Search This Blog
Load More
Trendy Right Now

Popular Posts

Showing posts with label Encryption. Show all posts
User Privacy
Cyber Crime Encryption Healthcare Phishing Attacks ransomware attacks User Privacy

Rising Cyberattacks Increase Stress on Healthcare Industry

 

The health industry has recently come under increasing pressure to protect sensitive data from cyberattacks as these attacks become more frequent and sophisticated. Healthcare providers have been targeted by cybercriminals seeking to obtain sensitive patient data such as medical records and financial information. This is a worrying trend that is posing a significant risk to patient privacy and could potentially harm the reputation of healthcare providers.

The rise in cyberattacks on the healthcare industry is not surprising given the vast amounts of sensitive data that are collected, stored, and shared within the sector. Patient data is highly valuable on the black market, with medical records often fetching high prices. Cybercriminals are using a variety of tactics to gain access to healthcare systems, including phishing emails, ransomware attacks, and exploiting vulnerabilities in software.

Healthcare providers must take proactive steps to protect themselves from these threats. This includes implementing robust cybersecurity measures such as firewalls, intrusion detection systems, and data encryption. Staff training is also critical to ensure that employees are aware of the risks and understand how to detect and respond to potential cyberattacks.

In addition to these measures, healthcare providers should also be regularly testing their cybersecurity defenses. This can be done through simulated cyberattack scenarios, which allow providers to identify weaknesses in their systems and make improvements before an actual attack occurs.

It is important to note that protecting patient data is not only a legal and ethical obligation but also a critical aspect of maintaining patient trust. Patients expect their healthcare providers to keep their personal and medical information confidential and secure. A data breach can have significant consequences for patient trust and can harm the reputation of healthcare providers.

In conclusion, cyberattacks on the healthcare industry are becoming more common, and healthcare providers must take proactive steps to protect patient data from these threats. This includes implementing robust cybersecurity measures, staff training and regularly testing their defenses. Protecting patient data is a legal and ethical obligation, and failure to do so can have significant consequences for patient trust and the reputation of healthcare providers.


Read more »
User Privacy
Air-Gapped Computers Encryption keylogger Linux malware Phishing Attacks South Korea User Privacy

Korean University Disclosed a Potential Covert Channel Attack

The School of Cyber Security at the Korean University in Seoul has developed a novel covert channel attack called CASPER that may leak data from air-gapped computers to a nearby smartphone at a pace of 20 bits per second. 

What is CASPER?

Casper is a 'recognition tool,' built to characterize its targets and decide whether or not to keep tracking them. Prior to introducing more advanced persistent malware into the targeted systems for espionage, the Casper surveillance virus was employed as a starting point.

Data leak

The target needs to first be infected with malware by a rogue employee or a cunning attacker with physical access, which is the case with nearly all personal channel attacks that target network-isolated systems.

Attacks utilizing external speakers have been created in the past by researchers. External speakers are unlikely to be employed in air-gapped, network-isolated systems used in harsh settings like government networks, energy infrastructure, and weapon control systems.

The malicious software has the ability to search the target's filesystem on its own, find files or data formats that match a hardcoded list, and make an exfiltration attempt.

Keylogging is a more realistic option and is better suited for such a slow data transmission rate. The malware will use binary or Morse code to encrypt the information to be stolen from the target and then transmit it through the internal speaker utilizing frequency modulation to create an undetectable ultrasound between 17 kHz and 20 kHz.

The researchers tested the proposed model using a Samsung Galaxy Z Flip 3 as the receiver and an Ubuntu 20.04-based Linux computer as the target. Both were running a simple recorder application with a sampling frequency of up to 20 kHz.

In the Morse code study, the researchers employed 18 kHz for dots and 19 kHz for dashes, with a length per bit of 100 ms. The smartphone, which was 50 cm away, was able to interpret the word 'covert' that was sent. In the binary data study, each bit had a length of 50 ms and was transferred at a frequency of 18 kHz for zeros and 19 kHz for ones. Nonetheless, the overall experiment findings demonstrate that the length per bit impacts the bit error rate, and a max reliable transmitting bit rate of 20 bits/s is possible when the length per bit is 50 ms.

A standard 8-character password could be transmitted by the malware in around 3 seconds at this data transfer rate, while a 2048-bit RSA key could be transmitted in roughly 100 seconds. Even under ideal conditions and with no interruptions, anything larger than that, such as a little 10 KB file, would take longer than an hour to escape the air-gapped system.

"Because sound can only transmit data at a certain speed, our technology cannot transmit data as quickly as other covert channel technologies using optical or electromagnetic methods." – Korea University.

The attack is limited since internal speakers can only emit sound in a single frequency band. Changing the frequency band for several simultaneous transmissions would be a solution to the slow data rate. The simplest method of defense against the CASPER assault was to turn off the internal speakers in mission-critical computers, which was disclosed by the researchers. The defense team could also use a high-pass filter to keep all created frequencies inside the range of audible sound, preventing ultrasonic transmissions. 





Read more »
User Privacy
Algorithm Cyber Crime Data Privacy Encryption FBI Phishing Attacks User Privacy

Demanding Data Privacy Measures, FBI Cyber Agent Urges Users

 

The FBI maintains a close eye on cyber security risks, but officials emphasized that in order to be more proactive with the prevention, they need the assistance of both people and businesses.

Every one of us can simply navigate that large and somewhat disorganized ecology thanks to algorithms. These algorithms are really beneficial at their best. At their worst, they are tools of mass deception that might seriously harm us, our loved ones, and our society.

