Data Breach , Fraud

Fraudsters Raid Computers for PayPal, Amazon and eBay Accounts Jeremy Kirk (jeremy_kirk) • June 6, 2016    

TeamViewer is strengthening the security of its remote access application after an uptick in account takeovers that the company says is the result of hackers reusing account credentials from recent data breaches.

See Also: 2016 Enterprise Security Study - the Results

The issue appears to primarily affect consumer accounts, although TeamViewer has a robust enterprise business: 90 percent of Fortune 500 companies use its application for remote support and access.

The vast majority of support queries TeamViewer has received concerning the attacks have been from consumers, says Axel Schmidt, a company spokesman. That's because enterprises have generally followed TeamViewer's security recommendations to protect their accounts.

"Very often what we find is that they [consumers] used the same account credentials across multiple internet accounts," Schmidt says.

Numerous victims have contributed their stories to a long Reddit thread. Fraudsters have used the compromised TeamViewer credentials to remotely access computers and hunt for other credentials stored in web browsers for services such as PayPal, eBay and Amazon.

Fallout From Big Breaches

The TeamViewer situation falls in line with what many security experts have predicted in the wake the release of more than 630 million credentials in May alone from years-ago hacks, including LinkedIn and MySpace (see 'Historical Mega Breaches' Continue: Tumblr Hacked).

Even if login credentials are several years old, many people continue to use the same ones across several services. A compromise of one provider supplies hackers with a fresh batch of logins that can be tried again against many other services. Password managers can help solve the problem, but are generally only used by more tech-savvy users.

On June 1, a statement from TeamViewer put it bluntly: "Careless use of account credentials remains to be a key problem for all internet services."

'Something Is Going Wrong'

An alternative explanation for the uptick in account compromises is that computers running TeamViewer have been infected with malware. The company advises people to avoid downloading adware bundles, to only download TeamViewer through legitimate outlets and to run security software.

Schmidt says TeamViewer has conducted internal audits since the account takeovers spiked and has found no evidence that it has been breached. Account passwords are hashed and salted, he said.

But Troy Hunt, who runs the breach notification service Have I Been Pwned, says the company may need to move forward with a deeper forensic analysis.

"Something is definitely going wrong somewhere," Hunt says. "They really need an independent party in at this time to get to the bottom of it and explain what's going on."

The company's security improvements will make it easier for users to see if their account is being targeted. A feature called Trusted Devices will send an email if there is a login attempt from a new device. Users can then decide whether to grant authorization to access TeamViewer from the device, according to a June 3 statement.

TeamViewer's second improvement, Data Integrity, involves more vigilant monitoring of the location of login attempts. If unusual activity is detected, a TeamViewer account may be tagged for a mandatory password reset, with users receiving an email alert.

The features are being rolled out globally. TeamViewer says "users may experience minor inconveniences" due to the rollout. Schmidt said TeamViewer had planned to introduce the features later this year but opted to speed up the rollout, which means some functions may not work as expected.

Users who think they could be affected by these attacks should immediately change their passwords. Also, TeamViewer offers two-factor authentication, which requires users to enter a time-based one-time passcode to gain access. The company supports eight two-factor apps for Android, iOS, Windows Phone and BlackBerry.

TeamViewer also has blacklisting and whitelisting options, which can restrict what machines are allowed to perform a remote access session.

View of an Attack

Nick Bradley, a practice leader within the Threat Research Group at IBM, described a harrowing account of how he watched a TeamViewer intrusion unfold at his house the night of June 3.

"In the middle of my gaming session, I lose control of my mouse and TeamViewer window pops up in the bottom right corner of my screen," Bradley writes. "As soon as I realize what is happening, I kill the application. Then it dawns on me: I have other machines running TeamViewer!"

He ran downstairs to another computer running TeamViewer, only to see the application's window pop up.

"Before I am able to kill it, the attacker opens a browser window and attempts to go to a new web page," he writes. "As soon as I reach the machine, I revoke control and close the app."

Many others haven't been so lucky. The Reddit thread chronicles many users who reported the attackers went on shopping sprees with PayPal funds and tried to buy gift cards on Amazon and eBay.

One Reddit poster attributed a TeamViewer hack that occurred on June 1 to the reuse of MySpace credentials, which were leaked last month in one of the largest data breaches of all time.

