Internet threat news

A team of three researchers has dusted off an old crypto vulnerability that can still affect major firms relying on RSA encryption key exchanges. Once the vulnerability is exploited it could enable an attacker to obtain the private encryption key necessary to decrypt sensitive HTTPS traffic under certain conditions. The three researchers, Tripwire’s Craig Young, researcher and journalist Hanno Böck, and Juraj Somorovsky of Ruhr-Universität Bochum have informed vendors affected by the vulnerability. They will make the Proof of Concept code available in time once all affected vendors have patched the vulnerability now called ROBOT. ROBOT, which stands for Return Of Bleichenbacher's Oracle Threat, is the latest in a fairly long line of similar vulnerabilities worked on by researchers. Daniel Bleichenbacher discovered the original threat back in 1998. Since then researchers have published new variations of the original Bleichenbacher attack in 2003, 2012, 2014, and 2015. This includes 2016’s DROWN, Decrypting RSA with Obsolete and Weakened eNcryption, which until ROBOT was announced was the latest threat to use a variation of Bleichenbacher’s method. DROWN could enable an attacker to crack encrypted communications and steal potentially sensitive data. At the time in potentially affected a third of all HTTPS sites.

Much of the news in the financial sectors related to Bitcoin’s surge in value. With one Bitcoin trading at $11,000 a week ago, now soaring to $17,500 a week later. At the time of writing the cryptocurrency was sitting at approximately $16,500. Such a surge in price caused many economists to declare the cryptocurrency a danger to the market and obviously experiencing a bubble that will pop anytime soon. While the economists are expecting the bubble to pop, hackers are doing their utmost to steal the valuable commodity. With the surge in price came a surge in phishing attacks. The attacks were intended to phish login details to steal funds from accounts and wallets.

In hindsight, it only seems natural that when the price of Bitcoin climbs as it does, hackers would want a piece of the pie. The past week saw a surge in phishing attempts looking to steal credentials and gain access to investor’s funds. CheckPhish, a website that keeps track of recent phishing pages against high-profile brands, detected five phishing domains which targeted users of the popular Blockchain wallet service. Added to this several other researchers discovered numerous other attempts.

Blockchain was by no means the only recognized brand targeted. Hackers also targeted LocalBitcoin, a popular exchange. In another case, researchers at Fortinet also identified another campaign that targeted users with cryptocurrency-related lures in the hopes they'd download and run files on their PCs.

Through extensive research done by Citizen Lab show Ethiopian spies using spyware acquired from Israeli company Cyberbit. The discovery resulted from the Ethiopian spies failing to configure the Command and Control (C&C) server. This left the information agency’s targets exposed online for all to see. The surveillance operation appears to have started last year.

The program utilized a poorly executed spear fishing campaign where potential targets were lured to download to download a fake Adobe Flash Player update or an app named Adobe PdfWriter to view videos or PDF files. These files were laced with the spyware sold by Cyberbit. The affair has yet again raised questions as to the morality of such companies. This is further highlighted by the fact that Ethiopia is one of the poorest countries in the world. Ethiopia is a country where less than 5 percent of the population has access to the internet and is a country run by an autocratic government routinely flagged for human rights abuses and corruption.

Intel has come under fire recently for numerous security vulnerabilities found in its ME firmware. Hardware vendors are no reacting to Intel's core CPU technology been riddled with security holes by actively disabling it before it is sent to customers. Currently, three major hardware vendors are offering products without Intel’s Management Engine (ME). The vendors are either disabling ME before reaching shelves or alternatively are providing firmware updates that disable the technology.

The Intel Management technology is often criticised as being a secret operating system inside the main Intel CPU. The component operates independently from the user's main OS, with separate processes, threads, memory manager, hardware bus driver, file system, and many other components. It is feared that if an attacker were to exploit any flaw within the ME technology they could gain access to firstly ME, then gain untethered control over the entire computer.

