Internet threat news

Depending on what circles you associate yourself with the name Astaroth has different meanings. From a character in the popular game Soulcalibur to a Great Duke of Hell according to Christian demonology. The InfoSec has its own identity placed on the name, that being an info-stealing Trojan. In a new campaign, the Microsoft Security Team warns, Asteroth is being distributed in a new campaign using “living off the land” techniques to avoid detection by anti-virus software packages. “Living off the land” tactics involve the attacker exploiting legitimate operating system tools to execute pieces of code, which are not written to disk but reside in memory, which means that the tactic also employs fileless malware execution, meaning a user does not need to actively download the malware in the form by clicking on a malicious link or attachment. Another factor which makes “living off the land” tactics a considerable threat to face is that the system tools exploited are often tools admins use for monitoring systems so they are whitelisted meaning that detection is further hampered as now researchers have to look at tools originally deemed safe.

With the malware developers behind GandCrab supposedly retiring something had to fill the void left in the market created by their departure. It would seem a contender has stepped up to the plate and that contenders name is Sodinokibi, also referred to as Sodin or REvil. This new ransomware has been on researchers’ radars since the beginning of 2019 but a comprehensive analysis of the ransomware has proven difficult given that the operators continually change tactics which only leave morsels of information with which to go on.

Researcher’s at Kaspersky Labs have discovered a new campaign seen distributing Sodinokibi, called Sodin by the security firm, which exploits a Windows zero-day vulnerability rather than the tried and tested distribution methods such as spam email campaigns prompting users to download the malicious program. In an article published by Orkhan Mamedov, Artur Pakulov, and Fedor Sinitsyn it was noticed that the malware has been distributed via CVE-2018-8453 Windows zero-day in a campaign which is geographically focused in Asia, targeting Hong Kong, South Korea, and Taiwan. The vulnerability when exploited allows for the escalation of privileges when the Win32k component fails to properly handle objects in memory. The flaw has already received a patch which was released in October 2018. Previously the vulnerability was seen exploited by a state-sponsored hacking group called FruityArmor. In that instance, it was used to distribute a payload designed to remain undetected and persistent on a target’s machine which further allowed the attacker persistent access to the machine.

According to a blog article published by security researcher’s based at Cisco Talos, a new malware loader has been seen in the wild specifically designed to hide in plain sight and allow the payload to evade detection by anti-malware solutions by injecting into the memory of compromised computers before the payload is dropped. This discovery represents the danger posed by hackers who create custom loaders to deliver a wide range of malware strains to suit their purposes. The loader is known to exploit the infamous “Heaven’s Gate” technique to avoid detection.

The Heaven’s Gate technique was first seen in 2009 allows 32-bit malware running on 64-bit systems to hide API calls by switching to a 64-bit environment. This effectively helps the loader evade detection as many anti-virus products struggle to detect such techniques. To further evade detection the loader further hides the payload within the packed and obfuscated loader which will unpack it and inject it a legitimate RegAsm.exe process using the process-hollowing technique. Process-hollowing involves the creating of a process on a machine which runs in a suspended state, which means it is not mapped on the machine’s memory further making it difficult for anti-virus packages to detect something is wrong. The technique is similar to process injection, in that execution of the malicious code is masked under a legitimate process to evade detection. In this instance the RegAsm.exe will be created by the malware loader in a suspended state and, subsequently, its memory will be unmapped and replaced with the malicious payload. This means that the payload is never written to the compromised machine's disk making it that much harder for the computer's defences to react to the intrusion.

Researchers at Malwarebytes have discovered a new and large malvertising campaign which targets users of the popular YouTube to MP3 conversion website Onlinevideoconverter. According to SimilarWeb the conversion website is visited by over 200 million users a month, making it clear why it has been targeted by hackers distributing malware via a malvertising campaign. Such campaigns had fallen out of favor in recent months according to researchers at Malwarebytes with detections of such campaigns steadily decreasing. The latest campaign is a clear indication that the tactic is still a viable one for hackers to use.