"Nabbed $260 from PayPal," the user wrote. "PayPal almost instantly refunded the money to my account. Now working to shore up the gaping hole in my security."

Schmidt says that anyone who suspects their account has been compromised should contact TeamViewer's support and submit log files. He also advised that they report the incident to police. The reason, he says, is that TeamViewer as well as other companies are subject to strict data privacy regulations and can't release certain information to the public.

"We need to get authorities involved," he says.

In this edition of the ISMG Security Report, Executive Editors Tracy Kitten of BankInfoSecurity and Mathew J. Schwartz of DataBreachToday provide the backstory behind the SWIFT-related theft of $81 million from the central bank of Bangladesh and subsequent incidents, as well as their impact on the regulation of financial institutions.

In this report, you'll also hear:

Bob Bigman, the longtime CISO at the Central Intelligence Agency who now serves as CEO of 2BSecure, discuss how enterprises can boost the "trustability" of their systems as technologies rapidly evolve; Jeremy Kirk, ISMG managing editor for security and technology, explain why some cybersecurity experts believe Australia isn't spending enough on its cyberdefense; and A report on how a drone sports what could be the world's most secure operating system.

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Please check out our May 31 and June 1 reports, which respectively examine global breach notification and the cybersecurity framework. The next ISMG Security Report will be posted Friday, June 10.

Theme music for the ISMG Security Report is by Ithaca Audio under a Creative Commons license.

Data Breach

Breach Notification Site LeakedSource Claims Users Were Targeted by Malware Marianne Kolbasuk McGee (HealthInfoSec) • June 9, 2016    

This story has been updated.

See Also: Creating a User-Centric Authentication and Identity Platform for the Healthcare Industry

More than 32.8 million Twitter credentials have been compromised and are being offered for sale on the dark web, claims LeakedSource, a subscription-based breach notification service. But some security experts question whether the credentials are current and authentic.

"Each [Twitter] record may contain an email address, a username, sometimes a second email and a visible password," LeakedSource reports in a blog. "We have very strong evidence that Twitter was not hacked, rather the consumer was. These credentials, however, are real and valid. Out of 15 users we asked, all 15 verified their passwords."

In two tweets, Michael Coates, Twitter's trust and information security officer, said he was confident Twitter's systems had not been compromised.

We securely store all passwords w/ bcrypt. We are working with @leakedsource to obtain this info & take additional steps to protect users.

LeakedSource claims that the data leak stems from malware infecting users' devices, "and the malware sent every saved username and password from browsers like Chrome and Firefox back to the hackers from all websites including Twitter."

The "proof for this explanation," LeakedSource says, is:

The join dates of some users with uncrackable (yet plaintext) passwords were recent. "There is no way that Twitter stores passwords in plaintext in 2014 for example." There was a very significant amount of users with the password "" and "null". "Some browsers "store passwords as "" if you don't enter a password when you save your credentials." The top email domains don't match up to a full database leak, "more likely the malware was spread to Russians." Many of the top 10 email domains targeted are Russian, the company reports.

Passwords were stolen directly from consumers; therefore, they are in plaintext with no encryption or hashing, LeakedSource says. "Remember that Twitter probably doesn't store the passwords in plaintext, Chrome and Firefox did."

LeakedSource says its source for the Twitter data is a user who goes by the alias "This email address is being protected from spambots. You need JavaScript enabled to view it.," a mysterious figure who has recently supplied LeakedSource with several other batches of data for free related to a number of other social media breaches, including LinkedIn, MySpace and most recently, the international social networking site Badoo.com and the Russian site VK.com, also known as Bkohtakte or Vkontakte (see LeakedSource: Assume Every Website Has Been Hacked).

It's unclear why Tessa88 is releasing the data now because most of the breaches appear to have actually occurred years ago.

LeakedSource did not immediately reply to Information Security Media Group's request for comment.

Are the Credentials Authentic?

Troy Hunt, who runs the data breach notification service Have I Been Pwned, is skeptical about the authenticity of the apparently leaked credentials. "It looks almost certain that this isn't a breach of Twitter itself, rather an aggregation of data from unknown sources. It's highly unlikely there are 32 million credentials in there that are usable against Twitter accounts. I haven't seen the data myself, but I trust Twitter's position in terms of it not coming from their system."

Lysa Myers, security researcher at the security firm ESET, says there are oddities in the Twitter incident, as well as some of the earlier social media breaches recently revealed.

