Tag Archive for: Security

Chinese hacking group has found new way to bypass two-factor authentication

/in ,

A group with alleged links to the Chinese government has been accused of hacking networks worldwide, but in a rare twist, it’s said to be bypassing two-factor authentication in the process.

The hack was detailed late last week by security researchers from Fox-IT Holding B.V. APT20, the group behind the campaign, targets web servers as the first point of entry with a particular focus on Jboss.

Once through the door, the group installs web shells then spreads throughout the network. Showing fairly typical behavior, the group seeks out passwords and administrator accounts to obtain more information from their targets utilizing virtual network credentials for more secure access.

Where it gets interesting is that the researchers claim they found evidence that APT20 was gaining access to VPN accounts that were protected by 2FA. Hacking 2FA isn’t new, and the process involved is somewhat complicated, but APT20 is said to have found a new way to bypass the process.

The hackers are believed to have stolen an RSA SecurID software token from a hacked system, then modified the key to work on different systems.

“The software token is generated for a specific system, but of course this system-specific value could easily be retrieved by the actor when having access to the system of the victim,” the security researchers explained. “As it turns out, the actor does not actually need to go through the trouble of obtaining the victim’s system-specific value, because this specific value is only checked when importing the SecurID Token Seed, and has no relation to the seed used to generate actual 2-factor tokens. This means the actor can actually simply patch the check which verifies if the imported soft token was generated for this system, and does not need to bother with stealing the system-specific value at all.”

While specifically applying to software-based tokens, the method is disturbing particularly given that 2FA is regularly held up as a way to prevent hacking such as this.

A full copy of the research into the group can be found here.

Sophisticated Android malware ZooPark tracks all your phone activities

/in

An advanced type of malware can spy on nearly every Android smartphone function and steal passwords, photos, video, screenshots and data from WhatsApp, Telegram and other apps. “ZooPark” targets subjects in the Middle East and was likely developed by a state actor, according to Kaspersky Lab, which first spotted and identified it.

ZooPark has evolved over four generations, having started as simple malware that could “only” steal device account details and address book contacts. The last generation, however, can monitor and exfiltrate keylogs, clipboard data, browser data including searching history, photos and video from the memory card, call records and audio, and data from secure apps like Telegram. It can also capture photos, video, audio and screenshots on its own, without the subject knowing. To get the data out, it can silently make calls, send texts and execute shell commands.

Kaspersky — a company with its own spotty security history that has been banned by the US government — said that it has seen less than 100 targets in the wild. “This and other clues indicates that the targets are specifically selected,” Kasperky Lab’s Alexey Firsh told ZDNet. It also implies that the campaign is backed by a nation state, though the security firm didn’t say which.

How the Malware works

At the same time, Kaspersky suggested that the malware might not have been built in-house. “The latest version may have been bought from vendors of surveillance tools,” it wrote. “That wouldn’t be surprising, as the market for those espionage tools is growing, becoming popular among governments, with several known cases in the Middle East.”

As is now known, a lot of those tools came from the US government itself. A group called Shadow Brokers famously stole exploits from the NSA — some of the zero day, unpatched variety — and eventually released them to the public. In other words, a hacking group was able to obtain malware from what should be the most secure agency in the world. That’s one of the reasons that security experts and companies like Apple don’t trust the US government with device backdoors.

Engadget

School dropout makes it to Forbes’ U-30 list

/in

Chandigarh, April 3 (IANS) A school dropout from Chandigarh who is now a cyber security expert has made it to the Forbes “30 under 30” Asia 2018 list.

Trishneet Arora, 25, made his way to the prestigious list which is packed with innovators and disruptors who are reshaping their industries and changing Asia for the better, a spokesperson for the young entrepreneur said here on Tuesday.

Arora is cyber security expert, an author and the founder and CEO of TAC Security — a Cyber-Security company based in Mohali, adjoining Chandigarh.

TAC Security performs vulnerability assessment and penetration testing for corporates, identifying weaknesses in their cyber security.

“In 2017, Arora was listed among the 50 Most Influential Young Indians by GQ Magazine. He has received funding from investor Vijay Kedia and support from former vice president of IBM, William May,” the spokesperson said.

His name now figures in the Enterprise Technology category of the Forbes “30 under 30” Asia 2018 list.

Besides young international personalities from across the world, international badminton player P.V Sindhu from India is part of the Forbes Asia “30 under 30” list under a different category.

