Key Aspects of Code Obfuscation

/in , ,

Code obfuscation is a process used to modify source code in a way that makes it harder to understand or reverse engineer, while still maintaining its functionality. Developers employ code obfuscation techniques to protect their software from unauthorized access, tampering, and reverse engineering. Let’s explore some key aspects of code obfuscation:

Remove Superfluous Data

The first step in code hardening is to eliminate unnecessary elements from your code. This includes removing redundant functions, debugging information, and metadata. By streamlining your codebase, you reduce the attack surface and make it more challenging for attackers to find vulnerabilities.

String Encryption

Encrypting strings within your code can make it difficult for attackers to extract sensitive information. By converting strings into an encoded format, you enhance security without altering the program’s behaviour.

Process Order Obfuscation

Rearrange the order of instructions or functions in your code. This can confuse reverse engineers and disrupt their understanding of the program’s logic.

Memory Randomization

Randomize memory addresses or data structures used by your program. This prevents attackers from predicting memory layouts and exploiting vulnerabilities.

Naming Obfuscation

Rename variables, functions, and classes in a way that doesn’t reveal their purpose. Meaningless or deceptive names make it harder for attackers to decipher the code.

Control Flow Obfuscation

Alter the control flow of your program by introducing conditional jumps, loops, or other constructs. This confuses static analysis tools and makes it challenging to follow the program’s execution path.

Remember that while code obfuscation enhances security, it may also increase execution time and overhead. Striking the right balance between protection and performance is crucial for real-world applications.

Why not to use nulled WordPress Themes and Plugins

/in , ,

Navigating the world of WordPress themes and plugins can be daunting, especially with the temptation of nulled (pirated or illegally obtained) themes and plugins. However, it’s crucial to understand the risks associated with using nulled WordPress themes and plugins. Here are several compelling reasons why you must avoid them:

1. Security Vulnerabilities

Nulled themes and plugins often contain hidden malicious code inserted by hackers. This code can compromise the security of your website, leading to malware infections, data breaches, and unauthorized access.

2. Lack of Updates and Support

Legitimate WordPress themes and plugins receive regular updates to address security vulnerabilities, introduce new features, and ensure compatibility with the latest version of WordPress. Nulled themes and plugins do not receive these updates, leaving your website vulnerable to security risks and compatibility issues. Furthermore, you won’t have access to customer support from the original developers if you encounter any issues.

3. Legal Risks

Using nulled themes and plugins is illegal and violates copyright laws. By downloading and using pirated software, you expose yourself to legal consequences, including fines and potential lawsuits from developers and copyright holders.

4. Poor Code Quality

Nulled themes and plugins are often poorly coded and lack proper documentation. This can lead to performance issues, website errors, and conflicts with other themes and plugins. In contrast, legitimate WordPress themes and plugins undergo rigorous testing and adhere to coding best practices to ensure optimal performance and reliability.

5. Blacklisting by Search Engines

Search engines like Google can detect websites using pirated software and may penalize them by lowering their search rankings or removing them from search results altogether. This can significantly impact your website’s visibility and traffic, ultimately affecting your online presence and business success.

6. Backdoor Access

Nulled themes and plugins may contain backdoors that allow hackers to gain unauthorized access to your website. Once inside, hackers can steal sensitive information, install malware, or hijack your website for malicious purposes.

7. Hidden Ads and Affiliate Links

Some nulled themes and plugins include hidden ads or affiliate links that generate revenue for the hacker. These ads can appear on your website without your knowledge or consent, detracting from the user experience and potentially driving visitors away.

8. Loss of Reputation

Using nulled themes and plugins can damage your reputation as a website owner or developer. Visitors may view your website as untrustworthy or insecure, leading to a loss of credibility and potential customers.

9. Compatibility Issues

Nulled themes and plugins may not be compatible with other WordPress themes, plugins, or updates, leading to website errors, broken functionality, and poor user experience.

10. Voided Warranties

Many legitimate theme and plugin developers offer warranties and guarantees to customers who purchase their products. However, by using nulled software, you forfeit any warranties or guarantees, leaving you without recourse if something goes wrong.

In summary, the risks associated with using nulled WordPress themes and plugins are extensive and far-reaching. It’s essential to prioritize the security, integrity, and legality of your website by investing in legitimate themes and plugins from reputable developers. By doing so, you can protect your website, your reputation, and your business from harm.

