Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Ransomware
Data Encrypting Malware Encrypted Files malware Ransom Ransomware

New Malicious Program 'Nefilim' Threatens to Release Stolen User Data


Nefilim, a new malicious program that basically is ransomware that functions by encrypting files on affected systems, has become active in the cyber ecosystem since February 2020. After encryption of the files, it demands a ransom from the victims for the decryption of files, tools, and software. However, it is still unclear how the ransomware is being spread, sources reckon that it's distributed via susceptible Remote Desktop Services.

As per the head of SentinelLabs, Vitali Krimez and Michael Gillespie from ID Ransomware, the code employed in Nefilim resembles much that of Nemty's, another file-encrypting ransomware that steals user data by restricting access to documents and multimedia using the AES-256 algorithm. As to the speculations of security researchers, it is likely that the authors of the first ransomware have a role to play in Nefilim's creation and distribution. However, due to the uncertainty revolving around the operation source of the new ransomware, experts also point towards a possibility of the source code being somehow obtained by the new malicious actors to develop a new variant.

While the encryption is underway, all the affected files are added with ".NEFILIM" extension. For instance, a file previously named "xyz.png" would start appearing as "xyz.png.NEFILIM" after the encryption takes place. The completion of the process is followed by a ransom note being created on the infected user's desktop titled "NEFILIM-DECRYPT.txt", "A large amount of your private files have been extracted and is kept in a secure location. If you do not contact us in seven working days of the breach we will start leaking the data. After you contact us we will provide you proof that your files have been extracted." the note reads.

As per the sources, for money matters, Nefilim primarily pins its hopes on email communications instead of a Tor payment site after the removal of the Ransomware-as-a-Service (RaaS) component and it stands out as one major difference. According to the analysis carried out by Gillespie, it has been made clear that as of now there exists no way to retrieve files without paying the ransom because the ransomware is reported to be completely secure. As a result of that, victims are being threatened to pay the demanded amount within a week or else the data stolen will be exposed by the attackers.
Read more »
ESET
cyber attack Cyber Attacks ESET

ESET: hackers used the Adobe brand to attack government websites


IT specialists of the Slovak company ESET warn of a new series of attacks committed by the Turla cyber-spy group, which are aimed at websites of government agencies in the world.

"ESET, a leader in information security, has discovered a new activity of the Turla group, which is aimed at government websites. This time, cybercriminals are using social engineering techniques, using a fake Adobe Flash update as a decoy to download malicious software," said the website.

According to the report, as a result of such attacks, at least four websites, two of which belong to the government of Armenia, were infected. At the same time, these web portals have been infected at least since the beginning of 2019. ESET specialists warned the national unit of CERT of Armenia. Thus, the researchers concluded that the main target of cybercriminals is officials and politicians.

During the recorded cyberattacks, hackers infect the selected site with malicious software, which is subsequently transmitted to the devices of users of the resource. After the initial infection, Turla operators get full access to the victims' devices.

ESET specialists were not able to determine what the hackers did on infected devices, but they usually try to steal confidential documents.

According to ESET, during the latest attacks, the cybercriminals of the Turla group used a completely new backdoor called PyFlash. According to ESET experts, the authors of Turla used Python for the first time in this malicious software. The command server sends commands to the backdoor to download files, execute Windows commands, and launch and remove malicious software.

The company added that the group of cybercriminals Turla is active in most of the world, but mainly its activities are aimed at countries in Eastern Europe and East Asia. Its main goals are government and military organizations. A group of cyber spies has been working for more than ten years.
Read more »
Technology
COVID-19 Samsung South Korea Technology

The Worldwide Pandemic Prompts Technology Giant Samsung to Embrace Electronic Voting


There is no denying the fact that the rise of COVID-19 has taken the world by storm yet it’s very astounding that the technology sector also has been affected to a critical degree. Technology giant Samsung Electronics has thus embraced electronic voting in favor of the first run through ever during this year's annual general meeting (AGM) on March 18, asking shareholders to utilize it to help check the spread of the worldwide pandemic coronavirus. 

Samsung's investor relations website on Monday encouraged shareholders to take the opportunity to cast a ballot via the internet up to March 17. This is on the grounds that the company directed a 1-to-50 stock split in 2018, prompting a huge increment in the shareholders numbers. 

Samsung's AGM is said to be held at a convention hall in Suwon, around 30 km (18 miles) south of Seoul, with a capacity of around 3,000 people as per reports by the centre's website Samsung explicitly called for electronic voting by shareholders with manifestations, or who have visited locales with high-risk districts, or who are identified as high-risk, for instance, pregnant women and those aged 65 or above. Reflecting guidance from the "Korea Centers for Disease Control and Prevention Guidance". 

