5 new cyberthreats pop up every second, here’s how to protect yourself

/in , ,

The start of 2018 has seen a massive rise in cryptocurrency mining and cryptojacking attacks, along with steady numbers of familiar malware and ransomware attacks, according to a Wednesday report from McAfee. On average, five new threat samples arose every second of Q1 2018, with several notable campaigns demonstrating just how sophisticated hackers have become.

“There were new revelations this quarter concerning complex nation-state cyber-attack campaigns targeting users and enterprise systems worldwide,” Raj Samani, chief scientist at McAfee, said in a press release. “Bad actors demonstrated a remarkable level of technical agility and innovation in tools and tactics. Criminals continued to adopt cryptocurrency mining to easily monetize their criminal activity.”

Of particular note was the rapid expansion of cryptojacking and other cryptocurrency mining attacks, in which criminals hijack victim’s browsers or infect their systems to mine for cryptocurrencies like Bitcoin—often without their knowledge. Coin miner malware grew a whopping 629% this year, growing from about 400,000 total known samples in Q4 2017 to more than 2.9 million in Q1 2018.

The rapid growth suggests that cybercriminals are drawn to the ease of infecting a user’s system and collecting the payments themselves, without having to rely on another party to monetize their attack, the report said.

“Cybercriminals will gravitate to criminal activity that maximizes their profit,” Steve Grobman, CTO at McAfee, said in the release. “In recent quarters we have seen a shift to ransomware from data-theft, as ransomware is a more efficient crime. With the rise in value of cryptocurrencies, the market forces are driving criminals to crypto-jacking and the theft of cryptocurrency. Cybercrime is a business, and market forces will continue to shape where adversaries focus their efforts.”

However, cryptomining is far from the only cyberthreat that businesses need to keep on their radar and protect against. Here are five campaigns the report identified as wreaking major havoc in Q1.

1. Bitcoin-stealing campaigns

A cybercrime ring called Lazarus launched a sophisticated Bitcoin-stealing phishing campaign called HaoBao this year, targeting global financial institutions and Bitcoin users, the report found. The attack came via malicious email attachments to victims, which, when opened, would implant a tool that scanned for Bitcoin activity and established a connection for ongoing data gathering and cryptomining.

2. Gold Dragon attacks

In January, the Gold Dragon attack targeted organizers of the Pyeongchang Winter Olympics in South Korea. The fileless malware attack—executed via a malicious Microsoft Word attachment that contained a hidden PowerShell implant script—encrypted stolen data and sent it to the attackers.

3. GhostSecret and Bankshot attacks

The international cybercrime group known as Hidden Cobra is believed to be associated with Operation GhostSecret, an attack targeting the healthcare, finance, entertainment, and telecommunications sectors and stealing data. The latest variation of the attack, called Bankshot, uses an embedded Adobe Flash exploit to allow hackers to get into victims’ systems.

4. LNK exploits

The amount of malware that exploits LNK capabilities grew 59% from Q4 2017 to Q1 2018, the report found. Meanwhile, PowerShell attacks have slowed.

5. Gandcrab ransomware

Growth in new ransomware slowed by 32% in Q1. However, the Gandcrab strain infected some 50,000 systems in the first three weeks of the quarter alone, taking Locky’s place as the ransomware leader. Gandcrab uses advanced methodologies, such as requesting ransom payments through the Dash cryptocurrency rather than through Bitcoin, to extract more value from their targets.

Tips to protect your business

Despite the rise of new attack types, business leaders can take a number of steps to protect employees and data.

In terms of cryptojacking, the attack is blocked by default in the browser Opera. Mozilla’s Firefox 63, due out in October, will block the attacks as well. Users can also download the minerBlock extension for Chrome and Firefox, as noted by TechRepublic contributor James Sanders.

Businesses can avoid the impact of ransomware by backing up files every day, and by taking other preventative steps.

