OAuth Dirty Dancing, Crypto Mining in the Cloud, Ransom Return, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 12 July, 2022
Episode 263 - 12 July 2022
OAuth Dirty Dancing- https://portswigger.net/daily-swig/dirty-dancing-in-oauth-researcher-discloses-how-cyber-attacks-can-lead-to-account-hijacking
Crypto Mining in the Cloud -
https://thehackernews.com/2022/07/cloud-based-cryptocurrency-miners.html
Rolling-PWN a Honda -
https://www.bleepingcomputer.com/news/security/hackers-can-unlock-honda-cars-remotely-in-rolling-pwn-attacks/
Amazon Scam Days- https://www.infosecurity-magazine.com/news/spike-amazon-prime-scams/
Ransom Return -
https://www.bleepingcomputer.com/news/security/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks/
Hi, I’m Paul Torgersen. It’s Tuesday July 12th 2022, and this is a look at the information security news from overnight.
From PortSwigger.net
A researcher has discovered a way to perform single-click account hijacking by abusing the OAuth process flow. He calls it Dirty Dancing because attackers can dance around the OAuth authentication process and how it communicates between a browser and a service provider. All the dirty details in the article.
From TheHackerNews.com:
GitHub Actions and Azure virtual machines are being leveraged for cloud-based crypto mining operations. At least 1,000 repositories and 550 code samples have been found taking advantage of the GitHub runners for mining. No number was provided for the Azure VMs. Details and a link to the Trend Micro research in the article.
From BleepingComputer.com:
Researchers found that several modern Honda models have a vulnerable rolling code mechanism that allows unlocking the cars or even starting the engine remotely. It has to do with intercepting signals from the fob and how the pseudorandom number generator works. The Hondas will re-sync when the car gets lock/unlock commands in succession, which allow codes from a previous session to be successful instead of invalidated. Details inside.
From Infosecurity-Magazine.com
With Amazon Prime Days come Amazon Prime Days scams. In 2021 there was nearly double the amount of phishing scams related to the sale than typical Amazon focused attempts. Be on the lookout for imposter websites and lots of “get an Amazon gift card if you fill out this survey.” Remember, if something looks too good to be true, it probably is.
And last today, from BleepingComputer.com
In a bit of good news, back in December of 2019, Maastricht University, a Dutch university with more than 22,000 students, fell victim to a ransomware attack. To get their files decrypted, they paid a ransom of 30 bitcoins, about 200,000 Euro at the time. Flash forward to February of this year when Dutch authorities found a wallet containing part of the paid ransom, which they promptly returned to the university. But because of the increase in value of the crypto, the amount returned was right about 500,000 Euro. Sometimes being the victim of a crime does pay.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.