Internet threat news

Apple has recently patched a serious root access flaw found macOS High Sierra. The flaw allows for the authentication to bypass making the system exceptional vulnerable to exploitation. The flaw would enable a potential attacker to gain root access to the vulnerable system. Apple has described the vulnerability as a logic flaw, and in a recently released statement confirmed that “An attacker may be able to bypass administrator authentication without supplying the administrator’s password,”

The flaw appears to be first mentioned on an Apple Developer forum on November 13 by a user who had been trying to help others solve a macOS issue related to all their admin accounts being turned into regular accounts after updating to High Sierra. Apple only became aware of the problem on Tuesday of this week when a Turkish developer sent a tweet to Apple Support and the media started covering the issue. Apple did respond in record time. Within 24 hours a patch was released for the vulnerability labeled CVE-2017-13872. It is hoped that the speedy response by Apple has mitigated any future damage that could come from the flaw being exploited. macOS users are advised to ensure that security update for High Sierra 10.13.1 has been downloaded and installed on their systems.

Hacking group Cobalt, who has developed a reputation for attacking banks, have been quick to exploit a Windows vulnerability that recently surfaced. Microsoft has patched the vulnerability found in Microsoft Office and it is strongly advised that all patches are downloaded as soon as possible. The vulnerability was discovered by the Embedi research team which affects the Microsoft Equation Editor (EQNEDT32.EXE), one of the executables that are installed on users' computers with the Office suite. This tool was designed to allow users to embed mathematical equations inside Office documents as dynamic OLE objects.

One of the major threats posed by the vulnerability, CVE-2017-11882, is that it can be exploited to run malicious code without user interaction and affects all Windows versions over the past 17 years. Having such a backdoor in your hacking arsenal is something hackers and criminal organizations dream of. Cobalt, believed to be behind an attack that targeted Russian speaking business earlier this year, has jumped on the opportunity to exploit the vulnerability detailed above.

Uber, the popular ride-hailing company, has an impressive history of making the news for almost all the wrong reasons. This has happened to the extent that investors forced co-founder and ex-CEO Travis Kalanick to step down paving the way for the new CEO Dara Khosrowshahi to pick up the pieces from past indiscretions. In this most recent case of terrible news for the company, hackers stole names, email addresses and phone numbers of 50 million Uber riders around the world and the personal information of about 7 million drivers were accessed as well, including some 600,000 U.S. driver’s license numbers. The company has stated that no Social Security numbers, credit card information, trip location details or other data were taken.

Terdot was first seen in the wild in October 2016, while discovered over a year ago it has managed to fly under the radar. While initially developed to be solely a banking Trojan, Terdot has since grown into a sophisticated hacking tool that can also work as a backdoor and infostealer. One of the interesting features of Terdot is its use legitimate services in order to read HTTPS traffic. For a full technical analysis of Terdot, Bitdefender released a 32-page document detailing the Trojan in depth.

This year will be remembered for many things within the InfoSec community. Ransomware’s popularity, worms becoming popular again and crypto jackers benefitting from cryptocurrencies ever-increasing value, another trend is the use of legitimate services to further the malware authors aims and circumvent newer security measures. Terdot most definitely falls into the last category detailed above.

In September this year, researchers at Armis, a company specializing in the Internet of Things security, announced that they had developed a proof of concept code that would allow potential hackers to hack Bluetooth devices. BlueBorne is the name given to a collection of eight vulnerabilities which could allow a hacker to take over devices that have Bluetooth enabled and run malicious code on the underlying OS or firmware.

In September when the news initially broke it came in the wake of Android, iOS, Microsoft, and Linux patching the flaws. This latest announcement made by Armis that could leave over  20 million Amazon Echo and Google Home devices running on Android and Linux are vulnerable to attacks via the BlueBorne vulnerability. Fortunately, both Amazon and Google have issued patches for the affected products, hence today's disclosure from Armis.

