Internet threat news
According to security researcher going by the pseudonym Frost, a bunch of websites is pushing a download which promises users the ability to earn up to 30 USD in Bitcoin daily. The program, called Bitcoin Collector, is nowhere near what it is advertised to be, rather it is a scam which will infect systems with ransomware and an information harvesting trojan. This is most certainly not what the user, now victim, had in mind when downloading the program they hoped would earn them a nice daily sum. Bitcoin is currently enjoying a surge in value with at the time of writing 1 BTC is 8,730 USD. This surge in recent value has been attributed to a variety of factors including accumulation of the cryptocurrency and unspent coin been at record highs. Regardless of the reasons, it will still mean that Bitcoin and other cryptocurrencies including Ethereum and Monero are still worth stealing and been exploited to lure unsuspecting victims.
Part of the scam incorporates a referral program which allows users to earn Ethereum for referring a set number of new users. The FAQ on one of the websites states that by referring 1,000 visits using your referral link you will earn 3 Ethereum. That is approximately worth 750 USD currently. This, however, is not the crux of the scam. Rather it is the download provided on the website which promises daily earnings of Bitcoins. These earnings are supposedly given free and are automatically paid out. If a potential victim clicks on the offer they are redirected to another website controlled by those behind Bitcoin Collector. Here the potential victim is offered a download which will download and install the money-making application. To further sell the legitimacy of the scam the scammers have even gone so far as to link a Virus Total detection page in an attempt to prove that it is not malicious.
Over the past couple of days, the security researcher who goes by the pseudonym SandboxEscaper has released several Microsoft Windows vulnerabilities to the public with no prior notice given to Microsoft. The researcher has developed a reputation amongst the InfoSec community for releasing vulnerabilities to the public, in particular, Windows vulnerabilities, without informing the software producer or giving prior notice as is seen as a good practice amongst researchers.
The first of the flaws published on May 22, can be classified as a local privilege escalation (LPE) zero-day. LPE can be seen as exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. It is important to note that when exploited such flaws cannot be used to break into a system. Rather hackers can use them at later stages in their attacks to elevate their access on compromised hosts from low-privileged to admin-level accounts. In this instance, the flaw resides in the Windows Task Scheduler process. In order to exploit it the attacker would need to run .job file which has been malformed to change the discretionary access control list (DACL), this is the system which limits who has access to a file, in the Task Scheduler. If correctly done the attacker can raise their privileges on the system from a low level to that of an admin. Once this is done the attacker would be granted access to the entire system.
According to IBM hacktivist attacks that resulted in quantifiable damage to the victim has declined by 95 percent since 2015. According to the data provided by IBM’s X-Force threat intelligence unit between 2015 and 2019 shows that the number of hacktivist attacks dropped from 35 in 2015 to 24 in 2016 and only 5 in 2017. In 2018, only two incidents were recorded and no attacks have been observed by IBM so far in 2019. The threat intelligence team noted that the data collected only includes attacks observed by reliable sources, only instances where someone took responsibility, and only if the attack resulted in quantifiable damage. In this instance, hacktivism can then be defined as the act of hacking a website or computer network in an effort to convey a social or political message.
2016 was a bumper year for the hacktivist group Anonymous that help bring the group to the public’s attention. From Operation Icarus, which was a series of Distributed Denial of Service attacks on banks to cyber attacks launched against the Thai police. This was followed in 2018 by a series of attacks on the Spanish government. Despite the associated press with the attacks it did not result in others been inspired to follow the path set by other hacktivists. IBM has contributed this decline to a variety of reasons. Central to the decline is the decrease in Anonymous activities over the years. IBM attributed this decline to the loss of key leaders within the organization and public relations failings. In 2016 during the US presidential election, a debate among Anonymous members spilled over into the public domain. While some members advocated for attacks against candidate websites, others strongly disagreed, arguing that the group does not support a particular political ideology and criticizing proposed attacks as “cringe-worthy.”
In January 2018, the InfoSec community was rocked by the news of the Meltdown and Spectre vulnerabilities affecting entire generations of Intel processors. As of May 14, 2019, academics announced that they had discovered a new side-channel attack affecting Intel processors. The attack utilizes a set of vulnerabilities that can allow attackers to retrieve data being processed inside a CPU. The flaw has been termed Zombieload and is fundamentally similar to the Meltdown, Spectre, and Foreshadow side-channel attacks that emerged.
As with the other three, the Zombieload flaw is exploited by abusing the speculative execution process. Speculative execution is an optimization technique where a computer system performs some task that may not be needed. Work is done before it is known whether it is actually needed, so as to prevent a delay that would have to be incurred by doing the work after it is known that it is needed. If it turns out the work was not needed, after all, most changes made by the work are reverted and the results are ignored. The academics who discovered the flaw published their findings in an academic paper titled, “ZombieLoad: Cross-Privilege-Boundary Data Sampling”, where prior to publishing the academics in question spent more than a year punching holes through the various components of the speculative execution process. What they discovered was an attack method which allowed for the leaking of data from the target CPU’s buffer zones and data processing operations.
According to researchers at Kaspersky Labs a Korean-speaking hacker group called ScarCruft, which is alleged to be a state-sponsored advanced persistent threat (APT) group, has increased its cyber-espionage ability by including a Bluetooth harvesting module within its current arsenal of cyber weapons. The group is known for targeting organizations and companies with links to the Korean peninsula and is known to use common techniques such as spear phishing and strategic web compromises to carry out campaigns. The latter technique, strategic web compromises sometimes also referred to as watering-hole attacks, where the attacker compromises a carefully selected website by inserting an exploit resulting in malware infection.
Kaspersky has been tracking ScarCruft activity since 2016 with what was termed Operation Daybreak where the group used a zero-day exploit to begin the process of infecting victims with malware. The malware traditionally is installed in a multi-stage process designed to bypass Windows UAC (User Account Control) in order to execute the next payload with higher privileges. The next step in the infection process occurs when the malware creates a downloader and a configuration file from its resource and executes it. The downloader malware uses the configuration file and connects to the command and control server to fetch the next payload. One of the key features of the malware is one of the methods it uses to avoid detection. The downloaded malware comes in the form of an image file with malicious code hidden within.
Those who have invested in Bitcoin have had much to smile about recently. The cryptocurrency rose to 6,000 USD on May 8, this was the first time it had broken this mark since November of last year. Nowhere near the 10,000 USD of yesteryear at the height of cryptocurrency popularity, this is still seen as some form of validation for those loyal to the original cryptocurrency. However, if you used the popular cryptocurrency exchange Binance, seen as one of the top five exchanges on the market currently, the price of bitcoin may be overshadowed by the news that hackers managed to steal 41 million USD from the exchange.
The hack occurred on May 7 and was responsibly disclosed to users of the platform via an official blog post. The company stated that the hack occurred as a result of hackers using a variety of techniques, which included phishing and the use of malware, to gain access to user accounts, which included API keys, 2FA codes, and potentially other information. It appears that the attack was incredibly well co-ordinated because at a set time the hackers initiated a mass withdrawal from these accounts, generating a massive 7,074 BTC transaction from Binance's main “hot wallet” to several smaller accounts. The massive withdrawal did trigger numerous alerts and warnings within the Japanese based exchange but sadly these warnings came too late in order to prevent them from happening.
Various Japanese news outlets reported that the Japanese Defense Ministry has adopted policies to enable the creation and maintenance of cyber-weapons in the form of malware. Japan is the latest country to announce that to formally recognize that it owns and develops cyber-weapons along with the US, UK, and Germany. According to the Japan Times the malware, which is to be created by a private company and the malware will be able to break into a computer system, hoping such a computer virus could work as a deterrent against cyber attacks. The malware is intended to be used as a defensive measure only according to government officials.
This announcement comes as part of the Japanese Defense Ministry plan to enhance its defensive capabilities beyond the ground, marine, and air domains but adopting both cyber and outer space as new areas requiring defensive expansion. Compared with other nations Japan is perceived to be lagging behind in its capability in addressing cyber threats. In order to readdress this, the ministry is looking to increase the number of personnel in its cyberspace unit to 220 from 150. This number is still considered small when one compares it to other countries with 6,200 personnel in the United States, 7,000 personnel in North Korea and 130,000 personnel in China according to data collected by the ministry.
Attackers have been actively exploiting a zero-day vulnerability in the widely used Oracle WebLogic Server to deliver not one but two ransomware variants. Zero-day vulnerabilities can be defined as a software security flaw that doesn’t yet have a patch. These vulnerabilities can result in security holes waiting to be exploited by cybercriminals. What is truly novel, and somewhat frightening, about the attack is the ransomware can be downloaded and executed without the end user clicking on anything, the attacker simply exploits the vulnerability. Traditionally, ransomware infections require the end user to initiate the downloading of the malware. This can be done by clicking a link or downloading an attachment, as examples. The above attack does not need this once an integral step to infection.
The vulnerability exploited in the attack was discovered two weeks ago along with a proof of concept exploit code. The vulnerability, CVE-2019-2725, was made public by the Chinese National Vulnerability Database and according to researchers from the security educational group SANS ISC warned that the vulnerability was under active attack. The vulnerability is regarded by experts as easy to exploit and allows the attacker the ability to execute code of their choice on cloud servers. The disclosure caused Oracle to release an emergency patch and it is strongly advised that administrators download the patch if they have not already.
Researchers at Malwarebytes have been closely following a sustained campaign against both users of the popular Electrum Bitcoin wallet and the company itself. What initially started out as a phishing campaign which was designed to trick users into downloading a malicious version of the wallet by exploiting a weakness in the Electrum software. This malicious wallet would then steal funds from the victim, by February of 2019 the attackers had stolen approximately 4 million USD, and in April this number has increased to 4.6 million USD. In February, the wallet's developers responded by exploiting the same flaw in order to redirect users to download the latest patched version.
For most incidents that would be the end, however, in March it became apparent that the software was in far more trouble than originally believed. The developers of the wallet actually had to attack their own users using an unknown vulnerability so that they couldn’t accidentally connect to a bad node exploited by the attackers. Now the attackers have responded by infecting machines with a botnet in order to carry out Distributed Denial of Service (DDoS) attacks against the wallet’s infrastructure. According to the researchers on April 24, the number of infected machines in the botnet was just below 100,000 and the next day it reached its highest at 152,000. The number of infected hosts keeps fluctuating but has seemed to plateau at over 100,000.
Researchers have seen a new campaign dropping the Qbot banking trojan via a phishing email campaign. The campaign was discovered by the JASK Special Operations Team. The trojan is dropped via camouflaging the spam email as parts of previous conversations in order to help avoid detection. The Qbot trojan is by no means new, first appearing in 2009, despite its age it has gone through numerous updates and evolutions in order to steal financial data and banking credentials from their targets. Numerous updates have also enabled the trojan to drop additional malware, to log user keystrokes, and create a backdoor to compromised machines. According to the JASK Special Operations Team,
“The delivery mechanism for this Qbot infection was a phishing campaign where the targeted user received an email containing a link to an online document. Interestingly enough, the delivery email was actually a reply to a pre-existing email thread.”
The team of researchers published their findings in an article which further showed that the link used by the hackers contained a VBScript-based dropper script packed as a ZIP archive and designed to drop the Qbot malware payload after being launched by the victim. The trojan is then downloaded by abusing the legitimate Windows BITSAdmin utility (bitsadmin.exe). The file that is used to hide the trojan is titled “August.png” and has up until the time of writing been detected 55 times on VirusTotal.
While Christians over the globe were celebrating the Easter weekend, news of three separate data breaches surfaced. On Saturday, 20 April 2019, a popular health and fitness platform Bodybuliding.com alerted its customers of a security breach detected during February 2019 which was the direct result of a phishing email received back in July 2018. Bodybuilding.com is the world's largest fitness website, with a community of over 1,000,000 BodySpace members and more than 17,000,000 forum members, as well as over 32,000,000 orders shipped all over the world since its online shop was opened for business. Along with the announcement two separate health care companies also suffered data breaches. With regards to the health care companies, one company illustrated how an organization should deal with a breach and another the wrong way.
Returning to the Bodybuilding.com data breach, the company announced that the breach may have affected certain customer information and after investigating the incident with the help of “external forensic consultants that specialize in cyber-attacks,” Bodybuilding.com says that it “could not rule out that personal information may have been accessed.” The company further confirmed that no full debit or credit card numbers could be accessed and stolen as the company only stored the last four digits and only for customers who opted to have their cards stored with their account information. Further, no social security numbers were compromised. As a precaution the company has reset all user passwords, meaning that users would have reset their passwords when logging onto the platform again.
Combatting malware infections is often a hard and thankless task made increasingly difficult by hackers. This task is made harder when attackers change tactics. When the costs associated with infections, such as data recovery, increase more stress is placed on organizations and those that defend the organizations. The latest report by Coveware shows that ransom amounts demanded in ransomware incidents has risen approximately 90%. Not only will departments responsible for cybersecurity curse the news but financial managers as well.
Coveware's Ransomware Marketplace Report involved analysis of recent ransomware cases the security firm has investigated. Figures from the investigation showed that the average ransom organizations paid per incident during the first quarter of this year stands at 12,762 USD, compared to 6,733 USD in the final quarter of 2018. This shows that the ransom cost associated with ransomware infections has almost doubled. According to Coveware, this increase can be accredited to the emergence of more expensive and more hands-on forms of ransomware like Ryuk, Bitpaymer and Dharma. These new hands-on, termed hands-on as the attackers actively target victims, ransomware variants no longer use the spray and pray technique of sending out massed spam emails but are far more targeted in approach. This approach has placed companies and organizations in their crosshairs in order to try to extort a much larger ransom.
In December 2019 this publication covered the emergence of sextortion scammers using ransomware in a bid to increase illicit earnings. It would appear that yet again such scammers are feeling the pinch and changes tactics once more in order to make money. The scammers behind the “Aaron Smith” scam, named after the email address used to send out the scam emails, made nearly 150,000 USD in Bitcoin in the period between August 30 and October 15. These profits have taken a remarkable knock, with the operators making only 17,000 USD in the first quarter of 2019.
In an effort to prevent this downward slide from continuing the scammers have changed tactics in order to prevent spam filters from stopping their emails of reaching their potential victims. According to researchers at Cisco Talos in a recently published article, revealed how the scammers adopted a relatively simple technique in an attempt to bypass spam filters. In the email example provided in the article, one would not be able to see that the message hides something behind the normal text. On deeper analysis, the message reveals a more complex underlying code that mixes plain text letters with HTML character entities. The recipient sees only the rendering of the email client. It is when the email is viewed in such a way the technique employed by the scammers is revealed.
From recently published research by FireEye indicates that the hackers behind the Triton malware are active once more. The group rose to the public’s attention in 2017 when the malware was used to target a petrochemical plant in Saudi Arabia. In this instance, according to research conducted by Symantec, it is believed that the attack was meant to cause physical damage at the industrial site. The attack was close to causing severe damage at the facility, but Triton's activities inadvertently closed down the plant due to its manipulation of SIS systems which caused them to enter a failed safe state.
Triton, sometimes of referred to as Trisis was specifically engineered to target a specific type of industrial control system (ICS), namely Triconex safety instrumented systems (SIS) controllers developed by Schneider Electric. The malware is named after the specific safety instrumented system it targets. Triton is unusual in the sense that it hones on processes with the aim to shut them down, resulting in the tampering with safety systems which could result in damage been caused to industrial systems resulting damage to machinery. Malware designed for such a purpose is relatively rare and forms only a handful of the threats faced on the current landscape. Previously seen examples include Stuxnet and Industroyer with the latter being a highly customizable piece of malware which can be equipped to better suit the attacker’s needs. Stuxnet was seen targeting nuclear power stations while Industroyer was seen targeting more conventional power stations.
Page 2 of 27<< Start < Prev 1 2 3 4 5 6 7 8 9 10 Next > End >>