Employee education remains paramount to any cybersecurity policy. Top ways to train employees to avoid cyberattacks include offering customised examples of threats that are relevant to an employee’s department and role (and particularly what phishing attacks look like), running unscheduling simulations of typical attacks, providing training models that employees can complete at their convenience, and rewarding those who take the proper actions.

Development Standards Technologies Tech Republic

Hackers weaponise secure USB drives

/in , ,

A cyber-espionage group is targeting a specific type of secure USB drive created by a South Korean defence company in a bid to gain access to its air-gapped networks.

According to a blog post by researchers at Palo Alto Networks, the attack was carried out by a group called Tick which conducts cyber-espionage activities targeting organisations in Japan and Korea.

Researchers said the weaponisation of a secure USB drive is an uncommon attack technique and likely done in an effort to spread to air-gapped systems – networks that are not connected to the internet.

They added that the malware used in these attacks will only try to infect systems running Microsoft Windows XP or Windows Server 2003.

Researchers said that indicated the malware was intentionally targeting older, out-of-support versions of Microsoft Windows installed on systems with no internet connectivity.

The USB stick installs a program called “SymonLoader” as a trojanised version of a Japanese language GO game.

It then extracts a hidden executable file from a specific type of secure USB drive and executes it on the compromised system.

According to researchers, if SymonLoader finds it is on a Windows XP or Windows Server 2003 system and finds that a newly attached device is a USB drive made by this particular company, then it will extract an unknown executable file from the USB.

Researchers said that while the identity of the file SymonLoader writes to the USB is unknown, they added that they know enough about it to know it is malicious.

“In contrast to HomamLoader, which requires an internet connection to reach its C2 server to download additional payloads, SymonLoader attempts to extract and install an unknown hidden payload from a specific type of secure USB drive when it’s plugged into a compromised system.

“This technique is uncommon and hardly reported among other attacks in the wild,” the researchers said.

Javvad Malik, security advocate at AlienVault, told SC Media UK that this particular attack bears all the signs of a very specific targeted attack designed to infect particular institutes or machines – not too dissimilar to Stuxnet.

“Employees that work in sensitive organisations that have air-gapped networks should be particularly vigilant against plugging in devices. In some cases, even approved USB drives should be tested in a separate environment prior to being loaded in secure areas,” he said.

“Prevention aside, critical systems should have threat detection controls that can alert where an infected drive has been plugged into an endpoint and take remedial steps beyond raising an alarm, such as isolating an infected machine from the rest of the network.”

Scott Walker, senior solutions engineer at Bomgar, told SC Media UK that with certain state-sponsored hacking groups’ focus on the military, financial and energy sectors, it is paramount that these organisations deploy solutions that help prevent these attacks.

“Integrating regular and up to date security training to educate employees will ensure they are aware of the most recent tactics used to target systems and what can be done to prevent these.

“In addition, implementing solutions to ensure that employees only have access to areas of the network and devices that their role requires can mitigate these types of attacks. This sounds simple, but in reality, it is an area often overlooked,” he said.

itnews

Cyber attack claims player details from World Rugby

/in ,

World Rugby has been forced to suspend one of its websites after the governing body was the target of a cyber attack that saw hackers obtain personal data from thousands of subscribers to one of their databases, The Sunday Telegraph can reveal.

It is understood that the hackers were able to access the first name, email address and encrypted passwords of thousands of users, including players, coaches and parents from across the world after the security breach on May 3.

It is not yet clear if it was a random attack to steal data or if World Rugby was deliberately targeted by one of the cyber espionage groups that has previously leaked confidential information from the websites of sporting bodies such as WADA and the IAAF.

The hackers targeted World Rugby’s training and education website, which is a platform for the grass-roots game to keep up to date with the latest drills to improve technique and offer advice for the prevention of injuries such as ­concussion.

World Rugby’s main website, including Rugby World Cup ticketing and fan data plus sensitive information around players’ disciplinary hearings, was not at risk from the attack.

World Rugby immediately took down the affected sites and denied access to databases when it detected the breach and brought in data and technology ­security experts to investigate the nature and scope of the incident and put in steps to prevent a similar attack.

