Tag Archive for: Hackers

A way to access Google accounts without a password by Hackers

/in ,

A recent discovery by security researchers has unveiled a new hacking technique that enables cyber criminals to infiltrate individuals’ Google accounts without requiring their passwords. CloudSEK, a security firm, conducted an analysis and identified a malicious form of malware that exploits third-party cookies to gain unauthorized access to users’ private data. This dangerous exploit is already being actively tested by various hacking groups.

The revelation of this exploit occurred in October 2023 when a hacker shared information about it on a Telegram channel. The hacker explained how accounts could be compromised through a vulnerability associated with cookies. Cookies are utilized by websites and browsers to track users and enhance their browsing experience.

Google authentication cookies play a crucial role in allowing users to access their accounts without repeatedly entering their login credentials. However, the hackers have discovered a method to retrieve these cookies, thereby bypassing the security measures of two-factor authentication.

To address this issue, Google Chrome, the world’s most widely used web browser with a market share exceeding 60% last year, is currently taking steps to crack down on third-party cookies.

“We routinely upgrade our defences against such techniques and to secure users who fall victim to malware. In this instance, Google has taken action to secure any compromised accounts detected,” Google said in a statement.

“Users should continually take steps to remove any malware from their computer, and we recommend turning on Enhanced Safe Browsing in Chrome to protect against phishing and malware downloads.”

The researchers who first uncovered the threat said it “underscores the complexity and stealth” of modern cyber-attacks.

“This exploit enables continuous access to Google services, even after a user’s password is reset,” Pavan Karthick M, a threat intelligence researcher at CloudSEK, wrote in a blog post detailing the issue.

“It highlights the necessity for continuous monitoring of both technical vulnerabilities and human intelligence sources to stay ahead of emerging cyber threats.”

The report, titled ‘Exploiting Undocumented OAuth2 Functionality for session hijacking: Malwares Compromising Google Accounts’, was authored by Pavan Karthick M., a threat intelligence researcher at CloudSEK.

Hackers weaponise secure USB drives

/in , ,

A cyber-espionage group is targeting a specific type of secure USB drive created by a South Korean defence company in a bid to gain access to its air-gapped networks.

According to a blog post by researchers at Palo Alto Networks, the attack was carried out by a group called Tick which conducts cyber-espionage activities targeting organisations in Japan and Korea.

Researchers said the weaponisation of a secure USB drive is an uncommon attack technique and likely done in an effort to spread to air-gapped systems – networks that are not connected to the internet.

They added that the malware used in these attacks will only try to infect systems running Microsoft Windows XP or Windows Server 2003.

Researchers said that indicated the malware was intentionally targeting older, out-of-support versions of Microsoft Windows installed on systems with no internet connectivity.

The USB stick installs a program called “SymonLoader” as a trojanised version of a Japanese language GO game.

It then extracts a hidden executable file from a specific type of secure USB drive and executes it on the compromised system.

According to researchers, if SymonLoader finds it is on a Windows XP or Windows Server 2003 system and finds that a newly attached device is a USB drive made by this particular company, then it will extract an unknown executable file from the USB.

Researchers said that while the identity of the file SymonLoader writes to the USB is unknown, they added that they know enough about it to know it is malicious.

“In contrast to HomamLoader, which requires an internet connection to reach its C2 server to download additional payloads, SymonLoader attempts to extract and install an unknown hidden payload from a specific type of secure USB drive when it’s plugged into a compromised system.

“This technique is uncommon and hardly reported among other attacks in the wild,” the researchers said.

Javvad Malik, security advocate at AlienVault, told SC Media UK that this particular attack bears all the signs of a very specific targeted attack designed to infect particular institutes or machines – not too dissimilar to Stuxnet.

“Employees that work in sensitive organisations that have air-gapped networks should be particularly vigilant against plugging in devices. In some cases, even approved USB drives should be tested in a separate environment prior to being loaded in secure areas,” he said.

“Prevention aside, critical systems should have threat detection controls that can alert where an infected drive has been plugged into an endpoint and take remedial steps beyond raising an alarm, such as isolating an infected machine from the rest of the network.”

