McDonald's Canada said Friday hackers stole the personal data of about 95,000 job seekers from the fast food chain's recruitment website over the past three years.

The data was from people who had sought work with the company since March 2014, and the company said it has launched an investigation into the hack.

The web portal targeted in the attack, which has been shut down, collected job candidates' names, addresses, emails, telephone numbers, employment histories and other relevant data, the company said in a statement.

More sensitive data such as health information, social insurance numbers and banking information is not collected during the recruiting process and were not affected, the company said.

There were no signs so far that the stolen information had been misused, the company said, and apologized to those affected.

"The careers webpage will remain shut down until the investigation is complete and appropriate measures are taken to ensure that this type of security breach does not happen again," the statement said, asking future job seekers to apply in person.

© AFP 2017

Tags:

Schneider Electric has released software and firmware updates to address several vulnerabilities affecting some of the company’s Wonderware and Modicon products.

According to advisories released by Schneider Electric and ICS-CERT, the Access Anywhere extension of the Wonderware InTouch HMI visualization software is affected by four medium and high severity vulnerabilities.

The list includes a cross-site request forgery (CSRF) on the Gateway component (CVE-2017-5156), an information disclosure flaw that could lead to the exposure of credentials (CVE-2017-5158), and a weakness related to the use of outdated cipher suites and improper verification of SSL certificates (CVE-2017-5160).

The fourth vulnerability, only mentioned in Schneider’s advisory, has been described as a flaw that allows an attacker to escape remote InTouch applications and launch other processes.

The security holes affect Wonderware InTouch Access Anywhere 2014 R2 SP1b (11.5.2) and prior, and they have been addressed with the release of Wonderware InTouch Access Anywhere 2017 (17.0.0). The vendor has also provided recommendations for mitigating the vulnerabilities.

Learn More at the 2017 Singapore ICS Cyber Security Conference

Three medium and high severity vulnerabilities have also been identified in Schneider Electric’s Modicon programmable logic controllers (PLCs).

The flaws are related to the exposure of login credentials during transmission (CVE-2017-6028), predictable authentication cookies (CVE-2017-6026), and insufficiently random TCP initial sequence numbers (CVE-2017-6030). Schneider Electric has published separate advisories for each of the issues.

The security holes affect Modicon M221, M241 and M251 PLCs. The vendor has released firmware updates that address the weaknesses related to insufficiently random values, and provided recommendations for reducing the risk of exploitation for the credentials protection vulnerability.

In early March, Schneider also released an advisory to warn customers of a flaw that can be exploited to execute arbitrary commands on Modicon PLCs.

The company also informed users this month about a high severity denial-of-service (DoS) vulnerability affecting the Flexera FlexNet Publisher component used in the Schneider Electric Floating License Manager. This license manager is used by both the PowerSCADA Expert and PlantStruxure PES products.

Related: High Severity Flaws Patched by Siemens, Schneider Electric

Related: Schneider Electric Patches Flaws in ClearSCADA, Wonderware Products

Related: Flaw in Schneider Industrial Firewalls Allows Remote Code Execution

Eduard Kovacs is an international correspondent for SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

A newly discovered piece of malware features a modular design and has been used in highly targeted campaigns, Forcepoint security researchers reveal.

Dubbed Felismus, the malware is a well-written Remote Access Trojan (RAT) believed to have been created by professional cybercriminals. The threat packs numerous anti-analysis capabilities (including advanced encryption of network communication) and shows good 'operational hygiene' relating to the re-use of email addresses and other traceable artefacts, Forcepoint says.

The first available samples feature filenames mimicking that of Adobe's Content Management System (AdobeCMS.exe) and emerged several weeks ago, but the malware’s attacks can be dated six months before. The attackers behind the malware and their targets remain opaque for the time being, but the RAT’s libraries appear to be actively exploited and the spotted attacks are believed to be part of a larger campaign.