As of yesterday, the training and education portal remained offline.

World Rugby also sent emails to the subscribers to warn them of the breach and reassure them that as the passwords were encrypted, there was no danger of them being breached.

Subscribers, however, were recommended to change their passwords when the site comes back online.

As World Rugby is based in Dublin, the governing body also informed the Irish Data Protection Commissioner’s office of the breach. The details of the attack emerged just days before the EU’s general data protection regulation comes into effect on May 25.

World Rugby could have faced a sanction from the Association of Data Protection Officers (ADPO) if the breach had occurred after that date. The ADPO will have the power to fine organisations up to €10 million (₦4,250,000,000) for data security breaches, depending on mitigating factors.

Sean Burnard, one of the subscribers who received the email alert, said he was alarmed by the breach. Burnard uses the portal to access the training drills and technique tips to help his sons improve their skills.

“At first my concern was that it was a spoof email but then it was confirmed that there had been a security breach,” he said.

The Telegraph

First-Ever Ransomware Found Using ‘Process Doppelgänging’ Attack to Evade Detection

/in , ,

Security researchers have spotted the first-ever ransomware exploiting Process Doppelgänging, a new fileless code injection technique that could help malware evade detection.

The Process Doppelgänging attack takes advantage of a built-in Windows function, i.e., NTFS Transactions, and an outdated implementation of Windows process loader, and works on all modern versions of Microsoft Windows OS, including Windows 10.

Process Doppelgänging attack works by using NTFS transactions to launch a malicious process by replacing the memory of a legitimate process, tricking process monitoring tools and antivirus into believing that the legitimate process is running.

If you want to know more about how Process Doppelgänging attack works in detail, you should read this article published late last year on thehackernews.com.

Shortly after the Process Doppelgänging attack details went public, several threat actors were found abusing it in an attempt to bypass modern security solutions.

Security researchers at Kaspersky Lab have now found the first ransomware, a new variant of SynAck, employing this technique to evade its malicious actions and targeting users in the United States, Kuwait, Germany, and Iran.

Synack Ransomware process - Doppelganging

Initially discovered in September 2017, the SynAck ransomware uses complex obfuscation techniques to prevent reverse engineering, but researchers managed to unpack it and shared their analysis in a blog post.

An interesting thing about SynAck is that this ransomware does not infect people from specific countries, including Russia, Belarus, Ukraine, Georgia, Tajikistan, Kazakhstan, and Uzbekistan.

To identify the country of a specific user, the SynAck ransomware matches keyboard layouts installed on the user’s PC against a hardcoded list stored in the malware. If a match is found, the ransomware sleeps for 30 seconds and then calls ExitProcess to prevent encryption of files.

SynAck ransomware also prevents automatic sandbox analysis by checking the directory from where it executes. If it found an attempt to launch the malicious executable from an ‘incorrect’ directory, SynAck won’t proceed further and will instead terminate itself.

Once infected, just like any other ransomware, SynAck encrypts the content of each infected file with the AES-256-ECB algorithm and provides victims a decryption key until they contact the attackers and fulfil their demands.

Synack Ransomware

SynAck is also capable of displaying a ransomware note to the Windows login screen by modifying the LegalNoticeCaption and LegalNoticeText keys in the registry. The ransomware even clears the event logs stored by the system to avoid forensic analysis of an infected machine.

Although the researchers did not say how SynAck lands on the PC, most ransomware spread through phishing emails, malicious adverts on websites, and third-party apps and programs.

Therefore, you should always exercise caution when opening uninvited documents sent over an email and clicking on links inside those documents unless verifying the source in an attempt to safeguard against such ransomware infection.

Although, in this case, only a few security and antivirus software can defend or alert you against the threat, it is always a good practice to have an effective antivirus security suite on your system and keep it up-to-date.

Last but not the least: to have a tight grip on your valuable data, always have a backup routine in place that makes copies of all your important files to an external storage device that isn’t always connected to your PC.

the hacker news

Android P to stop apps from monitoring network activity

/in ,

In the future, it looks like Android apps will no longer be able to detect when other apps on your device are connecting to the internet.

