Apple emergency updates fix 3 new zero-days exploited in attacks

By Sergiu Gatlan September 21, 2023 01:57 PM
Apple released emergency security updates to patch three new zero-day vulnerabilities exploited in attacks targeting iPhone and Mac users, for a total of 16 zero-days fixed this year.

Two bugs were found in the WebKit browser engine (CVE-2023-41993) and the Security framework (CVE-2023-41991), enabling attackers to bypass signature validation using malicious apps or gain arbitrary code execution via maliciously crafted webpages.

The third one was found in the Kernel Framework, which provides APIs and support for kernel extensions and kernel-resident device drivers. Local attackers can exploit this flaw (CVE-2023-41992) to escalate privileges.

Apple fixed the three zero-day bugs in macOS 12.7/13.6, iOS 16.7/17.0.1, iPadOS 16.7/17.0.1, and watchOS 9.6.3/10.0.1 by addressing a certificate validation issue and through improved checks.

“Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7,” the company revealed in security advisories describing the security flaws.

The list of impacted devices encompasses older and newer device models, and it includes:

iPhone 8 and later
iPad mini 5th generation and later
Macs running macOS Monterey and newer
Apple Watch Series 4 and later
All three zero-days were found and reported by Bill Marczak of the Citizen Lab at The University of Toronto’s Munk School and Maddie Stone of Google’s Threat Analysis Group.

While Apple has yet to provide additional details regarding the flaws’ exploitation in the wild, Citizen Lab and Google Threat Analysis Group security researchers have often disclosed zero-day bugs abused in targeted spyware attacks targeting high-risk individuals, including journalists, opposition politicians, and dissidents.

Article (

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

DO YOU REALLY WANT TO BUY THE NEW I15 PHONE THAT IS WAY OVERPRICED? Folks it is only a phone be real save the money

New T-Mobile hack allegedly exposes 90GB of data

Updated on: 22 September 2023 by Vilius Petkauskas Deputy Editor

T-Mobile, the global telecoms giant, could be facing a third data breach in less than 12 months. Cybercriminals say they’ve exposed employee credentials, customer info, and other sensitive data.
T-Mobile, the Deutsche Telekom-owned brand with operating subsidiaries in the US, Poland, and other countries, could be heading for a rocky end to the year, with a third major data breach on its hands.
Threat actors posted a database on a cybercriminal forum, which they claim contains information stolen in April 2023. The post says the stolen data includes employee credentials, partial Social Security numbers (SSNs), email addresses, customer data, T-Mobile’s sales and analytics data, and other information.

The post advertising the leak is called “T-Mobile, Connectivity Source”. Connectivity Source is one of T-Mobile’s authorized retailers serving customers T-Mobile branded stores.

According to the Cybernews research team, the sample data that attackers posted appears legitimate. So far, there’s no confirmed information about what data the leaked dataset contains. However, the team said that attackers posted a massive amount of data, 90 GB in total.

Cybernews has reached out to T-Mobile for confirmation, however, we did not receive a reply before publishing this article.

According to malware researchers vx-underground, who claim to have insider knowledge about the breach, the data was stolen shortly after T-Mobile‘s second hack of this year, which occurred in March, 2023.

Also in March, the company disclosed a cyberattack in which attackers may have accessed T-Mobile account PINs, SSNs, full names, and other data. In January 2023, T-Mobile USA suffered a breach involving the accounts of 37 million of its cell phone users.

The company has suffered numerous data breaches in the past as well. In August 2021, T-Mobile reported a data breach after an online forum said that the personal data of more than 100 million of the company’s users was leaked.

Bleeping Computers Comments:
By Sergiu Gatlan
September 20, 2023 05:11 PM 2

T-Mobile app glitch let users see other people’s account info

T-Mobile says a cyberattack did not cause this incident, and its systems were not breached.

Also, despite the significant wave of customers reporting that they’ve been affected by this issue, T-Mobile says the incident had limited impact, only affecting less than 100 individuals.

“There was no cyberattack or breach at T-Mobile,” a spokesperson told BleepingComputer when asked for more details.