TAC Security helps corporates recognise their weaknesses before fraudulent hackers can use them adversely. It helps to protect networks and information assets from malicious activity such as cyber-attacks. TAC is also responsible for security assessment for 50+ UPI based applications.

20% of Risky Emails Bypass Email Security

/in

Far too many risky emails are infiltrating email security solutions, according to a report released Tuesday by Mimecast.

The email and data security company released its second quarterly report on the effectiveness of email security systems, the Mimecast Email Security Risk Assessment (ESRA), based on a study of more than 44,000 users. The results are bleak, depicting how risky and potentially malicious emails continue to infiltrate security solutions.

As much as 9 out of 40 million emails analyzed by Mimecast, all of which passed through an email security vendor or cloud email service, were determined to have the potential for risk. The majority of these emails were spam, but a smaller amount of more dangerous emails also bypassed security, and it only takes one to cause irreversible harm.

More than 8,300 emails examined by Mimecast contained dangerous file attachments, while 1,669 contained known malware and 8,605 were impersonation attacks.

Impersonation attacks, or social engineering scams, are when a cybercriminal attempts to impersonate a trusted individual, like a company CEO, to obtain confidential information from duped employees. These types of scams have risen 400% since the release of Mimecast’s February ESRA report.

Phishing is now the primary entry method for cybercriminals seeking to access organizations according to a recent report from Symantec.

It’s also a preferred method of the Russian military according to a leaked NSA document published Monday by The Intercept. The report describes how the Russian military used email phishing to target United States agencies and services in the lead-up to the 2016 Presidential election.

Hackers attempted to spear-phish a private company in the United States to access information on voting-related technology, as well as targeting government agencies to impede requests for absentee ballots.

MEDIA POST

Cyber attacks: how your devices can be used

/in

The massive global cyber attack that wreaked havoc in computer systems earlier this month caused plenty of visible disruption, not least in Britain’s National Health Service.

But in the brave new inter-connected world heralded by the internet of things (IoT), so-called “ransomware” attacks could have as their source something quite mundane and yet present in ever more modern households.

In a not so far-off future, the source of a software glitch with serious consequences for the simple consumer could be anything from a connected coffee machine or refrigerator to a techie toy or an outsmart-you television.

Web-connected gadgets are becoming all the rage with tech-aware professionals.

But the mere idea that it only needs a hacker to give the software a malevolent tweak to send them on the blink with disastrous consequences may yet threaten the development of such goods’ popular take-up.

“Regarding last weekend’s attack there is no risk for connected objects. That in particular hit systems running Windows …and today there are no mass market gadgets with Windows loaded in order to function,” says Gerome Billois, a consultant with Wavestone.

“In contrast, there have already been massive attacks on connected objects,” Billois told AFP.

The Mirai malware strain made from hacked IoT devices including badly secured routers and internet connected cameras recently infected hundreds of thousands of poorly secured connected objects.

The idea was not to stop them from working but to transform them into zombies or botnets with a view to using them as relay stations for future cyber attacks.

Last week at a timely cyber security conference in The Netherlands, American wunderkind Reuben Paul, just 11, stunned an audience of security experts by hacking into a teddy bear via bluetooth to show how interconnected smart toys “can be weaponised”.

His prowess showed just how easy it is for tech savvy individuals to use everyday objects to harvest data or use them as spy holes for covert surveillance.

According to documents released in March by Wikileaks, US intelligence can hack smartphones, computers and smart, web-connected TVs, to pilot them and eavesdrop.

“All the other connected objects can be pirated, that has been shown, be it a coffee machine, a refrigerator, a thermostat, electronic entry systems, the lighting system…,” warns Loic Guezo, a cyber security analyst for southern Europe with Japanese security software company Trend Micro.

Mikko Hypponen, head of research at Finnish security specialists F-Secure, has for his part come up with his eponymous Hypponen’s Law.

This states that “once a device is described as ‘intelligent’, you can consider it as vulnerable.”

Neglected security

The future might well spell connected cars – but they too are subject to potential remote hacking, the consequences of which barely need stating.

When hackers lurking with their laptops have finished conjuring what havoc they might wreak on distant roads there are plenty of other things to which they could turn their attention.

These include vases which tell you when they need fresh water, insulin pumps – or how about sex toys?

So, the worried tech consumer may be asking him or herself – can a cyber hacker deprive me of my morning slug of caffeine?

Or maybe keep my thermostat blocked at 10 Celsius – a chilling thought – or even take over my GPS if I don’t hand over a ransom?

Theoretically, yes, specialists tell AFP.