"The Twitter leak, like the MySpace leak, does have some very curious data," she says. "There are a lot of the expected passwords, but then there are several which were apparently chosen by thousands of users that are very odd. Over 20,000 users referencing one specific date in 1961 seems particularly peculiar."

It's plausible that the Twitter leak represents many years' worth of phished credentials, Myers says. "I suspect, like the MySpace leak, that the data is fairly old given that Hotmail and Yahoo are the second and third most popular domains" in the supposed compromised Twitter data set.

"With all the legitimate threats that are happening every day, I fear that shouting about the leak of probably ancient data will contribute to 'breach fatigue,'" Myers says.

Fraud , Litigation

Experts Size Up the Impact of Appellate Court Decision on Other Cases Tracy Kitten (FraudBlogger) • June 6, 2016    

A federal appellate court ruling in favor of a Minnesota bank that sued its insurer for coverage of costs associated with a fraudulent wire transfer, is significant. But it may not have a substantial impact on other bank cases, financial fraud experts say.

See Also: How to Mitigate Credential Theft by Securing Active Directory

The U.S. Court of Appeals for the Eighth Circuit recently upheld a Minnesota district court's ruling that fraud losses suffered by the State Bank of Bellingham should be covered by the bank's insurance provider, BancInsure, an Oklahoma-based company that in November 2013 changed its name to Red Rock Insurance Co. The district court awarded State Bank $620,187, plus attorney's fees.

BancInsure appealed the ruling, arguing that Minnesota law governing insurance contracts do not apply to financial institution bonds. But the appellate court disagreed.

The lawsuit was filed in the aftermath of an October 2011 incident in which a computer the bank used to conduct wire transfers through the Federal Reserve's FedLine Advantage Plus system was infected with malware, according to court records. The computer was infected after one of the bank's five employees neglected to remove two physical tokens from the PC used after conducting a legitimate wire transfer, court filings state.

"It's very significant and is right on the mark," says financial fraud expert Avivah Litan, a Gartner analyst. "Hackers can usually find a way into an enterprise, and insurers shouldn't insure if they aren't prepared to deal with that fact. ... So yes, this decision is a win, but not a big win, because I expect insurance companies to continue challenging this type of ruling in future cases."

Litan predicts insurance companies will increasingly include cyberattack coverage exclusions in their policies for banks. "It's a little ... like homeowners' insurance. There are so many exclusions that most occurrences of damage to a house, short of a catastrophic fire, are not covered. And if consumers do file claims, their rates go up while they get little insurance coverage in return."

Other fraud experts predict the Minnesota case won't have much of an impact on other legal disputes between banks and insurers because it focused primarily on one state's laws.

Court Rules Cyberheist Covered by Policy

In the Bellingham case, the tokens were left in the PC overnight, the court records show. When the employee returned the next day, she saw that two unauthorized wire transfers had successfully been sent to two different banks in Poland; the bank was only able to reverse one of the unauthorized wires after contacting the Fed. The other wire, totaling $485,000, could not be reversed, court records show.

"In order to complete a wire transfer via FedLine, two Bellingham employees had to enter their individual user names, insert individual physical tokens into the computer, and type in individual passwords and passphrases," according to court records.

In 2010, State Bank purchased a financial institution bond from BancInsure. The bond, a type of insurance, provided coverage for losses, such as those caused by an employee's dishonesty and forgery, as well as computer-system fraud.

State Bank sued BancInsure when BancInsure denied the bank's claim, saying BancInsure breached its contract. The bank's coverage was not sold as cyber insurance.

BancInsure said it denied the bank's claim, according to court records, because the bank's fraud loss resulted from an employee's mistake, and not because of the theft of confidential information, mechanical breakdowns or the deterioration of computer systems.

But the district court agreed with the bank that the fraud loss should be covered by bond, noting that "the computer system's fraud was the efficient and proximate cause of [Bellingham's] loss," and ultimately resulted because hackers broke in, not because an employee approved a fraudulent wire or maliciously scheduled one.

"Neither the employees' violations of policies and practices (no matter how numerous), the taking of confidential passwords, nor the failure to update the computer's anti-virus software was the efficient and proximate cause of [Bellingham's] loss," the district court found.