It’s about time Google patches this nasty privacy flaw. Any app can monitor your network activity without your knowledge to see when you connect with a competing app, or perhaps worse.

XDA Developers first noticed the new changes coming to Android’s SELinux rules for apps targeting API level 28 running on Android P:

A new commit has appeared in the Android Open Source Project to “start the process of locking down proc/net.” /proc/net contains a bunch of output from the kernel related to network activity. There’s currently no restriction on apps accessing /proc/net, which means they can read from here (especially the TCP and UDP files) to parse your device’s network activity.

The SELinux changes only enable designated VPN apps to access some networking information, according to the code. As XDA Developers points out, Android apps won’t have to target API level 28 until 2019 — meaning the flaw could still be accessed for some time.

We’ll be looking for changes in the next release of the Android Open Source Project. Hopefully Google will jump in and patch things before Android P’s future release.

zdnet

GravityRAT: the trojan with a unique trick for evading analysis

/in ,

GravityRAT, a malware allegedly designed by Pakistani hackers, has recently been updated further and equipped with anti-malware evasion capabilites, Maharashtra cybercrime officials said.

The RAT was first detected by Indian Computer Emergency Response Team, CERT-In, on various computers in 2017. It is designed to infiltrate computers and steal the data of users, and relay the stolen data to Command and Control centres in other countries. The ‘RAT’ in its name stands for Remote Access Trojan, which is a program capable of being controlled remotely and thus difficult to trace.

Maharashtra cybercrime department officials said that the latest update to the program by its developers is part of GravityRAT’s function as an Advanced Persistent Threat (APT), which, once it infiltrates a system, silently evolves and does long-term damage.

“GravityRAT is unlike most malware, which are designed to inflict short term damage. It lies hidden in the system that it takes over and keeps penetrating deeper. According to latest inputs, GravityRAT has now become self aware and is capable of evading several commonly used malware detection techniques,” an officer of the cybercrime unit said.

One such technique is ‘sandboxing’, to isolate malware from critical programs on infected devices and provide an extra layer of security.

“The problem, however, is that malware needs to be detected before it can be sandboxed, and GravityRAT now has the ability to mask its presence. Typically, malware activity is detected by the ‘noise’ it causes inside the Central Processing Unit, but GravityRAT is able to work silently. It can also gauge the temperature of the CPU and ascertain if the device is carrying out high intensity activity, like a malware search, and act to evade detection,” another officer said.

Officials said that GravityRAT infiltrates a system in the form of an innocuous looking email attachment, which can be in any format, including MS Word, MS Excel, MS Powerpoint, Adobe Acrobat or even audio and video files.

“The hackers first identify the interests of their targets and then send emails with suitable attachments. Thus a document with ‘share prices’ in the file is sent to those interested in the stock market. Once it is downloaded, it prompts the user to enter a message in a dialogue box, purportedly to prove that the user is not a bot. While the users take this to be a sign of extra security, the action actually initiates the process for the malware to infiltrate the system, triggering several steps that end with GravityRAT sending data to the Command and Control server regularly,” an officer said.

The other concern is that the Command and Control servers are based in several countries. The data is sent in an encrypted format, making it difficult to detect exactly what is leaked.

Special Inspector General of Police (Cyber) Brijesh Singh of Maharashtra Police said, “We urge people to follow basic cyberhygiene like watching what they download, updating their anti-virus software and conducting cyber security reviews regularly.” CERT-In had issued an alert for it last year, with an advisory asking users to review cybersecurity measures and update anti-malware tools.