“This was a temporary system glitch related to a planned overnight technology update involving limited account information for fewer than 100 customers, which was quickly resolved.”
Nine data breaches since 2018
In May, T-Mobile disclosed the second data breach since the start of 2023 after hundreds of customers had their personal information exposed between late February and March after attackers hacked into the carrier’s systems.

In January, the mobile carrier revealed another data breach after the sensitive info of 37 million customers was stolen using one of its Application Programming Interfaces (APIs).

Since 2018, T-Mobile has been hit by seven other data breaches:

In August 2018, attackers accessed the data of around 3% of all T-Mobile customers.
In 2019, T-Mobile exposed the account info of an undisclosed number of prepaid customers.
In March 2020, T-Mobile employees were affected by a breach exposing their personal and financial information.
In December 2020, threat actors accessed customer proprietary network info (phone numbers, call records).
In February 2021, an internal T-Mobile app was accessed by unknown attackers without authorization.
In August 2021, hackers brute-forced their way through T-Mobile’s network following a breach of one of its testing environments.
In April 2022, the notorious Lapsus$ extortion gang breached T-Mobile’s network using stolen credentials.

Article (

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

LockBit Is Using RMMs to Spread Its Ransomware

The LockBit group is using native IT management software to live off the land, planting and then spreading itself before deploying its ransomware

Nate Nelson Contributing Writer, Dark Reading

The LockBit ransomware group is taking advantage of remote monitoring and management (RMM) software to spread its foothold in targeted networks.

Three recent attacks described in a report published Sept. 18 by Canada-based eSentire follow a similar trajectory: a LockBit affiliate either took advantage of exposed RMM instances, or brought their own RMM to the party, living off the land (LotL) in order to cement its footing in victim networks. Two of these cases affected manufacturers, and one struck a managed service provider (MSP), enabling the group to further compromise some of its downstream customers.

“There’s a general trend towards living off the land, where they’re just avoiding malware. Period. Even for initial access,” explains Keegan Keplinger, senior threat intelligence researcher with eSentire’s Threat Response Unit. “They want to get valid credentials, and use those legitimate credentials to get in.”

How LockBit Uses RMMs
In June, the Cybersecurity & Infrastructure Security Agency (CISA) published a cybersecurity advisory about LockBit, and for good reason. Arguably no cybercriminal outfit — in the ransomware-as-a-service game or otherwise — has been as prolific in 2023, with attacks seemingly targeting just about every possible sector, and every type of device, often yielding big money payouts.

The advisory details the group’s favored tactics, techniques, and procedures (TTPs), including its penchant for taking advantage of RMMs.

In a February 2022 attack against a home decor manufacturer, for example, eSentire’s threat researchers discovered a LockBit affiliate with admin access in an unprotected machine, attempting to establish persistence and spread to other computers via the RMM AnyDesk.

“Especially in the last year, threat actors have been pivoting to not using malware,” Keplinger explains, referring to how hackers establish persistence, and spread between and inside of networks. “Malware is often detected by antivirus, and if not, advanced endpoint technology. So anytime you can use either software that’s already in the environment, or software that could be conceivably legitimate, some people may not even recognize that as malicious right away.”

LockBit was counting on this in a June attack against a storage materials manufacturer, which counted itself a customer of the RMM ConnectWise. In this case, the researchers speculated that the threat actor was not able to steal credentials necessary to log into the company’s ConnectWise environment. So, instead, it installed its own, second instance of ConnectWise in the network.

“It’s pretty brilliant, because they said: ‘We already know ConnectWise is in this particular target organization. So, we’ll bring our own and nobody will really notice there’s another instance.'”

The Extent of the LockBit Threat
Organizations that enjoy the benefits of RMMs, without applying proper security controls to prevent their abuse, may expose not only themselves but also partners and customers, as LockBit’s MSP breach this February demonstrates.

The MSP in question had left its ConnectWise login panel exposed to the open Internet. The justification, the researchers speculated, was to make it easier for its customers’ IT administrators to access the service. But with brute force, or simply by purchasing them from the Dark Web, the attackers gained the necessary credentials to break through. Within five minutes of the intrusion, LockBit began dropping its ransomware binaries on multiple endpoints.