The shareholders' gathering is said to be furnished with thermal cameras and contactless thermometers, and those with fever or cough symptoms might be restricted from entering. 
Those with a fever at the scene will be coordinated to an area away from the main hall, the website informs. 

In what is the second-biggest outbreak in Asia after China, South Korea announced 74 new COVID-19 infections on Monday, bringing the nation's aggregate to 8,236 and hence such precautions are a must.
Read more »
Stalkerware
Coronavirus Gmail India malware MonitorMinor Security Social Media Spyware Stalkerware

Beware of Stalkerware That Has Eyes On All of Your Social Media!


Dear social media mongers, amidst all the talk about the Coronavirus and keeping your body’s health in check, your digital safety needs kicking up a notch too.

Because, pretty recently, security researchers discovered, what is being called as a “Stalkerware”, which stalks your activities over various social platforms like WhatsApp, Instagram, Gmail, Facebook, and others.

‘MonitorMinor’, per the sources, is definitely the most formidable one in its line.

Stalkerware are “monitoring software” or ‘Spyware’ that are employed either by people with serious trust issues or officials who need to spy for legitimate reasons.

Via this extremely creepy spyware kind, gathering information like the target’s ‘Geographical location’ and Messaging and call data is a cakewalk. Geo-fencing is another spent feature of it.

This particular stalkerware is hitting the headlines this hard because, MonitorMinor has the competence to spy on ‘Communication channels’, like most of our beloved messaging applications.

The discoverers of this stalkerware issued a report in which they mentioned that in a “clean” Android system, direct communication between applications is blocked by the “Sandbox” to kill the possibilities of the likes of this spyware gaining access to any social media platform’s data. This is because of the model called “Discretionary Access Control” (DAC).

Per sources, the author of the stalkerware in question manipulates the “SuperUser-type app” (SU utility) (if present) allowing them root-access to the system.

The presence of the SU utility makes all the difference for the worse. Because owing to it and its manipulation, MonitorMinor gains root access to the system.

The applications on the radar are BOTIM, Facebook, Gmail, Hangouts, Hike News & Content, Instagram, JusTalk, Kik, LINE, Skype, Snapchat, Viber, and Zalo-Video Call.

From lock patterns to passwords, MonitorMinor has the power to dig out files that exist in the system as ‘data’. And it obviously can use them to unlock devices. This happens to be the first stalkerware to be able to do so, mention sources.

Per reports, the procedure is such that the “persistence mechanism” as a result of the malware manipulates the root access. The stalkerware then reverts the system section to read/write from the initial read-only mode, copies itself on it, deletes itself from the user section, and conveniently goes back to read-only mode again.

Reports mention that even without the root access, MonitorMinor can do a consequential amount of harm to targets. It can control events in apps by manipulating the “Accessibility Services”. A “keylogger” is also effected via the API to permit forwarding of contents.
Unfortunately, victims can’t do much to eradicate the stalkerware form their systems, yet.

Other functions of the stalkerware include:
• Access to real-time videos from the device’s camera
• Access to the system log, contact lists, internal storage contents, browsing history of on Chrome, usage stats of particular apps
• Access to sound recordings from the device’s microphone
• Control over the device’s SMS commands.

The security researchers released a report by the contents of which, it was clear that the installation rate of it was the maximum in India, closely followed by Mexico and then Germany, Saudi Arabia, and the UK.

The researchers also per reports have reasons to believe that possibly the MonitorMinor might have been developed by an Indian because they allegedly found a ‘Gmail account with an Indian name’ in the body of MonitorMinor.

Read more »
security measures
Coronavirus COVID-19 Cyber Security security measures

Some useful Cybersecurity tips every Work-from-home Employee must know


Amid the Coronavirus (COVID-19) panic, numerous corporates and organizations have told their employees to work from home as a safety concern for the employees' health. This precautionary step indeed is a good measure to take care of the employees' health while maintaining the work productivity in balance, but it also brings up concerns about the cybersecurity or the company's networks and data. It would be the 1st time for many companies to start this work-from-home initiative, which means that these organizations lack the precautionary measure to prevent their company's networks and data from potential cyberattacks from hackers. Incidents of cyberattacks have already appeared amid the coronavirus outbreak.

How to protect your system while working from home

Password Manager
Password Management Systems are a great way to keep all the online passwords encrypted. This way, your team's online accounts, and passwords are safe. This feature allows safe sharing of the password, which means that the team can securely log in to the accounts without the risk of exposing the password.