Scott Walker, senior solutions engineer at Bomgar, told SC Media UK that with certain state-sponsored hacking groups’ focus on the military, financial and energy sectors, it is paramount that these organisations deploy solutions that help prevent these attacks.

“Integrating regular and up to date security training to educate employees will ensure they are aware of the most recent tactics used to target systems and what can be done to prevent these.

“In addition, implementing solutions to ensure that employees only have access to areas of the network and devices that their role requires can mitigate these types of attacks. This sounds simple, but in reality, it is an area often overlooked,” he said.

itnews

Iran hit by global cyber attack that left U.S. flag on screens

/in

DUBAI (Reuters) – Hackers have attacked networks in a number of countries including data centres in Iran where they left the image of a U.S. flag on screens along with a warning “Don’t mess with our elections”, the Iranian IT ministry said on Saturday.

“The attack apparently affected 200,000 router switches across the world in a widespread attack, including 3,500 switches in our country,” the Communication and Information Technology Ministry said in a statement carried by Iran’s official news agency IRNA.

The statement said the attack, which hit internet service providers and cut off web access for subscribers, was made possible by a vulnerability in routers from Cisco (CSCO.O) which had earlier issued a warning and provided a patch that some firms had failed to install over the Iranian new year holiday.

Cisco did not immediately respond to requests for comment.

A blog published on Thursday by Nick Biasini, a threat researcher at Cisco’s Talos Security Intelligence and Research Group, said: “Several incidents in multiple countries, including some specifically targeting critical infrastructure, have involved the misuse of the Smart Install protocol…

“As a result, we are taking an active stance, and are urging customers, again, of the elevated risk and available remediation paths.”

Iran’s IT Minister Mohammad Javad Azari-Jahromi posted a picture of a computer screen on Twitter with the image of the U.S. flag and the hackers’ message. He said it was not yet clear who had carried out the attack.

Azari-Jahromi said the attack mainly affected Europe, India and the United States, state television reported.

“Some 55,000 devices were affected in the United States and 14,000 in China, and Iran’s share of affected devices was 2 percent,” Azari-Jahromi was quoted as saying.

In a tweet, Azari-Jahromi said the state computer emergency response body MAHER had shown “weaknesses in providing information to (affected) companies” after the attack which was detected late on Friday in Iran.

Hadi Sajadi, deputy head of the state-run Information Technology Organisation of Iran, said the attack was neutralised within hours and no data was lost.

Reuters

3 Cybersecurity Practices That Small Businesses Need to Consider Now

/in , ,

All businesses, regardless of size, are susceptible to a cyberattack. Anyone associated with a company, from executive to customer, can be a potential target. The hacking threat is particularly dangerous to small businesses who may not have the resources to protect against an attack let alone ransomware.

Norman Guadagno, a senior marketing officer at Carbonite, has said that “almost one in five small business owners say their company has had a loss of data in the past year,” with each data hack costing anything ranging $100,000 to $400,000 [about ₦37,500,000 to ₦150,000,000]. It, therefore, pays to understand cybersecurity to better protect you and your business.

Ransomeware Risks
Ransomware attacks can be especially devastating for small business owners. When hackers seize your data, encrypt it, and demand money in exchange for the key to unlock that data, you are truly at the mercy of the criminals.

Given that smaller businesses are likely to have weaker protection than larger ones, it is important that adequate steps are taken to properly secure your information. Ensure that software and hardware is up to date and change passwords often.

Cloud-Based Security
Using some sort of central data vault is a popular solution for business security. There are a great many companies which provide this service, from the large Nokia Networks to smaller bespoke groups.

The advantage of this approach is that you will have access to the cyber expertise of the vault company while also possessing a significant degree of control over the cloud system you will be using. The disadvantage is that adopting this approach does not make your company immune to hackers since there are points of attack either at the vault company or at your own. But you are at least in expert hands.