The insurer appealed the decision, but the appellate court upheld the lower court's ruling. "We find that Minnesota courts would adhere to the general rule of treating financial institution bonds as insurance policies and interpreting those bonds in accordance with the principles of insurance law," the appellate court notes in its ruling. "We agree with the district court's conclusion that 'the efficient and proximate cause' of the loss in this situation was the illegal transfer of the money and not the employees' violations of policies and procedures."

Neither BancInsure nor State Bank replied to Information Security Media Group's request for comment.

Ruling's Impact Likely To Be Limited

Cybersecurity attorney Chris Pierson, CISO and general counsel at invoicing and payments provider Viewpost, questions whether the ruling will have much of an impact on other cases because of its focus on Minnesota law.

"Since this determination is based on the specific language of the policy and state law, it is not a broad brush to all insurance cases," he says. "The court's perspective that failing to remove a dual-factor and tokenized authentication medium is not 'a reasonably foreseeable event likely to cause the exploitation of an illegal money transfer' is hard to swallow. A lot more remains to be seen of this case."

Attorney Stan Orszula, a partner at the law firm Barack Ferrazzano Financial Institutions Group, notes that insurance companies closely watch case law and adjust their contracts after rulings like this one to ensure they don't have to cover big payouts for losses going forward.

"This type of incident could happen to anybody - an employee leaving a token behind or in a computer - so the insurance companies will adjust what they cover," he predicts.

But the court recognized that the fraud loss was tied to a malware infection, Orzsula says. "This loss would not have happened were it not for the criminal. You obviously have to be diligent about your security; but there are limits, and no one can be expected to cover every attack."

Looking ahead, Orzsula predicts insurers sued by banks in similar cases might ask courts to use the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool to help determine if a bank took reasonable security precautions to prevent fraud (see Gartner's Litan: FFIEC Assessment Tool Falls Short).

"Could that tool be used in litigation to prove whether a bank had reasonable security in place?" Orszula asks. "Could insurance companies use it to ask, 'How was your cybersecurity at the time of the attack? Did you assess your security properly? Did you take certain steps to mitigate risks?'"

Anti-Malware , Fraud , Risk Management

Research Report Says Botnet Located Mainly in Ukraine and Russia Jeremy Kirk (jeremy_kirk) • June 9, 2016    

Researchers have watched a botnet composed mostly of compromised computers in the Ukraine and Russia become a growing hive of criminal fraud activity, playing a role in everything from ransomware and click fraud to spam bots and supporting stolen payment card marketplaces.

See Also: Vulnerability Management with Analytics and Intelligence

The botnet, called Zbot, has also been engineered to be extra robust, which could make it very hard to shut down, according to a new report from cyber threat intelligence company RiskAnalytics, which describes how Zbot has become the back-end infrastructure of choice.

Noah Dunker, RiskAnalytics' director of security labs, started tracking Zbot in mid-2014. He says researchers have seen botnets linked to malware and exploit kits, but Zbot appears to be servicing a huge variety of crimeware.

"This has a smorgasboard of various services that are being by the criminal underground," Dunker says.

Better, Stronger, Faster

Zbot uses many long-known techniques to make it robust, according to the new report. It employs fast flux, which allows a domain name to be pointed at a new IP address quickly. Fast flux has a legitimate purpose that helps with redundancy and load balancing, but cybercriminals use it to make their services harder to shut down. It's difficult to block malicious IP address when the addresses change every few minutes.

Fast flux has long been employed by botnet operators, but RiskAnalytics says Zbot also uses something called double flux: Infected endpoints also run DNS services for the fast flux network, which adds another layer of reliability.

The computers comprising the botnet are loaded with a range of tools: an Nginx web server, spam bots and more. Some of the tools are designed to spread malware, such as ransomware and credential stealers, while others are support tools that help maintain the botnet.

The crimeware domains that are hosted on Zbot change their IP addresses every two and a half minutes. "Over time, hundreds or thousands of IP addresses are used," RiskAnalytics' report says.

Those domains include no less than seven carding websites, where stolen payment card data is sold, and even two scammy websites selling underpriced agricultural and industrial equipment, the new report notes.

Nearly 84 percent of the compromised computers that are part of the fast flux infrastructure are in the Ukraine, with 12 percent in Russia, 3 percent Romania, with others around the world, the researchers say.

Surprising Amount of Crimeware

Wayne Crowder, director of threat intelligence for RiskAnalytics, says researchers were surprised at the amount of crimeware that Zbot supports. The research shows that malware campaigns thought to be separate actually linked back to Zbot.

