LastPass was hacked, again!
Lockdown Mode fingerprinting, and Oktapus fishes for MFA!
All that coming up now on ThreatWire!
Greetings!!
I’m Shannon Morse and this is ThreatWire for August 30 2022 - this is your summary
of the threats to our security, privacy and Internet freedom.
Let’s jump right into the news this week.
LastPass was hacked!
Again!
LastPass initiated an email to customers just a couple of days ago, but the actual attack
happened to the platform about two weeks ago.
In this case, threat actors stole source code and proprietary technical info from their
servers.
According to reports and a security advisory LastPass posted, the attack happened due to
a compromised developer account, which allowed attackers to access a developer environment.
LastPass explained in their advisory that customer data and encrypted vaults weren’t
compromised, and LastPass employed a cybersecurity firm to do some forensics.
The company had detected unusual activity on the dev environment and conducted an investigation,
which led to this discovery.
The company has not elaborated further on how this stolen source code or technical information
could affect users.
Immediate risk is low but future risk could be a serious problem if source code is used
to develop future attacks on the platform.
LastPass has experienced a few different attacks, including a credential stuffing attack last
year which I also reported on.
A customer’s encrypted vault is secured with a master password, but if someone knows
that master password then all bets are off.
Adding multi factor authentication to a password manager account is vital for security for
any password manager, including this one.
Similar to Google’s Advanced Protection Program is Apple’s brand new privacy option
called Lockdown Mode, which is made for folks in high risk categories such as journalists,
activists, human rights defenders, politicians, people with access to proprietary or high
security information, etc.
People in these groups are often targeted by government backed threat actors and as
such, both Google and now Apple have created functionalities for accounts that require
specific security features to be enabled, or remove access to features that could be
exploited.
Starting next month, Apple iOS users can enable this feature on their phones or ipads, within
iOS 16, iPadOS 16, and Mac OS Ventura.
Lockdown mode disables accepting attachments via iMessage other than images, disables Javascript
compiling in web, blocks incoming Facetime calls from unknown callers, disables wired
connections to computers while the phone is locked, and disables mobile device management
config installations to potentially block malware installations.
According to John Ozbay, CEO of the privacy oriented company Cryptee, this mode is easy
for a developer to detect with device fingerprinting.
It’s likely that Lockdown Mode won’t be used by a large audience, so if they can be
detected, they will also stand out amongst a crowd of other iOS users.
A proof of concept was created to test this detection, which shows that any website or
ad could determine if a user is browsing in Lockdown mode.
Ozbay noted that the easiest setting to detect is Lockdown Modes disabling of custom fonts
loading on websites.
Their proof of concept website proves how easy it is to fingerprint a visitor using
Lockdown Mode vs one who is not.
And while this may not be considered a vulnerability, it is a privacy trade off.
Apple would have to rework how Lockdown Mode works in order to mitigate this issue.
But the theory is that if enough people enable Lockdown Mode, then all visitors to a site
or an app would blend in together and not be seen as an uncommon user.
Given that most users will likely not consider themselves a target for attacks like the ones
that Lockdown Mode is marketed towards, we probably will not see a huge influx of users
enabling this feature.
The POC website notes that Lockdown Mode is great for - security - but the trade off is
convenience of having features that could be exploited and the trade off of privacy
since Lockdown Mode could make you stand out of the crowd.
Each user would have to consider their own threat modeling to determine if the trade
offs are right for them.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patrons including JS, Nate, Juni, and Lewis for joining the alliance
on Patreon.com/threatwire.
Let’s finish out today’s episode with my last top story, about the Twilio hack.
Authy.
DoorDash.
Okta.
Signal.
What do all of these have in common?
The Twilio hack.
There’s been a lot of information shared about the Twilio hack and how it has affected
companies across the globe, so this is an effort to explain what happened, who was involved,
and why it hit so many targets at the same time.
First off: The big news this week is about Okta.
Okta is an identity as a service platform that employers can use to easily give employees
access to internal company tools with one single login.
Due to Twilio, a security provider, being targeted, Okta and Signal both stated data
was accessed.
Okta used Twilio services in order to send SMS for authentication.
So, Twilio was accessed in order to steal Okta customer credentials such as phone numbers
and ont time passcodes.
We first heard about this attack when Twilio and Cloudflare published information about
it a couple of weeks ago, in what looked like single attempts for account access, but were
linked to a much broader campaign.
A threat actor targeted Twilio, MailChimp, Klaviyo, Cloudflare, and more in a phishing
campaign that hit at least 130 organizations.
The group used a product dubbed Oktapus, which is a phishing toolkit, to steal Okta identity
credentials and MFA token codes from users at the targeted organizations.
Targeted users received text messages linking them to a phishing site that looked exactly
like the Okta authentication webpage for their org.
Many fell for it.
In total, 114 companies from the US, and 68 more worldwide were hit with the scam.
Unfortunately, the attack has seen a lot of success for the threat actors.
Researchers believe the group first targeted telecommunications companies to find phone
numbers for targets, so they could then text those numbers with legit looking phishing
links.
These links pretended to be Okta authentication pages used by employers, so a victim would
be asked to enter their credentials plus the MFA token to initiate a secure login.
Once the credentials and MFA code were entered, the data is sent via a Telegram channel to
the attackers, at which time the attackers can use those login creds to gain access to
the actual corporate accounts.
The intelligence company Group IB explained everything about this attack in a public post,
saying the threat actors likely started with software as a service firms in order to gain
access to customer lists or mailing lists to create a supply chain attack.
In total, 5441 MFA codes were compromised, with a total of 9,931 user credentials stolen.
Group IB tracked the Telegram data to a User called X who’s had an active account linked
to a GitHub account that traces back to North Carolina.
They’ve issued additional information about this user to law enforcement as well.
Oktapus analysis determined that companies like AT&T, Mailgun, MetroPCS, Slack, Verizon
and many more were targeted but hacks weren't necessarily successful against all of these
providers.
After this happened, many companies started coming forward saying unauthorized parties
gained access to their internal products.
DoorDash stated stolen creds for a vendor employee allowed access to internal tools,
including personal info like names, phone numbers, email and delivery addresses for
customers and delivery people.
A smaller portion of users also had their basic or partial credit card info stolen as
well.
As Twilio investigated, they found that the original attack gave attackers access to 93
Authy user accounts as well, since Authy is owned by Twilio.
That only accounts for a tiny portion of their 75 million Authy users, but an attacker could
use that access to steal any 2FA codes sent via those Authy accounts.
Twilio and Authy recommend users disable the Multi Device feature so attacker controlled
devices can’t be added to an account.
We’ll likely see more companies come forward as they investigate the attack and find new
evidence.
The best way to mitigate these kind of attacks is not to delete MFA, but to choose a better
MFA option.
Using FIDO2 compliant keys like Yubikeys offers additional security without the potential
of someone stealing a 6 digit code via MFA phishing techniques.
And of course, not clicking strange links that pretend to be a login prompt can help
as well.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
Don't forget to like and subscribe to Hak5 as well!
I'm Shannon Morse, I'll see you on the Internet!