Chinese hacking group has found new way to bypass two-factor authentication

/in ,

A group with alleged links to the Chinese government has been accused of hacking networks worldwide, but in a rare twist, it’s said to be bypassing two-factor authentication in the process.

The hack was detailed late last week by security researchers from Fox-IT Holding B.V. APT20, the group behind the campaign, targets web servers as the first point of entry with a particular focus on Jboss.

Once through the door, the group installs web shells then spreads throughout the network. Showing fairly typical behavior, the group seeks out passwords and administrator accounts to obtain more information from their targets utilizing virtual network credentials for more secure access.

Where it gets interesting is that the researchers claim they found evidence that APT20 was gaining access to VPN accounts that were protected by 2FA. Hacking 2FA isn’t new, and the process involved is somewhat complicated, but APT20 is said to have found a new way to bypass the process.

The hackers are believed to have stolen an RSA SecurID software token from a hacked system, then modified the key to work on different systems.

“The software token is generated for a specific system, but of course this system-specific value could easily be retrieved by the actor when having access to the system of the victim,” the security researchers explained. “As it turns out, the actor does not actually need to go through the trouble of obtaining the victim’s system-specific value, because this specific value is only checked when importing the SecurID Token Seed, and has no relation to the seed used to generate actual 2-factor tokens. This means the actor can actually simply patch the check which verifies if the imported soft token was generated for this system, and does not need to bother with stealing the system-specific value at all.”

While specifically applying to software-based tokens, the method is disturbing particularly given that 2FA is regularly held up as a way to prevent hacking such as this.

A full copy of the research into the group can be found here.

Nigerian citizen to stand trial in Memphis for cyber crimes

/in

A Nigerian citizen living in Accra, Ghana, has been extradited to Memphis to stand trial for an indictment charging him with cyber crimes and identity theft.

According to the U.S. Department of Justice, a federal grand jury in the U.S. District Court for the Western District of Tennessee indicted 64-year-old Babatunde Martins with wire fraud, aggravated identity theft, and conspiracy to commit money laundering.

Martins was also charged with conspiracy to commit wire fraud and conspiracy to commit computer fraud.

The indictment alleges that Martins, along with other Africa-based co-conspirators, hacked into the servers and email systems of a Memphis-based real estate company in June and July of 2016. Martins and his co-conspirators allegedly sent fake emails to “relevant business parties,” and redirected money to final destinations in Africa.

The indictment was handed down on August 23, 2017, but Martins did not make his initial appearance in a West Tennessee court until Monday, December 9, 2019.

The Department of Justice says that Martins is also charged with perpetrating romance scams, fake check scams, gold-buying scams, advance-fee scams, and credit card scams. The indictment alleges that proceeds from these scams were transferred from the U.S. to locations in Africa.

Five other people have pleaded guilty to being involved in the scheme. Olufalojimi Abegunde, 33, and Javier Luis Ramos-Alonso, 30, were convicted in March after a week-long trial in the U.S. District Court for the Western District of Tennessee. Abegunde received a 78-month sentence, and Ramos-Alonso received a 31-month sentence for their roles in the scheme.

The Department of Justice says that several others are still at large.

wreg.com

Bitcoin ransomware locks 10 years’ worth of government data in Argentina

/in ,

Bitcoin-hungry hackers have attacked a data center in Argentina which houses local government files.

According to Alicia Bañuelos, the country’s Minister of Science and Technology, the attack took place on November 25.

In an interview with Agencia de Noticia de San Luis — a local government digital news outlet — on December 2, Bañuelos said the center had already recovered 90 percent of the encrypted data. Some 7,700 GB — approximately 10 years worth data — was originally compromised as a result of the attack.

“Decrypting the files will take at least 15 days, mostly due to the sheer size of the archive,” Bañuelos added during the interview.

The size of the Bitcoin ransom is unknown, but reports suggest attackers asked for somewhere in between approximately $37,000 and $370,000 (0.5 and 50 BTC) in exchange for decrypting the files.

Just last week, Hard Fork reported on how a major US data center had been hit by Sodinokibi, a prominent strand of ransomware which several months ago earned a hacker $287,000 worth of Bitcoin in just three days.

Governments have proved to be popular targets. A group of cybercriminals calling themselves the “Shadow Kill Hackers” attacked the City of Johannesburg (South Africa) administration website in late October and threatened to upload the stolen data on the internet unless they received a $300,000 (4 BTC) Bitcoin ransom.

Hackers are also targeting private companies, including Spanish multinational security firm Prosegur, which was hit by Ryuk ransomware under two weeks ago.

thenextweb