zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - May 15, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - May 15, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup to give you and your clients an advantage over the adversary.

Key findings:

  • Toyota Allowed Passwordless Access to Car-Location Data for 10 Years
  • XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks
  • Discord Discloses Data Breach After Support Agent Hacked
  • CVE-2023-2698
  • CVE-2023-2697
  • CVE-2023-2692
  • CVE-2020-1170
  • CVE-2017-5586
  • CVE-2018-1335
  • Credit Card Data Breach: 2023-5-13
  • Credit Card Data Breach: 2023-5-12
  • Credit Card Data Breach: 2023-5-14

Toyota Allowed Passwordless Access to Car-Location Data for 10 Years

A misconfigured database at Toyota led to the public exposure of certain vehicle-related data of about 2.15 million customers between November 6, 2013, and April 17, 2023. The cloud-environment misconfiguration allowed anyone to access (without a password) in-vehicle terminal ID, chassis number, and vehicle location information of customers who used T-Connect G-Link, G-Link Lite, or G-BOOK services between January 2, 2012, and April 17, 2023. Toyota claims to have discovered no evidence of misuse of the data exposed in this breach.

XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks

Researchers have identified a phishing campaign that targets manufacturing firms and healthcare clinics in Germany to spread the XWorm malware through a unique attack chain. Dubbed MEME#4CHAN, the campaign uses "meme-filled" PowerShell code to deliver an obfuscated XWorm payload to infected victims. The phishing emails contain Microsoft Word documents that weaponize the Follina vulnerability (CVE-2022-30190) to drop an obfuscated PowerShell script, which the hackers use to bypass Antimalware Scan Interface and disable Microsoft Defender.

Discord Discloses Data Breach After Support Agent Hacked

Popular social media platform Discord suffered a security breach after a third-party support agent's account was compromised, resulting in unauthorized access to user email addresses, messages, and attached files in the support ticket queue. Discord acted quickly to disable the compromised account and conduct malware checks to eliminate any potential threats. While the company assured users of its commitment to security measures and minimal impact, it advised affected users to remain vigilant and report any suspicious behavior.

VULNERABILITIES

  • CVE-2023-2698 - A vulnerability classified as critical was found in SourceCodester Lost and Found Information System 1.0.
  • CVE-2023-2697 - A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0.
  • CVE-2023-2692 - A vulnerability has been found in SourceCodester ICT Laboratory Management System 1.0 and classified as problematic.

EXPLOITS

  • CVE-2020-1170 Cloud Filter Arbitrary File Creation / Privilege Escalation
  • CVE-2017-5586 OpenText Documentum D2 4.x Remote Code Execution
  • CVE-2018-1335 Apache Tika-server < 1.18 - Command Injection

BREACHES

Tags: DIB, tlp:green