2-Step Authentication
Most of the organizations work on a cloud platform, which means the employees have collaborative access. However, using cloud also exposes your network to cybercriminals if you have weak passwords, as they can pretend to be the user and gain access to your company's network. This is why 2 step verification is crucial for cloud-based software, and therefore it should be made a standard login protocol for all the work-from-home employees.

Inform your employees about the security of devices
Safety of the employees' devices is crucial while working from home, as the devices can be stolen or lost. Therefore, it is very important to keep your devices safe as it can provide cybercriminals access to your company's network. Follow these steps to ensure device safety:

  •  Always use lock screens and passwords on your device.
  •  Don't plug your untrusted USB into your device. 
  • Keep a regular backup of your device. 
  • Always use 'find my device' option, just in case your device gets lost. 
  • Encrypt important data and files
 Don't use Unsecured and Public Wifi networks
Avoid using public wifi at all costs as it can make your device vulnerable to cyberattacks.
Read more »
Ransomware
Coronavirus Google Google Play Store malware Ransomware

Stay Wary of Third-Party Apps: Malware App 'CovidLock' Locks User Out of their Phone


In an attempt to block misinformation from being spread by developers taking advantage of the COVID-19 charged environment, Google started prevention by blocking any search made for terms "COVID-19" and "coronavirus" on Google Play Store. It identified certain developers' malicious intent of exploiting user's concerns regarding the new coronavirus. As of now, Google's attempt to block searches has yielded positive results with the search for the aforementioned keywords returns no results at all on the Play Store.

Once you are out of the Play Store searching for the same, considering the installation of third-party apps, it becomes a matter of great concern as developers are embedding ransomware in apps named after the new coronavirus to delude uninformed users.

Recently, DomainTools, a Threat Intelligence company found an app known as "CovidLock" that is ransomware in the facade of 'coronavirus tracking app'. The app will appear to be a real-time tracker for the coronavirus but it will function as a malware that will lock the user out of his phone and ask for a ransom of $100 in bitcoin within a time period of 48 hours. If the affected user fails to provide the demanded ransom in the given time, he receives threats of his social media accounts being exposed online and the data stored onto his device being permanently deleted. It further notifies that his device is constantly monitored and in case he attempts to do anything stupid, everything will be automatically deleted.

However, a piece of good news is that the new mobile devices are secured against such attacks as Google has added defense against it. But in cases of users running versions older than Android Nougat, there are chances of their device being infected by this malware. To stay on a safer side, users are being advised to stick to the Google Play Store when downloading apps. Turning to unauthorized third-party sources invites great danger to user security especially at a time when our concerns and fears can be exploited and used against us. 
Read more »
Information Security News
Cyber Security Information Security News

Cybersecurity experts told how to protect yourself when working from home


After the World Health Organization (WHO) officially recognized the outbreak of COVID-2019 as a pandemic, many employers offered their employees to switch to remote work. Experts in the field of information security explained what risks exist when working from home and how to protect yourself from hackers.

Check Point Software Technologies specialists noted that employees feel more relaxed at home, especially when it comes to cybersecurity. This disadvantage can be exploited by hackers, who carry out attacks in order to gain access to personal or corporate data.

Employees can protect themselves from such attacks by following certain rules. First, strong passwords should be created. However, it is important to use different combinations for different accounts.

Also, cybersecurity experts recommend employees to be careful about emails. Since emails can be sent by hackers, they need to carefully study the information about the sender. This will make sure that the person is communicating with a colleague. According to experts, domains associated with coronavirus are 50 percent more likely to be malicious.

In addition, it should be remembered that a corporate laptop is not recommended for use in games or watching videos. This creates a security risk.

Experts do not advise company management to save money and provide devices for employees working from home so that they do not use personal devices.

If a person has to work on their own computer or laptop, then first he should consult with the corporate IT team. Also, employees need to protect home Wi-Fi with a more complex password to access the Network.

Timurbulat Sultangaliev, head of information security consulting company AT Consulting, said that for safe work from home, it is important to provide data encryption, antiviruses, firewalls, restrict access to the system to unauthorized users, monitor security and vulnerabilities, and provide multi-factor authentication.
Read more »
Spams
Coronavirus Cybersecurity Spams

Hackers take advantage of Coronavirus panic, launch Cyberattacks


The whole world is in high alert with coronavirus COVID-19, as being declared a pandemic and every government is making a tremendous effort to get the virus under control and protect its citizens. The virus already has everyone in a panic with the loss of life, tumbling economy and the global shutdown but one group is seemingly using this chaos and panic to its advantage. As the virus makes headlines daily, people heed to every information they can get to beat COVID-19, and hackers are using this to their gain. Several cybersecurity firms have reported cases and attacks in various forms by hackers using COVID-19 to lure their victims into spreading malware and falling into other traps. People are staying indoors and working from home and increasingly using the internet which presents as a sweet cake for hackers.


