Former Bupa employee offered 1 million customer records for sale on dark web

Current advancements to the internet and all of its capacities bring about a sense of urgency when it comes to safeguarding online security, especially in situations where crucial information can be stolen and exploited.

A Bupa employee managed to copy and steal data regarding more than 108,000 customers, then exposing a majority of that information on the dark web. Data Breaches found the breach on the dark web on June 23, posted by a vendor called MoZeal. The listing contained insurance information from 122 countries and included information like member and registration IDs, names, birthdates, all contact information and information about intermediaries.

It would appear that “MoZeal” is likely the rogue employee that Kenton referred to in his videotaped statement. Also of note: while Bupa reports that 108,000 were affected, MoZeal’s listing and thread indicated that there were over 130,000 in the U.K. alone, and that overall there were about 500,000 – 1 million records for sale.

Bupa has reportedly taken legal action, so this post will be updated as more information becomes available. The breach has had an intense effect primarily on the international health insurance industry as a whole.

Bupa responded to the reported discrepancy between their numbers and the AlphaBay vendor’s claims with a statement to Insurance Business reconciling some of the differences by noting that they referred to “policies” while the vendor referred to number of individuals. Ever since the breach was spotted, the company has already taken the necessary measures to notify each and every customer whose information has been stolen.

Company representatives also say the security of customer information has been made a paramount priority by the health insurer to prevent such breaches in the future. The employee responsible for the breach has already been terminated from his position, and Bupa is also pursuing legal action against the employee.

This attack is the latest in a series of data breaches taking place this year. There have been several such hacks so far that deliberately target entities in the health sector, and the number continues to increase with each passing period of time.

Google Blocks Spyware Family From Android App Store

Google this week released details of a sophisticated new family of spyware tools that the company recently blocked from its Play mobile app store after discovering the malware being used against some Android users.

Dubbed Lipizzan, the Android spyware appears to be developed by Equus Technologies, an Israeli startup that Google referred to as a 'cyber arms' seller in a blog post published Wednesday. In total, with the help of Google Play Protect, the Android security team has found Lipizzan spyware on 20 apps distributed in a targeted fashion to less than 100 Android devices. 

Google has quickly blocked and removed all of those Lipizzan apps and the developers from its Android ecosystem, and Google Play Protect has notified all affected victims. Google has also enhanced its Google Play Protect app scanning features to detect and prevent Lipizzan and similar targeted spyware from being uploaded to the mobile app store.

Sophisticated Multi-Stage Spyware

Google described Lipizzan as a two-stage spyware tool designed to monitor and steal a victim's email and SMS messages, intercept voice calls and media and steal location data.

In the first stage, attackers distribute Lipizzan by typically impersonating it as an innocuous-looking legitimate app such as "Backup" or "Cleaner" through various Android app stores, including the official Play store. When a victim installed the software, the first stage Lipizzan components would then download a second separate data monitoring and theft component. The second component was designed to work only if it determined the device was safe for it to do so.

If given the all-clear, the second stage would then root the device with known exploits and begin to ex-filtrate device data to a command and control server

Gathers Data from Other Popular Apps

Lipizzan's second application component was capable of a wide range of malicious activities such as to record voice calls, record from a phone's microphone, monitor the victim's location, take screenshots and take photos from the device's camera.

It can also gather data from specific apps, undermining their encryption, which includes WhatsApp, Snapchat, Viber, Telegram, Facebook Messenger, LinkedIn, Gmail, Skype, Hangouts, and KakaoTalk.

The second Lipizzan application shared a common signing certificate with the first components showing that the same authors likely developed both. When Google managed to block the first set of Lipizzan applications from Google Play, the authors managed to quickly upload a new set of apps with the same capabilities but slightly different properties. Instead of impersonating backup applications for instance, the new malware mimicked other innocuous sounding applications such as a sound recorder app and an alarm manager. Despite such changes Google managed to detect and block the malware, the three members of Google's security team said.

