20% of Risky Emails Bypass Email Security

/in

Far too many risky emails are infiltrating email security solutions, according to a report released Tuesday by Mimecast.

The email and data security company released its second quarterly report on the effectiveness of email security systems, the Mimecast Email Security Risk Assessment (ESRA), based on a study of more than 44,000 users. The results are bleak, depicting how risky and potentially malicious emails continue to infiltrate security solutions.

As much as 9 out of 40 million emails analyzed by Mimecast, all of which passed through an email security vendor or cloud email service, were determined to have the potential for risk. The majority of these emails were spam, but a smaller amount of more dangerous emails also bypassed security, and it only takes one to cause irreversible harm.

More than 8,300 emails examined by Mimecast contained dangerous file attachments, while 1,669 contained known malware and 8,605 were impersonation attacks.

Impersonation attacks, or social engineering scams, are when a cybercriminal attempts to impersonate a trusted individual, like a company CEO, to obtain confidential information from duped employees. These types of scams have risen 400% since the release of Mimecast’s February ESRA report.

Phishing is now the primary entry method for cybercriminals seeking to access organizations according to a recent report from Symantec.

It’s also a preferred method of the Russian military according to a leaked NSA document published Monday by The Intercept. The report describes how the Russian military used email phishing to target United States agencies and services in the lead-up to the 2016 Presidential election.

Hackers attempted to spear-phish a private company in the United States to access information on voting-related technology, as well as targeting government agencies to impede requests for absentee ballots.

MEDIA POST

Password manager OneLogin hacked, exposing sensitive customer data

/in

Password manager and single sign-on provider OneLogin has been hacked.

In a brief blog post, the company’s chief security officer Alvaro Hoyos said that it was aware of “unauthorized access to OneLogin data in our US data region,” and that it had reached out to customers.

Hoyos said that the company had blocked the unauthorized access after the breach and is working with law enforcement.

The blog post initially lacked detailed information about the incident, although the post had omitted that hackers had stolen sensitive customer data — a point that the company had instead only mentioned in an email sent to customers, seen by ZDNet.

“OneLogin believes that all customers served by our US data center are affected and customer data was potentially compromised,” the email read.

Later in the day, the company said in an update: “Our review has shown that a threat actor obtained access to a set of [Amazon Web Services, or AWS] keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US.”

The company confirmed that the attack appears to have started at 2am (PT), but staff were alerted of unusual database activity some seven hours later, who “within minutes, shut down the affected instance as well as the AWS keys that were used to create it”.

“The threat actor was able to access database tables that contain information about users, apps, and various types of keys,” the company said.

The company added that although it encrypts “certain sensitive data at rest,” it could not rule out the possibility that the hacker “also obtained the ability to decrypt data”.

But a spokesperson did not say what kind of data is and isn’t encrypted. We have asked for clarity, and will update when we hear back.

Some had questioned earlier in the day how the hackers had access to customer data that could ultimately be decrypted.

“Am I the only 1 to find it disturbing OneLogin had a decryption method for customer data accessible enough to be grabbed via breach?” said one user on Twitter.

The company has advised customers to change their passwords, generate new API keys for their services, and create new OAuth tokens — used for logging into accounts — as well as to create new security certificates. The company said that information stored in its Secure Notes feature, used by IT administrators to store sensitive network passwords, can be decrypted.

The company also hasn’t said how many customers were affected.

According to its website, dozens of major multinationals, including ARM, Dun & Bradstreet, The Carlyle Group, Conde Nast, and Dropbox (which a spokesperson disputed in an email), are customers.

OneLogin allows corporate users to access multiple web applications, sites, and services with just one password. It’s thought that the company has millions of users serving more than 2,000 companies in dozens of countries, according to CrunchBase.

The single sign-on provider integrates hundreds of different third-party apps and services, such as Amazon Web Services, Microsoft’s Office 365, LinkedIn, Slack, Twitter, and Google services.

It’s the second such breach in as many years. Last August, the company warned users that its Secure Notes service had been accessed by an “unauthorized user,” but it denied that any customer data had been compromised.