The threat is capable of self-updating, while also being able to identify and evade a large number of anti-virus products, most of which are well-known brands. The malware packs capabilities typical of RATs, such as file upload, file download, file execution, and shell (cmd.exe) command execution. The malware can also create text files on the local machine.

At the time of publishing, 31 of 61 anti-virus products on VirusTotal detected the threat based on the hash provided by ForcePoint.

The security researchers note that the malware’s command and control (C&C) infrastructure is active and appears to be maintained, while also revealing that the RAT uses at least three separate encryption methods for its traffic, depending on the type of message.

A series of domains associated with the threat were found to return a fake WordPress.org page from 2013, and to feature falsified details, such as invalid Hong Kong-based telephone numbers and inexistent street addresses. The email addresses used to register the domains haven’t been used anywhere else online, which confirms the degree of professionalism and good 'operational hygiene' these cybercriminals are using.

“The malware analysed appears to be both modular and well-written, strongly suggesting that skilled attackers are responsible, while its apparent scarcity in the wild implies that it is likely highly targeted. On top of this, the good 'operational hygiene' relating to the re-use of email addresses and other similarly traceable artefacts suggests coordinated, professional actors and, at the time of writing, there is little to link it with any known campaigns (APT-linked or otherwise),” Forcepoint says.

The security researchers say that, while the malware is well-written, the use of a folder name 'datas' and a typo in the function name 'GetCurrtenUserName' suggest that English might not be the authors’ first language. They also discovered that the available malware samples appear to have been compiled using a December 2014 version of the open-source TDM-GCC compiler suite.

The analyzed sample performed a small number of functions and generated only several unique log file entries, which could be indicative of the fact that either the campaign is currently dormant or the malware behaves differently depending on the infected machine. The researchers also noticed that a C&C IP address appeared to selectively block one of the security firm’s exit IPs during research.

“If the other modules and capabilities associated with the malware remain a matter of speculation, so too do the intended target(s). Of the five domains hosted on the C&C IP address identified within this post, three - cosecman[]com, nasomember[]com, and unmailhome[]com - have potential associations with the financial services sector; however, under this theory the naming of the remaining two domains - maibars[]com and mastalib[]com - remain unexplained,” Forcepoint concludes.

Related: macOS RAT Uses 0-Day for Root Access

Related: Adwind RAT Campaign Hits Organizations Worldwide: Kaspersky

Related: AthenaGo RAT Uses Tor2Web for C&C Communication

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

Germany's armed forces Saturday launch a cyber command, with a status equal to that of the army, navy and air force, meant to shield its IT and weapons systems from attack.

Military planners fear that wars of the future will start with cyber attacks against critical infrastructure and networks, extensive online espionage and sabotage. The Bundeswehr's new Cyber and Information Space (CIR) Command, based in the former West German capital of Bonn, will start off with 260 IT specialists but grow to 13,500 military and civilian personnel by July.

With the new digital force, Germany is taking a leading role among NATO allies, its new commander, Lieutenant General Ludwig Leinhos, told news weekly Focus.

Leinhos said the main tasks would be to operate and protect the military's own IT infrastructure and computer-assisted weapons systems, as well as surveillance of online threats.

He said the centre would also develop and war-game offensive capabilities because "in order to be able to defend yourself, you have to know the options for attack".

However, any full-scale cyber attacks abroad would have to be approved by the German parliament, just like any other military mission.

The security of national and government IT systems, meanwhile, remains the responsibility of the interior ministry which oversees the domestic security agency that handles counterespionage.

The German government has been sensitized to cyber security since the parliament was attacked last year, with security sources suspecting Russian hackers behind the attack.

Defense Minister Ursula von der Leyen had announced the creation of the cyber command two years ago to protect the military from increasing numbers of online attacks.

The defense ministry said that in this year's first nine weeks alone, the IT systems of the Bundeswehr had been targeted more than 280,000 times.

Leinhos said that "we are in a constant race between the development of attack options and defensive capabilities".

