Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Travelex
malware Ransomware Sodinokibi Ransomware Travelex

Sodinokibi Ransomware threats Travelex to release data, if ransom not paid.



The Sodinokibi Ransomware attackers are pressuring Travelex, a foreign exchange company to pay a 6 million dollar ransom amount or risk going their data public, the attackers warn that they will either release or sell the stolen data that contains users' personal information. 


Travelex was attacked on 31st by New Year's Eve ransomware Sodinokibi Ransomware, the operators stole 5 GB un-encrypted data and later encrypted the company's whole network. 

The Sodinokibi Ransomware operators in conversation with BleepingComputer stated that they are demanding 3 million dollars ransom or they would release the data containing "DOB SSN CC" and other. The ransom was later doubled to 6 million dollars. 

Meanwhile, the exchange company Travelex is still stating that no evidence of any stolen data exists. 

"Whilst the investigation is still ongoing, Travelex has confirmed that the software virus is ransomware known as Sodinokibi, also commonly referred to as REvil. Travelex has proactively taken steps to contain the spread of the ransomware, which has been successful. To date, the company can confirm that whilst there has been some data encryption, there is no evidence that structured personal customer data has been encrypted. Whist Travelex does not yet have a complete picture of all the data that has been encrypted, there is still no evidence to date that any data has been exfiltrated."

In further conversations with BleepingComputer, the operators said even if the company is denying that any data was stolen they are negotiating the ransom price and would benefit even if the ransom is not paid. 

"If this were true, they would not bargain with us now. On the other hand, we do not care. We will still benefit if they do not pay. Just the damage to them will be more serious."

And the Sodinokibi operators are right, they would benefit either way if Travelex does pay the ransom and if it doesn't then they'll simply sell the data. As for Travelex, it will inevitably suffer damage - by paying the ransom, public release of data or if the data is sold to other actors. 
Read more »
lazarus
Crypto Currency cyber attack Cyber Attacks Hacker group lazarus

Kaspersky Lab reports North Korean Hacker group Lazarus stealing cryptocurrencies using the Telegram messenger


A group of hackers calling themselves Lazarus modified their previous scheme to steal cryptocurrency which was used in 2018. Hackers use more effective tactics and act more carefully. According to Kaspersky Lab, now, not only users of the macOS operating system are at risk but also users of Windows.

Presumably, Lazarus hackers use malware that runs in memory and not on hard drives allowing it to remain undetected. The researchers believe that the group uses Telegram to spread the virus.

The new Lazarus attack was named Operation APpleJeus Sequel, which follows APpleJeus attack conducted in 2018. Principle of cryptocurrency theft remains the same as before: fake cryptocurrency companies are used to attract investors. The websites of these companies contain links to fraudulent

Telegram trading groups, through which malware that infects Windows computers is distributed.
Once the system is infected, attackers can gain remote access to it and steal the cryptocurrencies stored on the device. So far, researchers have been able to identify many victims of the new fraud across Europe and in China. A representative of Kaspersky Lab reports that it is known about the victims from Russia, China, Poland and the UK. At the same time, they include both individual traders and companies whose activities are related to cryptocurrency.

Kaspersky noted that currently, hackers from Lazarus have suspended their campaign using the messenger, but researchers suggested that in the future, attackers will use even more advanced methods.

Earlier, a closed UN report reported that North Korea finances the development of weapons through digital and Fiat currencies stolen from banks and cryptocurrency exchanges. Last fall, Group-IB said that a North Korean group of hackers stole $571 million in cryptocurrencies.
Read more »
Microsoft
Apple. MacOS cryptocurrency lazarus malware Microsoft

Malware Against Crypto-Currency Businesses; Microsoft and Apple are Targets Alike


“AppleJeus” operation was the first time “macOS” users were made victims by Lazarus. Herein, a manipulated application was used to target potential victims. Apparently, Lazarus used customized malware, especially for macOS users.

Per leading sources, the malware had been so fabricated that it released the current and the next-stage payload automatically without any manual actions required. For attacking Windows users a multi-stage infection procedure was fabricated.

Reportedly, compromising “crypto-currency” related business was the major objective of “AppleJeus” and Lazarus at large. The macOS malware employed the source course only to structure “macOS” installers. Allegedly, “QtBitcoinTrader” was used.

However, the hackers at Lazarus altered the macOS malware. For starters, it no more has an encryption/decryption network communication routine as per reports.

In another case, the .NET malware was disguised as Wallet updaters like “wfcwallet.com” and “www.chainfun365.com”. Herein, the multi-stage infection took place but in a different way.