ZDNet

Social Media, Brute Force Attacks, Passwords, Fake WAPs & Protecting Yourself

/in , ,

The video above shows a hack of Gmail, but your social media accounts can be just as vulnerable if you choose a common password like:

  • Password
  • 12345
  • QWERTY
  • iloveyou

Social media accounts are online assets, which no matter how big you build them, can still be a liability. This liability comes from how they can be exploited by hackers, especially when you do not take the proper steps to protect them.

You need to put as much effort into protecting your online assets as you do building them. You don’t need an entire IT team to do this, keep reading to learn the basics of what you need to do.

Defeat brute force hacks with better passwords

One of the most brainless hacks out there is known as a brute force hack. I hacker simply sets up a tool to target a specific account and the tool guesses passwords until it is right. You may know these tools as password recovery tools. They have be altered by hackers for nefarious purposes.

You have to defend against brute force hacks with better passwords that are complicated and use a mix of characters.

Fake WAPs: Use a variety of passwords

Let’s say that you took my advice above when you created a password that is “35IrulePLANETearthb1tches!” Good job, but now you have to come up with the new password for each of your social media accounts. This is important because of something known as the fake WAP. This is when a hacker will set up a free Wi-Fi network in a public location. They will then use the network to steal things like passwords.

Your first line of defense should be a good password manager. You can create a very strong password to get into the password manager, and then it could manage a wide variety of strong passwords for you. Good examples include:

Each one is going to help you protect your accounts by using a wide variety of passwords to defend against the fake WAP hack. Even if they do get one password to one of your social media accounts they won’t necessarily get access to all of your other accounts.

Secondary defense against fake WAP

Last failsafe to protect yourself against a fake WAP involves encryption. The problem with the fake WAP is the hacker will set up a hot spot that has no encryption on it. This means that they can see the following in plain text:

  • Confidential information that you send over your social media through private messages.
  • Any customer contact details that you sent back and forth.
  • Brand strategies discussed between related accounts.
  • Any credit card numbers that customers send through there.

The way that you are going to encrypt every single thing that you send over a hotspot, including your social media, is with a VPN with strong encryption. These tools are perfect for this job as they encrypt everything that is transferred to and from your device. All you have to do is connect to the VPN server and that takes care of your encryption, and your social media data.

Do your best against insider threats

Insider threats, especially recently fired employees that still have your social media, are very real. There have been a number of times when staff and being fired but they’re access to the social media has not been removed. The most embarrassing has probably been HMV.

 Here are ways that you can defend against this insider threat:

  • Make a record of all accounts that employees have access to.
  • Have plans in place to remove people from all accounts before they’re fired. Make sure a specific person is assigned to this.
  • If you have multiple accounts that multiple employees are given access to, it may be smart to consolidate these in one social media dashboard. You can use things like HootSuite, SocialFlow, or BufferApp.

The last point will make things easier ‘s that you only have one account to remove access from. Imagine having to remove access to twitter, Facebook, WordPress, Google, LinkedIn, etc.… Consolidate the accounts in one spot to minimize an insider threat caused by oversight on what accounts they have access to.

Social media and online security

Social media is a fantastic way to connect with your customers. It can be a very valuable asset to your company. The value that you get from that can be exploited by hackers for monetary reasons, or simply to troll you. Both of these will wind up costing you money. Invest in these tactics, make sure that your employees follow through on them, and you will save yourself a lot of money and heartache.

Cyber attacks: how your devices can be used

/in

The massive global cyber attack that wreaked havoc in computer systems earlier this month caused plenty of visible disruption, not least in Britain’s National Health Service.

But in the brave new inter-connected world heralded by the internet of things (IoT), so-called “ransomware” attacks could have as their source something quite mundane and yet present in ever more modern households.

In a not so far-off future, the source of a software glitch with serious consequences for the simple consumer could be anything from a connected coffee machine or refrigerator to a techie toy or an outsmart-you television.

Web-connected gadgets are becoming all the rage with tech-aware professionals.

But the mere idea that it only needs a hacker to give the software a malevolent tweak to send them on the blink with disastrous consequences may yet threaten the development of such goods’ popular take-up.

“Regarding last weekend’s attack there is no risk for connected objects. That in particular hit systems running Windows …and today there are no mass market gadgets with Windows loaded in order to function,” says Gerome Billois, a consultant with Wavestone.

