Watch out: These phishing emails claiming to be a ‘secure message’ from your bank

/in ,

Cyber criminals are faking secure messages from banks as a means of delivering malware to victims.

Often provided through an online portal, banks often provide secure messaging services for the purposes of communicating with the bank without having to pick up the phone or visit the a branch.

Hackers have realised that this provides a new method of attack and are now crafting spoof emails claiming to contain documentation relating to secure messages.

The sorts of clients who opt to use these secure messaging services are often high-value targets who already have a trusting online relationship with their bank – so could be more willing to follow instructions they get in an email from scammers that they believe to be real.

Criminals are registering domains that appear to look like legitimate bank domains and the fact they’re fake goes unnoticed because users don’t know how to spot an imposter or their email client doesn’t show the full domain in the subject line.

Uncovered by security researchers at Barracuda Networks, the campaign uses phishing emails to impersonate customers of big banks including Bank of America and TD Commercial banking.

The spoof messages are designed in such a way so as to look legitimate, even featuring sender addresses which look as if they come from the institution.

In some instances, the messages simply ask the victim to click on and download and attached document. However, others keep up the façade of being ‘secure’ – some emails provide instructions about using an authorization code to ‘unlock’ the attachment.

The malicious payload within is able to rewrite the files in the users’ directory on Windows machines once the victim opens the document – and this script can potentially missed by anti-virus software, thrown off the scent because they think the document is benign.

However, once downloaded onto the system, criminals have access to it and can update the script at a later date to become something more malicious, such as credential stealing malware – enabling them to stealthily gain access to the bank account of the victim – or something more brazen like ransomware.

Faking email messages might seem like a basic attack, but criminals are deploying this tactic because it works – especially when trusted institutions such as banks are used.

However, the good news is that users can be trained to spot phishing attacks – taking a step back and assessing the legitimacy of an email can go a long way towards protecting an individual or their organisation from falling victim to hackers.

zdnet

Malware discovered in CCleaner put millions of users at risk

/in

System-cleaning tool CCleaner is one of the most popular programs of its type in the world. According to Avast, which recently acquired maker Piriform, it boasts over 2 billion worldwide downloads and receives 5 million more each week. But it’s just been reported that up to 2.27 million users were put at risk from a backdoor found in a recent version of the program.

Security firm Cisco Talos warned that version 5.33 of CCleaner, which was downloadable from August 15 to September 11, had been modified to include the Floxif malware. The unaffected version 5.34 was released on September 12, but those who downloaded the tool during the weeks that version 5.33 was available may have unwittingly installed the backdoor.

The exact versions that were infected were the 32-bit version of CCleaner and CCleaner Cloud 1.07.3191. The 64-bit version of CCleaner was not affected.

Floxif can gather information about an infected system and send the data back to a hacker’s server. It can also allow other forms of malware, such as ransomware and keyloggers, to make their way onto a victim’s computer.

It’s unclear exactly how the person or persons responsible breached Avast’s systems, but Talos speculates it could have been “an insider with access to either the development or build environments within the organization.”

Paul Yung, Piriform’s Vice President of Products, has tried to play down the attack. In a blog post today, he wrote: “The threat has now been resolved in the sense that the rogue server is down, other potential servers are out of the control of the attacker.”

“Users of CCleaner Cloud version 1.07.3191 have received an automatic update. In other words, to the best of our knowledge, we were able to disarm the threat before it was able to do any harm.”

The company said it was working with US law enforcement agencies to discover who was behind the incident. “We apologize and are taking extra measures to ensure this does not happen again,” it added.

TechSpot

New Bluetooth vulnerability can hack a phone in 10 seconds

/in ,

More than 5.3 billion devices with Bluetooth signals are at risk of a malware attack newly identified by an internet of things security company.

If you’re not keeping count, that’s most of the estimated 8.2 billion devices that use Bluetooth, which allows for our gadgets to connect and communicate wirelessly. Nearly every connected device out there has Bluetooth capability. Your phones, laptops, speakers, car entertainment systems — the list goes on and on to even the most mundane gadgets.

Because those devices can connect to others effortlessly, Bluetooth has left an open attack point for hackers, according to researchers at Armis Labs. The attack method, which they’re calling BlueBorne, is especially dangerous because it can spread without the victim doing anything or noticing it.

In a lot of cases, malware depends on people clicking on a link they shouldn’t have, or downloading a virus in disguise. With BlueBorne, all hackers need to spread malware is for their victims’ devices to have Bluetooth turned on, said Nadir Izrael, Armis’ chief technology officer.

And once one device has been infected, the malware can spread to other devices nearby with the Bluetooth turned on. By scattering over the airwaves, BlueBorne is “highly infectious,” Armis Labs said.

“We’ve run through scenarios where you can walk into a bank and it basically starts spreading around everything,” Izrael said.

The attack echoes the way the WannaCry ransomware spread earlier this year. WannaCry allegedly used the NSA’s EternalBlue vulnerability and infected computers on the same network, even though they never downloaded the virus. That ransomware infected hundreds of thousands of computers within several hours.

Ben Seri, Armis Labs’ head of research, fears that BlueBorne will lead to a similar massive outbreak. In several trials testing out BlueBorne, researchers were able to create botnets and install ransomware using Bluetooth, all under the radar of most protection.

“Imagine there’s a WannaCry on Bluetooth, where attackers can deposit ransomware on the device, and tell it to find other devices on Bluetooth and spread it automatically,” said Michael Parker, the company’s vice president of marketing.

BlueBorne is a collection of eight zero-day vulnerabilities that Armis Labs discovered. Zero-day vulnerabilities are security flaws that are found before developers have a chance to fix them. That kind of exploit lets hackers execute malware remotely, steal data and pretend to be a safe network as a “man in the middle” attack.

It does this by taking advantage of how your Bluetooth uses tethering to share data, the company said. It’s able to spread through “improper validation,” Izrael said. The vulnerability affects devices on most operating systems, including those run by Google, Microsoft and Apple.

The three companies have released patches for the vulnerability. Apple confirmed that BlueBorne is not an issue for its mobile operating system, iOS 10, or later, but Armis noted that all iOS devices with 9.3.5 or older versions are vulnerable. Microsoft released a patch for its computers in July, and anybody who updated would be protected automatically, a spokesman said. Google said Android partners received the patch in early August, but it’s up to the carriers to release the updates. Pixel devices have already received the updates.

Of the 2 billion devices using Android, about 180 million are running on versions that will not be patched, according to Armis.

The concern is the multitude of devices that will not be getting updates. Google, Microsoft and Apple are tech titans that regularly update their products for security. But updates might not be as frequent for single-purpose smart devices like your smart refrigerator or a connected television.

Of the potentially impacted devices, Armis Labs estimated that 40 percent are not going to be patched. That’s more than 2 billion devices that will be left vulnerable to attacks, they warned.

“We’re looking at a forever-day scenario for many of these devices,” Parker said.

You can turn off your Bluetooth to prevent attacks if you won’t receive the patch, Armis advised.

cnet