These algorithms don't result in immediate or obvious improvements. Instead, they encourage persistent micro-manipulations that, with time, significantly alter our culture, politics, and attitudes. It makes little difference if you can fend off the manipulation or decide not to use the apps that use these algorithms. Your environment will change, but not in ways that are advantageous to you; rather, it will change in ways that are advantageous to the people who own and manage the platforms, when enough of your neighbors and friends make these very imperceptible adjustments in attitudes and conduct.

Over the years, numerous government officials have voiced comparable cautions, and two presidential administrations have made various attempts to resolve these security worries.TikTok has long maintained that it does not adhere to Chinese government content filtering regulations and that it retains user data from American users in the United States. But, the business has come under more and more criticism lately, and in July it finally admitted that non-American staff members did indeed have access to customer data from Americans.

Data privacy advocates have long raised concerns about these algorithms, but they have had little luck in enacting significant change. The American Data Privacy and Protection Act (ADPPA) would, for the first time, begin to hold the developers of these algorithms responsible and force them to show that their engagement formulas are not damaging the public. Because to these worries, the U.S. Senate overwhelmingly passed a law barring the software on all federally-issued devices. At least 11 other states have already ordered similar bans on state-owned devices.

Consumers currently have little control over how and by whom their equally important personal data is used for the benefit of others. A law similar to the ADPPA would offer a procedure to begin comprehending how these algorithms function, allowing users to have an impact on how they operate and are used.



Read more »
Technology
Cyber Privacy Cyberattacks CyberCrime Encryption Password Privacy Software Technology

Tech Issues Persist at Minneapolis Public Schools

 


Students and staff from Minneapolis Public Schools returned to their school buildings this week. However, the ongoing issues resulting from a cyberattack that occurred in the district caused disruptions to continue for the remainder of the week. 

There was an update to the district's attendance and grades system on Tuesday, and the system was working without a hitch. There are still some teachers who have difficulty logging into the programs, said Greta Callahan, the teacher chapter president of the Minneapolis Federation of Teachers. It was decided to cancel Monday's after-school activities because there was a problem that needed to be addressed. 

There have been a few email updates from district officials to parents regarding the "technical difficulties" that have occurred due to an "encryption event", but they have not explained what caused them to have these difficulties. So far, some of the district's information systems have been unavailable for a week as a result of these problems. 

The description of an "encryption event" may seem vague, but a ransomware attack could be what was happening, according to Matthew Wolfe, vice president of cybersecurity operations at Impero Software, a company that provides education software among other things. 

School districts have become more and more targeted in recent years as a result of terrorist attacks. As a result of the rapid transition to distance learning at the beginning of the pandemic, Wolfe believes districts became easier targets for the aforementioned disease. 

"With the increase in the number of devices, more areas are likely to be affected," Mr. Alexander explained, adding that because of the push to make e-learning accessible to all students at home, protection is often pushed to the back burner. 

The recent spate of cyberattacks has made headlines repeatedly in recent months: A cyberattack in January forced schools in the Des Moines area to cancel classes. Los Angeles Unified, the country's second-largest school district, has been attacked by ransomware, reportedly from Vice Society, in the wake of the alleged attack. The dark web has been crawled by about 2,000 students following that incident, with their psychological examinations being uploaded. 

There had not been any update from the Minneapolis district by the end of the school day Tuesday about what caused the incident and its cause. At a closed meeting held Tuesday night, a presentation on security issues related to IT would be made to the school board members. 

The Minneapolis district has released an update on its investigation into whether personal information was compromised, and it has found no evidence of this. 

However, the staff was tasked with resetting the passwords and guiding students through the procedure. 

On Monday, as a result of teacher frustration, Callahan reported that teachers were having difficulties resetting student passwords. As a result, teachers had to come up with creative ways to come up with a wide variety of workshops and activities for the students since printers were also down. 

There is a need for more transparency in the district's administration, according to Callahan. There does not seem to be anything else involved in this process other than just hoping everything works out by Monday. 

Parents have repeatedly been informed that district officials have worked with external IT specialists and school IT personnel "around the clock" to investigate the root cause of this attack and to understand what is transpiring on the computer systems as a result of it. 

When a cyberattack occurs at any time of day or night, school IT professionals are unavoidably overwhelmed and try to protect their schools constantly. "They're going through a really tough time right now for a district and it's going to be a long process," he said. 

Despite recent events that indicate Minneapolis schools may have been targeted, Wolfe said he believes it's likely that the schools have been targeted because of a 2020 incident that nearly caused the school district to incur a $50,000 loss. It is cyber fraud that occurs when payments are made to a fraudulent account to defraud a legitimate contractor. 

Minneapolis Public Schools said in a statement that the money had been safely returned to the district. They added that additional protocols had been implemented as a result. 

That incident was covered in a Fox 9 report that was published in February. In his testimony, Wolfe stated that a hacker engaged in a targeted attack is looking for vulnerabilities in a potential target. 

Several stories have been reported in the news about staffing shortages in Minneapolis. These include the district's financial outlook, as well as the absence of a permanent superintendent in the district, Wolfe said. As Wolfe pointed out, even the fact that the district is preparing to launch a new website to the public may garner hacker interest. 

"There is no doubt that this is an easy target to steal from because of all those digital footprints," Wolfe told.   
Read more »
ZIP File
Bitdefender Cisco Crypto Data Breach Decrypter Email Encryption Malicous Files ZIP File

Free MortalKombat Ransomware Decryptor Released

An open-source universal decryptor for the newly discovered MortalKombat malware, which encrypts files, has been made available by the Romanian cybersecurity firm Bitdefender. The virus has been employed on dozens of victims in the United States, United Kingdom, Turkey, and the Philippines, as per a recent Cisco analysis.