Malvertising involves the malicious use of advertising to spread malware. One of the main methods in distributing malware this way is by hiding and then subsequently executing malicious code within relatively safe online advertisements. These ads can lead a victim to unreliable content or directly infect a victim's computer with malware, which may damage a system, access sensitive information or even control the computer through remote access. Malvertising is often used in conjunction with what has been termed by researchers as drive-by downloads and can be defined as the unintentional downloading of malware without the need for the user to click on a download link. The malware can be downloaded merely by clicking on an ad which is deemed safe by the user.

EA, undoubtedly one of the world’s major players in the games industry in terms of both releases and sales, is not immune to security issues, like with any company reliant on the Internet. The company has a reputation for generating bad press, whether from business practices or unfulfilled promises relating to games. However, when a company in conjunction with security firms finds and fixes a security flaw that would potentially affect millions of customers negatively a certain amount of positive acknowledgment should be given. In this instance, the flaws which were discovered by security firms Check Point and CyberInt consisted of a chain of vulnerabilities which if exploited, could result in the attacker taking over millions of user accounts.

In both a blog post and a press release, researchers detail exactly the flaw and the possible ramifications if exploited. The chain of vulnerabilities discovered by the researchers exploits EA Games' use of authentication tokens in conjunction with the oAuth Single Sign-On (SSO) and trust authentication mechanism that is built into the login process. When exploited a threat actor would be able to hijack a player’s session resulting in compromise and at worst complete account takeover. Further, if exploited correctly a complete account takeover would give the threat actor access to a wealth of information including credit card details. These details could then be used to fraudulently by in-game currency on behalf of the compromised user which could be used by the threat actor. Most worryingly, if the flaw was exploited in the wild before it was patched would require no information been handed over to the threat actor by the user.

We have followed the exploits of the GandCrab operators with keen interest on this platform. We covered how Bitdefender and Europol worked together to develop and release a decryptor for GandCrab versions 1 (GDCB extension), 4 (KRAB extension), and 5 (random 10-character extension), however, none existed for version 5.2. We also covered how the operators of GandCrab were offering their ransomware as a service which resulted in the ransomware seen to be distributed via a sextortion scam. Well, we have seen a mix of good news and bad news in combatting the ransomware, today's latest news is will definitely be considered good by the general public. On June 17, Bogdan Botezatu, a security researcher with Bitdefender announced via Twitter that a decryptor for v5.2 had been released as a free tool to the public and could be used by any victim suffering from such an infection.

The healthcare sector has come under increasing fire over recent years. This fire was caused by numerous cybersecurity incidents, from breaches to malware infections affecting critical service delivery. Now the US Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) has issued an alert warning that files using the Digital Imaging and Communications in Medicine (DICOM) standard can be abused to hide malware. The DICOM standard is used in virtually all hospitals around the world, including by imaging equipment (CT, MR, ultrasound), imaging information systems (HIS, RIS, PACS), and peripheral equipment (workstations and 3D printers). The vulnerability in DICOM type files was discovered by Cylera’s Markel Picado Ortiz, who has described the flaw as a “fundamental design flaw.”

According to the NCCIC successful exploitation of this design flaw, which has been publically announced and has been given a CVE designation of CVE-2019-11687, could allow an attacker to embed executable code into image files used by medical imaging devices. Further, malicious code embedded within such image files which results in a Windows executable will not interfere with the readability and functionality of the DICOM imagery. This could potentially make the detection of malware harder and promote malware persistence on infected devices.

On Thursday, June 6, 2019, for approximately two hours a large amount of European Internet traffic was rerouted through the infrastructure of China Telecom, China's third-largest telco and internet service provider (ISP). According to experts, the traffic was rerouted following a BGP route leak at Swiss data center colocation company Safe Host. It has been estimated that over 70,000 routes from its internal routing table had been leaked and subsequently rerouted to the Chinese ISP. This is the second time the ISP has been caught hijacking traffic from Western countries.