"If you're a criminal and want to make sure that your stuff is going to stay up, you're going to buy the best infrastructure to hide your activity," Crowder says.

It's not clear how other cybercriminals get linked up with Zbot. Crowder says there isn't a lot of discussion on underground forums for how to rent time on Zbot.

The problem for security companies is figuring out how to quickly block domains and IPs that are part of the botnet. RiskAnalytics says it has developed a way to quickly find out about new bad IPs, which it distributes as a feed to its customers.

Fast flux has its advantages as far as redundancy, but it's also very noisy, Dunker says. RiskAnalytics monitors how the botnet's fast flux infrastructure rearranges the services it is hosting by watching the ever-changing DNS activity, or passive DNS observation.

"As soon as an IP address is seen resolving to one of the host names that we flagged for fast flux, it becomes part of the [block] list," Dunker says.

Authentication , Data Breach , Risk Management

Company Spokesman: 'It's Important to Vet Breached Data Carefully' Jeremy Kirk (jeremy_kirk) • June 9, 2016    

Dropbox, the widely popular web storage service, became caught in the crossfire of the latest mega breaches when several identity theft services recently misreported that its credentials had been leaked.

See Also: Unite & Disrupt: Mitigate Attacks by Uniting Security Operations

Blogger Brian Krebs first revealed that a batch of data advertised on underground websites and labeled as Dropbox credentials actually came from Tumblr's breach. The situation illustrated how not being careful in verifying breaches can lead to an embarrassing mixup.

"Based on this experience, I would caution everybody not to jump to judgment around some of these alleged data leaks until they've actually been verified by the experts," says Patrick Heim, head of Dropbox's trust and security, in an interview with Information Security Media Group.

In late May, the identity theft protection company LifeLock alerted its subscribers to a Dropbox breach, based in part of on information supplied to it by CSID, another company that specializes in identity theft intelligence.

"Quite frankly, it was false," Heim says.

Dropbox had actually obtained the raw Tumblr data through confidential channels two months before that data - labeled as Dropbox's - was publicly posted on Twitter by a Russian hacker last month. "We actively pursue identifying information that may indicate there's risk to our users," Heim says. "We vet that information and take the appropriate action."

On June 8, LifeLock apologized to Dropbox, writing that "as any cybersecurity expert will tell you, determining the source of credentials can be a complicated business, made only more so by the nefarious parties involved."

'Slightly Nervous and Paranoid'

Dropbox has been carefully watching the events of the past few weeks. Upwards of 630 million credentials stolen years ago from LinkedIn, Tumblr, Fling, MySpace and Twitter were put up for sale on underground markets (see 'Historical Mega Breaches' Continue: Tumblr Hacked).

"I think a good security professional is never overly confident and always slightly nervous and paranoid," Heim says.

Dropbox, which counts 1 billion users, has a team that analyzes data dumps to figure out if its users will be impacted. There's a lot of intentional obfuscation in the world of hackers and data dumps, Heim says.

For example, Dropbox's team recently spotted a file first seen in 2014 purporting to be its users' credentials recently reposted again for sale. Heim says this time, it had a new bitcoin address for payment. Often, hackers obtain data they didn't actually steal and then offer it for sale, he says. "It's the underground scamming the underground," he says.

As far as the latest breaches, Heim says nothing has dramatically changed. But he does suspect the data releases are fueling targeted phishing attacks. Most of the breaches have included email addresses, which are perennially useful for hackers.

Preventive Measures

To guard against account takeovers, Dropbox uses a system that analyzes authentication attempts and looks for signals that someone may be using automated tools to try many combinations of credentials, Heim says. The company will also proactively prompt users to reset their passwords if certain accounts appear at risk.

Many services - including MySpace and LinkedIn - have said that their breaches occurred prior to technical changes they made to lessen the impact of a data release, including stronger hashing algorithms for passwords and salting. Salted password hashes have more random data added, which makes the hashes more difficult to crack.

Heim says he doesn't want to give away too much detail about Dropbox's security, but said it does use strong hashing algorithms. If there is a breach, the data would be, for all practical purposes, useless, he contends.

The company is also studying ways to encourage more users to employ two-factor authentication, which typically involves entering a one-time passcode in addition to a username and password. Less than 1 percent of Dropbox users have two-factor authentication enabled.

"That is a number we really, really want to drive up," Heim says.