Summary: Symantec’s Threat Hunting team discovered over 1,822 iOS apps and 37 Android apps containing hard-coded AWS credentials. Most of the identified apps provide direct access to private cloud infrastructure with a substantial portion allowing access to live databases. These databases contain sensitive user and customer information.

The source of these discovered vulnerabilities can be traced to using shared components such as a library or third-party SDK (Software Development Kit). The developers using those components could have left it for convenience in the development stage, accessing certain assets, and overlooked codes. The problem with leaving hard-coded AWS credentials is that usually the same token can be used for other AWS contents and thus expose sensitive information.

Why it matters: The threat of hardcoded AWS credentials is a supply chain vulnerability that can allow threat actors to access otherwise-secured technologies. In the case of these detected AWS vulnerabilities, the use of open-sourced or shared components are used to develop the apps. These shared components can bypass the normally secured services. More importantly, the implementation of these hardcoded credentials can allow threat actors to pivot from one vulnerability to another and thus exposing sensitive user and customer data.

Summary: Multiple companies have reported a new sophisticated phishing attack using SMS phishing messages with links to phishing sites. The messages mimic the name of the employer as well as the authenticating body. The most prevalent of these authenticating bodies has been “Okta.” As such, one of the most common formats for phishing links is “[COMPANY]-okta.com.” These websites are set up minutes before the texts are sent to avoid detection of the company’s phishing sites.

The core vulnerability that is targeted by the threat actors is the user’s multifactor authentication (MFA) credentials. Normally, MFA credentials are used as an added layer of protection for users to further verify the user’s identity. One of the most prevalent forms of MFA is the use of time-based one-time passwords (TOTP). The attackers rely on the users to provide not only their credentials but also the TOTP. Once placed within the phishing site, a Telegram messaging bot forwards the credentials to the threat actor to allow them access to the victim’s accounts.

Why it matters: It is commonly said that end users are the most vulnerable links in security. As such, multiple factors of authentication have been widely adapted to reinforce the standard authentication method of usernames and passwords. One of the more prevalent forms of doing so is applying TOTP and other forms of one-time passwords. This attack circumvents this defense by allowing the target to enter the password in a false website, thus giving the threat actor the ability to access the user’s account in their stead. The implementation and success of the attack has allowed threat actors to implement supply chain attacks. More importantly, these attacks show that even with formal training and technical controls, the end users remain an attack vector.

Summary: An Iranian hacking group, designated as TA453, has been detected using multiple personas in phishing emails. Phishing emails have been detected with multiple fake personas, or sock puppet accounts, being CC’d in the email message to the victim. The fake personas then respond to the email to create a sense of legitimacy and trustworthiness. These fake emails use personal email addresses rather than impersonating the CC’d users’ institutional emails.

These elaborate email conversations are used to lure users into clicking malicious links that are attached to the email. Researchers have discovered that these links lead to a OneDrive link that contained a password-protected DOCX file. Three macros have so far been discovered involving the attack. The macros run in the background to collect user credentials and a list of running processes which are then exfiltrated using Telegram’s API (Application Programming Interface).

Why it matters: The prevalence of targeted phishing attempts has been included in basic security training. This group’s new strategy aims to disguise phishing attempts as genuine conversations to gain the user’s trust and circumvent the standard security awareness training. Commonly, impersonating institutions’ websites is a common tactic for threat actors to contact. However, this new technique uses impersonated personal email addresses to subvert the standard expectations of phishing emails. This new tactic shows the importance of developing new security training to combat the new threat actor tactics.