Apple has recently patched a serious root access flaw found macOS High Sierra. The flaw allows for the authentication to bypass making the system exceptional vulnerable to exploitation. The flaw would enable a potential attacker to gain root access to the vulnerable system. Apple has described the vulnerability as a logic flaw, and in a recently released statement confirmed that “An attacker may be able to bypass administrator authentication without supplying the administrator’s password,”

The flaw appears to be first mentioned on an Apple Developer forum on November 13 by a user who had been trying to help others solve a macOS issue related to all their admin accounts being turned into regular accounts after updating to High Sierra. Apple only became aware of the problem on Tuesday of this week when a Turkish developer sent a tweet to Apple Support and the media started covering the issue. Apple did respond in record time. Within 24 hours a patch was released for the vulnerability labeled CVE-2017-13872. It is hoped that the speedy response by Apple has mitigated any future damage that could come from the flaw being exploited. macOS users are advised to ensure that security update for High Sierra 10.13.1 has been downloaded and installed on their systems.

Hacking group Cobalt, who has developed a reputation for attacking banks, have been quick to exploit a Windows vulnerability that recently surfaced. Microsoft has patched the vulnerability found in Microsoft Office and it is strongly advised that all patches are downloaded as soon as possible. The vulnerability was discovered by the Embedi research team which affects the Microsoft Equation Editor (EQNEDT32.EXE), one of the executables that are installed on users' computers with the Office suite. This tool was designed to allow users to embed mathematical equations inside Office documents as dynamic OLE objects.

One of the major threats posed by the vulnerability, CVE-2017-11882, is that it can be exploited to run malicious code without user interaction and affects all Windows versions over the past 17 years. Having such a backdoor in your hacking arsenal is something hackers and criminal organizations dream of. Cobalt, believed to be behind an attack that targeted Russian speaking business earlier this year, has jumped on the opportunity to exploit the vulnerability detailed above.

Uber, the popular ride-hailing company, has an impressive history of making the news for almost all the wrong reasons. This has happened to the extent that investors forced co-founder and ex-CEO Travis Kalanick to step down paving the way for the new CEO Dara Khosrowshahi to pick up the pieces from past indiscretions. In this most recent case of terrible news for the company, hackers stole names, email addresses and phone numbers of 50 million Uber riders around the world and the personal information of about 7 million drivers were accessed as well, including some 600,000 U.S. driver’s license numbers. The company has stated that no Social Security numbers, credit card information, trip location details or other data were taken.

Terdot was first seen in the wild in October 2016, while discovered over a year ago it has managed to fly under the radar. While initially developed to be solely a banking Trojan, Terdot has since grown into a sophisticated hacking tool that can also work as a backdoor and infostealer. One of the interesting features of Terdot is its use legitimate services in order to read HTTPS traffic. For a full technical analysis of Terdot, Bitdefender released a 32-page document detailing the Trojan in depth.

This year will be remembered for many things within the InfoSec community. Ransomware’s popularity, worms becoming popular again and crypto jackers benefitting from cryptocurrencies ever-increasing value, another trend is the use of legitimate services to further the malware authors aims and circumvent newer security measures. Terdot most definitely falls into the last category detailed above.

In September this year, researchers at Armis, a company specializing in the Internet of Things security, announced that they had developed a proof of concept code that would allow potential hackers to hack Bluetooth devices. BlueBorne is the name given to a collection of eight vulnerabilities which could allow a hacker to take over devices that have Bluetooth enabled and run malicious code on the underlying OS or firmware.

In September when the news initially broke it came in the wake of Android, iOS, Microsoft, and Linux patching the flaws. This latest announcement made by Armis that could leave over  20 million Amazon Echo and Google Home devices running on Android and Linux are vulnerable to attacks via the BlueBorne vulnerability. Fortunately, both Amazon and Google have issued patches for the affected products, hence today's disclosure from Armis.

A team consisting of government, industry, and academic officials successfully demonstrated that a commercial aircraft could be remotely hacked in a non-laboratory setting. The hack occurred in September 2016 and was recently announced at the 2017 CyberSat Summit in Tyson’s Corner, Virginia. Robert Hickey, aviation program manager within the Cyber Security Division of the DHS (Department of Homeland Security) Science and Technology (S&T) Directorate. Robert Hickey, aviation program manager within the Cyber Security Division of the DHS Science and Technology (S&T) Directorate said that “We got the airplane on Sept. 19, 2016. Two days later, I was successful in accomplishing a remote, non-cooperative, penetration,”

Obviously, due to the sensitive nature of the information details of the hack are classified. What has been detailed to the public is that the hack was accomplished by having no one actually touch the plane and there was no need to have an insider threat providing information or otherwise. In order to gain access to the aircraft, they accessed the aircraft’s systems through radio frequency communications that many aircraft use as a matter of course.