Common motivations to use nulled WordPress themes & plugins

/in , ,

Despite the associated risks, here are some reasons people may be tempted to use nulled WordPress themes and plugins.

1. Cost Savings

One of the primary reasons people opt for nulled themes and plugins is to avoid paying for legitimate versions. Nulled versions are typically available for free or at a significantly lower cost than purchasing the original product.

2. Access to Premium Features

Nulled themes and plugins often claim to offer premium features and functionality found in paid versions. This can be appealing to users who want access to advanced features without having to pay for them.

3. Ease of Access

Nulled themes and plugins are readily available for download from various websites, file-sharing platforms, and online forums. This accessibility makes it convenient for users to obtain and install pirated software without going through official channels.

4. Experimentation and Testing

Some users may use nulled themes and plugins for testing purposes or to experiment with different designs and functionalities on their websites before committing to purchasing the original product.

5. Lack of Awareness

In some cases, users may not be aware of the risks associated with using nulled software. They may mistakenly believe that downloading and using pirated themes and plugins is harmless or acceptable.

6. Desperation or Urgency

Users facing tight budgets or urgent deadlines may resort to using nulled themes and plugins as a quick and inexpensive solution to address their immediate needs.

7. Peer Pressure or Recommendations

In online communities or forums, users may encounter recommendations or endorsements for nulled themes and plugins from other members. Peer pressure or positive reviews may influence users to try out pirated software despite the potential risks.

8. Lack of Technical Knowledge

Some users may lack the technical knowledge or expertise to evaluate the risks associated with using nulled themes and plugins. They may not fully understand the potential security vulnerabilities or legal implications involved.

It’s important to note that while these reasons may seem compelling, the risks associated with using nulled WordPress themes and plugins far outweigh any perceived benefits. Users must prioritize the security, integrity, and legality of their websites by investing in legitimate themes and plugins from reputable developers.

How to send a WhatsApp chat without saving the contact

/in ,

WhatsApp is one of the most popular applications. It makes communication as simple as adding the correct number of anyone in the world and voila, that’s it. However, it can be somewhat annoying that in order to message someone, you always have to first add that person in your address book, but there are so many occasions where you just want to communicate with someone for a couple of messages and nothing else.

That’s why many third-party apps take care of this simple task for you. It shouldn’t be that difficult to send messages through WhatsApp without saving the contact. The problem is that these apps can compromise the security and functionality of your smartphone. They might also be incompatible with certain operating systems.

To help you resolve this issue, we’ll show you how to send messages through WhatsApp without having to add the contact to your address book. And best of all, this method doesn’t require that you install other apps and it works for both iOS and Android operating systems.

The Process:

This process may at first glance seem somewhat confusing for users who are not very experienced using their smartphone. But once you complete the process one time, it will be a piece of cake every time after that.

  • Open your preferred browser on your smartphone.
  • Type the following link in the search bar: https://api.whatsapp.com/send?phone=XXXXXXXXXXX (In place of the Xs type the phone number of the person you want to contact, including the country code, but without the + sign.)
  • That means that if the person has a Nigerian number (with the +234 prefix), it would look something like this: https://api.whatsapp.com/send?phone=2348038657737
  • Press ‘enter‘ on your smartphone.
  • A WhatsApp window will open asking if you want to send a message to that phone number. Press on ‘send message‘.
  • You will automatically be redirected to WhatsApp with the ‘start chatting‘ window to the person you entered in your phone.

Programmer finds ridiculous ATM loophole that let him withdraw ₦377 million in cash

/in , , ,

It sounds like something straight out of a movie: an unsatisfied bank programmer discovers the perfect scheme for making an ATM spit out free money.

But apparently, this story is true: The South China Morning Postand China’s Daily Economic News report that 43-year-old Qin Qisheng managed to withdraw over 7 million yuan (upwards of ₦377 million) from ATMs operated by his employer, Huaxia Bank — all by exploiting a crazy loophole.

According to the reports, the bank’s system didn’t properly record withdrawals made around midnight — effectively spitting out cash without removing the total from a user’s account. Normally, that might send up a red flag that a transaction had failed, but Qisheng allegedly inserted scripts into the system that suppressed those alerts.

Qisheng started pulling out money in November 2016, but it wasn’t until January 2018, some 1,358 withdrawals later, that the bank discovered the bad code in its system and brought him to the authorities.