Earlier this year, Google found and blocked a dangerous Android spyware, called Chrysaor, allegedly developed by NSO Group, which was being used in targeted attacks against activists and journalists in Israel, Georgia, Turkey, Mexico, the UAE and other countries. Like Lipizzan, Chrysaor was also used for targeted cyber-spying. The malware was discovered on what Google described as a few dozen Android devices.

Protect your Android device

• Android users are strongly recommended to follow these simple steps in order to protect themselves.
• Ensure that you have already opted into Google Play Protect.
• Download and install apps only from the official Play Store.
• Enable 'verify apps' feature from settings.
• Protect their devices with pin or password lock.
• Keep "unknown sources" disabled while not using it.
• Keep your device always up-to-date with the latest security patches.

The Biggest CyberSecurity Incidents Of 2017 At A Glance

It's only July, and already there's been viral, state-sponsored ransomware, leaks of spy tools from intelligence agencies, and full-on campaign hacking. And that's just the beginning. The first six months of 2017 have seen an inordinate number of cyber security meltdowns. And they weren't just your standard corporate breaches. 

Let this recap of 2017's biggest cyber-incidents so far serve as a reminder of just how chaotic things have already gotten–and the year's only halfway done.

SHADOW BROKERS

The mysterious hacking group known as the Shadow Brokers, claiming to have breached the spy tools of the elite NSA-linked operation known as the Equation Group. The identity of the Shadow Brokers is still unknown, but the group's leaks have revived debates about the danger of using bugs in commercial products for intelligence-gathering. Agencies keep these flaws to themselves, instead of notifying the company that makes the software so the vendor can patch the vulnerabilities and protect its customers.

WANNACRY

WannaCry spread around the world, walloping hundreds of thousands of targets, including public utilities and large corporations. Though powerful, the ransomware also had significant flaws, including a mechanism that security experts effectively used as a kill switch to render the malware inert and stem its spread. In total, WannaCry netted almost 52 bitcoins, or about $130,000—not much for such viral ransomware. Microsoft had released the MS17-010 patch for the bug in March, but many institutions hadn't applied it and were therefore vulnerable to WannaCry infection.

PETYA

This malware, called Petya, NotPetya and a few other names, was more advanced than WannaCry in many ways, but still had some flaws, like an ineffective and inefficient payment system. Researchers suspect that the ransomware actually masked a targeted cyber-attack against Ukraine. The ransomware hit Ukrainian infrastructure particularly hard, disrupting utilities like power companies, airports, public transit and the central bank.

WIKILEAKS CIA VAULT 7

WikiLeaks published a data trove containing 8,761 documents allegedly stolen from the CIA that contained extensive documentation of alleged spying operations and hacking tools. Revelations have detailed individual tools for things like using Wi-Fi signals to track a device's location, and persistently surveilling Macs by controlling the fundamental layer of code that coordinates hardware and software. Wiki Leaks claims that Vault 7 reveals "the majority of hacking arsenal including malware, viruses, Trojans, weaponize 'zero day' exploits, malware remote control systems and associated documentation.

CLOUDBLEED

The internet infrastructure company Cloudflare announced that a bug in its platform caused random leakage of potentially sensitive customer data. Cloudflare worked with search engines ahead of and after the announcement to remove the leaked data from caches, and experts noted that it was unlikely that hackers used the data malevolently; the random leaks would have been difficult to weaponize or monetize efficiently. A bug or a damaging attack affecting a company like Cloudflare can impact, and potentially endanger, a significant portion of the web.

198 MILLION VOTERS RECORDS EXPOSED

Unfortunately, it's not uncommon to hear that a trove of voter data was breached or exposed somewhere in the world. But on June 19, researcher Chris Vickery discovered a publicly accessible database that contained personal information for 198 million US voters—possibly every American voter going back more than 10 years. The group had misconfigured it, though, such that some data on the server was protected, but more than a terabyte of voter information was publicly accessible to anyone on the web. Misconfiguration isn't a malicious hack in itself, but it is a critical and all-too-common cybersecurity risk for both institutions and individuals.