Later on files of the likes of “rasext,dll” and “msctfp.dat” are uploaded onto the target’s system. Allegedly, the Remote Access Connection Manager was also into play.

Per sources, there was another case where a highly altered form of the macOS malware was at work. Similar to other cases, the fake website and application were being called by the attacker. The apparent differences as per reports in the attack are as follows:
o The malicious application was hosted via “GitHub”.
o The post-installation script of the macOS malware was different as well.
o This version used “ADVobfuscator” to hide its code.
o The author of this modified macOS malware utilized “Object-C” and not QT framework.


In a different attack, the post-install script was the same as the previous attack; the author here had used “SWIFT” for the development of the malware. The method of data collection was changed and then the conduct authentication began. According to sources, the “auth_signature and auth_timestamp” parameters were used to deliver the second payload. The current system time of the device is acquired by the malware and then it’s combined with the “12GWAPCT1F011S14” hard-coded string and an “MD5 hash” is created. The hash is used as the “auth_signature” parameter and the time is used as the value of the “auth_timestamp” parameter. These values can be reproduced as well and finally, the second payload is uploaded.

Apart from all the macOS cases, there was a Windows incident as well. Per sources, a version of the “UnionCryptoTrader” was found. Allegedly, the “Telegram messenger” was at play. The infection procedure was pretty much the same as one of the previous cases with an add-on. A final backdoor payload was done. This version showed numerous exchange rates for crypto-currency.

Reportedly, the Windows malware uploads the encrypted “msctfp.dat file” and loads all the configuration values. Later an extra command is executed as per the contents of the file. Finally, the malware communicates with the C2 server, a post request is sent.

Several parameters are sent and according to the response code from the C2 server, the “POST” request is sent through along with the encrypted data and a random value that could be used to identify individual victims.

Innumerable fake websites were found still in action. The fake websites were crypto-currency oriented but could easily be identified as fake if looked at with a keen eye.

Part 2 of the “AppleJeus” had its victims spread across, Poland, China, Russia, and the US with most of them related to businesses involving crypto-currency.

Lazarus group has been quite a matter of talk for a very long time. It especially continues to be a matter of concern for the cyber-world.

The AppleJeus and other malware that exist and would exist in the future are evolving by the hour. Crypto-currency associated businesses are the key and foremost objects of Lazarus and other threat actors and hence need to be more vigilant than ever.


Read more »
Windows
Ransomware Technology Windows

SNAKE Ransomware Targets Entire Corporate Systems?


The new Snake Ransomware family sets out to target the organizations’' corporate networks in all their entirety, written in Golang and containing a significant level of obfuscation, the observations and disclosure for the attacks were made by a group of security specialists from the MalwareHunterTeam.

The Ransomware upon successful infection subsequently erases the machine's Shadow Volume Copies before ending different processes related to SCADA frameworks, network management solutions, virtual machines, and various other tools.

After that, it continues to encrypt the machine's files while skirting significant Windows folders and system files. As a feature of this procedure, it affixes "EKANS" as a file marker alongside a five-character string to the file extension of each file it encrypts. The threat wraps up its encryption routine by dropping a ransom note entitled "Fix-Your-Files.txt" in the C:\Users\Public\Desktop folder, which instructs victims to contact "bapcocrypt@ctemplar.com" so as to purchase a decryption tool.

The ransom note of SNAKE ransomware (Source: Bleeping Computer)

“It is clearly evident from the language in the ransom note, that this Ransomware specifically targets the entire network rather than individual workstations. Further indicating that any decryptor that is purchased will be for the network and not individual machines, but it is too soon to tell if they would make an exception.”
 - This is what Bleeping Computer said in a blog post on SNAKE. 

Nonetheless, the rise of SNAKE Ransomware highlights the critical requirement for organizations to defend themselves against a Ransomware infection.

While making effective use of the suggestions to forestall a Ransomware infection in the first place, they ought to likewise consider 'investing' into a solution like Tripwire File Analyzer for the purpose of distinguishing suspicious documents and conduct on the network.

Read more »
Vulnerability and Exploits
HackerOne PayPal PayPal Bug bounty Vulnerability and Exploits

PayPal Fixes 'High-Severity' Password Security Vulnerability


Researcher Alex Birsan, while examining PayPal's main authentication flow– discovered a critical security flaw that hackers could have exploited to access passwords and email addresses of users. He responsibly reported the vulnerability to PayPal on November 18, 2019, via the HackerOne bug bounty platform and received a bug bounty over $15,000 for the issue which was acknowledged by HackerOne after 18 days of its submission and later patched by the company on 11th December 2019. 