Since the emergence of Coinhive was reported the popularity of cryptojacking has increased exponentially. Coinhive allows website owners to integrate a Javascript miner on their website to generate extra revenue. The mining is done by the website user when on the website. Many websites have adopted Coinhive for exactly this purpose. People ethically employing Coinhive notify users that their computer resources are been used to mine cryptocurrency, in this instance Monero, while on the website.

While a novel idea and can be employed ethically it is open to abuse. Security researchers at Malwarebytes have released a report detailing the abuses been experienced by users globally. Malwarebytes has been one of the first major antivirus companies that have added support for blocking such scripts.

Popular websites have always been a target for hackers trying to spread malware. The popular website Crunchyroll.com, which allows users to stream their favorite anime shows, experienced an attack over the weekend which forced the company to close its website over the weekend. While there is still speculation as to the nature of the attack, the attack still serves as a reminder to any company with a website that it is a target.

On November 4, it appeared that visitors to the popular website were asked to download a desktop version of their software. This software was not as it seemed as it also included malware that was installed along with it. Crunchyroll staff based in Germany were quick to notice that something was not right and immediately took to Twitter to warn users not to access the website. The website was then taken offline to prevent further infections.

This desktop application was not one offered by the site themselves, but one being offered by the hackers in order to distribute malware. It is still not known what malware the file, called “CrunchyViewer.exe”, was looking to distribute. Later the same day Ellation, Crunchyroll’s parent company, released a statement detailing what occurred and giving instructions on how to remove the malicious content if it was downloaded.

Hackers targeting all facets of the cryptocurrency boom is by no means a new phenomenon. On Nov 1, news broke of two separate incidents targeting cryptocurrency wallets in two different ways. Reasons for cryptocurrencies becoming one of the favored targets for hackers can be directly attributed their increasing popularity and soaring stock values. While the blockchain revolution is changing how we operate, hackers are still deploying the same methods as always to steal legitimate users cryptocurrency.

A security researcher at Romanian firm Bitdefender, Bogdan Botezatu, detected the first attacks on Monday this week when their SSH (Secure Shell) honeypots detected a bot attempting to change the system configuration to hijack funds from Ethereum mining operations. The bot was targeting an operating system optimized for Ethereum mining, called EthOS. This is a commercial operating system that can mine Ethereum, Zcash, Monero and other crypto-currencies that rely on GPU power. According to the OS’s creators, their offering is currently running on more than 38,000 mining rigs across the world. As with other specialized operating systems, it comes pre-loaded with the necessary tools and a default username and password. After deployment, the user only needs to add a wallet for mining fees and, of course, most importantly, change the default username and password.

Google’s reCAPTCHA has become one of the staple security innovations protecting users from spam and abuse in recent years. Advertised as a free service offered by tech giants Google, reCAPTCHA uses an advanced risk analysis engine and adaptive CAPTCHAs to keep automated software from engaging in abusive activities on your site. This is intended to allow only legitimate users access to your website.

In research published by the Computer Science Department at the University of Maryland (UM), a team of four created a system which effectively breaks reCAPTCHA with an accuracy of 85%. Anything which can break reCAPTCHA to an accuracy of over 1% is considered broken.

The automated system, termed unCAPTCHA by the team from UM, works by not targeting the image-based challenge but rather the audio version that Google added so people with disabilities can solve its puzzle. In summary, this is done by downloading the audio puzzle and feeding it to six text-to-speech (TTS) systems, aggregating the results, and feeding most probable answer back to Google's servers.

In tests carried out by the team, it was shown that unCAPTCHA can break 450 reCAPTCHA challenges with an 85.15% accuracy in 5.42 seconds, which is less time taken for a human to listen to one reCAPTCHA audio challenge. In order to do this, the code uses TTS systems such as Bing Speech Recognition, IBM, Google Cloud, Google Speech Recognition, Sphinx. The code has been made available on GitHub.