<h1 id="hpr-news">HPR NEWS</h1>
<h1 id="news-for-the-community-by-the-community">News for the community,
by the community.</h1>
<ul>
<li><p><strong>TAGS:</strong> Ransomware, Malware, Phishing, Security
Breach</p></li>
<li><p><a
href="https://thehackernews.com/2022/10/microsoft-confirms-server.html">Microsoft
Confirms Server Misconfiguration Led to 65,000+ Companies' Data
Leak</a></p>
<ul>
<li>Microsoft &#x201C;misconfigured&#x201D; an <a
href="https://azure.microsoft.com/en-us/products/storage/blobs/#overview">Azure
Blob Storage</a> server causing a security breach. Attackers were able
to access unauthorized customer data; business transactions and other
interactions between Microsoft and its customers. <a
href="https://socradar.io/">SOCRadar</a>, a cyber security company, is
calling the security breach &#x201C;BlueBleed&#x201D;. SOCRadar discovered the breach
on September 24, 2022 Microsoft is downplaying the security breach but
security researcher Kevin Beaumont isn't buying it. Mr. Beaumont suggest
Microsoft dropped the ball on informing its customers, and federal
regulators, of the security breach in a timely manner.</li>
</ul></li>
<li><p><a
href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-hiddenads-malware-that-runs-automatically-and-hides-on-google-play-1m-users-affected/">HiddenAds
malware affects 1M+ Android users</a></p>
<ul>
<li>McAfee&#x2019;s Mobile Research Team identified multiple apps containing
malware on the Google Play Store. After install, the malicious android
apps automatically run services without the user knowing or interacting
with the app. That&#x2019;s right, they auto run after install. These malicious
apps then disguise themselves by changing their icon to the &#x201C;Google
Play&#x201D; icon and renaming to themselves to &#x201C;Google Play&#x201D; or &#x201C;Settings&#x201D;.
The malicious apps quickly create permanent malicious services. McAfee&#x2019;s
Mobile Research Team demonstrates the resilience of the malware by using
<a href="https://www.man7.org/linux/man-pages/man1/kill.1.html">kill
-9</a> on the service processes. More malicious processes generate
immediately as if nothing happened.</li>
</ul></li>
<li><p><a
href="https://thehackernews.com/2022/10/experts-warn-of-stealthy-powershell.html">Fully
undetectable PowerShell backdoor disguised as part of a Windows
update</a></p>
<ul>
<li>Director of security research at SafeBreach, Tomer Bar stated, "The
covert self-developed tool and the associated C2 commands seem to be the
work of a sophisticated, unknown threat actor who has targeted
approximately 100 victims."</li>
<li>Based on the metadata found within a malicious document, this seems
to be a LinkedIn-based spear-phishing attack, which ultimately leads to
the execution of a PowerShell script via a piece of embedded macro
code.</li>
<li>"The Macro drops 'updater.vbs' creates a scheduled task pretending
to be part of a Windows update, which will execute the updater.vbs
script from a fake update folder under
'%appdata%\local\Microsoft\Windows,'"said Tomar.</li>
<li>Currently 32 security vendors and 18 anti-malware engines have
flagged the decoy document and the PowerShell scripts as malicious.</li>
<li>The findings come as Microsoft has <a
href="https://thehackernews.com/2022/07/microsoft-resumes-blocking-office-vba.html">taken
steps</a> to block Excel 4.0 (XLM or XL4) and Visual Basic for
Applications (VBA) macros by default across Office apps, prompting
threat actors to pivot to <a
href="https://thehackernews.com/2022/07/hackers-opting-new-attack-methods-after.html">alternative
delivery methods</a>.</li>
</ul></li>
<li><p><a
href="https://apnews.com/6f1ec0c740d878ad00f5b08d2521f831">Millions of
patients compromised in hospital data leak.</a></p>
<ul>
<li>Nearly 3 million Illinois &amp; Wisconsin patients are caught in a
hospital data breach. Advocate Aurora Health, which operates 27
hospitals, said in a statement, &#x201C;the breach may have exposed information
including a patients' medical provider, type of appointments, medical
procedures, dates and locations of scheduled appointments, and IP
addresses&#x201D;. The system blamed the breach on its use of pixels, computer
code that collects information on how a user interacts with a website,
including products developed by Google and Facebook's parent company
Meta that make the collected data accessible to those companies.</li>
<li>The health care industry's use of pixels has come under wide
criticism from privacy advocates who warn that the technology's use
violates federal patient privacy law. A <a
href="https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf">report</a>
published in June by The Markup found many of the country's top-ranked
hospitals used the Meta Pixel, collecting and sending sensitive patient
information to the social media company.</li>
</ul></li>
</ul>
<h2 id="user-space">User space.</h2>
<ul>
<li><a
href="https://www.washingtontimes.com/news/2022/oct/21/texas-sues-google-surreptitiously-collecting-users/">Texas
sues Google for biometric data collecting</a>
<ul>
<li>Texas has filed a lawsuit against Google claiming the tech behemoth
took users&#x2019; biometric data without permission. <a
href="https://kenpaxton.com/">Texas Attorney General Ken Paxton</a>,
claims Google is illegally data harvesting Texans using features and
devices such as: Google Photos, Google Assistant, and Nest Hub Max. <a
href="https://www.linkedin.com/in/jose-castaneda-378a338a">Google
spokesman Jos&#xE9; Casta&#xF1;eda</a><br />
is willing to take the argument to court, &#x201C;AG Paxton is once again
mischaracterizing our products in another breathless lawsuit,&#x201D;.</li>
</ul></li>
</ul>