The aforementioned bug affected one of the primary and most visited pages amongst all of PayPal's, which is its 'login form' as mentioned by Birsan in the public disclosure of the flaw. 

As Birsan was exploring the main authentication flaw at PayPal, his attention got directed to a javascript file that seemingly contained a cross-site request forgery (CSRF) token along with a session ID. "providing any kind of session data inside a valid javascript file," the expert told in his blog post, "usually allows it to be retrieved by attackers." 

"In what is known as a cross-site script inclusion (XSSI) attack, a malicious web page can use an HTML <script> tag to import a script cross-origin, enabling it to gain access to any data contained within the file." 

While giving their confirmation, PayPal put forth that sensitive, unique tokens were leaked in a JS file employed by the Recaptcha implementation. Sometimes users find themselves in situations where they have to go through a captcha quiz after authentication and according to the inference drawn by PayPal, "the exposed tokens were used in the post request to solve the captcha challenge." The captcha quiz comes into play after multiple failed login attempts, that is normal until you come to terms with the fact that " “the response to the next authentication attempt is a page containing nothing but a Google captcha. If the captcha is solved by the user, an HTTP POST request to /auth/validate captcha is initiated.” Although, in order to successfully obtain the credentials, the hacker would be required to find a way of making targeted users visit an infected website prior to logging into their PayPal account. 

While assuring its users, PayPal said that it “implemented additional controls on the security challenge request to prevent token reuse, which resolved the issue, and no evidence of abuse was found.”
Read more »
Russia
Cyber Security Cyber Security awareness Cyber Security News Russia

Russian experts warn the danger of charging the phone in public places


The number of charging stations at airports, bus stops, metro stations and other public places in Russia has been growing rapidly in recent years. However, using such USB-inputs is not safe because attackers can access data stored in the phone or download malware through them. Today in Moscow you can charge your gadgets at airports and train stations, in metro trains, buses, at public transport stops, and in shopping and entertainment centers.

According to Sergey Nikitin, Deputy head of Group-IB, standard USB cables contain four wires: two for data transfer and two for charging. The problem is that hackers embed a special device in the charging wire, or add a small computer to the charger itself. When people connect a gadget to charge, they connect it to some other device.

"Attackers can thus gain access to your device," said the expert. Nikitin gave an example of one of these attacks: a small computer sends malicious code to the gadget, runs it, and so the hacker gains access to the data of the smartphone. An expert at Jet Infosystems Georgy Starostin noted that cybercriminals can download photos from victim's phones for blackmail or infect the device with a virus.

According to him, charging stations in public places carry other risks, the company providing the service can also install additional equipment. According to him, this way it will collect user data for further analysis and sale to advertisers.

The Avast press service said that information is transferred via USB ports in the same way as to the computer. If there are any vulnerabilities in the USB phone software, hackers can gain full control of the connected phone.

Experts advised users to try to avoid charging stations in public places. Avast offered to buy a portable power supply for charging the gadget or USB cables in which the data wires are removed.
Read more »
Vulnerability and Exploits
Cisco Vulnerability and Exploits

Cisco faces criticism after a hacker finds 120+ bugs in its product



A triad of severe vulnerabilities in Cisco DCNM (Data Center Network Manager) stock allows hackers to remotely sidestep the verification and invade into companies’ servers, the reason being a few safety failures that include hard-coded creds.

The 3 vulnerabilities were in the huge 120 vulnerabilities list in the stock discovered by the hacker Steven Seeley, who currently works for Source Incite. It was Steven who informed the company about the issue through a glitch hunt program called Zero Day Initiative, by Trend Micro. 

In an interview with Computer Business Review, he Australian cybersecurity specialist/hacker said that "the group of 3 vulnerabilities are the most dangerous among the 120 vulnerabilities, and if the hackers get a hand of it, they can exploit it using execution as root through remote code. It is as simple as that."

Simon further says that by exploiting these vulnerabilities, the hacker could easily gain access to almost anything like personal information, credentials, and passwords.
"I was rejected by the company Cisco after 8 interviews," said Simon on Twitter.

In response to the situation, Cisco has urged its users to update their systems and software, as to stay safe from the bugs. Earlier this week the company said, "we have repaired the vulnerabilities in and users are requested to immediately update the software."

Unfortunately, the readers of Computer Business Review are well aware that not all the products were built to be the same when it comes to patch management, the issue being that most of the critical bugs are neglected by the company.

