia Trolls Public Health

Everything you see on the Internet is trueHey here is a surprise – things on Facebook are fake. GovInfo Security is reporting that social media trolls sponsored by Russia have been actively stirring up the mindless vaccination debates. Researchers from George Washington University and Johns Hopkins University published their findings on (08/23/2018). They published a report, “Weaponized Health Communication: Twitter Bots and Russian Trolls Amplify the Vaccine Debate,” in the American Journal of Public Health. In the article, they based studied social media tweets collected from 2014 to 2017 on the vaccine debate.

Facebook profited from Russia-backed accounts trying to sway the 2016 U.S. presidential election

According to the research the Internet Research Agency, a company backed by the Russian government is at the center of the dis-information. The known Russian social media troll which specializes in online influence operations is linked to the spread of “polarized and anti-vaccine” misinformation via social media. The social media posts appear designed to undercut trust in vaccines. Such information could lead to lower vaccination rates and further contribute to a rise in mass outbreaks of measles, mumps, and rubella among children, among other viral infections.

How do anti-vaccine messages spread?

From 2014-2017, Twitter bots and Russian trolls disseminated anti-vaccine messages in trying to erode public consensus on vaccination in the U.S.

From 2014-2017, Twitter bots & Russian trolls disseminated anti-#vaccine messages in an attempt to erode public consensus on #vaccination in the US

The researchers’ review of anti-vaccine messaging on Twitter found the sources of disinformation are automated. There appears to be a steady stream of vaccine discussion being undertaken by social media bots. Social media bots are automated accounts. The researchers also identified and social media cyborgs’, that are hacked accounts taken over by bots. There are also social media trolls. Social media trolls are people who often disguise their identity and seek to sow discord.

The researchers also identified “content polluters.” Content polluters used anti-vaccine messages as bait to entice their followers to click on advertisements and links to malicious websites. The researchers contend that content polluters collate to high levels of anti-vaccine content. In the case of Russian trolls, however, their “messages were more political and divisive” and included both pro-vaccine and anti-vaccine content.

Trolls tied to Russia

Examples of Russian troll commentsTo identify accounts controlled by Russian trolls, the researchers used previously published information on Twitter accounts that intelligence agencies have tied to Russian government disinformation campaigns. As an example, CNN reports that one Russian troll account sent 253 tweets containing the #VaccinateUS hashtag among their sample. Among those tweets with the hashtag;

  • 43% were pro-vaccine,
  • 38% were anti-vaccine,
  • 19% were neutral.

By posting a variety of anti-, pro-, and neutral tweets and directly confronting vaccine skeptics, trolls, and bots “legitimize” the vaccine debate, the researchers wrote in the study. The researchers noted,

This is consistent with a strategy of promoting discord across a range of controversial topics, a known tactic employed by Russian troll accounts … One commonly used online disinformation strategy, amplification, seeks to create impressions of false equivalence or consensus through the use of bots and trolls.

amplification, seeks to create impressions of false equivalence or consensus through the use of bots and trollsThe prevalence of social media bots, trolls, and cyborgs – accounts in online discourse about vaccines threatens to skew discussions.  Researchers warn. “This is vital knowledge for risk communicators, especially considering that neither members of the public nor algorithmic approaches may be able to easily identify bots, trolls, or cyborgs.

The researchers found that the trolls, bots, and cyborgs goal is to create open-ended discussions designed to amplify online debates and disagreements. One tact cited in the article is rehashing discredited research published 20 years ago with fake claims of risks that have led to some parents opting to not vaccinate their children.

Threats from online misinformation

The threat from online misinformation is that even fewer parents will vaccinate their children against measles, mumps, and rubella. The researchers wrote that vaccine-hesitant parents are more likely to turn to the internet for information and less likely to trust healthcare providers and public health experts on the subject … Exposure to the vaccine debate may suggest that there is no scientific consensus, shaking confidence in vaccination. The researchers warn,

Recent resurgences of measles, mumps, and pertussis and increased mortality from vaccine-preventable diseases such as influenza and viral pneumonia underscore the importance of combating online misinformation about vaccines.

Russian troll use Facebook to amplify online disagreementsAmplifying debates over vaccines appear to be part of what ambassador John B. Emerson described as the Kremlin’s 4D campaigns – for dismiss, distort, distract and dismay. In a 2015 speech, Mr. Emerson warned that the Russian government was becoming more expert at running these types of propaganda campaigns.