Biometric Security
Smartphones are already using thumbprints for user identification purposes, but 2017 promises to deliver even more advancements along these lines. Biometric systems will be able to analyze and evaluate every part of your company’s security features. Touch pads will have sensors able to identify a user from their computer habits like typing speed and even online browsing taste.

The Internet of Things (IoT) is such that security measures are under increasing scrutiny as multiple devices, over ever-expanding distances, can be linked together. This facilitates speedier data sharing and storage as the hardware (and the businesses using the hardware) becomes more familiar to users. But it also means that device-level security must be effective if it is to minimize the risk of an effective cyber attack – multiple-factor authentication is needed.

Increased Automation Assists Security Staff
Biometrics, the cloud, and the increasing prevalence of the IoT are signposting an expanding role for automation in cybersecurity. When the smart systems already mentioned combined with the human element of a security process, a strong deterrent against criminals can be created. Automated technology constantly reviews your protection arrangements, looking for possible gaps and plugging them. The use of these systems complements the work of your staff and safeguards your business against all but the most determined attackers.

Cybersecurity is evolving as it tries to keep pace with increasingly sophisticated hack attacks. This is why it is important to secure your business effectively by taking expert advice. The cost to businesses of cyberattacks is already monumental, and it is growing. Consumers are also becoming more aware of the dangers of computer crime and they will often take their custom to those businesses which take data security seriously. Being small is no excuse for businesses – they must pay heed to industry advice and ensure that they are properly protected against cybercrime in 2017.

Tech.co

Hackers can get rich using your computer — and you’d never know it

/in

It’s getting hard to read the news without hearing about another cyber attack making its way around the global internet.

A growing trend among cybercriminals is the kind of malware attack that infiltrates your network and works quietly in the background to perform tasks such as mining a digital currency and sending the profits back to the author of the virus while the host remains unaware.

This type of threat has been highlighted by the Adylkuzz attack which exploits the same Microsoft vulnerability as the WannaCry attack. However, where WannaCry seized files and ransomed them, Adylkuzz installs a cryptocurrency miner on compromised machines.

“These are not particularly unusual, we see a lot of malware that does cryptocurrency mining,” Nick Savvides, a security specialist at Symantec told News.com.au. “There’s a very big business in it.”

Such malware can often go undetected but will likely degrade a computer’s performance and speed.

“If criminals get it right it doesn’t chew up too many resources, just enough that it can deliver something,” and the infection can go undetected for long periods of time.

Given the rising value of many cryptocurrencies in recent months, “it’s possible to make quite a bit of money out of it without it being noticed,” Savvides said.

After security firm Proofpoint published a blog this week describing how the attack turns infected users into unwitting financial supporters of cyber criminals, some reports claimed the Adylkuzz malware could end up being a bigger attack than WannaCry which infected as many as 200,000 Windows systems in more the 150 countries. But Savvides disagrees.

“I just don’t see it. The reason I don’t see it is that this has been active for some time now, the rates of infection have been pretty low, and there hasn’t been an associated e-mail campaign to infect hosts,” he said.

Proofpoint said it has detected a number of infected machines that have transferred several thousand dollars worth of the cryptocurrency Monero to the creators of the virus dating back to as early as April 24.

Interestingly, once the malware exploits the Microsoft vulnerability, it shuts it down, thus denying anyone else the chance to do the same. “One bad guy making sure no one else can steal his host.”

These types of attacks share certain characteristics with the commonly used distributed denial of service (DDoS) attacks which also take control of unwitting hosts to direct their computer’s traffic at a particular network.

“In fact as a cybercriminal, you could dual purpose that botnet. You could go and infect thousands of hosts and utilize them to not just mine bitcoins for you but to also launch a denial of service attack for you,” Savvides said.

These kind of attacks “aren’t going away.”

So if your computer is running a little slower than usual, how can you check if it might possibly be compromised?

According to Savvides the only thing the average person can do to ensure they’re not the unwitting victim of such malware is to run a security tool like Norton Power Eraser which is a free virus and malware removal tool that people can run to clean their device.

“I think that’s really the only way for a layman to determine this,” he said.

New York Post