In a conversation with Computer Business Review, Simon said that he will release the source codes this coming week. He mentioned that the vulnerabilities were very minor to exploit, but it did consume mind-boggling research to find the bugs in the starting phase. "The research consumed a whole month along with reviewing the code origin and debugging the run-time."

Cisco says the trio of the vulnerabilities is not dependent on each other. A single vulnerability itself is capable of the exploit, let alone the trio. Cisco has released the latest security patch on its website. The users who have still not updated it can install it from the 'download center' on the website.
Read more »
Technology
Ballie robot Samsung Technology

Samsung announces a new product Ballie - a robot companion

Samsung has launched a new product at CES 2020, named Ballie a tennis ball-like robot that rolls around following the owner. The bot Ballie has a built-in camera to follow it's the owner and capture special moments, Samsung South Korean tech giant announced the product at CES tech show in Las Vegas.

"I love this guy," said president and chief executive H S Kim as Ballie whizzed around the stage chasing him. 
He said the product is a combination of 5g and Artificial Intelligence, both areas in which Samsung plans to focus on in 2020.

Ballie is being received with both positive and negative views. One analyst said that it seems fun but might struggle with stairs. It has roared on the internet and is already being compared with robot companions from several movies - including BB-8 from the latest Star Wars trilogy films.

Along with being a perfect robot companion, Ballie overshadows it's owner, acts as a fitness assistant and can help in household chores like switching on smart devices at home. 
"It's fun - it reminded me of a cross between a Sphero toy and R2-D2 with the sounds it was making," said Simon Bryant at market research firm Futuresource.
He also mentions that it's strange that Samsung introduces Ballie with its own voice recognition ability without any mention of the company's virtual assistant Bixby.

Paul Gagnon, an analyst at IHS Markit comments, "I can see a lot of people who will be hesitant with security and privacy concerns". Though, Samsung assures that Ballie would strictly follow privacy and data protection standards. 

Samsung has not yet revealed when Ballie will be available in the market to buy or how much it will cost. 
When asked by the BBC why a product like this now, Samsung spokesman Benjamin Braun said, "There are two technologies that are helping this come to life. One is artificial intelligence and the other one is 5G. Those very much focus areas for Samsung in 2020."
Though, Mr. Bryant said he was unimpressed by these ideas, "I thought it just smacked as a desperate attempt to move on from mobile," he said. 
Read more »
Windows
Brute-force attack Cyber Security Microsoft Remote Desktop Protocol Windows

Cyber Attack Alert! Microsoft Gives Inside Revelations About RDP Brute Force Attacks


Microsoft conducted a long-term study, which majorly focused on RDP brute-force attacks, their success and the duration they last for.

Per sources, according to the reports of the study, over 0.8% of the RDP brute force attacks on an average last for about “2-3 days”. The study also revolved around the effect of such attacks on various business organizations.

Data from over 45,000 devices and workstations that ran “Microsoft Defender Advanced Threat Protection” (commercial version of the free Defender anti-virus app) was acquired in terms of RDP login related acts.

According to reports, both failed and successful attempts at RDP login was part of the data collected for the detailed study that spread across numerous months of dedication.

Reportedly, the aforementioned successful and failed events include Windows events with ID 4264 and 4265, correspondingly. The usernames that the attackers or users may have used were also collected.


Per sources, RDP, Remote Desktop Protocol happens to be a feature of the Windows operating system that enables the users to log into a “remote computer” or device by way of an interface that looks much like a desktop, by means of the computer’s public IP address and port 3389.

Businesses and organizations usually make use of RDP and its provisions to manage servers, workstations and other connected devices in remote areas. It’s easier for the administrators and employees alike to work that way.

Brute force attacks have been pretty common on Windows devices especially via open RDP ports. Automated tools that the hackers use help them to create various combinations of passwords and usernames to figure out the target computer’s RDP login details.

Simple and basic combinations stand at the top of the hit list. The password and usernames combinations that have previously been leaked on the dark web are also used the most.

Where on an average these brute force attacks last for 2 to 3 days, in 90% of the cases, as the reports have found out, the attacks last for around a week.

According to the study reports the attacks spread across days because the hackers were trying out selected combos per hour rather than blindly shooting combos.

This clearly helped the attackers dodge the chances of their attack Internet Protocols getting banned by the firewalls.

Microsoft, according to sources, also mentioned that “0.8% of the devices that were attacked by the brute-force attacks were compromised. Also, that on an average a machine was expected to have a high probability of being compromised leading to an RDP brute force attack every 3-4 days”.