MACRON CAMPAIGN HACK

Hackers dumped a 9GB trove of leaked emails from the party of left-leaning front-runner (now French president) Emmanuel Macron. The attack was less strategic and explosive than the WikiLeaks releases of pilfered DNC emails that dogged Hillary Clinton's presidential campaign. Researchers did find evidence that the Russian-government-linked hacker group Fancy Bear attempted to target the Macron campaign in March.

Remote Code Execution Vulnerability: Microsoft CVE-2017-8570

Description:

A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. It has been classified as critical. Affected is an unknown function of the component Object Handler. The manipulation with an unknown input leads to a privilege escalation vulnerability. CWE is classifying the issue as CWE-269. This is going to have an impact on confidentiality, integrity, and availability.

Overview of Attack:

An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. Exploitation of this vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software.

In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.

Technologies Affected:

• Microsoft Office 2007 Service Pack 3
• Microsoft Office 2010 Service Pack 2 (32-bit editions)
• Microsoft Office 2010 Service Pack 2 (64-bit editions)
• Microsoft Office 2013 RT Service Pack 1
• Microsoft Office 2013 Service Pack 1 (32-bit editions)
• Microsoft Office 2013 Service Pack 1 (64-bit editions)
• Microsoft Office 2016 (32-bit edition)
• Microsoft Office 2016 (64-bit edition)

Recommendations:

1. Run all software as a non-privileged user with minimal access rights.
2. Deploy network intrusion detection systems to monitor network traffic for malicious activity.
3. Do not accept or execute files from untrusted or unknown sources.
4. Do not follow links provided by unknown or untrusted sources.
5. Implement multiple redundant layers of security.

References:

• CVE-2017-8570
• Microsoft - Microsoft Homepage
• Microsoft - Microsoft Office Product Homepage

Part 2: Android SpyDealer Trojan (Detailed Technical Analysis)

In our previous post we were looking at the newly detected Trojan SpyDealer which is able to spy on more than 40 communication apps in your Android device. Let's have a look at the detailed technical analysis of this case today. (Credits: Palo Alto)

• Service Launching and Configuration:

After installed on an Android device, SpyDealer shows no application icon. However, it registers two broadcast receivers to listen for events related to the device booting up and network connection status. At the first launch, it retrieves configuration information from the local asset file named readme.txt. The first line of this file indicates the IP address of a remote C2 server, the second line configures what actions the malware can take on mobile networks, and the third line specifies what actions are allowed under a Wi-Fi network.

Fig 1. Content of the readme.txt

• Rooting and Persistence

SpyDealer uses two different rooting procedures to gain root (superuser) privilege. Rooting applications like this one are created for users who want to gain low-level access to their phone which wouldn’t be possible without removing some security protections. This is not the first time that Android malware has stolen root exploits from existing commercial rooting tools. SpyDealer 1.9.1 and 1.9.2 gain root privilege by abusing “Baidu Easy Root”.

The downloaded file “raw.zip” contains the exploits from “Baidu Easy Root” version 2.8.3. For example, 022d251cf509c2f0 is an executable binary file observed in the “raw.zip”, and the original file in “Baidu Easy Root” is actually in gzip format. It’s interesting that we can recover its original file name which is fb_mem_root.

Fig 2. Files in the downloaded raw.zip and Baidu Easy Root v2.8.3

• Command & Control

SpyDealer is capable of receiving commands from remote servers via a number of different channels by either actively initiating connections to C2 servers or passively receiving instructions from C2 servers. These channels include via SMS, UDP and TCP connections. This section details how the malware utilizes each of these channels to communicate with the remote C2 servers.

• SMS

SpyDealer registers a broadcast receiver with a higher priority than the default messaging app to listen for the commands via incoming SMS messages. The commands received through SMS are first decoded for further parsing and processing. Each SMS command contains a command index and arguments split by a newline. The command index ranges from 1 to 5 and each command is detailed in below table.