“In contrast, there have already been massive attacks on connected objects,” Billois told AFP.

The Mirai malware strain made from hacked IoT devices including badly secured routers and internet connected cameras recently infected hundreds of thousands of poorly secured connected objects.

The idea was not to stop them from working but to transform them into zombies or botnets with a view to using them as relay stations for future cyber attacks.

Last week at a timely cyber security conference in The Netherlands, American wunderkind Reuben Paul, just 11, stunned an audience of security experts by hacking into a teddy bear via bluetooth to show how interconnected smart toys “can be weaponised”.

His prowess showed just how easy it is for tech savvy individuals to use everyday objects to harvest data or use them as spy holes for covert surveillance.

According to documents released in March by Wikileaks, US intelligence can hack smartphones, computers and smart, web-connected TVs, to pilot them and eavesdrop.

“All the other connected objects can be pirated, that has been shown, be it a coffee machine, a refrigerator, a thermostat, electronic entry systems, the lighting system…,” warns Loic Guezo, a cyber security analyst for southern Europe with Japanese security software company Trend Micro.

Mikko Hypponen, head of research at Finnish security specialists F-Secure, has for his part come up with his eponymous Hypponen’s Law.

This states that “once a device is described as ‘intelligent’, you can consider it as vulnerable.”

Neglected security

The future might well spell connected cars – but they too are subject to potential remote hacking, the consequences of which barely need stating.

When hackers lurking with their laptops have finished conjuring what havoc they might wreak on distant roads there are plenty of other things to which they could turn their attention.

These include vases which tell you when they need fresh water, insulin pumps – or how about sex toys?

So, the worried tech consumer may be asking him or herself – can a cyber hacker deprive me of my morning slug of caffeine?

Or maybe keep my thermostat blocked at 10 Celsius – a chilling thought – or even take over my GPS if I don’t hand over a ransom?

Theoretically, yes, specialists tell AFP.

“The logic of a cybercriminal is to make money,” says Wavestone’s Billois. Such an individual will not feel the need to make do with small-scale attacks.

Connected TVs, having rapidly become widespread, are an ideal portal for making ransom demands.

“Tomorrow, one can imagine devices which attack your connected house, bringing it under control, and then you get sent a message by another channel,” muses Guezo.

All that would required would be to perfect the sort of virus one can find on offer within the murky confines of the “darknet”, off the beaten track for day to day netizens.

Cyber security specialists are very much aware of the need to keep working on solutions offering protection as more and more homes go “smart” and “connected” with various boxes as add-ons to their usual routers.

The specialists’ plan is to work with the makers of connected goods in order to incorporate a security interface right from the start, thereby offering what the profession calls “security by design”.

Some experts feel that, in the rush to bring fascinating and cutting edge technologies into the home, the need for commensurate security has been rather left behind.

“It is extremely difficult to calculate the solidity of a connected object in terms of cybersecurity,” Billois regrets.

“As a consumer it is today impossible to know if you are buying a secure connected object or not,” he adds.

“There’s no label such as a made in Europe kind of tag guaranteeing an object won’t catch fire, or won’t pose a risk to children.”

Fin24Tech

Critical flaw in Twitter’s code could let hackers take over your account

/in ,

A security researcher discovered a critical vulnerability in the advertising code of Twitter, the most popular micro-blogging website in the world, which if exploited could let hackers publish updates from any other account without needing access to the victim’s profile.

The white-hat hacker, writing in a blog post this week (22 May), claimed to have uncovered the issue while exploring Twitter’s code for bugs. He said the flaw could give cybercriminals the ability to “publish entries in Twitter-network by any user of this service.”

The vulnerability was initially found on 26 February 2017 and fixed two days later.

The hacker, known as kedrisch, reported the flaw via Twitter’s bug bounty service – a programme managed by the organisation HackerOne which lets researchers disclose bugs in exchange for rewards.

In this instance, kedrisch was handed a bounty of $7,560 (₦2,872,800) for his efforts.

The issue he found was in Twitter’s advertising code. Essentially, the researcher said flaws existed in how the service’s media library uploaded files such as videos, images and gifs to the platform.

Rules surrounding the responsible disclosure programme mean the flaw is only coming to light now.