“They pretty much can go in unfettered when they get into those tools, and they get admin credentials,” Keplinger laments. Indeed, before it was stopped, the group had used the RMM’s remote access capabilities to reach customers in manufacturing, business services, hospitality, and transportation.

Companies can harden themselves against this kind of abuse by applying multi-factor authentication and strict access controls to these powerful tools. And, Keplinger adds, “endpoint monitoring is probably the biggest differentiator that’s stopping and preventing these attacks.”

“They’re very successful,” he warns of LockBit, for those not yet convinced. “Very pervasive, and very destructive.”

Article (

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

Microsoft leaks 38TB of private data via unsecured Azure storage

By Sergiu Gatlan September 18, 2023 11:18 AM
The Microsoft AI research division accidentally leaked dozens of terabytes of sensitive data starting in July 2020 while contributing open-source AI learning models to a public GitHub repository.

Almost three years later, this was discovered by cloud security firm Wiz whose security researchers found that a Microsoft employee inadvertently shared the URL for a misconfigured Azure Blob storage bucket containing the leaked information.

Microsoft linked the data exposure to using an excessively permissive Shared Access Signature (SAS) token, which allowed full control over the shared files. This Azure feature enables data sharing in a manner described by Wiz researchers as challenging to monitor and revoke.

When used correctly, Shared Access Signature (SAS) tokens offer a secure means of granting delegated access to resources within your storage account.

This includes precise control over the client’s data access, specifying the resources they can interact with, defining their permissions concerning these resources, and determining the duration of the SAS token’s validity.

“Due to a lack of monitoring and governance, SAS tokens pose a security risk, and their usage should be as limited as possible. These tokens are very hard to track, as Microsoft does not provide a centralized way to manage them within the Azure portal,” Wiz warned today.

“In addition, these tokens can be configured to last effectively forever, with no upper limit on their expiry time. Therefore, using Account SAS tokens for external sharing is unsafe and should be avoided.”

38TB of private data exposed via Azure storage bucket

The Wiz Research Team found that besides the open-source models, the internal storage account also inadvertently allowed access to 38TB worth of additional private data.

The exposed data included backups of personal information belonging to Microsoft employees, including passwords for Microsoft services, secret keys, and an archive of over 30,000 internal Microsoft Teams messages originating from 359 Microsoft employees.

In an advisory on Monday by the Microsoft Security Response Center (MSRC) team, Microsoft said that no customer data was exposed, and no other internal services faced jeopardy due to this incident.

Wiz reported the incident to MSRC on June 22nd, 2023, which revoked the SAS token to block all external access to the Azure storage account, mitigating the issue on June 24th, 2023.

“AI unlocks huge potential for tech companies. However, as data scientists and engineers race to bring new AI solutions to production, the massive amounts of data they handle require additional security checks and safeguards,” Wiz CTO & Cofounder Ami Luttwak told BleepingComputer.

“This emerging technology requires large sets of data to train on. With many development teams needing to manipulate massive amounts of data, share it with their peers or collaborate on public open-source projects, cases like Microsoft’s are increasingly hard to monitor and avoid.”

BleepingComputer also reported one year ago that, in September 2022, threat intelligence firm SOCRadar spotted another misconfigured Azure Blob Storage bucket belonging to Microsoft, containing sensitive data stored in files dated from 2017 to August 2022 and linked to over 65,000 entities from 111 countries.

SOCRadar also created a data leak search portal named BlueBleed that enables companies to find out if their sensitive data was exposed online.

Microsoft later added that it believed SOCRadar “greatly exaggerated the scope of this issue” and “the numbers.”


Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

Facebook Messenger phishing attack pumps out 100K+ weekly messages

Updated on: 12 September 2023
Vilius Petkauskas Deputy Editor

Millions of Facebook business accounts worldwide are being targeted with phishing messages, with a success rate of close to one in 70 victims infected, researchers say.