Perhaps the most surprising part of this story: the bank didn’t want to keep pressing charges once he’d returned the money. Maybe fearing the bad publicity (apparently the loophole has already been fixed), Huaxia Bank reportedly asked police to drop the case — reportedly accepting Qisheng’s explanation that he was merely testing the bank’s security and was holding onto the money for the bank to reclaim. As one does.

The courts refused, though, and Qisheng is now looking at 10 and a half years in prison after losing his appeal. They didn’t buy the argument, considering that he’d moved the money to his personal bank account, instead of the bank’s dummy account, and had apparently been investing some in the stock market, too.

The Verge

WhatsApp restricts message-sharing to fight fake news

/in ,

WhatsApp is limiting all its members to forwarding any single message up to five times in an effort to tackle the spread of false information on the platform.

The Facebook-owned business had already introduced the policy in India six months ago.

The move followed a number of mob lynchings that were blamed on fake reports spread via the service.

Until now, users elsewhere could forward messages up to 20 times.

The update to the app’s rules was announced at an event in Jakarta, Indonesia. The country is holding its general election in April.

The firm told the BBC it had made its decision after “carefully” evaluating the results of its half-year-long test in the country.

“The forward limit significantly reduced forwarded messages around the world,” a spokeswoman added.

“[This] will help keep WhatsApp focused on private messaging with close contacts. We’ll continue to listen to user feedback about their experience, and over time, look for new ways of addressing viral content.”

Scrambled messages

Up to 256 users can be enrolled in a WhatsApp group.

So, theoretically, a single user can now only forward a message up to 1,280 other individuals rather than the 5,120 people figure that had been possible previously.

There is nothing, however, to stop those on the receiving end each forwarding the message up to five times themselves.

The restriction comes at a time WhatsApp and Facebook’s other services are under scrutiny for their role in the spread of propaganda and other untruths online.

Last week, Facebook announced it had removed 500 pages and accounts allegedly involved in peddling fake news in Central Europe, Ukraine and other Eastern European nations.

It also recently announced that it had employed a UK-fact-checking service to flag content on its main platform .

However, the use of end-to-end encryption by WhatsApp means its messages can only be read by their senders and recipients, limiting the firm’s ability to spot false reports.

But at the end of last year, the Indian press reported that the governmentwas considering a change to the law that would force Facebook to police WhatsApp for “unlawful” content. This would challenge its use of the encryption technology.

BBC

Zimbabwe blocks Facebook, WhatsApp and Twitter amid crackdown

/in ,

Zimbabwe has blocked Facebook, Twitter and WhatsApp messaging app amid a crackdown on days of violent protests, BBC reported on Friday.

A coalition of local human rights groups says at least 12 people have been killed and many more beaten and tortured by security forces this week.

The Zimbabwe Human Rights NGO Forum accused the authorities of cutting off the internet “to mask the massive human rights violations”.

The protests were sparked on Monday by a sharp rise in the price of fuel.

The government has blamed the opposition and political rights groups for the protests, which has seen riot police clashing with protesters in the capital, Harare, and the southern city of Bulawayo after they lit fires and blocked roads using rocks.

There has been looting and some businesses and schools in the two cities have been forced to close. Soldiers are guarding petrol stations, where there are still long queues of motorists looking for petrol.

The UN has called on the government to halt the “excessive use of force” by security forces including firing live ammunition, and allegations of night-time door-to-door searches and beatings.

“Doctors’ associations say more than 60 people were treated in hospital for gunshot wounds, this is not way to react to the expression of economic grievances by the population,” Reuters news agency quotes UN human rights spokesperson Ravina Shamdasani as saying.

The Zimbabwe Human Rights NGO Forum said it had recorded at least 844 human rights violations in all.

On Thursday, prominent activist Evan Mawarire, who called for a stay-at-home protest on social media, was charged with subverting the government, a crime which carries up to 20 years in jail. He gained fame as a figurehead of the #ThisFlag protests against the former president, Robert Mugabe, in 2016.

President Emmerson Mnangagwa said the rise was aimed at tackling shortages caused by an increase in fuel use and “rampant” illegal trading.

But many Zimbabweans – worn down by years of economic hardship – suddenly found they could not even afford the bus fare to work.

Roads were barricaded by protesters earlier this week

They feel that the president, who is on a tour of Russia and Asian countries this week, is failing to live up to his promises following his election last year in disputed polls.

He is struggling to revive the economy, which is experiencing high inflation while wages have stagnated.

The southern African nation faces a severe shortage of US dollar cash and confidence in its bond notes, currency that can only be traded in Zimbabwe, is low.

The bond notes, or “bollars”, are supposed to be worth the same as the dollar but have lost value because of a lack of foreign currency backing the note, and are now worth much less than a dollar.

The fuel hike means petrol prices rose from $1.24 (₦445.16) a litre to $3.31(₦1,188.29) , with diesel up from $1.36(₦488.24) a litre to $3.11(₦1,116.49).

The new prices mean Zimbabwe now has the most expensive fuel in the world, according to GlobalPetrolPrices.com.

Hackers weaponise secure USB drives

/in , ,

A cyber-espionage group is targeting a specific type of secure USB drive created by a South Korean defence company in a bid to gain access to its air-gapped networks.

According to a blog post by researchers at Palo Alto Networks, the attack was carried out by a group called Tick which conducts cyber-espionage activities targeting organisations in Japan and Korea.

Researchers said the weaponisation of a secure USB drive is an uncommon attack technique and likely done in an effort to spread to air-gapped systems – networks that are not connected to the internet.

They added that the malware used in these attacks will only try to infect systems running Microsoft Windows XP or Windows Server 2003.

Researchers said that indicated the malware was intentionally targeting older, out-of-support versions of Microsoft Windows installed on systems with no internet connectivity.

The USB stick installs a program called “SymonLoader” as a trojanised version of a Japanese language GO game.

It then extracts a hidden executable file from a specific type of secure USB drive and executes it on the compromised system.

According to researchers, if SymonLoader finds it is on a Windows XP or Windows Server 2003 system and finds that a newly attached device is a USB drive made by this particular company, then it will extract an unknown executable file from the USB.

Researchers said that while the identity of the file SymonLoader writes to the USB is unknown, they added that they know enough about it to know it is malicious.

“In contrast to HomamLoader, which requires an internet connection to reach its C2 server to download additional payloads, SymonLoader attempts to extract and install an unknown hidden payload from a specific type of secure USB drive when it’s plugged into a compromised system.

“This technique is uncommon and hardly reported among other attacks in the wild,” the researchers said.

Javvad Malik, security advocate at AlienVault, told SC Media UK that this particular attack bears all the signs of a very specific targeted attack designed to infect particular institutes or machines – not too dissimilar to Stuxnet.

“Employees that work in sensitive organisations that have air-gapped networks should be particularly vigilant against plugging in devices. In some cases, even approved USB drives should be tested in a separate environment prior to being loaded in secure areas,” he said.

“Prevention aside, critical systems should have threat detection controls that can alert where an infected drive has been plugged into an endpoint and take remedial steps beyond raising an alarm, such as isolating an infected machine from the rest of the network.”

Scott Walker, senior solutions engineer at Bomgar, told SC Media UK that with certain state-sponsored hacking groups’ focus on the military, financial and energy sectors, it is paramount that these organisations deploy solutions that help prevent these attacks.

“Integrating regular and up to date security training to educate employees will ensure they are aware of the most recent tactics used to target systems and what can be done to prevent these.

“In addition, implementing solutions to ensure that employees only have access to areas of the network and devices that their role requires can mitigate these types of attacks. This sounds simple, but in reality, it is an area often overlooked,” he said.

itnews

First-Ever Ransomware Found Using ‘Process Doppelgänging’ Attack to Evade Detection

/in , ,

Security researchers have spotted the first-ever ransomware exploiting Process Doppelgänging, a new fileless code injection technique that could help malware evade detection.

The Process Doppelgänging attack takes advantage of a built-in Windows function, i.e., NTFS Transactions, and an outdated implementation of Windows process loader, and works on all modern versions of Microsoft Windows OS, including Windows 10.

Process Doppelgänging attack works by using NTFS transactions to launch a malicious process by replacing the memory of a legitimate process, tricking process monitoring tools and antivirus into believing that the legitimate process is running.

If you want to know more about how Process Doppelgänging attack works in detail, you should read this article published late last year on thehackernews.com.

Shortly after the Process Doppelgänging attack details went public, several threat actors were found abusing it in an attempt to bypass modern security solutions.

Security researchers at Kaspersky Lab have now found the first ransomware, a new variant of SynAck, employing this technique to evade its malicious actions and targeting users in the United States, Kuwait, Germany, and Iran.

Synack Ransomware process - Doppelganging

Initially discovered in September 2017, the SynAck ransomware uses complex obfuscation techniques to prevent reverse engineering, but researchers managed to unpack it and shared their analysis in a blog post.

An interesting thing about SynAck is that this ransomware does not infect people from specific countries, including Russia, Belarus, Ukraine, Georgia, Tajikistan, Kazakhstan, and Uzbekistan.

To identify the country of a specific user, the SynAck ransomware matches keyboard layouts installed on the user’s PC against a hardcoded list stored in the malware. If a match is found, the ransomware sleeps for 30 seconds and then calls ExitProcess to prevent encryption of files.

SynAck ransomware also prevents automatic sandbox analysis by checking the directory from where it executes. If it found an attempt to launch the malicious executable from an ‘incorrect’ directory, SynAck won’t proceed further and will instead terminate itself.

Once infected, just like any other ransomware, SynAck encrypts the content of each infected file with the AES-256-ECB algorithm and provides victims a decryption key until they contact the attackers and fulfil their demands.

Synack Ransomware

SynAck is also capable of displaying a ransomware note to the Windows login screen by modifying the LegalNoticeCaption and LegalNoticeText keys in the registry. The ransomware even clears the event logs stored by the system to avoid forensic analysis of an infected machine.

Although the researchers did not say how SynAck lands on the PC, most ransomware spread through phishing emails, malicious adverts on websites, and third-party apps and programs.

Therefore, you should always exercise caution when opening uninvited documents sent over an email and clicking on links inside those documents unless verifying the source in an attempt to safeguard against such ransomware infection.

Although, in this case, only a few security and antivirus software can defend or alert you against the threat, it is always a good practice to have an effective antivirus security suite on your system and keep it up-to-date.

Last but not the least: to have a tight grip on your valuable data, always have a backup routine in place that makes copies of all your important files to an external storage device that isn’t always connected to your PC.

the hacker news

GravityRAT: the trojan with a unique trick for evading analysis

/in ,

GravityRAT, a malware allegedly designed by Pakistani hackers, has recently been updated further and equipped with anti-malware evasion capabilites, Maharashtra cybercrime officials said.

The RAT was first detected by Indian Computer Emergency Response Team, CERT-In, on various computers in 2017. It is designed to infiltrate computers and steal the data of users, and relay the stolen data to Command and Control centres in other countries. The ‘RAT’ in its name stands for Remote Access Trojan, which is a program capable of being controlled remotely and thus difficult to trace.

Maharashtra cybercrime department officials said that the latest update to the program by its developers is part of GravityRAT’s function as an Advanced Persistent Threat (APT), which, once it infiltrates a system, silently evolves and does long-term damage.

“GravityRAT is unlike most malware, which are designed to inflict short term damage. It lies hidden in the system that it takes over and keeps penetrating deeper. According to latest inputs, GravityRAT has now become self aware and is capable of evading several commonly used malware detection techniques,” an officer of the cybercrime unit said.

One such technique is ‘sandboxing’, to isolate malware from critical programs on infected devices and provide an extra layer of security.

“The problem, however, is that malware needs to be detected before it can be sandboxed, and GravityRAT now has the ability to mask its presence. Typically, malware activity is detected by the ‘noise’ it causes inside the Central Processing Unit, but GravityRAT is able to work silently. It can also gauge the temperature of the CPU and ascertain if the device is carrying out high intensity activity, like a malware search, and act to evade detection,” another officer said.

Officials said that GravityRAT infiltrates a system in the form of an innocuous looking email attachment, which can be in any format, including MS Word, MS Excel, MS Powerpoint, Adobe Acrobat or even audio and video files.

“The hackers first identify the interests of their targets and then send emails with suitable attachments. Thus a document with ‘share prices’ in the file is sent to those interested in the stock market. Once it is downloaded, it prompts the user to enter a message in a dialogue box, purportedly to prove that the user is not a bot. While the users take this to be a sign of extra security, the action actually initiates the process for the malware to infiltrate the system, triggering several steps that end with GravityRAT sending data to the Command and Control server regularly,” an officer said.

The other concern is that the Command and Control servers are based in several countries. The data is sent in an encrypted format, making it difficult to detect exactly what is leaked.

Special Inspector General of Police (Cyber) Brijesh Singh of Maharashtra Police said, “We urge people to follow basic cyberhygiene like watching what they download, updating their anti-virus software and conducting cyber security reviews regularly.” CERT-In had issued an alert for it last year, with an advisory asking users to review cybersecurity measures and update anti-malware tools.