Fig 3. SMS Command List

To get the geographical location based on the GSM cell information, SpyDealer takes advantage of the interface of Baidu map service. It first collects the GSM cell identity, area code and network operator and then posts the encoded data to the Baidu map service to retrieve the geographical location. With this tactic, a compromised device’s location is exposed to the attacker even there is no GPS available.

Fig 4. Utilize the interface of Baidu map service to get geographical location

Besides the commands listed above, SpyDealer can also set the remote server’s IP address under the following two conditions:

1. The length of the command index received in the SMS (Table 3) is larger than 4, then the command index is actually the remote server’s IP address
2. The incoming SMS message body starts with the string “L112 ” which is followed by the remote server’s IP address

• TCP Server

SpyDealer creates a TCP server on the compromised device listening at port 39568 and waits for incoming commands. The command format and description are listed below table:

Fig 5. Commands via TCP channel

However, there is no authentication mechanism implemented before accepting the incoming commands, which means anyone can connect to a compromised device and control it as long as one knows the target device’s IP address.

• UDP/TCP Client

SpyDealer can also actively connect to the remote server with the configured IP address to ask for commands through UDP or TCP. At first launch, the remote server’s IP address is retrieved from the local asset readme.txt, and the use of UDP or TCP protocols is determined based on another local asset named socket. The command data received by the client is encrypted by the server using Tiny Encryption Algorithm (TEA) Once the client receives a command, the malware decrypts the data.

Fig 6. TEA algorithm used to decrypt incoming comman

• Private Data Collection

As discussed in section Command & Control, we have seen this malware employ many mechanisms to collect private data. Additionally, with root privilege, SpyDealer also tries to gather data from more than 40 common apps falling in different categories including social, communication, browser, mobile mail client, etc. The targeted apps are listed in the below table:

List full of targeted apps

ID	Package Name	App Name
1	com.facebook.katana	Facebook
2	com.tencent.mm	WeChat
3	com.whatsapp	WhatsApp
4	com.skype.raider/com.skype.rover	Skype
5	jp.naver.line.android	Line
6	com.viber.voip	Viber
7	com.tencent.mobileqq	QQ
8	org.telegram.messenger	Telegram
9	com.alibaba.mobileim	Ali WangXin
10	kik.android	Kik
11	com.icq.mobile.client	icq video calls & chat
12	com.keechat.client	KeeChat Messenger
13	com.oovoo	ooVoo Video Call, Text & Voice
14	com.instanza.cocovoice	Coco
15	com.bbm	BBM
16	com.gtomato.talkbox	TalkBox Voice Messenger
17	com.rebelvox.voxer	Voxer Walkie Talkie Messenger
18	com.immomo.momo	MOMO
19	com.zing.zalo	Zalo
20	com.loudtalks	Zello PTT Walkie Talkie
21	com.duowan.mobile	手机YY
22	im.yixin	易信
23	cn.com.fetion	飞信
24	com.sgiggle.production	Tango
25	com.renren.mobile.android	人人
26	net.iaround	遇见
27	com.sina.weibo	Sina Weibo
28	com.tencent.WBlog	Tencent Weibo
29	org.mozilla.firefox	Firefox Browser
30	com.oupeng.browser	Oupeng Browser
31	com.android.browser	Android Native Browser
32	com.baidu.browser.apps	Baidu Browser
33	com.tencent.mtt	Tencent QQ Browser
34	com.lenovo.browser	Lenovo Browser
35	com.qihoo.browser	Qihoo Browser
36	com.taobao.taobao	Taobao
37	com.netease.mobimail	NetEase Mail
38	com.tencent.androidqqmail	Tencent QQ Mail
39	com.corp21cn.mail189	189 Mail
40	cn.cj.pe	139 Mail
41	com.baidu.netdisk	Baidu Net Disk
42	com.l	Smart Shopping List – Listonic
43	com.dewmobile.kuaiya	Zapya
44	com.funcity.taxi.passenger	Kuaidi Taxi

• Accessibility Service Abuse

An increasing number of apps encrypt data before storing it into databases, especially for some popular communication and social apps. App developers do this to protect user data from malicious attacks like this one. To avoid this obstacle, starting in version 1.9.3, SpyDealer implemented an extra accessibility service to steal plain messages by directly extracting texts from the screen.