A BGP route leak has been defined by the Internet Engineering Task Force (IETF) as “the propagation of routing announcement(s) beyond their intended scope. That is, an announcement from an Autonomous System (AS) of a learned BGP route to another AS is in violation of the intended policies of the receiver, the sender, and/or one of the ASes along the preceding AS path.” That is a mouthful of technical terms that sounds like a foreign language to even InfoSec researchers. In summary, the Border Gateway Patrol (BGP) is used to reroute traffic at the ISP level. It has been known to be problematic with leaks occurring frequently. However, there are safeguards and safety procedures that providers usually set up to prevent BGP route leaks from influencing each other's networks. However, instead of ignoring the BGP leak, China Telecom re-announced Safe Host's routes as its own, and by doing so, interposed itself as one of the shortest ways to reach Safe Host's network and other nearby European communication companies and ISPs.

It is almost a weekly occurrence that a company announces they have suffered a data breach. Oven the numbers, in the millions, are difficult for us to wrap our heads around. Besides this, the cost to the individual affected by such a breach can be hidden within the sheer scope of these large numbers. When financial data is stolen such as credit card numbers and other account information, hackers can either use the data to clone cards and make fraudulent purchases. Or they can sell the data on Dark Web platforms so others may do the same or commit identity theft. What of personal information relating to an individual’s healthcare and medical history?

In 2018, this publication covered the data breach affecting SingHealth where 1.5 million patients’ medical records were leaked including the president of Singapore. Earlier this year we also covered who might be responsible for the breach and subsequent leak of information. This all begs the question as to why do hackers want this information. Medical data can include any and all data relating to past and present health conditions, pharmacy prescriptions, hospital records, insurance details, and online medical account credentials. Unlike with financial data, it would appear on the surface that other than for blackmail purposes there is little that can be done with such information.

A new report published by Carbon Black examines how hackers use medical information for their own gain. Hackers are actively selling such information on Dark Web marketplaces. Such information is demanding high prices and is clearly in demand. The most expensive offering on these marketplaces is information relating to providing information which can be used to forge a medical background, an alarming prospect given the harm which could be done when someone who has not qualified, poses as a medical professional. Such information can be used in the real world to forge insurance documents, medical diplomas, doctor licenses, and DEA licenses. Such information has been seen going for 500 USD per listing.

When the developers behind Coinhive announced that they would be shutting down the service of allowing websites to mine cryptocurrency rather than advertising, the rise of cryptominers was predicted by some to end. The development of Coinhive opened a Pandora’s Box and drove the abuse and development of other cryptominers, malware designed to hijack CPU resources to mine cryptocurrency, it was unlikely that Coinhive’s demise would signal the death of the malware variant. This statement seems proven by the emergence of a new crypto miner, labeled BlackSquid by researchers at TrendMicro, the malware is designed to infect web servers, network drives, and removable drives to turn them into Monero mining rigs. According to a report published by TrendMicro the malware uses several vulnerabilities to break into systems and help evade detection.

Over the years there have been numerous examples of distributed denial of service (DDoS) designed to be executed on Linux machines and servers. With the advent of the Internet of Things, the number of devices available to be controlled by attackers has skyrocketed and along with it numerous versions of botnets. Cryptominers have also come to be a common foe for Linux admins. It is rare to see Linux based malware in other forms be they trojans or backdoors. According to researchers based at security firm Intezer have discovered a previously undetected malware strain targeting Linux systems. In a report published by the researcher, Ignacio Sanmillan, the malware employs advanced evasion techniques with the use of rootkits to leverage trojan-based payloads.

The malware called HiddenWasp seems to base most of its code on the recently-discovered Linux malware strain Winniti, a hacking tool alleged developed by state-sponsored Chinese hackers.