Emails with malware ZIP attachments containing BAT loader scripts are sent to random users by MortalKombat distributors. When the script is run, it will download and run the Laplas Clipper and ransomware binaries on the computer.

Although it has been identified since 2010, Xorist is disseminated as a ransomware constructor, enabling online threat actors to design and alter their own variant of the malware. The MortalKombat decryptor is a standalone executable that doesn't require installation on affected devices. The user may optionally choose a specific place holding backed-up encrypted data. It offers to scan the entire filesystem to find files infected by MortalKombat.

In addition, Bitdefender said that the malware has a clipboard-monitoring feature that targets users of cryptocurrencies particularly. The emails include references to expired cryptocurrency payments and attachments that resemble CointPayments transaction numbers but conceal the malware payload. The ransomware, which encrypts all of a PC's data, including those in virtual machines and the recycle bin, is downloaded by the software after its launch. It takes the victim's background and replaces it with a Mortal Kombat 11 image, hence the name.

In a study by PCrisk, Cisco discovered a leaked version of the Xorist builder, where the builder interface options closely mirrored an actual Xorist ransomware building interface. The creator creates an executable ransomware file that the attackers can further modify. Notably, MortalKombat was used in recent attacks by an unidentified financially motivated malicious attacker as a part of a phishing operation targeted at multiple companies.

Read more »
Web3
Artificial Intelligence Blockchain Cyber Security Encryption Machine learning Web3

Zero-Knowledge Encryption Might Protect User Rights

 

Web3 is an evaluation of the internet that moves past a centralized structure and tries to connect data in a decentralized way in order to offer a speedy and individualized user experience. This version of the internet is sometimes referred to as the third generation of the web.Web3 sometimes referred to as the Semantic Web, is based on AI and ML and employs blockchain technology to protect the security and privacy of user data.

Role of Zero-Knowledge Encryption

Using specific user keys, zero-knowledge encryption protects data. No one other than the user may access their encrypted files because administrators and developers do not know or have access to them. 

Zero-knowledge proofs, which may verify the truth of a proposition without revealing the underlying data, make this possible. Zero-knowledge cryptography enables information to be "private and useable at the same time," according to Aleo's CEO Alex Pruden, in contrast to other well-known types of encryption such as end-to-end models used in private messaging apps, through which only users and senders may read information. Without disclosing personal information about yourself, you can demonstrate your trustworthiness with zero-knowledge proof.

Decentralized identity (DCI) constructions, tokenization, and self-hosted wallets are three features of Web3 that promote user ownership of data and algorithms. Zero-knowledge proofs and least privilege are two techniques used in decentralized computing (DCI).

Reasons for  Zero-Knowledge Encryption

One drawback of zero-knowledge encryption is that it frequently leaves users unable to access their data moving forward if they ever need to find their encryption key or password. Because it requires more work to securely transfer and store user data, service providers that offer the full zero-knowledge encryption guarantee are often slower than their less secure competitors.

There is no better alternative than zero-knowledge encryption if a user wishes to maintain the privacy and security of their data while still hosting it on an external server for simple data management.








Read more »
Ukraine
APT C&C C2 Encryption malware Payload Russian Hackers SSH Threat actors Ukraine

Data Theft Feature Added by Russian Nodaria APT

An updated piece of information-stealing malware is being used against targets in Ukraine by the Nodaria spy organization, also known as UAC-0056. The malware was created in Go and is intended to gather a variety of data from the infected computer, including screenshots, files, system information, and login passwords.

The two-stage threat known as graphiron consists of a downloader and a payload. The downloader has the addresses of command-and-control (C&C) servers hardcoded in. It will look for active processes when it is executed and compare them to a blacklist of malware analysis tools.

If no processes on the blacklist are discovered, this will connect to a C&C server, download the payload, and then decrypt it before adding it to autorun. The downloader is set up to run only once. It won't try again or send a signal if it is unable to download and run the payload.

Graphiron shares several characteristics with earlier Nodaria tools like GraphSteel and GrimPlant. Advanced features allow it to execute shell commands, gather system data, files, login passwords, screenshots, and SSH keys. Further, it uses port 443 to communicate with the C2 server, and all communications are encrypted using an AES cipher.

Attacks against Georgia and Kyrgyzstan have been carried out by Nodaria since at least March 2021. The recognized tools used by the group include WhisperGate, Elephant Dropper and Downloader, SaintBot downloader, OutSteel information stealer, GrimPlant, and GraphSteel information stealer.



Read more »
VMware
CERT CISA & FBI CVE vulnerability Encryption malware Patch Fix Ransomware Attacks. VMware

Ransomware Targeting VMware ESXi Servers Rises

The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have released a joint advisory warning about an ongoing ESXiArgs ransomware campaign targeting unpatched and out-of-service or out-of-date versions of the VMware ESXi hypervisor for virtual machines (VMs).

The OpenSLP service contains a heap overflow bug that can be exploited by unverified threat actors in simple attacks. This security hole is identified as CVE-2021-21974 on the CVE database. 3,800 VMware ESXi servers around the world have reportedly been compromised, potentially rendering any running VMs useless, as per CISA.

Application of the patch as soon as feasible is strongly advised by CERT-FR, but it also says that systems that are not patched should be checked for indicators of compromise.

Although it has since moved to North America, the ESXiArgs ransomware appears to have begun attacking servers in Europe around February 3. Organizations should isolate impacted servers, reinstall ESXi 7. x or ESXi 8. x in a supported version, and apply any patches, according to the French computer emergency response team (CERT).