Yes Chrome is scanning your Windows PC, but it might be a bug

/in , ,

A few days ago Kelly Shortridge, a product manager at SecurityScorecard detected some unexpected behavior on her PC, as a honeypot Canarytoken reported being accessed by Chrome.exe. That’s not what you’d expect from a web browser normally, except for one thing — Google did add some antivirus-y capabilities to its browser on Windows late last year as an enhancement to its Chrome Cleanup tool that can help reset hijacked settings. Google Chrome security lead Justin Schuh explained how the feature works and pointed to some documentation about it, and that was that —

If you are hitting this issue and you want a fix right now then go to chrome://downloads in your browser, go to the menu in the top right, and select Clear All. That will clear Chrome’s list of downloaded files so that it won’t have any files to existence-check at startup. If you have a large list of downloaded files then this will improve startup time slightly.

It turns out the “AV scanning” wasn’t that at all, and what it was doing could affect you right now. It turns out that Chrome is checking the integrity of downloaded files at startup, and a bug lead it to that particular folder. It relies on the Downloaded History list for this check, and if you have a lot of files in there, it could slow down your computer when you start Chrome. While the dev team is working to skip the check entirely in a future update, users worried about it can fix it by clearing their download history.

Cisco Switches in Iran, Russia Hacked in Apparent Pro-US Attack

/in , , ,

Hacked Cisco Switch

A significant number of Cisco switches located in Iran and Russia have been hijacked in what appears to be a hacktivist campaign conducted in protest of election-related hacking. However, it’s uncertain if the attacks involve a recently disclosed vulnerability or simply abuse a method that has been known for more than a year.

Cisco devices belonging to organizations in Russia and Iran have been hijacked via their Smart Install feature. The compromised switches had their IOS image rewritten and their configuration changed to display a U.S. flag using ASCII art and the message “Don’t mess with our elections…”

The hackers, calling themselves “JHT,” told Motherboard that they wanted to send a message to government-backed hackers targeting “the United States and other countries.” They claim to have only caused damage to devices in Iran and Russia, while allegedly patching most devices found in countries such as the U.S. and U.K.

Iran’s Communication and Information Technology Ministry stated that the attack had impacted roughly 3,500 switches in the country, but said a vast majority were quickly restored.

Kaspersky Lab reported that the attack appeared to mostly target the “Russian-speaking segment of the Internet.”

While there are some reports that the attack involves a recently patched remote code execution vulnerability in Cisco’s IOS operating system (CVE-2018-0171), that might not necessarily be the case.

The Cisco Smart Install Client is a legacy utility that allows no-touch installation of new Cisco switches. Roughly one year ago, the company warned customers about misuse of the Smart Install protocol following a spike in Internet scans attempting to detect unprotected devices that had this feature enabled.

Attacks, including ones launched by nation-state threat actors such as the Russia-linked Dragonfly, abused the fact that many organizations had failed to securely configure their switches, rather than an actual vulnerability.

Cisco issued a new warning last week as the disclosure of CVE-2018-0171 increases the risk of attacks, but the networking giant said it had not actually seen any attempts to exploit this vulnerability in the wild. Cisco’s advisory for this flaw still says there is no evidence of malicious exploitation.

There are hundreds of thousands of Cisco switches that can be hijacked by abusing the Smart Install protocol, and Cisco Talos experts believe attackers are unlikely to bother using CVE-2018-0171.

The Network Security Research Lab at Chinese security firm Qihoo 360 says the data from its honeypot shows that the attacks have “nothing to do with CVE-2018-0171” and instead rely on a publicly available Smart Install exploitation tool released several months ago.

While none of the major players in the infosec industry have confirmed that the attacks on Iran and Russia rely on CVE-2018-0171, technical details and proof-of-concept (PoC) code have been made available by researchers, making it easier for hackers to exploit.

Hamed Khoramyar, founder of Sweden-based ICT firm Aivivid, said the attacks exploited CVE-2018-0171. Kudelski Security also reported seeing attacks involving both CVE-2018-0171 and another recently disclosed IOS vulnerability tracked as CVE-2018-0156. However, Kudelski’s blog post also lists Khoramyar as one of its sources.

Security Week

Facebook’s Cambridge Analytica data scandal, explained

/in , ,

Cambridge Analytica improperly obtained data from as many as 50 million people. That’s put Mark Zuckerberg on the defensive.
The Verge

Chrome Is Scanning Files on Your Computer

/in ,

The browser you likely use to read this article scans practically all files on your Windows computer. And you probably had no idea until you read this. Don’t worry, you’re not the only one.