Attackers have been abusing Facebook’s Messenger platform to peddle millions of targeted phishing messages. According to cybersecurity firm Guardio, cybercrooks target highly rated marketplace sellers and, sometimes, large corporations with fake business inquiries.

For example, the fake message will start with a simple “hello” from a fake account. From the victim’s perspective, that’s just another potential customer.

The attackers’ message proceeds to inquire whether a product is still available. The only way to know which ‘product’ the fake client is talking about is to download a file.

This way, criminals try coaxing victims into downloading an RAR or ZIP archive containing a downloader for a Python-based infostealer. Attackers bypass automated scanners by encoding the content.

Legitimate business accounts are a lucrative target for threat actors. Stolen credentials can be quickly sold on forums for criminals who use them to peddle fake ads, malware, and scams.

Guardio researchers claim that while the attack method here is far from novel, the scale of the campaign is worrying. In only 30 days, attackers managed to target a staggering 7% of all Facebook business accounts, with one out of 250 victims downloading the malicious file.

The overall success rate for the campaign appears even higher, with Guardio claiming one in 70 targets have been infected in what it described as a staggering “success rate” for the criminal undertaking.

The precise reason for the discrepancy between these two sets of figures was not made clear by researchers.

“The threat actors hold an army of bots and fake Facebook accounts as well as a listing of millions of business accounts, pages, and managers – sending over 100k phishing messages a week to Facebook users around the world,” researchers claim.

By following the breadcrumbs left by the perpetrators, Guardio’s team deduced that the threat actors likely come from Vietnam: some of the commands are in Vietnamese and there are signs of the Coc Coc browser, popular in the South-east Asian nation.

Telegram/Discord API tokens left by attacker bots led researchers to a Telegram account named “MrTonyName,” which they believe to be one of those behind the attack.

To all techs suggestion keep Facebook off all lan networks, if marketing need it keep them in the DMZ zone

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

Vulnerability: GhostToken vulnerability in Google Cloud

Reported by Colin Domoney Must Read Article1-Aug-25-2023-01-31-48-4868-PM ( Great article

This week, we have news of the so-called GhostToken vulnerability, which could allow attackers to target Google Cloud users via the application marketplace. According to the researchers at Astrix who discovered the vulnerability, it could have allowed attackers to access the target account’s Google Drive, Calendar, Photos, Google Docs, Google Maps, and other Google Cloud Platform services. The researchers reported their findings to Google in June 2022, Google accepted them in August 2022, and in April 2023, they released a global patch to address the issue. Researchers also recommended that Google Cloud users regularly verify the application installed on their instance using the application management page on the Google Cloud portal.

The root cause of the vulnerability relates to the manner in which Google Cloud manages the lifecycle of an application and, specifically, how the application’s associated OAuth2 tokens are managed. The Google Cloud provides a 30-day grace period from the time an application is scheduled for deletion until the time it is permanently deleted. This grace period is to allow administrators an opportunity to recover resources deleted in error. While in the pending deletion state, the application (and its associated resources such as OAuth2 tokens) are invisible to platform users. The researchers at Astrix discovered that if an application’s pending deletion was canceled within the 30-day window, then the application and all its associated resources would be restored. They tested this with an OAuth2 token and discovered that this token still provided access to its original resources.

They describe how this delete/pending deletion/cancel deletion loop can be used to effectively hide a rogue application from the application management page of a user’s Google Cloud portal, using the following attack flow:

Article (

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

Software Makers May Face Greater Liability in Wake of MOVEit Lawsuit

Makers of vulnerable apps that are exploited in wide-scale supply chain attacks need to improve software security or face steep fines and settlement fees.
Elizabeth Montalbano Contributor, Dark Reading (August 22, 2023)

Roy Comment great article way to many firms are using “Terms and Conditions on there web sites to try and avoid litigation” Microsoft is a great example, I can name many others that I come in contact with, another example is RackSpace totally hosed the mail world with there security breach Dec 2022. All firms need to be held accountable/and financially for security breaches

A nationwide class-action suit filed against Progress Software in the wake of the massive MOVEit breach could point to additional litigation against software companies whose vulnerable applications are exploited in large-scale supply chain attacks, a legal expert says.