Updated ESXiArgs Ransomware

On infected ESXi hosts, the ransomware encrypts files with the. vmxf,.vmx,.vmdk,.vmsd, and. nvram extensions and produces a.args file for each encrypted document with metadata.

The research shows that ESXiArgs is based largely on stolen Babuk source code, which has previously been used by other ESXi ransomware attacks, including CheersCrypt and the PrideLocker encryptor from the Quantum/Dagon group. It is unclear whether this is a new variety or simply a shared Babuk codebase because the ransom notes for ESXiArgs and Cheerscrypt are quite similar but the encryption technique is distinct.

CISA and FBI urged owners of VMware ESXi servers to upgrade them to the most recent version, harden ESXi hypervisors by turning off the SLP service and make sure the ESXi hypervisor is not accessible through the open internet.

Read more »
Windows Defender
API Bug Encryption malware Ransomware Attacks. Software Windows Defender

Conti Source Code & Everything API Employed by Mimic Ransomware

A new ransomware variant known as Mimic was found by security researchers, and it uses the Windows 'Everything' file search tool's APIs to scan for files that should be encrypted.

The virus has been "deleting shadow copies, terminating several apps and services, and abusing Everything32.dll methods to query target files that are to be encrypted," according to the first observation of it in June 2022.

What is Mimic ransomware?

The ransomware payload for Mimic is contained in a password-protected package that is presented as Everything64.dll and dropped by the executable Mimic along with other components. Additionally, it contains tools for disabling valid sdel binaries and Windows Defender.

Mimic is a flexible strain of ransomware that may use command-line options to target specific files and multi-processor threads to encrypt data more quickly. The victim of a mimic ransomware attack first receives an executable, most likely via email. This executable loads four files onto the target machine, including the primary payload, auxiliary files, and tools to turn off Windows Defender.

The popular Windows filename search engine 'Everything' was created by Voidtools. The tool supports real-time updates and is lightweight and speedy, using few system resources. According to Trend Micro, this combination of several active threads and the way it abuses Everything's APIs enables it to operate with little resource consumption, resulting in a more effective assault and execution.

Although Mimic is a new strain with unknown activity, the developers' use of the Conti builder with the Everything API demonstrates their skill as software engineers and their awareness of how to accomplish their objectives.



Read more »
US Schools
CIA Data Breach Encryption FBI Ransomware Attacks. US Schools

LAUSD Computers are Breached via Cybercriminals

According to Los Angeles Unified School District (LAUSD), the second-largest school district in the U. S., the Vice Society ransomware group has stolen files containing private information, including Social Security Numbers, from contractors (SSNs).

Additionally, LAUSD disclosed that the threat actors were present on its network for more than two months, from July 31 to September 3, 2022. The group claimed to have stolen 500 GB of data from the school system's systems to BleepingComputer before distributing the stolen material, but they offered no supporting documentation.

Experian's IdentityWorksSM, which aids in detecting information misuse, is being made available to contractors and their staff members by LAUSD for free for a year. The FBI, CISA, and MS-ISAC jointly released an advisory warning of Vice Society's excessive targeting of the U.S. education sector on the day LAUSD reported the ransomware attack. Hackers replied to L.A. Unified's refusal to pay a ransom by exposing the data they obtained into the dark web, where other nefarious characters may use it for identity theft.

The school district declared it would not comply with the cybercriminals' ransom demands in order to better utilize the money for its students and their education, the ransomware group released data from LAUSD.

Data theft is simply one aspect of an operation. The second step entails encrypting computer systems so that users are unable to access them and daily business is rendered impossible. Although basic tasks, such as classroom instruction and record-keeping, were more challenging for approximately two weeks, hackers were able to encrypt systems in the district's facilities division. Schools never had to temporarily close, as in other places when various school systems were targeted.

The revelation in the notice came as no surprise to cybersecurity professionals. They anticipated that an examination would show the system intrusion started earlier than was initially reported. Officials from the school district did not disclose the number of potential victims. When there are more than 500 California citizens affected, the required number for public notification, a notice letter should be filed with the state attorney general in addition to notifying the victims.
Read more »
User Privacy
Backups Canada Cyber Security Encryption Malicious actor Password United States User Privacy

5 Updates to Secure Data as Workers Return to Work

According to an Adastra survey, more than 77% of IT decision-makers in the U.S. and Canada estimate their organizations will likely experience a data breach over the next three years.

Employees should be aware of data security practices since the 2022 Verizon Data Breach Investigations Report states, 82% of data breaches are caused by human error, placing companies of all sizes at risk.

5 Upgrades to Data Security


1. Protect data, not simply the barrier

With approximately 90% of security resources going toward firewall technology, it appears that many firms are focusing on protecting the walls around their data. However, there are potential ways for firewalls, including via clients, partners, and staff. Such individuals can all get beyond external cyber security and abuse sensitive data. 

2. Be aware of threats

Insider threats can be challenging to identify and stop due to their nature. It might be as simple as a worker opening an email attachment that is from a credible source and activating a ransomware worm. Threats of this nature are the most frequent and expensive worldwide.

3. Encrypt each device

A growing number of individuals prefer to work on personal devices. A solid, unchangeable data backup strategy might aid a business in making a speedy incident recovery. 

4. Create secure passwords

Most firms tend to display weak password policies, resulting in basic, generic, and hackable passwords for vital accounts that have access to private and priceless data. Passwords should be fairly complex; they should be updated every 90 days. 

5. Develop a company safety strategy

Each person who has a username and password is responsible for data security. IT administrators must regularly remind managers and employees that they are never permitted to share their login information with any third parties.