Last year, Google announced some upgrades to Chrome, by far the world’s most used browser—and the one security pros often recommend. The company promised to make internet surfing on Windows computers even “cleaner” and “safer ” adding what The Verge called “basic antivirus features.” What Google did was improve something called Chrome Cleanup Tool for Windows users, using software from cybersecurity and antivirus company ESET.

Tensions around the issue of digital privacy are understandably high following Facebook’s Cambridge Analytica scandal, but as far as we can tell there is no reason to worry here, and what Google is doing is above board.

In practice, Chome on Windows looks through your computer in search of malware that targets the Chrome browser itself using ESET’s antivirus engine. If it finds some suspected malware, it sends metadata of the file where the malware is stored, and some system information, to Google. Then, it asks you to for permission to remove the suspected malicious file. (You can opt-out of sending information to Google by deselecting the “Report details to Google” checkbox.)

A screenshot of the Chrome pop-up that appears if Chrome Cleanup Tool detects malware on your Windows computer.

A screenshot of the Chrome pop-up that appears if Chrome Cleanup Tool detects malware on your Windows computer.

Last week, Kelly Shortridge, who works at cybersecurity startup SecurityScorecard, noticed that Chrome was scanning files in the Documents folder of her Windows computer.

“In the current climate, it really shocked me that Google would so quietly roll out this feature without publicizing more detailed supporting documentation—even just to preemptively ease speculation,” Shortridge told me in an online chat. “Their intentions are clearly security-minded, but the lack of explicit consent and transparency seems to violate their own criteria of ‘user-friendly software’ that informs the policy for Chrome Cleanup [Tool].”

Her tweet got a lot of attention and caused other people in the infosec community—as well as average users such as me—to scratch their heads.

“Nobody likes surprises,” Haroon Meer, the founder at security consulting firm Thinkst, told me in an online chat. “When people fear a big brother, and tech behemoths going too far…a browser touching files it has no business to touch is going to set off alarm bells.”

Now, to be clear, this doesn’t mean Google can, for example, see photos you store on your windows machine. According to Google, the goal of Chrome Cleanup Tool is to make sure malware doesn’t mess up with Chrome on your computer by installing dangerous extensions, or putting ads where they’re not supposed to be.

As the head of Google Chrome security Justin Schuh explained on Twitter, the tool’s “sole purpose is to detect and remove unwanted software manipulating Chrome.” Moreover, he added, the tool only runs weekly, it only has normal user privileges (meaning it can’t go too deep into the system), is “sandboxed” (meaning its code is isolated from other programs), and users have to explicitly click on that box screenshotted above to remove the files and “cleanup.”

In other words, Chrome Cleanup Tool is less invasive than a regular “cloud” antivirus that scans your whole computer (including its more sensitive parts such as the kernel) and uploads some data to the antivirus company’s servers.

But as Johns Hopkins professor Matthew Green put it, most people “are just a little creeped out that Chrome started poking through their underwear drawer without asking.”

That’s the problem here: most users of an internet browser probably don’t expect it to scan and remove files on their computers.

When reached out for comment, a Google spokesperson redirected me to the blog post from last year and Schuh’s tweets.

A section in Chrome’s Privacy Whitepaper explains that “Chrome periodically scans your device to detect potentially unwanted software.” That exact language has been there since at least January of 2017, according to archived versions of the whitepaper. And similar language (“Chrome scans your computer periodically for the sole purpose of detecting potentially unwanted software”) has been there for even longer.

Martijn Grooten, the editor of Virus Bulletin and organizer of one of the premiere antivirus conferences in the world, told me in a Twitter chat that the behavior of the Chrome Cleanup Tool was “sensible.”

“For almost all users, this seems really harmless, and for those who are extremely concerned about Google seeing some metadata, maybe they shouldn’t be running Google’s browser in the first place,” he said.

Motherboard