Intelligence experts in the U.S. and Europe have warned that these Kremlin campaigns continue. In February, U.S. Director of National Intelligence Dan Coats warned the Senate Intelligence Committee that the intelligence community expected Russia to attempt to amplify existing divisions in U.S. society to spread chaos for strategic effect. Ambassador Coats warned,

At a minimum, we expect Russia to continue using propaganda, social media, false-flag personas, sympathetic spokespeople and other means of influence to try to exacerbate social and political fissures in the United States.

Anti-Bot research

Little research has gone into researching how to identify social media trolls or bots that influence online discussions. (rb- I covered some of the efforts underway to detect bots in 2016.) In 2015, DARPA ran a contest in which it asked researchers to classify whether a stream of tweets it had harvested about vaccines in 2014 were bots. Researchers were given a data set with more than 4 million messages harvested from 7,000 accounts, of which 39 were bots.

MIT Technology Review reported the winner, data science and social analytics firm SentiMetrix, correctly identified all the bots, with only one false positive. SentiMetrix was able to use an algorithm to  look for “linguistic cues” the poster was fake, like

  • Little research has gone into researching how to identify social media trolls or botTweets that used bad grammar,
  • Output was similar to other chatbots like Eliza,
  • Profile pictures that used stock images,
  • Numbers of tweets posted over time,
  • Unusual posting patterns,
  • Female username with a profile photo of a bearded man. (rb- Sound familiar? I wrote about some of these same steps in 2016)

The research led SentiMetrix to identify 25 bots, which enabled it to train a machine-learning algorithm to pinpoint 10 more. Despite such work, “the public health community largely overlooked the implications of these findings,” the Johns Hopkins and George Washington researchers say.

The impact of social media bots on the vaccine debates is not an abstract concern. The U.S. Centers for Disease Control and Prevention reports they are investigating 124 cases of measles across 22 states and DC, including Michigan. That’s already more than the 118 cases counted in the U.S. during all of 2017.

Spreading measles in Michigan

WOODTV in Grand Rapids reports that cases of measles in Michigan have hit a two-decade high. Angela Minicuci with the MDHHS told WOODTV the state has “tallied 10 cases of measles so far this year — the highest case count since 1998.

The CDC says low vaccination rates are to blame for recent measles outbreaks. They report the majority of those who contract measles, which is highly contagious, have not been vaccinated.

One reason so many are at risk of spreading measles is that 18 states allow parents to opt-out of vaccinating their schoolchildren for non-medical reasons. In June 2018 researchers found  multiple “hotspot” areas,” at high risk for vaccine-preventable pediatric infection epidemics.” Included in these hotspots are Detroit, Troy, and Warren, Michigan. The DetNews reports these areas had more than 400 kindergartners receive the non-medical vaccination exemptions.

Grand Traverse AcademyIn 2017 an outbreak of measles and whooping cough forced Grand Traverse Academy in Traverse City Michigan to close for a week. Grand Traverse County has one of Michigan’s highest rates of schoolchildren opting out of vaccines — twice the state average and six times the national rate for kindergartners in 2013-14.

The problem is not limited to the United States. In Europe, there’s been a “dramatic increase” in measles infections. WHO says there were 23,927 cases of measles in Europe during 2017 and 5,273 in 2016.

rb-

They want you to ignore the truthRenée DiResta, who researches disinformation online at Data For Democracy, pointed out the obvious,  “This isn’t just happening on Twitter. This is happening on Facebook, and this is happening on YouTube, where searching for vaccine information on social media returns a majority of anti-vaccine propaganda,”

She says. “The social platforms have a responsibility to start investigating how this content is spreading and the impact these narratives are having on targeted audiences.

The Russians want us focused on our own problems so that we don’t focus on them. 

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

HFCC More Secure Than Most

HFCC More Secure Than MostNYC based security reputation firm SecurityScorecard just released its 2015 Higher Education report (PDF) which has some surprising results. According to ArsTechnica the security startup pegged MIT near the bottom of its security posture list. What the Ars article did not tell us what universities had excellent security postures.

The other surprising result is that Henry Ford Community College, in Dearborn, Michigan has the 5th best security posture in the SecurityScorecard report of 485 colleges and universities.

Henry Ford Community College

The report says HFCC is among the best securing their network. HFCC scored well in all phases of the online security studied including:

  1. Web Application Security,
  2. Network Security,
  3. Endpoint Security,
  4. Hacker Chatter,
  5. Social Engineering,
  6. DNS Health,
  7. IP Reputation,
  8. Patching Cadence, and
  9. Password Exposure.

The report explains that each category consists of dozens of security-risk indicators, resulting in a holistic security assessment.

rb-

As an alumnus and former instructor at HFCC, I say well done!

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.