Data security is identified as the largest disruptor in 2023 by researchers as businesses continue to boost their cybersecurity resilience. According to the poll, 68% of managers say that the company has a cybersecurity unit and another 18% indicate companies are in process of building one. Only 6% of participants claimed to have no cybersecurity section.

A breach could cost significantly more than an audit from a data security firm. The estimated cost of a data breach in the US increased from $9 million to $9.4 million in 2022, as per Statista.

Read more »
Yahoo
Cryptography Cyber Crime Email Attacks Encryption Gmail Outlook Protonmail User Privacy Yahoo

Is Data Safeguarded by an Encrypted Email Service?

Email is the primary form of communication in both our personal and professional lives. Users might be surprised to hear that email was never intended to be secure due to our dependency on it. Email communication carries some risks, but you may still take precautions to protect your inbox. 

What is encryption in email?

One of the most important applications for practically any organization nowadays is email. Additionally, it's among the primary methods for malware to infect businesses.

Email encryption is the process of encrypting email communications to prevent recipients other than the intended ones from seeing the content. Authentication may be included in email encryption.

Email is vulnerable to data exposure since it is usually sent in clear text rather than encryption. Users beyond the intended receivers can read the email's contents using tools like public-key cryptography. Users can issue a public key that others can use to encrypt emails sent to them, while still holding a private key that they can use to decrypt those emails or to electronically encrypt and verify messages they send.

Impacts of an Encrypted Email Service

1. Safeguards Private Data 

It is crucial to ensure that only intended recipients view the material sent via email as it frequently contains sensitive data and business secrets. It is also vital that cyber criminals are unable to decrypt the data being transmitted between people. 

Services for encrypted email are created in a way that protects user privacy rather than invading it. Not simply because they are run by very small teams, but also because their platforms were created with security in mind, encrypted email services are intrinsically more secure. To begin with, the majority employ zero-access encryption, which ensures that only the user has access to confidential data.

2. Cost-effective 

It is not necessary to buy additional hardware whenever the server which hosts the email service currently includes encryption. Many firms have invested in their own servers although it might not be essential.  A reliable third-party service is substantially less expensive.

3. Barrier Against Government Monitoring 

One can learn everything you need to know about Gmail and Yahoo from the fact that no major whistleblower, activist, dissident, or investigative reporter trusts them to transmit sensitive information, at least in terms of government surveillance. Google, for instance, makes it very plain on its official website that it reserves the right to accede to requests from the government and provide useful information.ProtonMail is founded in Switzerland, a country with some of the world's strongest privacy rules.

4. Prevents Spam

Spam attachments frequently contain malware, ensuring that hackers gain access. When you or another person uses encrypted email to deliver attachments, the email includes a digital signature to verify its authenticity. No individual will accept spoofed emails this way. 

Establish strong digital practices to prevent exposing oneself vulnerable. Update your hardware and software. We must improve internet security measures as our reliance on technology increases. Services for secure, encrypted email provide everything that caters to your privacy needs. 

Read more »
User Privacy
Apple Data protection Encryption FBI iCloud malware User Privacy

Apple Improves iCloud Data End-to-End Encryption

Apple took a step further in its continuous effort to offer people even better ways to safeguard private data when it unveiled new cutting-edge security capabilities aimed at defending against attacks on user data in the cloud. 

Advanced Data Protection allows trusted devices of iCloud users sole access to the data encryption for the majority of their data. It is already available in the U.S. for participants in the Apple Beta Software Program and will be available to all U.S. customers by the end of the year.

According to a press release from Apple, the only essential categories excluded from Advanced-Data Protection are iCloud Mail, Contacts, and Calendar due to the necessity to interoperate with the worldwide email, contacts, and calendar systems.

Apple apparently abandoned plans to provide end-to-end encryption to iCloud backups after the FBI objected. Privacy organizations like the Electronic Frontier Foundation have long urged Apple to do this.

These new features join a number of other safeguards that make Apple products the most secure on the market, including the setups directly into our specially made chips with efficient system encryption and data protections and features like Lockdown Mode, which provides an extremely high level of optional security for users like journalists, human rights activists, and diplomats. Apple is committed to enhancing device and cloud security or continuously introducing additional safeguards.

Despite the fact that the great majority of users will never be the target of extremely sophisticated assaults, the functionality adds an essential degree of security for users. If a highly skilled opponent, such as a state-sponsored attacker, were ever to be successful in accessing cloud servers and inserting its personal device to spy on these encrypted communications, conversations between users who have activated iMessage Contact Key Verification receive immediate alerts.

According to an Apple official, the company has been trying to add hardware keys for some time, but most recent version of FIDO standards, it was cautious about implementation and usability. A recent increase in the availability of the keys, the spokesman added, as well as evolving and intensifying threats, were further driving factors for the business.

Read more »
VPN Leak
Android Cyber Security Encryption Google HTTP Attacks IP Address VPN Leak

Android Spills Wi-Fi Traffic When VPNs Are Enabled

Regardless of whether the Block connections without VPN or Always-on VPN options are turned on, Mullvad VPN has found that Android leaks traffic each time the device links to a WiFi network. 

Source IP addresses, DNS lookups, HTTPS traffic, and most likely NTP traffic are among the items that are being leaked outside VPN tunnels. With the help of a VPN, encrypted data can flow anonymously and be untraceable between two sites on the internet. Consider passing a ping pong ball to someone else across a table as an example. The ball is freely available for third parties to take, manipulate, and return to their intended location. It would be far more difficult to intercept the ball if it were to roll through a tube. 