In a statement, Twitter said: “The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user.

“By sharing media with a victim user and then modifying the post request with the victim’s account ID the media in question would be posted from the victim’s account. This bug was patched […] and no evidence was found of the flaw being exploited by anyone other than the reporter.”

Charlie Miller, a security expert well-known for being part of the collective which remotely hacked a 2014 Jeep Cherokee, tweeted: “As former appsec [Application Security] tech lead for Twitter, I’ll just say I’m not shocked this was in code from the ads team.” He did not elaborate further.

 Last December, kedrisch was awarded $1,120 (₦425,600) for finding a less critical flaw which could let a hacker change comments on Twitter’s official forums. This was publicly disclosed on 12 May 2017.
Most recently, Twitter issued a warning to users of its Vine service that a bug potentially exposed users’ email addresses and phone numbers to unnamed third parties. In an email sent to all impacted Vine users, it said the bug affected the Vine Archive for “less than 24 hours”.
Vine was bought by Twitter back in 2012 however the company decided to shut down the popular short video publishing application earlier this year amid a period of heavy job cuts.

“We want to emphasise that this information can’t directly be used to access your account, and we have no information indicating that it has been misused,” Twitter’s email to Vine users stressed. “We take these incidents very seriously, and we’re sorry this occurred,” it added.

IBTimes

Interconnected smart toys “can be weaponised”

/in , ,

An audience of security experts attending a cybersecurity conference at the World Forum in The Hague (The Netherlands) on Tuesday were shocked when a demonstration done by an 11-year-old “cyber ninja” showed the dismal cyber security standards that are prevailing in technology. He hacked into the Bluetooth devices to manipulate a teddy bear and show how interconnected smart toys “can be weaponised”.

The wonder kid in question is American Reuben Paul, a cyber security expert and white hat hacker who’s currently studying in the sixth standard of a school in Austin, Texas. Techworm had reported about the hacking skills of Reuben way back in 2015 when he warned an audience about the dangers of smartphone hacking while delivering a keynote address as a 9-year-old.

“From airplanes to automobiles, from smartphones to smart homes, anything or any toy can be part of the” Internet of Things (IOT),” Reuben told the crowd. “From terminators to teddy bears, anything or any toy can be weaponised.”

As part of his live demonstration and to prove his point, Reuben deployed his cuddly looking teddy bear ‘Bob’, which connects to the iCloud via Wi-Fi and Bluetooth smart technology to receive and transmit messages.

He then plugged a “Raspberry Pi” – a tiny and low cost computer – into his laptop on stage and started scanning the hall for available Bluetooth devices. To the astonishment of everyone in the hall, Reuben was able to download dozens of numbers including some of top officials.

Then, using the programming language called Python, he went on to hack into his Internet-connected teddy bear via one of the numbers and turned on Bob’s lights and transferred a recorded message from the audience through to the bear.

“Most internet-connected things have a blue-tooth functionality … I basically showed how I could connect to it, and send commands to it, by recording audio and playing the light,” he told AFP explaining his demonstration.

“IOT home appliances, things that can be used in our everyday lives, our cars, lights refrigerators, everything like this that is connected can be used and weaponised to spy on us or harm us.”

For instance, they could be used to steal private information such as passwords, as remote surveillance devices to spy on kids, or to locate a person using GPS.

More terrifyingly, toys could even be programmed to say “meet me at this location and I will pick you up,” Reuben said.

Besides being a cyber-ninja, Reuben is also the youngest American to earn a black belt in Shaolin Kung Fu. With the help from his family, Reuben has set up a non-profit organisation called CyberShaolin whose purpose is to spread awareness about “the dangers of cyber-insecurity”.

Since his talk, Reuben has been receiving congratulatory messages on Twitter from various experts in the infosec community applauding his work.

Reuben’s father, Mano Paul, an IT expert, said that his kid’s cyber skills emerged at the age of six, when he began exploring how software systems worked.

“He has always surprised us. Every moment when we teach him something he’s usually the one who ends up teaching us,” he told the AFP.

Reuben hopes to study cyber-security at either CalTech or MIT universities.

