Polyverse Weekly Breach Report – Feb. 10th 2020

Feb 10, 2020By Shaina Raskin

Breach Report

A snapshot of last week’s reported cybersecurity breaches and vulnerabilities

Twitter

Hackers abused a function on Twitter’s platform to find the phone numbers associated with millions of user accounts. To read more: https://thehackernews.com/2020/02/find-twitter-phone-number.html

 

Toll

Toll, an Australian logistics company, announced that it suffered a cybersecurity incident that forced the company to shut down customer-facing systems. To read more: https://www.zdnet.com/article/toll-group-shuts-down-it-systems-in-response-to-cybersecurity-incident/

 

Sudo

A researcher found a vulnerability in Sudo, a program for Unix-like operating systems, that could enable low-privileged users to execute arbitrary commands with root privileges on Linux and Mac operating systems. To read more: https://thehackernews.com/2020/02/sudo-linux-vulnerability.html

 

Woodstock

The City of Woodstock, Ontario, is still feeling the effects of a cyberattack months after criminals took down its computer systems. The three-week-long attack will ultimately cost the city more than C$1m. To read more: https://lfpress.com/news/local-news/woodstock-cyber-attack-costs-mount-to-million-dollar-mark/wcm/b43fbd3b-8c62-4734-9f2b-177e899fee5b

 

Wawa breach

Millions of customers who shopped at Wawa stores were told that a data breach had exposed some of their personal information. Hackers recently put up payment-card details of more than 30m victims on Joker’s Stash, a dark-web marketplace. To read more: https://thehackernews.com/2020/01/wawa-credit-card-breach.html

 

Philips smart bulbs

Researchers revealed a vulnerability in Philips Hue Smart Light Bulbs. The bulbs can be exploited wirelessly from more than 100 meters away, allowing hackers to infiltrate targeted computer networks. To read more: https://thehackernews.com/2020/02/philips-smart-light-bulb-hacking.html

 

Google Takeout

Google accidentally shared private videos of some Takeout account holders with others who also use the service. The problem occurred over a five-day period in November 2019. To read more: https://thehackernews.com/2020/02/google-photos-videos.html

 

Hanna Andersson

Salesforce.com has been implicated in a class action against clothing retailer Hanna Andersson, which was filed after a data breach impacted the chain’s customers. The lawsuit argues that an e-commerce platform run on Salesforce failed to detect the breach for three months. To read more: https://www.law.com/therecorder/2020/02/04/hanna-andersson-customers-sue-salesforce-for-data-breach/?slreturn=20200105110221

 

Linear eMerge E3

Hackers are now hijacking smart doors and building-access systems to launch DDoS attacks. The attacks target Linear eMerge E3 access controls, which are made by Nortek Security & Control. To read more: https://www.zdnet.com/article/hackers-are-hijacking-smart-building-access-systems-to-launch-ddos-attacks/

 

Nintendo

A 21-year-old man pleaded guilty to hacking Nintendo’s servers numerous times using phishing techniques. He downloaded thousands of files, including developer tools and nonpublic information about upcoming products. To read more: https://arstechnica.com/gaming/2020/02/fbi-catches-hacker-that-stole-nintendos-secrets-for-years/

 

Cisco

Researchers discovered five new security vulnerabilities in Cisco networking equipment that enable hackers to take complete control of systems. The bugs are remote code-execution issues that impact routers, switches and IP cameras. To read more: https://thehackernews.com/2020/02/cisco-cdp-vulnerabilities.html

 

Web shells

Microsoft says that it detects a daily average of  77,000 active web shells across 46,000 infected servers. These malicious programs enable attackers to interact with the hacked systems. To read more: https://www.zdnet.com/article/microsoft-says-it-detects-77000-active-web-shells-on-a-daily-average/

 

IowaReporterApp

This app, made by Shadow, a political-technology company, was used to count and report votes from the Iowa caucuses. Unfortunately it also came with a range of software bugs that could have been exploited by hackers to change vote totals, passwords and other sensitive information. To read more: https://www.propublica.org/article/the-iowa-caucuses-app-had-another-problem-it-could-have-been-hacked

 

Charming Kitten

An Iran-based hacking group known as Charming Kitten is using fake interviews to target public figures with phishing campaigns. The group targets political and human-rights activists to steal email credentials and scan their networks. To read more: https://threatpost.com/charming-kitten-uses-fake-interview-requests-to-target-public-figures/152628/

 

Bitbucket repositories

A new malware campaign used Bitbucket repositories from Atlassian to launch cyberattacks. To read more: https://securityboulevard.com/2020/02/cybereason-uncovers-malware-distributed-via-bitbucket-repositories/

 

Homeland Security

Various government agencies, including the Department of Homeland Security, bought access to a commercial database that gives users the ability to access location data on millions of people. To read more: https://www.fastcompany.com/90461766/report-homeland-security-is-using-location-data-from-games-and-weather-apps-to-track-millions-of-people

 

Idea Buyer

An Ohio product-launch company shut down in December after a cyberattack wiped out completed and in-progress work. Ohio’s Attorney General is now suing the company for failing to deliver services. To read more: https://www.bizjournals.com/columbus/news/2020/02/08/dublin-business-closed-by-cyber-attack-sued-by.html

 

The registered trademark Linux® is used pursuant to a sublicense from the Linux Foundation, the exclusive licensee of Linus Torvalds, owner of the mark on a world­wide basis.