Information is difficult to obtain because data goes through VPNs similarly. The source and destination of the data packet are likewise obscured because it is encrypted. The Android platform was intentionally designed with this behavior. However, due to the erroneous description of the VPN Lockdown functionality in Android's documentation, users were probably unaware of this until now.

The finding was made by Mullvad VPN while conducting an unpublished security check. The supplier has submitted a feature request to Google's Issue Tracker to fix the problem. A Google developer, however, stated that the functionality was working as intended and that Google has no plans to change it.

"We have investigated the feature request you have raised, and we are pleased to inform you that everything is operating as intended. We don't believe there is a compelling reason to offer this because we don't believe most consumers would grasp it," the Google engineer added.

Unfortunately, Always-on VPN is not totally functioning as intended and contains a glaring weakness, according to a Swedish VPN company by the name of Mullvad. The issue is that Android will send a connectivity check, every now and then to see whether any nearby servers are offering a connection. Device information essential to connectivity checks includes IP addresses, HTTPS traffic, and DNS lookups. Even with Always-on VPN turned on, anyone monitoring a connectivity check could view bits of information about the device because none of this is encrypted since it doesn't travel over the VPN tunnel.

The traffic that escapes the VPN connection contains metadata from which critical de-anonymization information, such as the locations of WiFi access points, may be derived.

The blog post by Mullvad explains that "the connection check traffic could be observed and evaluated by the party controlling the interconnect check server and any entity noticing the network traffic. Even if the message only indicates that an Android device is connected, the metadata, which includes the source IP, can be used to derive additional information, especially when combined with information like WiFi access point locations."

People who use VPNs to shield themselves from persistent attacks would still perceive the risk to be high, even though this is difficult for inexperienced threat actors. Mullvad adds that even if the leaks are not rectified, Google has to at least update the documentation to accurately state that the Block connections without VPN function would not safeguard Connectivity Checks. 

Mullvad is still discussing the data leak's relevance with Google and has requested that they make it possible to turn off connectivity checks and reduce liability points. Notably, this option has the intended capability thanks to GrapheneOS, Android-based anonymity and safety os version that can only be utilized with a select few smartphone models.

Read more »
User Privacy
BIOS Virus Cloud Services Data Breach Encryption Intel Lenovo UEFI Firmware User Privacy

Leak of BIOS Source Code Confirmed by Intel


The authenticity of the suspected leak of Intel's Alder Lake BIOS source code has been established, potentially posing a cybersecurity risk to users.

Alder Lake, the firm's 12th generation processor, which debuted in November 2021, is coded for the Unified Extensible Firmware Interface (UEFI) in the released documentation.

The breach, according to an Intel statement provided to Tom's Hardware, does not "reveal any new vulnerabilities since we do not rely on encryption of information as a defense policy."Additionally, it is urging other members of the security research community to use its bug bounty program to submit any potential problems, and it is also alerting customers about the situation.

The 5.97 GB of files, source code, secret keys, patch logs, and compilation tools in the breach have the most recent timestamp of 9/30/22, indicating that a hacker or insider downloaded the data time. Several references to Lenovo may also be found in the leaked source code, including code for 'Lenovo String Service,' 'Lenovo Secure Suite,' and Lenovo Cloud Service integrations.

Tom's Hardware, however, has received confirmation from Intel that such source code is real and is its "exclusive UEFI code."

Sam Linford, vice president of Deep Instinct's EMEA Channels, said: "Source code theft is a very serious possibility for enterprises since it may lead to cyber-attacks. Because source code is a piece of a company's intellectual property, it is extremely valuable to cybercriminals."

This year, there have been multiple instances where an organization's source code was exposed. The password manager LastPass disclosed that some of its source code had been stolen in August 2022, and Rockstar Games' Grand Theft Auto 5 and the Grand Theft Auto 6 version's source code was stolen in September 2022.
Read more »
Telegram
Command and Control(C2) Cyber Security DDOS Attacks Encryption Ransomware Attacks. Russian Hackers Telegram

Evolution of LilithBot Malware and Eternity Threat Group

A variant of the versatile malware LilithBot was recently uncovered by ThreatLabz in its database. This was connected to the Eternity group, also known as the Eternity Project, a threat entity affiliated with the Russian Jester Group, which has been operating since at least January 2022, according to further investigation.

In the darknet, Eternity disseminates many malware modules bearing the Eternity name, such as a stealer, miner, botnet, ransomware, worm+dropper, and DDoS bot.

LilithBot Malware

The distribution channels for the LilithBot that were found were a specialized Telegram group and a Tor connection that offered one-stop shopping for these multiple payloads. It included built-in stealer, clipper, and miner capabilities in addition to its primary botnet activity. 

The LilithBot multipurpose malware bot was discovered by Zscaler's ThreatLabz threat research team in July 2022 and was being offered as a subscription by the Eternity organization. In this campaign, the threat actor adds the user to its botnet and then steals files and user data by sending it via the Tor network to a command-and-control (C2) server. The malware in this campaign performs the functions of a stealer, miner, clipper, and botnet while using false certificates to avoid detection.

This malware-as-a-service (MaaS) is unusual because, in addition to using a Telegram channel to share updates on the latest features, it also uses a Telegram Bot to let customers create the binary. Common cryptocurrencies accepted by Eternity for payments include BTC, ETH, XMR, USDT, LTC, DASH, ZEC, and DOGE. Eternity often conducts business via Telegram.

If the buyer requests it, hackers will construct viruses with add-on functionality and offer customized viruses. The infection costs from $90 and $470 in USD. The Eternity Telegram channel demonstrates the frequent upgrades and improvements the team makes to its services.