TechWorm

3 Cybersecurity Practices That Small Businesses Need to Consider Now

/in , ,

All businesses, regardless of size, are susceptible to a cyberattack. Anyone associated with a company, from executive to customer, can be a potential target. The hacking threat is particularly dangerous to small businesses who may not have the resources to protect against an attack let alone ransomware.

Norman Guadagno, a senior marketing officer at Carbonite, has said that “almost one in five small business owners say their company has had a loss of data in the past year,” with each data hack costing anything ranging $100,000 to $400,000 [about ₦37,500,000 to ₦150,000,000]. It, therefore, pays to understand cybersecurity to better protect you and your business.

Ransomeware Risks
Ransomware attacks can be especially devastating for small business owners. When hackers seize your data, encrypt it, and demand money in exchange for the key to unlock that data, you are truly at the mercy of the criminals.

Given that smaller businesses are likely to have weaker protection than larger ones, it is important that adequate steps are taken to properly secure your information. Ensure that software and hardware is up to date and change passwords often.

Cloud-Based Security
Using some sort of central data vault is a popular solution for business security. There are a great many companies which provide this service, from the large Nokia Networks to smaller bespoke groups.

The advantage of this approach is that you will have access to the cyber expertise of the vault company while also possessing a significant degree of control over the cloud system you will be using. The disadvantage is that adopting this approach does not make your company immune to hackers since there are points of attack either at the vault company or at your own. But you are at least in expert hands.

Biometric Security
Smartphones are already using thumbprints for user identification purposes, but 2017 promises to deliver even more advancements along these lines. Biometric systems will be able to analyze and evaluate every part of your company’s security features. Touch pads will have sensors able to identify a user from their computer habits like typing speed and even online browsing taste.

The Internet of Things (IoT) is such that security measures are under increasing scrutiny as multiple devices, over ever-expanding distances, can be linked together. This facilitates speedier data sharing and storage as the hardware (and the businesses using the hardware) becomes more familiar to users. But it also means that device-level security must be effective if it is to minimize the risk of an effective cyber attack – multiple-factor authentication is needed.

Increased Automation Assists Security Staff
Biometrics, the cloud, and the increasing prevalence of the IoT are signposting an expanding role for automation in cybersecurity. When the smart systems already mentioned combined with the human element of a security process, a strong deterrent against criminals can be created. Automated technology constantly reviews your protection arrangements, looking for possible gaps and plugging them. The use of these systems complements the work of your staff and safeguards your business against all but the most determined attackers.

Cybersecurity is evolving as it tries to keep pace with increasingly sophisticated hack attacks. This is why it is important to secure your business effectively by taking expert advice. The cost to businesses of cyberattacks is already monumental, and it is growing. Consumers are also becoming more aware of the dangers of computer crime and they will often take their custom to those businesses which take data security seriously. Being small is no excuse for businesses – they must pay heed to industry advice and ensure that they are properly protected against cybercrime in 2017.

Tech.co

Windows 7, not XP, was the reason last week’s WCry worm spread so widely

/in ,

Wanacry stats

Eight days ago, the WCry ransomware worm attacked more than 200,000 computers in 150 countries. The outbreak prompted infected hospitals to turn away patients and shut down computers in banks and telecoms. Now that researchers have had time to analyze the self-replicating attack, they’re learning details that shed new and sometimes surprising light on the world’s biggest ransomware attack.

Chief among the revelations: more than 97 percent of infections hit computers running Windows 7, according to attacks seen by antivirus provider Kaspersky Lab. By contrast, infected Windows XP machines were practically non-existent, and those XP PCs that were compromised were likely manually infected by their owners for testing purposes. That’s according to Costin Raiu, director of Kaspersky Lab’s Global Research and Analysis Team, who spoke to Ars.

While the estimates are based only on computers that run Kaspersky software, as opposed to all computers on the Internet, there’s little question Windows 7 was overwhelmingly affected by WCry, which is also known as “WannaCry” and “WannaCrypt.” Security ratings firm BitSight found that 67 percent of infections hit Windows 7, Reuters reported.