A team consisting of government, industry, and academic officials successfully demonstrated that a commercial aircraft could be remotely hacked in a non-laboratory setting. The hack occurred in September 2016 and was recently announced at the 2017 CyberSat Summit in Tyson’s Corner, Virginia. Robert Hickey, aviation program manager within the Cyber Security Division of the DHS (Department of Homeland Security) Science and Technology (S&T) Directorate. Robert Hickey, aviation program manager within the Cyber Security Division of the DHS Science and Technology (S&T) Directorate said that “We got the airplane on Sept. 19, 2016. Two days later, I was successful in accomplishing a remote, non-cooperative, penetration,”

Obviously, due to the sensitive nature of the information details of the hack are classified. What has been detailed to the public is that the hack was accomplished by having no one actually touch the plane and there was no need to have an insider threat providing information or otherwise. In order to gain access to the aircraft, they accessed the aircraft’s systems through radio frequency communications that many aircraft use as a matter of course.

Since the emergence of Coinhive was reported the popularity of cryptojacking has increased exponentially. Coinhive allows website owners to integrate a Javascript miner on their website to generate extra revenue. The mining is done by the website user when on the website. Many websites have adopted Coinhive for exactly this purpose. People ethically employing Coinhive notify users that their computer resources are been used to mine cryptocurrency, in this instance Monero, while on the website.

While a novel idea and can be employed ethically it is open to abuse. Security researchers at Malwarebytes have released a report detailing the abuses been experienced by users globally. Malwarebytes has been one of the first major antivirus companies that have added support for blocking such scripts.

Popular websites have always been a target for hackers trying to spread malware. The popular website Crunchyroll.com, which allows users to stream their favorite anime shows, experienced an attack over the weekend which forced the company to close its website over the weekend. While there is still speculation as to the nature of the attack, the attack still serves as a reminder to any company with a website that it is a target.

On November 4, it appeared that visitors to the popular website were asked to download a desktop version of their software. This software was not as it seemed as it also included malware that was installed along with it. Crunchyroll staff based in Germany were quick to notice that something was not right and immediately took to Twitter to warn users not to access the website. The website was then taken offline to prevent further infections.

This desktop application was not one offered by the site themselves, but one being offered by the hackers in order to distribute malware. It is still not known what malware the file, called “CrunchyViewer.exe”, was looking to distribute. Later the same day Ellation, Crunchyroll’s parent company, released a statement detailing what occurred and giving instructions on how to remove the malicious content if it was downloaded.

Hackers targeting all facets of the cryptocurrency boom is by no means a new phenomenon. On Nov 1, news broke of two separate incidents targeting cryptocurrency wallets in two different ways. Reasons for cryptocurrencies becoming one of the favored targets for hackers can be directly attributed their increasing popularity and soaring stock values. While the blockchain revolution is changing how we operate, hackers are still deploying the same methods as always to steal legitimate users cryptocurrency.

A security researcher at Romanian firm Bitdefender, Bogdan Botezatu, detected the first attacks on Monday this week when their SSH (Secure Shell) honeypots detected a bot attempting to change the system configuration to hijack funds from Ethereum mining operations. The bot was targeting an operating system optimized for Ethereum mining, called EthOS. This is a commercial operating system that can mine Ethereum, Zcash, Monero and other crypto-currencies that rely on GPU power. According to the OS’s creators, their offering is currently running on more than 38,000 mining rigs across the world. As with other specialized operating systems, it comes pre-loaded with the necessary tools and a default username and password. After deployment, the user only needs to add a wallet for mining fees and, of course, most importantly, change the default username and password.

Google’s reCAPTCHA has become one of the staple security innovations protecting users from spam and abuse in recent years. Advertised as a free service offered by tech giants Google, reCAPTCHA uses an advanced risk analysis engine and adaptive CAPTCHAs to keep automated software from engaging in abusive activities on your site. This is intended to allow only legitimate users access to your website.

In research published by the Computer Science Department at the University of Maryland (UM), a team of four created a system which effectively breaks reCAPTCHA with an accuracy of 85%. Anything which can break reCAPTCHA to an accuracy of over 1% is considered broken.

The automated system, termed unCAPTCHA by the team from UM, works by not targeting the image-based challenge but rather the audio version that Google added so people with disabilities can solve its puzzle. In summary, this is done by downloading the audio puzzle and feeding it to six text-to-speech (TTS) systems, aggregating the results, and feeding most probable answer back to Google's servers.

In tests carried out by the team, it was shown that unCAPTCHA can break 450 reCAPTCHA challenges with an 85.15% accuracy in 5.42 seconds, which is less time taken for a human to listen to one reCAPTCHA audio challenge. In order to do this, the code uses TTS systems such as Bing Speech Recognition, IBM, Google Cloud, Google Speech Recognition, Sphinx. The code has been made available on GitHub.

News broke on October 24 of a new ransomware variant targeting Russian and Ukrainian systems. The ransomware infected both personal computers and company servers. Among the affected organizations are Kiev’s metro system, Russian media organization Interfax and Odessa airport. Interfax was forced to publish to its Facebook page during the outage since its servers were taken offline for a number of hours.

The ransom demanded is 0.05 Bitcoin ($287.65 at the time of writing) and is conveyed in the now customary method of a ransom note. The malware code is unusual in the sense that it is laced with pop culture references pertaining to the hit show Game of Thrones, whose holding company HBO has its own battles with cybercrime. The ransomware also tries a list of passwords while attempting to spread which include “love”, “sex”, “god” and “secret”, which were dubbed the “four most common passwords” by the 1995 movie Hackers. In fact, the four most common passwords are 123456, 123456789, qwerty, and 12345678.

Since the middle of September, researchers have been watching an Internet of Things Botnet grow by nearly 10,000 infections per day. The botnet has been codenamed IoT_reaper. The current size of Reaper is estimated to be over 2 million infections. Much has been published over the years about how vulnerable IoT devices are. We are now beginning to see the practical implications of all the warnings made by experts.

According to researchers at Netlab the botnet is mainly made up of IP-based security cameras, network video recorders (NVRs), and digital video recorders (DVRs). The botnet uses some code from the Mirai IoT malware, but there are also many new things that make the botnet a standalone threat in its own right. One of the major differences between the Reaper and Mirai is its propagation method. Mirai was dependant on scanning for open Telnet ports and attempted to log in using a preset list of default or weak credentials. Reaper primarily uses exploits to forcibly take over unpatched devices and add them to its command and control (C&C) infrastructure.

Reaper also differs from Mirai in several important ways including that it uses exploits to take over devices. Other ways Reaper differs is that it is Lua execution environment integrated. This enables Reaper to perform more complex attacks. Reaper’s scan behavior is also not very aggressive helping keep it under the radar, making it harder to detect.

Recently we reported on the first ever ransomware which changes both the user PIN and encrypts user data on Android devices, discovered by researchers at ESET. In less than a week another piece of malware was discovered targeting Android users. SockBot, discovered by researchers at Symantec, is a Trojan which was used to target users who play Minecraft Pocket Edition mobile game. A total of 8 apps have been discovered carrying the Trojan on Google’s Play Store. The apps which were advertised as player skin apps and legitimate had total installation count ranging between 600,000 and 2.6 million.

All of the apps were created by the same developer going by the name of FunBaster. Google has since removed the apps. Fortunately, for those who may have been infected with SockBot, Google is able to remove infected apps from user’s mobile devices. This action taken by Google would have drastically reduced the number of possible infections. Using a popular app or game to try and lure users to download malicious apps is by no means a new trick. Given the popularity of Minecraft and a user base that consists of many younger users not aware of the dangers posed the creator picked a target easily susceptible to a malware attack.

Researchers at Slovakia based security firm ESET have discovered a new ransomware variant that targets Android users. The researchers believe this to be the first instance on ransomware which abuses Android Accessibility. A feature that provides users alternative ways to interact with their smartphone devices, and mainly abused in the past by Android banking Trojans to steal banking credentials. Discovered by ESET products as Android/DoubleLocker.A, this ransomware strain is based on the foundations of a particular banking Trojan, known for misusing accessibility services of the Android operating system.  

Lukáš Štefanko, the ESET malware researcher who discovered DoubleLocker believes that based on the ransomware’s banking Trojan roots DoubleLocker has the possibility of being converted into a ransombanker malware. This would be a two-stage malware that first tries to wipe your bank or PayPal account and subsequently locks your device and data to request a ransom. While this is currently speculation, ESET researchers have seen similar malware in the wild already dating back to May of this year.