The Eternity gang frequently refers users to a dedicated Tor link where a detailed description of their various viruses and their features may be found. The Tor link takes you to the homepage, where you can learn more about the different products and modules you may buy. The targeted user's files and documents are encrypted by the malware. A specific video explaining how to create the ransomware payload is available on the Tor page. Their Ransomware is the most expensive item on sale. For yearly membership, Eternity Stealer costs $260.
  • Eternity Miner as a yearly subscription costs $90.
  • Eternity Miner ($90 )as an annual subscription 
  • Eternity Clipper ($110 )
  • Eternity Ransomware ($490)
  • Eternity Worm ($390)
  • Eternity DDoS Bot (N/A) 

It is adaptable to the unique needs of clients and can constantly be updated at no further cost. They also provide their clients with numerous additional discounts and perks.

It is possible that the organization is still carrying out these tasks as the LilithBot malware has developed, but doing so in more complex ways, for as by completing them dynamically, encrypting the tasks like other areas of code, or employing other cutting-edge strategies.

The 'Microsoft Code Signing PCA' certificate authority issues a valid Microsoft-signed file, and it will also show a countersignature from Verisign. But as research is seen, LilithBot's bogus certificates lack a countersignature and appear to have been granted by the unverified Microsoft Code Signing PCA 2011.

Read more »
RaaS
APT actors Chinese Hackers Command and Control(C2) Data Breach Encryption Log4Shell PowerShell RaaS

Cheerscrypt Spyware Attributed to Chinese APT Entity

The Emperor Dragonfly Chinese hacker group, notorious for frequently switching between several ransomware families to avoid detection, has been connected to the Cheerscrypt virus. 

The attacks were linked by the cybersecurity company Sygnia to a threat actor also dubbed Bronze Starlight and DEV-0401. The hacking gang seems to be a ransomware operation, but past research suggests that the Chinese government is interested in many of its victims.

Cheerscrypt is the most recent addition to a long range of ransomware families that the gang has previously used, including LockFile, Atom Silo, Rook, Night Sky, Pandora, and LockBit 2.0 in a little over a year.

Recently, Sygnia researched a Cheerscrypt ransomware operation that utilized Night Sky ransomware TTPs. The attackers then dropped a Cobalt Strike beacon linked to a C2 address formerly tied to Night Sky operations. 

The code for the Babuk ransomware, which was exposed online in June 2021, was used to develop the Cheerscrypt ransomware family, which Trend Micro first analyzed in May 2022. Cheerscrypt is one of several ransomware families used by the APT organization. The DEV-0401 group, unlike other ransomware gangs, oversees every stage of the assault chain directly, from the first access to the data theft. It does not rely on a system of affiliates.

A significant Log4Shell vulnerability in Apache Log4j was utilized by hackers in January 2022 assaults to acquire initial access to VMware Horizon servers. They subsequently dropped a PowerShell payload that was used to send an encrypted Cobalt Strike beacon. Apart from the beacon, the hackers also sent three Go-based tools: a keylogger that sent keystrokes to Alibaba Cloud, a customized version of the internet proxy tool iox, and the tunneling program NPS.

Trend Micro initially identified Cheerscrypt in May 2022, highlighting its capacity to target VMware ESXi servers as a component of a tried-and-true strategy known as double extortion to force its victims into paying the ransom or risk having their data exposed.

The hackers break into networks, take information, and encrypt devices just like other ransomware groups that target businesses. The victim is then coerced into paying a ransom through double-extortion methods using the data. The stolen data is posted on a data leak website when a ransom is not paid.

A PowerShell payload that can deliver an encrypted Cobalt Strike beacon has been dropped on VMware Horizon servers by infection chains that have exploited the major Log4Shell vulnerability in the Apache Log4j library.

Cheerscrypt and Emperor Dragonfly share initial access vectors, and lateral movement strategies, including the use of DLL side-loading to distribute the encrypted Cobalt Strike beacon. Notably, the ransomware gang is acting as a 'lone wolf' separated from the rest of the cybercrime community rather than as a RaaS (Ransomware-as-a-Service) platform for affiliates.






Read more »
Ransomware
Cyber Attacks Data Exfiltration Encryption Extortion Scheme Ransomware

Newly Discovered Royal Ransomware is Targeting Organizations with Multi-Million Dollar Assaults

 

A new ransomware operation dubbed “Royal” is targeting organizations with ransom demands ranging from $250.000 to over $2 million. 

A new report from BleepingComputer in collaboration AdvIntel researchers has investigated the group’s encryptor and its methodology. The ransomware group was first identified in January 2022 and includes vetted and experienced hackers from past operations. 

Interestingly, it does not operate as a Ransomware-as-a-Service (RaaS), but instead as a private group without partners or affiliates. At first, the group employed the encryptors of other ransomware operations, such as the BlackCat example, before utilizing its own encryptors, the first being Zeon, an encryptor that designs ransom notes identical to Conti’s. 

Royal modus operandi 

Based on the observations gathered by threat analysts, this month, the Royal ransomware used a new encryptor and its name in ransom notes to represent itself accurately. The security experts have also identified that the hacking group is working underground and has not employed a data leak site to disclose their activities. 

The malicious campaign is employing a technique called “callback phishing,” wherein the Royal hackers mimic software vendors and food delivery platforms in emails, pretending to be an offer to renew a subscription. 

When victims call the number, the ransomware operators employ social engineering to lure them into installing remote access software, thus acquiring access to the corporate network. Subsequently, the hackers execute multiple attack procedures, eventually leading to the encryption of the exploited devices. They employ Cobalt Strike to spread out across the network, collect credentials, steal data, and finally encrypt machines. 