Fig 7. Configuration of the accessibility service

• Surveillance

SpyDealer is capable of surveilling a compromised victim through multiple means including recording phone call and surrounding audio, recording video, taking photos, capturing screenshots, and monitoring geographical locations. It takes these actions based on commands it receives from the command and control channels described above.

• Record Phone Call and Surrounding Audio

SpyDealer registers a PhoneStateListener to monitor the phone call status. Once there is an active phone call, the audio recording procedure is triggered. The recorded audio data is finally compressed in zip format and stored to

/sdcard/.tmp/audio/<current_time_in_yyyyMMddHHmmss>_<phone_call_num><phone_call_ date>.zip

A message in the format “audio\n<IMSI>\n<IMEI>\n<zip_file_path>” will be sent to the remote server after audio is successfully recorded.

In addition to recording phone calls, SpyDealer is also capable of recording surrounding, ambient audio. It can be configured to record audio at a specific time range. The recorded audio file is stored to the following path in zip format

/sdcard/.tmp/environmentaudioaudio/<current_time_in_yyyyMMddHHmmss>.zip

Audio files recorded more than seven days ago are automatically deleted from the directory /sdcard/.tmp/environmentaudioaudio.

• Record Video

SpyDealer checks to see if the camera is available to record a video every three seconds. In the Android system, a preview surface is required to take a video, which means the user is aware of the video recording event. To avoid this, SpyDealer intentionally sets a very tiny preview surface which, in this case, is 3.0dip * 3.0dip in dimensions. Each video is recorded for 10 seconds and is finally stored to

/data/data/<package_name>/files/cameravideo/<current_time_in_yyyyMMddHHmmss>.zip

If a network connection is available, SpyDealer sends a message in the format “cameravideo\n<IMSI>\n<IMEI> \n<zip_file_path>” to the remote server.

Fig 8. A tiny surface view is defined for recording video silently

• Take Photos

Similar to recording video without a user’s awareness, this malware creates another tiny preview surface which is 0.100000024dip * 0.100000024dip in dimensions before taking a photo. Using the front or rear camera depends on the configuration which the attacker can set remotely. The taken photo is stored to

/data/data/<package_name>/files/camerapic/camera_<current_time_in_millseconds >.jpg

A message indicating a photo is taken is then sent to the remote server and the message is in the format “camerapic\n<IMSI>\n<IMEI>\n<picture_path>”.

• Monitor Geographic Location

SpyDealer dynamically registers a broadcast receiver listening for screen’s status. Whenever the screen is turned off, it tries to get the geographical location via GPS. At the same time, a location listener is registered to track the device’s location. This location listener is notified with the updated location every 10 seconds or whenever 100 meters of movement occurs between location updates. If a network connection is available, the location data will be sent to the remote server in the format

LGPS\n<IMEI>\n<IMSI>\n<longitude>\n<latitude>\n<current_time_in_yyyy-MM-dd hh:mm:ss>

However, the location data is saved locally if there is no network connection and will be uploaded later when the connection is restored.

Conclusion:

SpyDealer makes use of the commercial rooting app “Baidu Easy Root” to gain root privilege and maintain persistence on the compromised device. It employs a wide array of mechanisms to steal private information. At the same time, it accesses and exfiltrates sensitive data from more than 40 different popular apps with root privilege. With accessibility service, this malware is also capable of extracting plain text messages from target apps at real time. To remotely control the victim device, the malware implements three different C2 channels and support more than 50 commands.