Here is how hackers are exploiting the global panic from the virus

Phishing Mails and Malwares
FireEye a cybersecurity company, has learned about cybersecurity threats coming from China, North Korea, and Russia. Chinese hacking group attacks East Asia, the North Korean groups are targeting South Korean Non-governmental Organizations and Russian groups are attacking parts of Ukraine. These use phishing emails and spams to spread malware but they are not just limited to malware, some mails are business mails to fish out money from the receiver.

Stealing Personal Information
A Chinese group named Vicious Panda by the security firms has tricked people into sharing sensitive personal information using a document from Mongolian Health Ministry. Other hackers are using maps and dashboards for stealing personal information reports Reason Labs. The most common one is the abuse of the dashboard created by John Hopkins University. People rely on these to track the spread of the virus and know the infected number.

 Fake Apps, Websites Imposters, and Misinformation 
Among other methods are - Fake Apps to track the spread of coronavirus and the infected patient, where they went, where not to go, virus hotspots. These apps are filled with malware and could be asking you to pay money. Then there are the Fake websites, where the actors imposter global organizations like the World Health Organization. Some social media campaigns and accounts are also responsible for sharing misinformation about the virus that it's a conspiracy of rival countries.

The crux is, as long as COVID-19 remains a threat, hackers will continue to take its advantage, so we need to be diligent and smart while surfing the net to avoid being scammed. A few steps like only trusting variable sources for information on the virus life

  • Use a trustable source of information on the virus. 
  • Not installing apps from unverified sources. 
  • Don't pay anything to any website or application, only trust government sources. 
  • Don't open spam emails or any attachment if it's not known.
Read more »
Technology
Cookies Facebook Identity Theft Technology

2 New Android Malwares on The Hunt to Gain Control of User’s Account



As per discoveries of competent security software two new Android malware is on the hunt to 'discreetly' access control of the victim's account so as to send different ill-intentioned content. The two malware together steal cookies collected by the browser as well as applications of famous social networking sites and accordingly making things easier for the thieves to do their job. 

While cookies are frequently perceived as quite harmless since they are characterized as small bits of data collected by websites to smoothly track user activity online with an end goal to create customized settings for them in the future however in a wring hands, they represent a serious security hazard. A grave security risk since, when websites store these cookies, they utilize a unique session ID that recognizes the user later on without having them to enter a password or login again. 

Once possessing a user's ID, swindlers can trick the websites into assuming that they are in fact the person in question and thusly take control of the latter's account. What's more, that is actually what these cookie thieves did, as described by computer security software major Kaspersky, creating Trojans with comparable coding constrained by a similar command and control (C&C) server. 

The primary Trojan obtains root rights on the victim's device, which permits the thieves to transfer Facebook's cookies to their own servers. Be that as it may, in many cases, just having the ID number isn't sufficient to assume control for another's account. A few sites have safety measures set up that forestalls suspicious log-in endeavors as well. 

Here is when the second Trojan comes in. This malignant application can run a proxy server on a victim's device to sidestep the security measures, obtaining access without raising any doubt. From that point onwards, the thieves can act as the 'person in question' and assume control for their social media accounts to circulate undesirable content. While a definitive aim of the cookie thieves remains rather obscure, a page revealed on the same C&C server could provide a clue: the page promotes services for distributing spam on social networks and messengers. 

In simpler words, the thieves might be looking for account access as an approach to dispatch widespread spam and phishing attacks. 

Malware analyst Igor Golovin says "By combining two attacks, the cookie thieves have discovered a way to gain control over their victims` account without arising suspicions. While this is a relatively new threat -- so far, only about 1,000 individuals have been targeted -- that number is growing and will most likely continue to do so, particularly since it`s so hard for websites to detect." 

He adds later "Even though we typically don`t pay attention to cookies when we`re surfing the web, they`re still another means of processing our personal information, and anytime data about us is collected online, we need to pay attention." 