The targeted individuals would then discover a ransom note, named README.TXT, containing a Tor link to engage in negotiations with malicious hackers. The ransomware operators will offer their demand, with ransom amounts ranging from $250.000 to over $2 million. To prove that they have the firm’s data, Royal will decrypt a few files and share lists of the siphoned data. 

It remains unclear how successful the operation is because at the time of writing there are no reports of any victims actually paying for the decryption key. The researchers have strongly recommended network, windows, and security admins to keep an eye on the activities of this group, as they are ramping up their operations and will likely surge to become a significant business-targeting ransomware operation.
Read more »
Encryption
Antivirus APT actors Backdoor Chinese Hackers Command and Control(C2) CVE Cyber Crime Encryption

Middle East Targeted via Steganography

A hacktivist gang that has previously attacked an African country's stock exchange with malware and seized vast amounts of data is now focusing on the governments of several Middle Eastern countries.

ESET, a cybersecurity company, discovered Witchetty also known as LookingFrog for the first time in April 2022. It is thought to be closely associated with the state-sponsored Chinese threat actor APT10 formerly known as Cicada. The gang is also regarded as TA410 personnel, who have previously been connected to strikes against American energy suppliers.

A threat actor identified as Witchetty was seen by Broadcom's Symantec Threat Hunter Team utilizing steganography to conceal an unknown backdoor in a Windows logo.

The new malware uses steganography, a method for hiding a message in an openly available document, to extract dangerous code from a bitmap image of a previous version of the Microsoft Windows logo.

In the campaign that Symantec found, Witchetty is utilizing steganography to conceal backdoor software that is XOR-encrypted in an outdated Windows logo bitmap picture.

"By disguising the payload in this way, the attackers were able to host it on a reliable, cost-free service. Downloads from reputable servers like GitHub are much less likely to cause concern than downloads from a command-and-control (C&C) server that is under the control of an attacker" the researchers stated.

Backdoor employment

The employment of another backdoor known as Stegmap is highlighted in Symantec's most recent investigation of attacks between February and September 2022, when the organization attacked the governments of two Middle Eastern countries as well as the stock exchange of an African nation. 

Like many backdoors, Stegmap includes a wide range of features that enable it to do file manipulation operations, download and run executables, stop processes, and alter the Windows Registry. The hackers updated their toolset for this effort to target the vulnerabilities, and they used steganography to shield their harmful payload from antivirus software.

By taking advantage of the Microsoft Exchange ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) attack chains to drop web shells on susceptible servers, the threat actors acquire initial access to a network and launch the attack. 

According to the chronology of an attack on a Middle Eastern government organization, Witchetty maintained remote access for as long as six months and carried out a variety of post-exploitation activities, such as network enumeration and the installation of custom malware, up to September 1, 2022.

Governments and state institutions around the world, including those in Asia and Africa, continue to face active threats from TA410 and Witchetty. The best defense against such attacks is to implement security upgrades as soon as they are available. In the campaign that Symantec has identified, the hackers depend on last year's flaws to infiltrate the target network and take advantage of the subpar management of publicly accessible servers.



Read more »
ZIP files
Agent Tesla Cyber Crime Dark Web Encryption keylogger PowerShell Quantum User Privacy ZIP files

Hackers Deploy Agent Tesla Malware via Quantum Builder

A campaign promoting the long-standing.NET keylogger and remote access trojan (RAT) known as Agent Tesla uses a program that is available on the dark web that enables attackers to create harmful shortcuts for distributing malware. 

In the campaign that the experts observed, malicious hackers were using the developer to generate malicious LNK, HTA, and PowerShell payloads used to produce Agent Tesla on the targeted servers. The Quantum Builder also enables the creation of malicious HTA, ISO, and PowerShell payloads which are used to drop the next-stage malware. 

When compared to previous attacks, experts have found that this campaign has improved and shifted toward LNK, and Windows shortcut files. 

A spear-phishing email with a GZIP archive is swapped out for a ZIP file in a second round of the infection sequence, which also uses other obfuscation techniques to mask the harmful behavior. 

The shortcut to run PowerShell code that launches a remote HTML application (HTA) using MSHTA is the first step in the multi-stage attack chain. In turn, the HTA file decrypts and runs a different PowerShell loader script, which serves as a downloader for the Agent Tesla malware and runs it with administrative rights. 

Quantum Builder, which can be bought on the dark web for €189 a month, has recently witnessed an increase in its use, with threat actors utilizing it to disseminate various malware, including RedLine Stealer, IcedID, GuLoader, RemcosRAT, and AsyncRAT. 

Malicious hackers often change their tactics and use spyware creators bought and sold on the black market for crimes. This Agent Tesla effort is the most recent in a series of assaults in which harmful payloads were created using Quantum Builder in cyber campaigns against numerous companies. 

It features advanced evasion strategies, and the developers frequently upgrade these techniques. To keep its clients safe, the Zscaler ThreatLabz team would continue to track these cyberattacks. 

Agent Tesla, one of the most notorious keyloggers used by hackers, was shut down on March 4, 2019, due to legal issues. It is a remote access program built on the.NET platform, that has long existed in the cyber realm, enabling malicious actors to obtain remote access to target devices and transmit user data to a domain under their control. It has been in the public since 2014 and is promoted for sale on dark web forums. 

In a recent attack, OriginLogger, a malware that was hailed as the replacement for the well-known data theft and remote access trojan (RAT) noted as Agent Tesla, had its functioning dissected by Palo Alto Networks Unit 42.



Read more »
Subscribe to: Posts (Atom)