“The logic of a cybercriminal is to make money,” says Wavestone’s Billois. Such an individual will not feel the need to make do with small-scale attacks.

Connected TVs, having rapidly become widespread, are an ideal portal for making ransom demands.

“Tomorrow, one can imagine devices which attack your connected house, bringing it under control, and then you get sent a message by another channel,” muses Guezo.

All that would required would be to perfect the sort of virus one can find on offer within the murky confines of the “darknet”, off the beaten track for day to day netizens.

Cyber security specialists are very much aware of the need to keep working on solutions offering protection as more and more homes go “smart” and “connected” with various boxes as add-ons to their usual routers.

The specialists’ plan is to work with the makers of connected goods in order to incorporate a security interface right from the start, thereby offering what the profession calls “security by design”.

Some experts feel that, in the rush to bring fascinating and cutting edge technologies into the home, the need for commensurate security has been rather left behind.

“It is extremely difficult to calculate the solidity of a connected object in terms of cybersecurity,” Billois regrets.

“As a consumer it is today impossible to know if you are buying a secure connected object or not,” he adds.

“There’s no label such as a made in Europe kind of tag guaranteeing an object won’t catch fire, or won’t pose a risk to children.”

Fin24Tech

3 Cybersecurity Practices That Small Businesses Need to Consider Now

/in , ,

All businesses, regardless of size, are susceptible to a cyberattack. Anyone associated with a company, from executive to customer, can be a potential target. The hacking threat is particularly dangerous to small businesses who may not have the resources to protect against an attack let alone ransomware.

Norman Guadagno, a senior marketing officer at Carbonite, has said that “almost one in five small business owners say their company has had a loss of data in the past year,” with each data hack costing anything ranging $100,000 to $400,000 [about ₦37,500,000 to ₦150,000,000]. It, therefore, pays to understand cybersecurity to better protect you and your business.

Ransomeware Risks
Ransomware attacks can be especially devastating for small business owners. When hackers seize your data, encrypt it, and demand money in exchange for the key to unlock that data, you are truly at the mercy of the criminals.

Given that smaller businesses are likely to have weaker protection than larger ones, it is important that adequate steps are taken to properly secure your information. Ensure that software and hardware is up to date and change passwords often.

Cloud-Based Security
Using some sort of central data vault is a popular solution for business security. There are a great many companies which provide this service, from the large Nokia Networks to smaller bespoke groups.

The advantage of this approach is that you will have access to the cyber expertise of the vault company while also possessing a significant degree of control over the cloud system you will be using. The disadvantage is that adopting this approach does not make your company immune to hackers since there are points of attack either at the vault company or at your own. But you are at least in expert hands.

Biometric Security
Smartphones are already using thumbprints for user identification purposes, but 2017 promises to deliver even more advancements along these lines. Biometric systems will be able to analyze and evaluate every part of your company’s security features. Touch pads will have sensors able to identify a user from their computer habits like typing speed and even online browsing taste.

The Internet of Things (IoT) is such that security measures are under increasing scrutiny as multiple devices, over ever-expanding distances, can be linked together. This facilitates speedier data sharing and storage as the hardware (and the businesses using the hardware) becomes more familiar to users. But it also means that device-level security must be effective if it is to minimize the risk of an effective cyber attack – multiple-factor authentication is needed.

Increased Automation Assists Security Staff
Biometrics, the cloud, and the increasing prevalence of the IoT are signposting an expanding role for automation in cybersecurity. When the smart systems already mentioned combined with the human element of a security process, a strong deterrent against criminals can be created. Automated technology constantly reviews your protection arrangements, looking for possible gaps and plugging them. The use of these systems complements the work of your staff and safeguards your business against all but the most determined attackers.

Cybersecurity is evolving as it tries to keep pace with increasingly sophisticated hack attacks. This is why it is important to secure your business effectively by taking expert advice. The cost to businesses of cyberattacks is already monumental, and it is growing. Consumers are also becoming more aware of the dangers of computer crime and they will often take their custom to those businesses which take data security seriously. Being small is no excuse for businesses – they must pay heed to industry advice and ensure that they are properly protected against cybercrime in 2017.

Tech.co

WannaCry Ransomware Decryption Tool Released; Unlock Files Without Paying Ransom

/in

If your PC has been infected by WannaCry – the ransomware that wreaked havoc across the world last Friday – you might be lucky to get your locked files back without paying the ransom of $300 to the cyber criminals.

Adrien Guinet, a French security researcher from Quarkslab, has discovered a way to retrieve the secret encryption keys used by the WannaCry ransomware for free, which works on Windows XP, Windows 7, Windows Vista, Windows Server 2003 and 2008 operating systems.

WannaCry Ransomware Decryption Keys

The WannaCry’s encryption scheme works by generating a pair of keys on the victim’s computer that rely on prime numbers, a “public” key and a “private” key for encrypting and decrypting the system’s files respectively.

To prevent the victim from accessing the private key and decrypting locked files himself, WannaCry erases the key from the system, leaving no choice for the victims to retrieve the decryption key except paying the ransom to the attacker.

But here’s the kicker: WannaCry “does not erase the prime numbers from memory before freeing the associated memory,” says Guinet.

Based on this finding, Guinet released a WannaCry ransomware decryption tool, named WannaKey, that basically tries to retrieve the two prime numbers, used in the formula to generate encryption keys from memory, and works on Windows XP only.

Note: Below I have also mentioned another tool, dubbed WanaKiwi, that works for Windows XP to Windows 7.

“It does so by searching for them in the wcry.exe process. This is the process that generates the RSA private key. The main issue is that the CryptDestroyKey and CryptReleaseContext does not erase the prime numbers from memory before freeing the associated memory.” says Guinet

So, that means, this method will work only if:

  • The affected computer has not been rebooted after being infected.
  • The associated memory has not been allocated and erased by some other process.

“In order to work, your computer must not have been rebooted after being infected. Please also note that you need some luck for this to work (see below), and so it might not work in every case!,” Guinet says.

“This is not really a mistake from the ransomware authors, as they properly use the Windows Crypto API.”

While WannaKey only pulls prime numbers from the memory of the affected computer, the tool can only be used by those who can use those prime numbers to generate the decryption key manually to decrypt their WannaCry-infected PC’s files.

Good news is that another security researcher, Benjamin Delpy, developed an easy-to-use tool called “WanaKiwi,” based on Guinet’s finding, which simplifies the whole process of the WannaCry-infected file decryption.

All victims have to do is download WanaKiwi tool from Github and run it on their affected Windows computer using the command line (cmd).

WanaKiwi works on Windows XP, Windows 7, Windows Vista, Windows Server 2003 and 2008, confirmed Matt Suiche from security firm Comae Technologies, who has also provided some demonstrations showing how to use WanaKiwi to decrypt your files.

Although the tool won’t work for every user due to its dependencies, still it gives some hope to WannaCry’s victims of getting their locked files back for free even from Windows XP, the aging, largely unsupported version of Microsoft’s operating system.

The Hacker News

‘WannaCry’ Ransomware Attack Spreads to 74 Countries

/in

A wave of ransomware infections took down a wide swath of UK hospitals and is rapidly moving across the globe.

The so-called Wanna Decryptor ransomware is currently moving like wildfire across 74 countries in more than 45,000 attacks, including a massive takedown of several UK hospitals today.

The number of infections across the world is quickly growing, according to Kaspersky’s Twitter post. So far, some of the countries that have been hit include Britain, Spain, Russia, Taiwan, India, and the Ukraine, according to various reports streaming across the WannaCry Twitter feed.

Security experts say the ransomware attack is exploiting the Server Message Block (SMB) critical vulnerability that was patched by Microsoft on March 14, MS17-010. The 0day exploit, aka ETERNALBLUE, believed to be an NSA exploit tool, initially was leaked by Shadowbrokers, prompting a patch from Microsoft.

“There is nothing comparable to date. This is a massive global ransomware operation, the largest and most effective to date. Unfortunately, not all organizations patched against ETERNALBLUE/shadowbrokers exploits,” said Kurt Baumgartner, principal security researcher, Global Research and Analysis Team (GReAT) for Kaspersky Lab.

According to an Avast blog post, Telefonica in Spain and the National Health Service (NHS) hospitals in England have been hit.

In the UK, a large scale attack hit a number of hospitals across the region, forcing medical staff to re-route emergency patients to other hospitals in the area, according to a report in The Guardian.

The malware struck NHS hospitals around lunch time, with an initial email going out to employees that the email servers were encountering difficulty, followed by clinical and patient systems going down, the Guardian reported. That was followed by a ransom note appearing on employees’ computer screens, demanding $300 in Bitcoins to be paid in three days, otherwise the ransom would double. And if no payment was made after seven days, then the files would be forever lost, according to the report.

