Week of January 16, 2023: T-Mobile says API abuse hit 37 million accounts, and Yum! Brands reports ransomware

What mattered to security leaders in the week of January 16, 2023? T-Mobile told investors in a January 19 Form 8-K that an attacker had pulled data on about 37 million customer accounts through a single API since late November 2022, and Yum! Brands confirmed that a ransomware attack had closed about 300 of its UK restaurants and taken company data. Chainalysis also reported that ransomware gangs collected roughly 40% less in 2022 as more victims refused to pay.

T-Mobile 8-K: API abuse exposed data on about 37 million accounts

T-Mobile's January 19 Form 8-K said it identified on January 5 that a bad actor was obtaining data through a single API without authorization, and traced and stopped the activity within a day. Its preliminary finding was that data for approximately 37 million current postpaid and prepaid accounts was taken, starting on or around November 25, 2022. The API exposed names, billing addresses, emails, phone numbers, dates of birth, account numbers and plan details, but not payment card data, Social Security numbers, government IDs, passwords or PINs. It became a reference case for detecting abuse of a legitimate API. (T-Mobile US, Inc. (SEC EDGAR))

Yum! Brands confirms ransomware closed about 300 UK restaurants

Yum! Brands, which operates KFC, Pizza Hut, Taco Bell and The Habit Burger Grill, disclosed a ransomware attack, reported on January 19, that forced about 300 of its UK locations to close; those restaurants had since returned to normal operations. The company took some systems offline, brought in outside forensic specialists and notified federal law enforcement. It said data was taken from its network but it had no evidence that customer databases were stolen, and in an 8-K it told investors it did not expect a notable financial impact. Franchise operations with shared IT can turn one intrusion into hundreds of closed storefronts. (BleepingComputer)

Chainalysis: ransomware takings fell to about $456.8 million in 2022

Blockchain analytics firm Chainalysis estimated that ransomware gangs extorted about $456.8 million from victims in 2022, down roughly 40% from the record $765 million recorded in the previous two years. It attributed the fall to more victims refusing to pay rather than fewer attacks. The average lifespan of a ransomware strain also shrank, from 153 days in 2021 to 70 days in 2022, as brands such as Conti ended and newer operations including Royal, Play and BlackBasta appeared. The numbers gave boards evidence that refusing to pay was becoming the norm. (BleepingComputer)

CERT-UA ties a CaddyWiper attack on Ukrinform to Sandworm

Ukraine's CERT-UA said on Wednesday, January 18, that a destructive malware attack on the national news agency Ukrinform was likely the work of Sandworm, a group previously linked to Russia's GRU. The attackers pushed CaddyWiper through Windows group policy, which showed they already had access to the network, but the threat was contained quickly and the agency kept operating while CERT-UA helped restore systems. Deployment through group policy is a reminder that domain controller compromise turns a single intrusion into an estate-wide wipe. (BleepingComputer)

Exploit details loom for a critical ManageEngine SAML flaw

Horizon3.ai planned to release technical details and a proof-of-concept exploit for CVE-2022-47966, an unauthenticated remote code execution flaw affecting two dozen ManageEngine products including ADSelfService Plus, Password Manager Pro, PAM360 and ServiceDesk Plus. The bug came from an outdated Apache Santuario XML library and is exploitable only where SAML single sign-on is or once was enabled. GreyNoise had not yet seen exploitation attempts, but researchers called the flaw easy to exploit at scale. Several of the affected tools hold privileged credentials, which raised the stakes of delay. (Help Net Security)

Source code audit turns up two critical remote code execution bugs in git

An audit of git by X41 D-Sec researchers and a GitLab security engineer found 35 security issues, two of them critical: CVE-2022-41903, an out-of-bounds write in log formatting, and CVE-2022-23251, a truncated allocation leading to an out-of-bounds write through a large number of attributes. Both may allow remote code execution. A separate high-severity flaw in Git GUI for Windows, CVE-2022-41953, could run arbitrary code when cloning repositories, and users were told to avoid the tool with untrusted repositories. Developer workstations and build servers needed the new releases. (Help Net Security)