Per sources it’s imperative to look for the following things in a sign-in attempt:
 Event ID 4625 login type
 number of other devices with RDP inbound connections from one or more of the same IP
 number of failed sign-ins
 Event ID 4625 failure reason
 The number count of a username and the times it failed to log in
 number of RDP inbound external IP
 an hour and the day of the failed sign-in
 RDP connections
 Timing of successful sign-in attempts

To secure your device from such attacks, it’s supremely essential to monitor unknown connections and failed sign-in attempts.


Read more »
Ukraine
Cyber Crime Cyber Crime Report Scam Ukraine

Ukrainian cyber police exposed a fraudulent scheme of financial auctions


Earlier EhackingNews reported that cyber police in the Kharkiv region exposed members of a criminal hacker group who purposefully carried out attacks on private organizations and individuals to illegally gain access to their remote servers. It is established that in this way they managed to hack more than 20 thousand servers around the world.

It turned out that in fact, the cyber police exposed a fraudulent scheme of financial auctions with a monthly turnover of $100 thousand.

According to cyber police, the attackers opened in Kiev several call centers to conduct trading on the world financial markets. They offered their victims to invest money, which in the future, according to them, can bring high profits. Otherwise, they promised to return the invested money.

Scammers created an imitation of trading, appropriating money for themselves. When the client tried to withdraw money, the attackers carried out a number of operations that led to the complete loss of money by the client.

All invested money was credited to the offshore accounts of the attackers. In the end, the income amounted to more than 100 thousand US dollars monthly. The attackers worked on the territory of Ukraine and the European Union. Cyber police identify all victims.

Law enforcement officers raided the offices of fraudsters and seized system units, servers, and mobile phones. During an inspection of this technique, it was found that the attackers also sold illegal drugs. Their sale was carried out in Ukraine and abroad via the Internet. Attackers face up to 12 years in prison and confiscation of property.

It is worth noting that fraud with Bank cards is gaining popularity in Ukraine. A fraudster who stole more than $42 thousand from his victims was detained last month. The man duplicated Bank cards of citizens. Imitating an ATM operation error, he used special manipulations to duplicate the card of the next user of the Bank.
Read more »
Windows
malware Ransomware Security News Windows

Clop Ransomware Upgraded, Now can Terminate 663 Windows Processes


In February 2019, Michael Gillespie from MalwareHunter Team founded Clop ransomware that has been evolving to reach its full potential and now a variant of the same can terminate a total of 663 Windows processes.

While it was first discovered, it did not demonstrate any unique quality which made it stand out amid other ransomware variants, it was merely another likewise addition in the ransomware ecosystem like others that existed since 2017. However, it has continued to take various forms since its discovery and is emerging with all new and integrated process killer that affects several processes of Windows 10 apps, office applications, programming IDEs, languages and text editors.

As per the sources, it was noted in March 2019, that the attackers behind Clop Ransomware started to target entire networks instead of individual systems, they changed the ransom note to imply the same. The same year also witnessed a sudden disruption in the services of Clop Ransomware wherein they abruptly changed and disabled services for Microsoft SQL Server, MySQL, Microsoft Exchange, BackupExec and other enterprise software.

In 2019, while warning the organizations and businesses regarding app-killing malware, the Federal Bureau of Investigation (FBI) reported that the ransomware threat now is even amplified as the attackers are continually upgrading themselves, they have devised ways to bypass detection and be more effective in their operations. Organizations are being warned by investigative agencies to keep abreast of such potential threats and build a security net to guard their systems.

While commenting on the matter, Abrams, editor-in-chief for Bleeping Computer said, "It is not known why some of these processes are terminated," Bleeping Computer editor-in-chief, Abrams, said, "especially ones like Calculator, Snagit, and SecureCRT, but it’s possible they want to encrypt configuration files used by some of these tools."

Meanwhile, in a conversation with SC Media UK, Javvad Malik, security awareness advocate at KnowBe4, told "Clop is a variant of the CryptoMix ransomware family, but has been evolving rapidly in the last year to disable an increasingly large number of windows processes,"

"The main goal of Clop is to encrypt all files in an enterprise and request a payment to receive a decryptor to decrypt all the affected files," read the McAfee report in August.

"To achieve this, we observed some new techniques being used by the author that we have not seen before. Clearly, over the last few months, we have seen more innovative techniques appearing in ransomware."

Read more »
Subscribe to: Comments (Atom)