The figures challenge the widely repeated perception that the outbreak was largely the result of end users who continued to deploy Windows XP, a Windows version Microsoft decommissioned three years ago. In fact, researchers now say, XP was largely untouched by last week’s worm because PCs crashed before WCry could take hold. Instead, it now appears, the leading contributor to the virally spreading infection were Windows 7 machines that hadn’t installed a critical security patch Microsoft issued in March

The Kaspersky figures are illuminating because they show Windows 7 x64 Edition, which is widely used by large organizations, being infected close to twice as much as Windows 7 versions mostly used in homes and small offices. It’s not clear if that means enterprises are less likely to patch or if there are other explanations.

Also on Friday, researchers published convincing evidence that malicious spam e-mails played no role in initially seeding last week’s ransomware worm. Rather, according to a blog post published by AV provider Malwarebytes, it spread through a mechanism that scanned the Internet for computers with open Server Message Block ports. The worm then used a modified version of “EternalBlue,”—the advanced SMB exploit that was developed by the National Security Agency and leaked by the Shadow Brokers group—to install WCry on vulnerable computers. From there, WCry propagated from vulnerable machine to vulnerable machine inside local networks.

“Developing a well-crafted campaign to identify just… a few thousand vulnerable machines would allow for the widespread distribution of this malware on the scale and speed that we saw with this particular ransomware variant,” Malwarebytes Senior Malware Intelligence Analyst Adam McNeil wrote.

A third revelation: more people than previously known may have been repackaging EternalBlue and other recently leaked NSA exploits in the weeks before the WCry outbreak. Security firm Secdo said on Friday that it unearthed evidence showing that multiple groups exploited the SMB vulnerabilities to install a separate ransomware package, steal login credentials, and to conscript computers into a botnet.

According to Secdo researcher Gil Barak:

Based on these findings, we suspect that the scope of the damage is much greater than previously thought and that there are at least three different groups that have been leveraging the NSA exploit to infect enterprise networks since late April… These attacks demonstrate that many endpoints may still be compromised despite having installed the latest security patch.

Researchers from a separate security firm already showed that criminals were using EternalBlue to make vulnerable computers part of a cryptocurrency mining botnet. A Secdo representative said the attacks the company reported occurred around the same time.

Meanwhile, EternalRocks—a separate self-replicating exploit also developed by the NSA and released in last month’s Shadow Brokers release—is also being repackaged in active attacks. Researcher Miroslav Stampar has details here.

Finally, as reported by Wired on Friday, attackers have been using a knock-off of the powerful Mirai Internet-of-things botnet to attack two servers that are currently preventing WCry and a WCry copycat variant from spreading. Before executing on a vulnerable computer, the worms are programmed to reach out to hardcoded domain names. If the domains respond, the worm aborts without infecting or spreading. Researchers suspect developers intended the mechanism to function as a killswitch they could use to stop the worm, should attackers lose control of it. Should the distributed denial-of-service attacks knock the servers out of commission, there is the possibility the self-replicating infections could start again.

MalwareTech, the pseudonymous researcher who registered the domain that stopped last Friday’s WCry worm, said he’s not concerned about the attacks. He explained to Ars: “at this point, very few samples are actually spreading, so even if the sinkhole were to go offline, the damage would be limited.”

Just to be on the safe side, he has sought the help of an unnamed DDoS mitigation service.

Coda Developer Panic Says Source Code for Several Apps Stolen via Handbrake Malware Attack

/in ,

In a blog post on Wednesday, Panic Inc. developer and co-founder Steven Frank disclosed that he downloaded a malware infected version of HandBrake earlier this month, which led to the theft of the source code for several of the company’s popular apps.

In early May, a mirror download server hosting the popular video coding app Handbrake was hacked, and an infected version of the Handbrake app took the place of the genuine article. The hacked version infected user’s machines with OSX.PROTON, which gave hackers root-access privileges to a Mac.

Hacker’s were able to access Frank’s Mac via the infected app, and collected his login credentials, including his git credentials. Frank assures Panic customers that the hacker’s did not access customer data or sync data.

In a case of extraordinarily bad luck, even for a guy that has a lot of bad computer luck, I happened to download HandBrake in that three day window, and my work Mac got pwned.

Long story short, somebody, somewhere, now has quite a bit of source code to several of our apps.

Before I continue, three important points:

  • There’s no indication any customer information was obtained by the attacker.
  • Furthermore, there’s no indication Panic Sync data was accessed.
  • Finally, our web server was not compromised.

(As a reminder, we never store credit card numbers since we process them with Stripe, and all Panic Sync data is encrypted in such a way that even we can’t see it. Read more.)

Panic offers several popular apps, including web editor Coda, FTP app Transmit, SSH client Prompt, and more. The attackers have demanded a large ransom, to be paid via Bitcoin. Panic does not intend to pay the ransom.

Panics warns customers to only download Panic’s apps from the Panic website or the Mac App Store, as the stolen source code could potentially be used to create malware-laden versions of the software packages.

Panic has been in contact with both Apple and the FBI, and Apple’s team is on the lookout for any stolen or malware-infested versions of the Panic apps. The FBI is investigating the matter.

Frank asks that customers notify the company if they see any unofficial Panic apps available in the wild. Such apps are likely to be infected with malware in an attempt to spread their evil payload.

We’ll be working overtime for the foreseeable future to keep an eye on this situation.

But we could also use your help.

If you see any cracked or otherwise unofficial versions of our apps in the wild, it’s safest to assume they are infected, and we ask that you please let us know. If you see our source show up somewhere, also let us know. And if you have information that could help with the investigation into this incident, definitely let us know.

MacTrast

WannaCry Ransomware Decryption Tool Released; Unlock Files Without Paying Ransom

/in

If your PC has been infected by WannaCry – the ransomware that wreaked havoc across the world last Friday – you might be lucky to get your locked files back without paying the ransom of $300 to the cyber criminals.

Adrien Guinet, a French security researcher from Quarkslab, has discovered a way to retrieve the secret encryption keys used by the WannaCry ransomware for free, which works on Windows XP, Windows 7, Windows Vista, Windows Server 2003 and 2008 operating systems.

WannaCry Ransomware Decryption Keys

The WannaCry’s encryption scheme works by generating a pair of keys on the victim’s computer that rely on prime numbers, a “public” key and a “private” key for encrypting and decrypting the system’s files respectively.

To prevent the victim from accessing the private key and decrypting locked files himself, WannaCry erases the key from the system, leaving no choice for the victims to retrieve the decryption key except paying the ransom to the attacker.

But here’s the kicker: WannaCry “does not erase the prime numbers from memory before freeing the associated memory,” says Guinet.

Based on this finding, Guinet released a WannaCry ransomware decryption tool, named WannaKey, that basically tries to retrieve the two prime numbers, used in the formula to generate encryption keys from memory, and works on Windows XP only.

Note: Below I have also mentioned another tool, dubbed WanaKiwi, that works for Windows XP to Windows 7.

“It does so by searching for them in the wcry.exe process. This is the process that generates the RSA private key. The main issue is that the CryptDestroyKey and CryptReleaseContext does not erase the prime numbers from memory before freeing the associated memory.” says Guinet

So, that means, this method will work only if:

  • The affected computer has not been rebooted after being infected.
  • The associated memory has not been allocated and erased by some other process.

“In order to work, your computer must not have been rebooted after being infected. Please also note that you need some luck for this to work (see below), and so it might not work in every case!,” Guinet says.

“This is not really a mistake from the ransomware authors, as they properly use the Windows Crypto API.”

While WannaKey only pulls prime numbers from the memory of the affected computer, the tool can only be used by those who can use those prime numbers to generate the decryption key manually to decrypt their WannaCry-infected PC’s files.

Good news is that another security researcher, Benjamin Delpy, developed an easy-to-use tool called “WanaKiwi,” based on Guinet’s finding, which simplifies the whole process of the WannaCry-infected file decryption.

All victims have to do is download WanaKiwi tool from Github and run it on their affected Windows computer using the command line (cmd).

WanaKiwi works on Windows XP, Windows 7, Windows Vista, Windows Server 2003 and 2008, confirmed Matt Suiche from security firm Comae Technologies, who has also provided some demonstrations showing how to use WanaKiwi to decrypt your files.

Although the tool won’t work for every user due to its dependencies, still it gives some hope to WannaCry’s victims of getting their locked files back for free even from Windows XP, the aging, largely unsupported version of Microsoft’s operating system.

The Hacker News