According to Kaspersky experts all hope’s isn’t lost they made certain recommendations which might help a user to save themselves from becoming a victim of cookie theft : - 
  1. Block third-party cookie access on your phone`s web browser and only let your data be saved until you quit the browser
  2. Periodically clear your cookies
  3. Use a reliable security solution that includes a private browsing feature, which prevents websites from collecting information about your activity online.
Read more »
Vulnerability and Exploits
big bounty. Cloud Shell Google Vulnerability and Exploits

Google rewards 100,000$ as bug bounty prize!


Google has awarded 100,000 dollars prize to a Dutch researcher Wouter ter Maat for the Google Cloud Platform (GCP), for vulnerabilities found in the Google Cloud Shell.


Wouter ter Maat received 100 thousand dollars, Google's very first annual Cloud Platform bug-bounty prize by finding a clever container escape and search for bugs.

Google also announced, that then it will be increasing the payouts for annual Google Cloud Platform prizes in its Vulnerability Reward Programme (VRP). It will offer prizes to the top six vulnerability reports in GCP products submitted in 2020 with a cash prize of up to 313,337 dollars. The first place would win 313,337 dollars and the sixth place will end up with a thousand dollars. In order to be eligible, the bug hunters will have to submit a public write-up with the word limit of 31,337 words.

 The Bug-

Google Cloud Shell is an interactive shell environment for Google Cloud Platform. It is a Linux with a browser-based front, that allows administrators to use various resources in the Google Cloud Platform.

Ter Maat noticed several issues in the cloud shell, the way it interacts with resources and authentication problems.

 “When the Cloud Shell instance is done starting a terminal window is presented to the user,” ter Maat wrote in his write-up published in December. “Noteworthy is the fact that the gcloud client is already authenticated. If an attacker is able to compromise your Cloud Shell, it can access all your GCP resources.”

The researcher could connect to resources after launching the Cloud Shell, and as very few processes were running he was able to enter a container, escape it and access the full host by examining the file system. “I noticed that there were two Docker UNIX sockets available,” explained ter Maat. “One in ‘/run/docker.sock’, which is the default path for our Docker client running inside the Cloud Shell (Docker inside Docker); the second one in ‘/google/host/var/run/docker.sock.'”

 "This second socket was revealed to be a host-based Docker socket, as indicated by its pathname. Anyone who can communicate with a host-based Docker socket can easily escape the container and gain root access on the host at the same time,” the researcher noted, adding that he could do that by just writing a quick script.

“After running it you will find that all containers inside the pod will automatically reboot. Now all containers run in privileged mode,” said ter Maat.

Researchers say, if malicious actors gain control of privileged containers, the possibilities for abuse are seemingly endless. They can view software and exploit their vulnerabilities, codes can be re-written, coin miners can be executed and effectively hidden and much more.
Read more »
Tor project
Bug Cyber Security IP addresses JavaScript exploit Security Software Tor project

Tor Browser Bug Executes Uncalled for JavaScript Codes!


The well-known Tor is allegedly experiencing some kind of bug in its mechanism. It has hence warned the users to stay vigilant as regards to the “Tor Browser Bug”, which runs JavaScript codes on various unexpected sites.

Tor (originally Team Onion Router) is a free and open-source software which chiefly works on allowing anonymous communication to users.

Reportedly, the team has been working on a solution and would roll it out as soon as it is done, but there isn’t a particular time to expect it.

One of the most critical features for the security of the Tor Browser Bundle (TBB) happens to be the ability to block the code execution of the JavaScript, mention sources.

TBB is a browser that has a set of superior privacy features majorly for concealing real IP addresses to maintain the anonymity of online users and their devices’ locations.

Owing to these features, the browser has become a go-to for the working people, especially the journalists, citizens of repressive countries and people with political agendas because after all, it is a great instrument to dodge online censorship and firewalls.

People who are against the anonymity of the users and just can’t let things be, have in the past tried several times to expose Tor Browser users’ actual IP addresses via exploits that functioned on JavaScript code.

Sources cite that while few attempts of the better nature have been successfully employed to track down criminals, others were pretty strangely executed.

And then recently, a bug was discovered in the much appreciated TBB’s security mechanism. When the browser was set to allow the use of the most supreme security level and still permitted the execution of the JavaScript code when instead it should have barred it.

It is a relief that the team of Tor is well aware of the bug and is, with dedication working towards developing a patch for it. Per sources, they also mentioned that if a user requires to “Block JavaScript” they could always disable it entirely.

As per reports, the procedure for doing the above-mentioned is to open the “about config” and search for “javascript.enabled”. If here the “Value” column mentions “false” it means that the JavaScript is disabled and if it mentions “true” then right-click to select “Toggle” or double click on the row to disable it.

Read more »
Subscribe to: Comments (Atom)