© AFP 2017

Tags:

WikiLeaks has released information and source code for a framework allegedly used by the U.S. Central Intelligence Agency (CIA) to make analysis of its tools and attribution more difficult.

The whistleblower organization on Friday made public 676 source code files of the Marble Framework. According to WikiLeaks, version 1.0 of the framework was released in 2015, and the CIA has continued using it during 2016.

Files that appear to be part of the official Marble Framework documentation describe it as a framework “designed to allow for flexible and easy-to-use obfuscation when developing tools.” These types of techniques have been used by many malware developers to hinder researchers.

The first round of Vault 7 files released by WikiLeaks showed that the CIA learned from the NSA’s mistakes after the intelligence agency’s Equation Group was exposed by security researchers. CIA employees apparently determined that the use of custom cryptography was one of the NSA’s biggest mistakes, as it allowed researchers to link different pieces of malware to the same developer.

The Marble framework allows obfuscation of a tool using a random technique to prevent forensics investigators and security vendors from linking it to a specific developer. Marble users can also select the algorithm they want to use or configure the application to omit certain algorithms.

Charles R. Smith, CEO of Softwar Inc, pointed out that Marble leverages the Bouncy Castle cryptography APIs.

During its analysis of the Marble source code, WikiLeaks identified test examples written in Chinese, Russian, Korean, Arabic and Farsi, which suggests that the agency may have used the framework to trick investigators into believing that its tools were developed by individuals speaking one of these languages.

“This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion,” WikiLeaks said. “But there are other possibilities, such as hiding fake error messages.”

The source code files made available by WikiLeaks also include a deobfuscation tool.

WikiLeaks has offered to share the exploits it has obtained with tech firms, but many companies have not agreed to the organization’s conditions. U.S. officials also hinted that using the leaked information could have legal repercussions.

While the available information has led to the discovery of some zero-day vulnerabilities, cybersecurity vendors and other tech companies determined that many of the flaws have already been patched. Last week, WikiLeaks published files focusing on Mac and iPhone exploits, but Apple claimed most of the security holes had been addressed.

The CIA has refused to comment on the authenticity of the leaked documents. However, the agency pointed out that its mission is to collect intelligence from overseas entities, and claimed that it does not spy on individuals in the U.S.

Related: Industry Reactions to CIA Hacking Tools

Related: Security Firms Assess Impact of CIA Leaks

Eduard Kovacs is an international correspondent for SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

The Linux kernel vulnerability leveraged at the Zero Day Initiative’s Pwn2Own 2017 competition to hack Ubuntu has been patched.

The flaw was disclosed at the event by researchers at Beijing-based enterprise security firm Chaitin Tech. The exploit, which earned the hackers $15,000, was part of the only attempt to break Ubuntu at this year’s Pwn2Own.

The vulnerability, tracked as CVE-2017-7184, has been described as an out-of-bounds heap access weakness that can be exploited to cause a denial-of-service (DoS) condition or to execute arbitrary code. A local attacker can exploit the flaw to escalate privileges on the system.

“The specific flaw exists within the handling of xfrm states,” ZDI explained in its advisory. “The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer.”

The vulnerability was addressed in the Linux kernel a few days after Pwn2Own ended. Ubuntu has released fixes and other Linux distributions are working on patches as well.

Red Hat has classified it “high severity,” but pointed out that the flaw cannot be exploited for privilege escalation on default or common configurations of Red Hat Enterprise Linux 5, 6 and 7.

Mozilla and VMware have also patched the Firefox and Workstation vulnerabilities disclosed at Pwn2Own, and ZDI has made its advisories public for these security holes.

Related: Another Old Flaw Patched in Linux Kernel

Related: Code Execution Flaw Affected Linux Kernel Since 2005

Related: "Dirty COW" Linux Kernel Exploit Seen in the Wild

Eduard Kovacs is an international correspondent for SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags: