Yes Chrome is scanning your Windows PC, but it might be a bug

/in , ,

A few days ago Kelly Shortridge, a product manager at SecurityScorecard detected some unexpected behavior on her PC, as a honeypot Canarytoken reported being accessed by Chrome.exe. That’s not what you’d expect from a web browser normally, except for one thing — Google did add some antivirus-y capabilities to its browser on Windows late last year as an enhancement to its Chrome Cleanup tool that can help reset hijacked settings. Google Chrome security lead Justin Schuh explained how the feature works and pointed to some documentation about it, and that was that —

If you are hitting this issue and you want a fix right now then go to chrome://downloads in your browser, go to the menu in the top right, and select Clear All. That will clear Chrome’s list of downloaded files so that it won’t have any files to existence-check at startup. If you have a large list of downloaded files then this will improve startup time slightly.

It turns out the “AV scanning” wasn’t that at all, and what it was doing could affect you right now. It turns out that Chrome is checking the integrity of downloaded files at startup, and a bug lead it to that particular folder. It relies on the Downloaded History list for this check, and if you have a lot of files in there, it could slow down your computer when you start Chrome. While the dev team is working to skip the check entirely in a future update, users worried about it can fix it by clearing their download history.

Cisco Switches in Iran, Russia Hacked in Apparent Pro-US Attack

/in , , ,

Hacked Cisco Switch

A significant number of Cisco switches located in Iran and Russia have been hijacked in what appears to be a hacktivist campaign conducted in protest of election-related hacking. However, it’s uncertain if the attacks involve a recently disclosed vulnerability or simply abuse a method that has been known for more than a year.

Cisco devices belonging to organizations in Russia and Iran have been hijacked via their Smart Install feature. The compromised switches had their IOS image rewritten and their configuration changed to display a U.S. flag using ASCII art and the message “Don’t mess with our elections…”

The hackers, calling themselves “JHT,” told Motherboard that they wanted to send a message to government-backed hackers targeting “the United States and other countries.” They claim to have only caused damage to devices in Iran and Russia, while allegedly patching most devices found in countries such as the U.S. and U.K.

Iran’s Communication and Information Technology Ministry stated that the attack had impacted roughly 3,500 switches in the country, but said a vast majority were quickly restored.

Kaspersky Lab reported that the attack appeared to mostly target the “Russian-speaking segment of the Internet.”

While there are some reports that the attack involves a recently patched remote code execution vulnerability in Cisco’s IOS operating system (CVE-2018-0171), that might not necessarily be the case.

The Cisco Smart Install Client is a legacy utility that allows no-touch installation of new Cisco switches. Roughly one year ago, the company warned customers about misuse of the Smart Install protocol following a spike in Internet scans attempting to detect unprotected devices that had this feature enabled.

Attacks, including ones launched by nation-state threat actors such as the Russia-linked Dragonfly, abused the fact that many organizations had failed to securely configure their switches, rather than an actual vulnerability.

Cisco issued a new warning last week as the disclosure of CVE-2018-0171 increases the risk of attacks, but the networking giant said it had not actually seen any attempts to exploit this vulnerability in the wild. Cisco’s advisory for this flaw still says there is no evidence of malicious exploitation.

There are hundreds of thousands of Cisco switches that can be hijacked by abusing the Smart Install protocol, and Cisco Talos experts believe attackers are unlikely to bother using CVE-2018-0171.

The Network Security Research Lab at Chinese security firm Qihoo 360 says the data from its honeypot shows that the attacks have “nothing to do with CVE-2018-0171” and instead rely on a publicly available Smart Install exploitation tool released several months ago.

While none of the major players in the infosec industry have confirmed that the attacks on Iran and Russia rely on CVE-2018-0171, technical details and proof-of-concept (PoC) code have been made available by researchers, making it easier for hackers to exploit.

Hamed Khoramyar, founder of Sweden-based ICT firm Aivivid, said the attacks exploited CVE-2018-0171. Kudelski Security also reported seeing attacks involving both CVE-2018-0171 and another recently disclosed IOS vulnerability tracked as CVE-2018-0156. However, Kudelski’s blog post also lists Khoramyar as one of its sources.

Security Week

Iran hit by global cyber attack that left U.S. flag on screens

/in

DUBAI (Reuters) – Hackers have attacked networks in a number of countries including data centres in Iran where they left the image of a U.S. flag on screens along with a warning “Don’t mess with our elections”, the Iranian IT ministry said on Saturday.

“The attack apparently affected 200,000 router switches across the world in a widespread attack, including 3,500 switches in our country,” the Communication and Information Technology Ministry said in a statement carried by Iran’s official news agency IRNA.

The statement said the attack, which hit internet service providers and cut off web access for subscribers, was made possible by a vulnerability in routers from Cisco (CSCO.O) which had earlier issued a warning and provided a patch that some firms had failed to install over the Iranian new year holiday.

Cisco did not immediately respond to requests for comment.

A blog published on Thursday by Nick Biasini, a threat researcher at Cisco’s Talos Security Intelligence and Research Group, said: “Several incidents in multiple countries, including some specifically targeting critical infrastructure, have involved the misuse of the Smart Install protocol…

“As a result, we are taking an active stance, and are urging customers, again, of the elevated risk and available remediation paths.”

Iran’s IT Minister Mohammad Javad Azari-Jahromi posted a picture of a computer screen on Twitter with the image of the U.S. flag and the hackers’ message. He said it was not yet clear who had carried out the attack.

Azari-Jahromi said the attack mainly affected Europe, India and the United States, state television reported.

“Some 55,000 devices were affected in the United States and 14,000 in China, and Iran’s share of affected devices was 2 percent,” Azari-Jahromi was quoted as saying.

In a tweet, Azari-Jahromi said the state computer emergency response body MAHER had shown “weaknesses in providing information to (affected) companies” after the attack which was detected late on Friday in Iran.

Hadi Sajadi, deputy head of the state-run Information Technology Organisation of Iran, said the attack was neutralised within hours and no data was lost.

Reuters

Facebook’s Cambridge Analytica data scandal, explained

/in , ,

Cambridge Analytica improperly obtained data from as many as 50 million people. That’s put Mark Zuckerberg on the defensive.
The Verge

Twitter has removed over 1.2 million accounts for promoting terrorism

/in

Twitter released its biannual Transparency Report today and it shared stats on how it continues to handle terrorist content. Overall, since August of 2015, twitter has removed over 1.2 million accounts that promoted terrorism. During the second half of last year, it permanently suspended 274,460 accounts for this reason, which is slightly less than what was removed during the first half of 2017. Twitter notes that it has now seen a decline in these sorts of removals across three reporting periods and it attributes that pattern to “years of hard work making our site an undesirable place for those seeking to promote terrorism.”

Of those accounts that were removed between July 1st and December 31st last year, 93 percent were flagged by Twitter’s internal tools and algorithms. Around 74 percent were suspended before ever tweeting — stats that are in line with Twitter’s report from the first half of 2017 as well. Government reports of violations are still on the decline. Last September, Twitter reported that government-originating reports accounted for less than one percent of removals. Now, they account for less than 0.2 percent.

In addition to the terrorist content updates, Twitter also shared information on some changes it has made to how it notes when content is being withheld. It’s now differentiating when content is being blocked due to a court order or because of local laws. The Transparency Report also notes that there was a 38 percent increase between the first and second half of 2017 regarding copyright violation takedown notices for both Twitter and Periscope. There was an 18 percent decrease in trademark violation notices.

Twitter makes a point to note the efforts of governments to limit online speech. “With the passage of new legislation and ongoing regulatory discussions taking place around the world about the future of public discourse online, we are seeing a potential chilling effect with regards to freedom of expression,” Twitter said in a blog post. To address that, Twitter says it uploads request for content withholding to the Lumen database, which collects and analyzes these sorts of requests. “Lumen serves as a critical transparency resource as more freedom of expression comes under fire, by making such requests available for public review,” said Twitter.

Lastly, Twitter reiterated its effort to “increase the collective health, openness and civility of public conversation around the world, and to hold ourselves publicly accountable toward progress.” In regards to that, Twitter also recently hosted a Periscope livestream, taking questions from the public about its policies, and launched a request for public proposals on how to promote healthy, open and civil conversations on its platform.

Engadget

School dropout makes it to Forbes’ U-30 list

/in

Chandigarh, April 3 (IANS) A school dropout from Chandigarh who is now a cyber security expert has made it to the Forbes “30 under 30” Asia 2018 list.

Trishneet Arora, 25, made his way to the prestigious list which is packed with innovators and disruptors who are reshaping their industries and changing Asia for the better, a spokesperson for the young entrepreneur said here on Tuesday.

Arora is cyber security expert, an author and the founder and CEO of TAC Security — a Cyber-Security company based in Mohali, adjoining Chandigarh.

TAC Security performs vulnerability assessment and penetration testing for corporates, identifying weaknesses in their cyber security.

“In 2017, Arora was listed among the 50 Most Influential Young Indians by GQ Magazine. He has received funding from investor Vijay Kedia and support from former vice president of IBM, William May,” the spokesperson said.

His name now figures in the Enterprise Technology category of the Forbes “30 under 30” Asia 2018 list.

Besides young international personalities from across the world, international badminton player P.V Sindhu from India is part of the Forbes Asia “30 under 30” list under a different category.

TAC Security helps corporates recognise their weaknesses before fraudulent hackers can use them adversely. It helps to protect networks and information assets from malicious activity such as cyber-attacks. TAC is also responsible for security assessment for 50+ UPI based applications.

Chrome Is Scanning Files on Your Computer

/in ,

The browser you likely use to read this article scans practically all files on your Windows computer. And you probably had no idea until you read this. Don’t worry, you’re not the only one.

Last year, Google announced some upgrades to Chrome, by far the world’s most used browser—and the one security pros often recommend. The company promised to make internet surfing on Windows computers even “cleaner” and “safer ” adding what The Verge called “basic antivirus features.” What Google did was improve something called Chrome Cleanup Tool for Windows users, using software from cybersecurity and antivirus company ESET.

Tensions around the issue of digital privacy are understandably high following Facebook’s Cambridge Analytica scandal, but as far as we can tell there is no reason to worry here, and what Google is doing is above board.

In practice, Chome on Windows looks through your computer in search of malware that targets the Chrome browser itself using ESET’s antivirus engine. If it finds some suspected malware, it sends metadata of the file where the malware is stored, and some system information, to Google. Then, it asks you to for permission to remove the suspected malicious file. (You can opt-out of sending information to Google by deselecting the “Report details to Google” checkbox.)

A screenshot of the Chrome pop-up that appears if Chrome Cleanup Tool detects malware on your Windows computer.

A screenshot of the Chrome pop-up that appears if Chrome Cleanup Tool detects malware on your Windows computer.

Last week, Kelly Shortridge, who works at cybersecurity startup SecurityScorecard, noticed that Chrome was scanning files in the Documents folder of her Windows computer.

“In the current climate, it really shocked me that Google would so quietly roll out this feature without publicizing more detailed supporting documentation—even just to preemptively ease speculation,” Shortridge told me in an online chat. “Their intentions are clearly security-minded, but the lack of explicit consent and transparency seems to violate their own criteria of ‘user-friendly software’ that informs the policy for Chrome Cleanup [Tool].”

Her tweet got a lot of attention and caused other people in the infosec community—as well as average users such as me—to scratch their heads.

“Nobody likes surprises,” Haroon Meer, the founder at security consulting firm Thinkst, told me in an online chat. “When people fear a big brother, and tech behemoths going too far…a browser touching files it has no business to touch is going to set off alarm bells.”

Now, to be clear, this doesn’t mean Google can, for example, see photos you store on your windows machine. According to Google, the goal of Chrome Cleanup Tool is to make sure malware doesn’t mess up with Chrome on your computer by installing dangerous extensions, or putting ads where they’re not supposed to be.

As the head of Google Chrome security Justin Schuh explained on Twitter, the tool’s “sole purpose is to detect and remove unwanted software manipulating Chrome.” Moreover, he added, the tool only runs weekly, it only has normal user privileges (meaning it can’t go too deep into the system), is “sandboxed” (meaning its code is isolated from other programs), and users have to explicitly click on that box screenshotted above to remove the files and “cleanup.”

In other words, Chrome Cleanup Tool is less invasive than a regular “cloud” antivirus that scans your whole computer (including its more sensitive parts such as the kernel) and uploads some data to the antivirus company’s servers.

But as Johns Hopkins professor Matthew Green put it, most people “are just a little creeped out that Chrome started poking through their underwear drawer without asking.”

That’s the problem here: most users of an internet browser probably don’t expect it to scan and remove files on their computers.

When reached out for comment, a Google spokesperson redirected me to the blog post from last year and Schuh’s tweets.

A section in Chrome’s Privacy Whitepaper explains that “Chrome periodically scans your device to detect potentially unwanted software.” That exact language has been there since at least January of 2017, according to archived versions of the whitepaper. And similar language (“Chrome scans your computer periodically for the sole purpose of detecting potentially unwanted software”) has been there for even longer.

Martijn Grooten, the editor of Virus Bulletin and organizer of one of the premiere antivirus conferences in the world, told me in a Twitter chat that the behavior of the Chrome Cleanup Tool was “sensible.”

“For almost all users, this seems really harmless, and for those who are extremely concerned about Google seeing some metadata, maybe they shouldn’t be running Google’s browser in the first place,” he said.

Motherboard

Google shutting down goo.gl URL shortener next year

/in ,

google shortener

The goo.gl link is very common on the web and was first launched by Google in 2009. However, the company announced on Friday, March 30, 2018, that it’s winding down the URL Shortener beginning next month, with a complete deprecation by next year. Fortunately, existing links will continue to work.

The URL shortener service launched in 2009 for FeedBurner and the Google Toolbar. With neither of those services available, the same is now happening to goo.gl for both consumers and developers. The latter group is being directed to Firebase Dynamic Links with the announcement meant to “refocus” Google’s efforts.

many popular URL shortening services have emerged and the ways people find content on the Internet have also changed dramatically, from primarily desktop webpages to apps, mobile devices, home assistants, and more.

However, for average users that just want to truncate a link, there is no new alternative from the company, with Google suggesting Bitly and Ow.ly.

Starting on April 13, 2018, new and anonymous users will no longer be able to reach the goo.gl console to create short links. However, existing users will have access to all features like creation, management, and analytics until March 30, 2019, when the console will be discontinued.

Google notes “all links will continue to redirect to the intended destination” even after 2019, with users also able to export link information from the console.

Developers are encouraged to switch over to Firebase Dynamic Links that have the advantage of automatically detecting the user’s platform and send the user to either the web or your app.

URL Shortener has been a great tool that we’re proud to have built. As we look towards the future, we’re excited about the possibilities of Firebase Dynamic Links, particularly when it comes to dynamic platform detection and links that survive the app installation process. We hope you are too!

9 to 5 Google

Facebook is hosting an online abuse summit with other tech leaders

/in

Desperate to show it takes thwarting misinformation, fraud and spam seriously, Facebook just revealed that it’s hosting a private “Fighting Abuse @Scale” invite-only conference in San Francisco on April 25th. Speakers from Facebook, Airbnb, Google, Microsoft and LinkedIn will discuss how to stop fake news, prevent counterfeit account creation, use honeypots to disrupt adversarial infrastructure and how machine learning can be employed to boost platform safety.

Facebook Event: fighting abuse Though never publicly announced, Facebook has already privately filled the event to capacity. The company’s PR says this isn’t a “last-minute” event as we originally described it, and initial invites went out February 6th. But the sudden move to invite journalists less than a month ahead seems timed to humanize Facebook’s efforts to combat its ongoing data abuse and election interference scandals.

Fighting Abuse @Scale will be held at the Bespoke Event Center within the Westfield Mall in SF. We can expect more technical details about the new proactive artificial intelligence tools Facebook announced today during a conference call about its plans to protect election integrity. The first session is titled “Combating misinformation at Facebook” and will feature an engineering director and data scientists from the company.

Facebook previously held “Fighting Spam @Scale” conferences in May 2015 and November 2016 just after the presidential election. But since then, public frustration has built up to a breaking point for the social network. Russian election interference, hoaxes reaching voters, violence on Facebook Live, the ever-present issue of cyberbullying and now the Cambridge Analytica data privacy scandal have created a convergence of backlash. With its share price plummeting, former executives speaking out against its impact on society and CEO Mark Zuckerberg on a media apology tour, Facebook needs to show this isn’t just a PR problem. It needs users, potential government regulators, and its own existing and potential employees to see it’s willing to step up and take responsibility for fixing its platform.

tech crunch

New Mac Malware Hijacks Web Connections: What to Do

/in ,

“2018 is barely two weeks old, and already it looks like we’ve got new piece of macOS malware! Hooray :)”

That’s how Apple-focused security researcher Patrick Wardle opened a blog post on Jan. 11, detailing what Wardle calls “MaMi,” a stealthy DNS hijacker that reroutes your internet traffic to possibly malicious websites.

MaMi also has abilities that haven’t yet been activated: It can steal passwords, take screenshots, download files and programs, run other pieces of software and inject bogus security certificates.

Check If You’re Infected

To see whether your Mac was infected by MaMi, go to System Preferences, click on the Network section and check the IP address of your DNS server. If it’s “82.163.143.135” or “82.163.142.137,” then you’ll need to change it to something benign, such as Google’s 8.8.8.8 or 8.8.4.4 or OpenDNS’s 208.67.2222.222 or 208.67.220.220.

Notice we said “was” infected. The MaMi sample that Wardle found deleted itself after changing the DNS settings on his test machine, so even if you found a smoking-gun DNS setting, the malware that did it may be long gone.

How to Prevent Infection

To prevent infection by MaMi, use common sense. Every piece of Mac malware found in recent years has required user approval, presumably unwitting, to be installed.

So don’t authorize that Adobe Flash Player update, that video player you apparently need to see a clip of a naked celebrity, or that antivirus software that showed up in a pop-up window telling you your Mac was infected. Instead, hold off and get Mac antivirus software straight from the source.

It’s not yet known how MaMi (named after a text string Wardle found in the code) infects a Mac, though Wardle suspects “rather lame methods such as malicious email, web-based fake security alerts/popups or social-engineering type attacks.” But as of this writing, only one antivirus scanning engine in the online VirusTotal repository detects MaMi through the usual file-matching methods.

How MaMi Malware Works

DNS servers are the phone books of the internet. They match human requests with network addresses  so that, among other things, you can see this website in your web browser.

DNS hijacking sends a computer to a malicious DNS server that could, for example, send you to an evil version of Tom’s Guide that could infect you with even more malware.

It’s not clear how widespread MaMi is so far. Wardle was tipped off to it by a posting on a Malwarebytes forum, but didn’t explain how he located his own copy. Wardle did point to a website that automatically downloaded the binary to our computer when we connected. (We’re using a Windows PC, so the malware didn’t do anything to us.)

tomsguide.com