According to security researcher going by the pseudonym Frost, a bunch of websites is pushing a download which promises users the ability to earn up to 30 USD in Bitcoin daily. The program, called Bitcoin Collector, is nowhere near what it is advertised to be, rather it is a scam which will infect systems with ransomware and an information harvesting trojan. This is most certainly not what the user, now victim, had in mind when downloading the program they hoped would earn them a nice daily sum. Bitcoin is currently enjoying a surge in value with at the time of writing 1 BTC is 8,730 USD. This surge in recent value has been attributed to a variety of factors including accumulation of the cryptocurrency and unspent coin been at record highs. Regardless of the reasons, it will still mean that Bitcoin and other cryptocurrencies including Ethereum and Monero are still worth stealing and been exploited to lure unsuspecting victims.

Part of the scam incorporates a referral program which allows users to earn Ethereum for referring a set number of new users. The FAQ on one of the websites states that by referring 1,000 visits using your referral link you will earn 3 Ethereum. That is approximately worth 750 USD currently. This, however, is not the crux of the scam. Rather it is the download provided on the website which promises daily earnings of Bitcoins. These earnings are supposedly given free and are automatically paid out. If a potential victim clicks on the offer they are redirected to another website controlled by those behind Bitcoin Collector. Here the potential victim is offered a download which will download and install the money-making application. To further sell the legitimacy of the scam the scammers have even gone so far as to link a Virus Total detection page in an attempt to prove that it is not malicious.

Over the past couple of days, the security researcher who goes by the pseudonym SandboxEscaper has released several Microsoft Windows vulnerabilities to the public with no prior notice given to Microsoft. The researcher has developed a reputation amongst the InfoSec community for releasing vulnerabilities to the public, in particular, Windows vulnerabilities, without informing the software producer or giving prior notice as is seen as a good practice amongst researchers.

The first of the flaws published on May 22, can be classified as a local privilege escalation (LPE) zero-day. LPE can be seen as exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. It is important to note that when exploited such flaws cannot be used to break into a system. Rather hackers can use them at later stages in their attacks to elevate their access on compromised hosts from low-privileged to admin-level accounts. In this instance, the flaw resides in the Windows Task Scheduler process. In order to exploit it the attacker would need to run .job file which has been malformed to change the discretionary access control list (DACL), this is the system which limits who has access to a file, in the Task Scheduler. If correctly done the attacker can raise their privileges on the system from a low level to that of an admin. Once this is done the attacker would be granted access to the entire system.

According to IBM hacktivist attacks that resulted in quantifiable damage to the victim has declined by 95 percent since 2015. According to the data provided by IBM’s X-Force threat intelligence unit between 2015 and 2019 shows that the number of hacktivist attacks dropped from 35 in 2015 to 24 in 2016 and only 5 in 2017. In 2018, only two incidents were recorded and no attacks have been observed by IBM so far in 2019. The threat intelligence team noted that the data collected only includes attacks observed by reliable sources, only instances where someone took responsibility, and only if the attack resulted in quantifiable damage. In this instance, hacktivism can then be defined as the act of hacking a website or computer network in an effort to convey a social or political message.

2016 was a bumper year for the hacktivist group Anonymous that help bring the group to the public’s attention. From Operation Icarus, which was a series of Distributed Denial of Service attacks on banks to cyber attacks launched against the Thai police. This was followed in 2018 by a series of attacks on the Spanish government. Despite the associated press with the attacks it did not result in others been inspired to follow the path set by other hacktivists. IBM has contributed this decline to a variety of reasons. Central to the decline is the decrease in Anonymous activities over the years. IBM attributed this decline to the loss of key leaders within the organization and public relations failings. In 2016 during the US presidential election, a debate among Anonymous members spilled over into the public domain. While some members advocated for attacks against candidate websites, others strongly disagreed, arguing that the group does not support a particular political ideology and criticizing proposed attacks as “cringe-worthy.”