Progress faces claims of negligence and breach of contract, among others, in five nationwide class-action lawsuits filed by consumer-rights law firm Hagens Berman after the Cl0p ransomware gang exploited a critical zero-day flaw in its MOVEit managed file transfer application.

The attack has affected both multinational, high-profile million- and billion-dollar organizations — Shell Oil and British Airways among them — as well as smaller organizations both public and private who deploy MOVEit to exchange sensitive data and large files both internally and externally.

Environments that had vulnerable versions of the software installed exposed sensitive personally identifiable information (PII) of customers, including names, Social Security numbers, birth dates, demographic information, insurance policy numbers, and other financial information.

Hagens Berman claims that in all, Progress has compromised the sensitive personal information of more than 40 million people, and promises that more class actions are on the way as more of the 600 affected organizations come forward.

The suits claim that Progress failed “to properly secure and safeguard personally identifiable information,” thus exposing plaintiffs to “a current and ongoing risk of identity theft” as well as invasion of privacy, financial costs, loss of time and loss of productivity, according to a court filing. Moreover, they face a continued risk that their private information will be misused by criminals.

Depending on how the case proceeds, it could set further precedent for the liability of software providers if and when they fail to fix vulnerabilities in their products before attackers can exploit them and cause data, financial, and other losses for their customers.

Article (

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

Hosting firm says it lost all customer data after ransomware attack

Sounds like what could happen to Microsoft O365 and they have no liability (there are inexpensive backup solutions available)

By Bill Toulas August 23, 2023 10:40 AM (great reporting)
Danish hosting firms CloudNordic and AzeroCloud have suffered ransomware attacks, causing the loss of the majority of customer data and forcing the hosting providers to shut down all systems, including websites, email, and customer sites.

The two brands belong to the same company and stated that the attack unfolded last Friday night. However, today’s operational status remains highly problematic, with the firm’s IT teams only managing to restore some servers without any data.

Moreover, the firm’s statement clarifies that it won’t be paying the threat actors a ransom and has already engaged with security experts and reported the incident to the police.

Unfortunately, the system and data restoration process isn’t going smoothly, and CloudNordic says many of its customers have lost data that appears to be irrecoverable.

“Since we neither can nor wish to meet the financial demands of the criminal hackers for a ransom, CloudNordic’s IT team and external experts have been working intensively to assess the damage and determine what could be recovered,” reads CloudNordic’s statement (machine translated)

“Sadly, it has been impossible to recover more data, and the majority of our customers have consequently lost all their data with us.”

Both public notices include instructions on recovering websites and services from local backups or Wayback Machine archives.

Given the situation, the two hosting service providers previously recommended that heavily impacted customers move to other providers, such as Powernet and Nordicway.

Article (

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

Sneaky Amazon Google ad leads to Microsoft support scam

By Lawrence Abrams August 21, 2023 01:52 PM

A legitimate-looking ad for Amazon in Google search results redirects visitors to a Microsoft Defender tech support scam that locks up their browser.
Today, BleepingComputer was alerted to what appeared to be a valid advertisement for Amazon in the Google search results.
The advertisement shows Amazon’s legitimate URL, just like in the company’s typical search result, as shown below.

These tech support scams will automatically go into full-screen mode, making it hard to get out of the page without terminating the Google Chrome process.
However, when Chrome is terminated in this way, on the relaunch, it will prompt users to restore the previously closed pages, reopening the tech support scam.
A demonstration of today’s fake Amazon Google ad leading to the tech support scam site can be seen below

Google ads abused to distribute malware
BleepingComputer reached out to both Google and Amazon regarding this malvertising but has not received a response at the time of this publication.
Google advertisements have been heavily abused over the past year by other threat actors to distribute malware, which sometimes leads to ransomware attacks.
The threat actors would create replicas of legitimate sites but swap the download links to distribute trojanized programs that install malware.
The Royal ransomware operation also creates Google advertisements promoting malicious sites that install Cobalt Strike beacons. These beacons are used to provide initial access to corporate networks to conduct ransomware attacks.

Article (

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient