Internet threat news
With the recent spate of data breaches and leaks of arguably HBO’s most popular television program, Game of Thrones, one can assume many of the company’s executives wish they could return to an era with no internet. Hacking of the entertainment industry appears to be on the rise and placing the relevant companies in the headlines for all the wrong reasons. If one was looking for a silver lining, the shared excitement the leaks caused on platforms like Reddit does show how popular Game of Thrones still is.
The most recent dump which seems to have occurred early this week would be the third similar data dump in about two weeks. From initial reports, it appeared that the hackers in the most recent attack tried to extort an undisclosed sum from HBO, which the hackers themselves redacted in statements issued to the press.
Marcus Hutchins, a security researcher who also goes by the name MalwareTech, made headlines in May as the person who discovered, almost accidentally, the inbuilt killswitch in the WannaCry ransomware which caught the world unawares. Fast forward to August and the same person hailed as a hero who prevented a further 10 million systems been infected by WannaCry was arrested in Las Vegas during the DefCon one of the largest hacking conferences in the world. At his bail hearing on Friday, he initially pleaded not guilty and was granted bail of 30,000 USD. Hutchins still had to spend the weekend in Jail as his lawyers could not pay the bail in time. Hutchins has to wear a GPS locating tag and is not to communicate his co-accused who is as of yet unnamed. Hutchins has been accused of creating and maintaining the Kronos banking Trojan and can face up to 20 years in jail if convicted.
With WannaCry and Petya attacks slowing down it was only a matter of time till the lessons learned from these attacks would be used by other cyber criminals. The creators of TrickBot have most certainly learnt how to increase the propagation exponentially of the malware using the lessons learnt from this year’s most devastating cyber-attacks.
The new version (1000029 or v24) of the credential stealing malware has been found to be using the same SMB exploit famously used by WannaCry and Petya. TrickBot has been stealing credentials from banking institutions towards the end of last year. It has attacked financial institutions across the globe. The favoured attack vector for TrickBot is through email attachments impersonating invoices from a large financial institution.
With the arrest of Alexander Vinnick, a 38-year-old Russian who was believed to be one the creators and operators of BTC-e on money laundering charges. The total believed to be laundered through the platform totals over 4 Billion USD. The laundered funds are believed to be in conjunction with cyber-attacks, tax fraud, and drug trafficking. The man was arrested by Greek police at the request of US law enforcement agencies.
The arrest will hopefully further shine a light on how cyber-criminals, once they have either stolen or extorted cryptocurrencies are able to launder that money in order to be used legitimately.
How the criminals are able to cash out
Whether it is from ransomware campaigns or direct theft from legitimates user's cryptocurrency wallets, it is very difficult to survive solely on the cryptocurrencies. What is then needed is someone willing to launder the money in a similar vein to how it is done in other illicit trades and black market operations.
Google’s Android security team have discovered and new and immensely powerful spyware termed Lippizan. Google claims the spyware was created by Equus Group, an Israeli based company who by their own account specializes in the development of “…of tailor made innovative solutions for law enforcement, intelligence agencies, and national security organizations.” Lippizan appears to be a targeted malware infecting a small selection of apps upon Google Play. Google states that their experts noticed the malware and intervened and removed the infected apps. The new security feature, Google Play Protect, was used to remove the infected apps. According to Google, this new feature allows for users to use the app store with peace of mind by applying even stricter controls on the uploading of apps.
On Friday, 21 July 2017, a 29-year-old man pleaded guilty to hijacking over 900,000 routers from Deutsche Telekom’s network towards the end of 2016. The attack which leveraged a customized version of the Mirai malware according to the hacker accidentally denied many Germans and German companies without access to the internet impacting on their ability to conduct business. The hacker has not been named by authorities but has gone by the nickname “Spiderman”, “BestBuy”, and “Popopret”. The hacker may be sentenced to 10 years in prison, with sentencing scheduled for 28 July 2017.
Admissions in Court
While during court proceeding the 29-year-old accused admitted that it was never his intention to cause the routers to stop functioning completely. Rather it was his intention to use the hijacked routers as pawns in a DDoS attack. Accidently his version of Mirai shut down routers rather than assisting in executing the DDoS attack he had planned. A week later he did exactly the same thing, this time in the UK by accidentally shutting down 100,000 routers again denying users the ability to use the internet disrupting businesses. He has not been charged for the shutting down of the UK routers as of yet. The man was arrested in February of this year by UK police at a London airport and extradited to Germany to faces the charges brought forward by German police stationed in Cologne who also issued the international arrest warrant.
Just weeks after American law enforcement agencies, the Department of Homeland Security and the Federal Bureau of Investigation, in a joint non-public report warning of a critical infrastructure hack, the Government Communications Headquarters (GCHQ), one of Britain's secretive spying agency has reported the possibility of a similar attack within its borders. A copy of the document issued by the National Cyber Security Centre (NCSC), a branch within in GCHQ, obtained by Motherboard and later confirmed by the BBC states that industrial software companies have likely been compromised.
While the NCSC report does not mention specific instances where systems were compromised, unlike the US joint report which listed a company managed a nuclear power station in Kansas had been breached, it does appear that activity indicative of a campaign is discernible. It does not appear as if UK companies are the specific target, rather part of a global campaign targeting critical infrastructure systems and companies in the West. Both law enforcement agencies in Turkey and Ireland have reported similar suspicious activity.
As of yesterday researchers at Trend Micro have reported someone trying to leverage the SambaCry vulnerability to install a backdoor Trojan on Linux machines running unpatched versions of Samba, a file sharing program. Researchers at Trend Micro confirmed that most of the attacks targeted network-attached storage (NAS) appliances, many of which ship with the Samba server which allows file sharing across different operating systems.
The vulnerability exploited by SambaCry (CVE-2017-7494) is not new and affects several versions of Samba. The vulnerability was patched by Samba when it became apparent that the vulnerability was being exploited by the cryptocurrency miner EternalMiner over a month ago. Despite the vulnerability being patched, it is apparent that not all users have updated their versions of Samba currently installed on their devices.
The global cyber security company, Kaspersky, has landed itself in the headlines once more as the General Service Administration of the US has removed Kaspersky and its products from a list of approved vendors. The General Service Administration is responsible for federal government purchasing contracts. This will undoubtedly make it more difficult to buy Kaspersky products within the borders of the US. The GSA stated that “GSA's priorities are to ensure the integrity and security of US government systems and networks and evaluate products and services available on our contracts using supply chain risk management processes,” in response to the removal from the aforementioned list.
Kaspersky’s removal from the GSA’s list of approved vendors due to what US law officials see as close ties to the Russian Intelligence Agency, the FSB. US Officials see this relationship as more than cordial and believe the alleged relationship between the FSB and Kaspersky could place American networks in danger, and the potential to increase Russia’s cyber espionage ability. In a congressional hearing in May, it expressed concern over the links between the Russian tech giant and the Russian Government. However, the hearing stopped short of providing any concrete evidence proving such links.
When news broke on 6 July 2017, that companies who manage nuclear energy power stations within the US were hacked alarms were triggered. Rightly so, fears of what happened in Ukraine previously when its energy sector was essentially shut down by hackers must of being on many minds. On some other minds was probably the thought that this was the end and perhaps they should have been prepping for a doomsday scenario. While hacking of energy suppliers and companies associated with the maintenance and managing of power stations is a cause of concern, cybersecurity researchers at Cisco’s Talos Intelligence Division, worked hard to try to quell some of the fears many might have had.
The recent variant of Petya, also called GoldenEye or NotPetya, is believed by security researchers globally to be malware type known as a wiper rather than the ransomware originally reported on. For the purposes of this article, the malware will be referred to solely as NotPetya for the remainder of the article in order to keep confusion down to a minimum. While it initially did appear as ransomware by demanding a ransom to decrypt data that had been encrypted as well as leveraging EternalBlue and EternalRomance as if earlier ransomware attack campaigns. Added to this victims were instructed to pay the ransom in the now traditional method of Bitcoin. Once analyzed by numerous researchers in numerous leading security companies, the truth does appear stranger than fiction.
German email service provider, Posteo, has attempted to combat the new version of Petya by blocking the email accounts used by the hackers utilizing their service in order to extort Bitcoin from victims. By blocking the email accounts of the hackers, they cannot access their mail or send mail. Thus, this would leave victims who to paid the ransom unable to receive the encryption code. This has left many to criticize the move by the company to block emails and thus render victims without the option to pay for their files to be decrypted. In an email sent to journalists at Motherboard, Posteo defended their position and believe that preventing misuse of their platform to be vital for the company and legitimate users of their platform. Posteo went further to say that there was no guarantee that if the ransom is paid the victim's files would be decrypted.
Researchers and analysts at Trend Labs have discovered a new fileless ransomware which they have termed Sorebrect. Although fileless ransomware is by no means new, this latest variant displays some cunning features intended for it to evade detection and frustrate forensic audits. The variant was first discovered infecting systems in Lebanon and Kuwait, however, it has recently been seen infecting systems as far afield as Canada, China, Croatia, Italy, Japan, Mexico, Russia, Taiwan, and the U.S. Sorebrect seems to be specifically targeting companies within the manufacturing, technology, and telecommunications industries. Experts further believe that this new variant will in all likelihood appear in more countries or even peddled as a Ransomware as a Service (RaaS) on the Dark Web to serve criminal organizations in extorting money from victims.
US Authorities Warn of North Korean DDoS Botnet
The Department of Homeland Security and the Federal Bureau of Investigation via United States Computer Emergency Readiness Team (US-CERT) issued a bulletin warning of a new distributed denial-of-service (DDoS) botnet targeting US businesses. It is believed the threat actors are the hacking group “Hidden Cobra”, who are also known as the Lazarus Group. This group is suspected of having strong ties to the North Korean government. Both the FBI and the Department of Homeland Security stated that it appears that businesses within the media, aerospace, financial, and critical infrastructure sectors within the US as well as other international businesses and state organizations.
Page 16 of 27<< Start < Prev 11 12 13 14 15 16 17 18 19 20 Next > End >>