The NHS issued an alert and confirmed 16 medical centers had been hit, according to Kaspersky Lab.

This ransom message also appeared in Spain, where telecom giant Telefonica was also targeted, the Guardian noted.

“The suspected syndicated attack is unique in that it’s not targeted at any one industry or region, and is using a particularly nasty form of malware that can move through a corporate network from a single entry point,” says Simon Crosby, co-founder and chief technology officer at Bromium.

“As usual, it’s leveraging a recently patched vulnerability that many have failed to implement in a timely matter,” he says. “As long as the industry continues to play this never ending cat and mouse game of patchwork systems, sophisticated attackers will easily find ways to exploit the public in increasingly large scale attacks such as this.”

How WannaCry Makes You Cry

The ETERNALBLUE exploit tool surfaced on the Internet via the Shadowbrokers’ dump on April 14. Although Microsoft had issued the March patch, many organizations have not yet installed it, according to Kaspersky’s blog post on WannaCry.

The security firm said WannaCry initiates through an SMBv2 remote code execution in Microsoft Windows and then encrypts data with a file extension “.WCRY.” It then drops and executes a decryptor tool that was designed to hit users in multiple countries with a ransom note translated to the appropriate language for that country, according to Kaspersky Lab.

Kaspersky’s Baumgartner describes the attack this way: “It is a worm over SMB and the communications are over TOR, directly to hidden services, so I would not call it a peer-to-peer worm.”

Researchers recommend installing Microsoft’s patch, which closes the affected SMB Server vulnerability used in the WannaCry attack.

For organizations that have older equipment or legacy software, such as hospitals, manufacturing plants, and power plants, deploying a patch can be complicated and disruptive, which may in part explain how a wide swath of NHS hospitals fell victim to WannaCry.

Dark Reading

11 things you shouldn’t put on your Facebook

/in ,

What do you put on your Facebook profile and on your wall? Anything? Everything? Well, according to a hacker, you should be very careful what you put on your Facebook, or you could lose a lot, from money, to even your life.

Some of these things include the sort of details many people use for their passwords – things like their maiden name, first pet, or their favourite album, which seem innocuous when in this other context of a personality list.

Below is a list of some of them:

1. Photographs of your children

While it might seem cute, putting up photographs of your young ones could expose them to pedophiles. Also, what type of information or pictures would your children want to see about themselves online at a later date?

2. Phone number

Your privacy is important, so unless you have a phone number for business purposes, putting up your personal number online could lead to unnecessary phone calls, stalking or even being exposed to scammers.

3. Birthday

Your birthday is one way people can access your bank account and personal details, once they link it with your name and address.

4. Location

There are location services on Android or iPhones, which means that many people know where you live including those that may wish to harm you. Please turn off your location.

5. Too many friends

Having 4,000+ friends on Facebook, when in reality, you only know about 100 is exposing yourself to a lot of unwanted information and interaction. You should definitely prune your friend list.

6. Where your child/young family member goes to school

Do not put the name of your child’s school on Facebook. Frequent offenders are prowling the internet for such information that might put your child at risk.

7. Your boss

We have heard of people losing their jobs because of Facebook posts. While you should be careful of what you post, maybe you should remove your boss, to avoid unnecessary hassle.

8. Relationship status

Your relationships are better kept private. It may not work out, and the consequent change from “in a relationship” to “single” will make you feel worse than you already do.

9. When you are going on holiday

Putting your holiday plans on Facebook is not a good idea. Burglars can choose that time to rob your house.

10. ATM card pictures

This is never a good idea as the number on your card can be used to defraud you.

11. Boarding pass pictures

Taking a photo of your boarding pass, is a way to show off. But it could have serious consequences, the barcode on your boarding pass is unique to you, and can be used to find the information you gave to the flight company.

Naij

7 Steps to Fight Ransomware

/in , ,

Ransomware can be a highly lucrative system for extracting money from a customer. Victims are faced with an unpleasant choice: either pay the ransom or lose access to the encrypted files forever. Until now, ransomware has appeared to be opportunistic and driven through random phishing campaigns. These campaigns often, but not always, rely on large numbers of emails that are harvested without a singular focus on a company or individual.

As ransomware perpetrators continue to hone their skills, we’re seeing a shift to more specific targets. The driver of this shift is the realization that companies, especially larger ones, are much higher-value targets than an average individual and are thus able to pay significantly higher ransoms.

This change has elevated the need for companies to strengthen their defensive strategies. Executives must allocate resources and ensure strategies are active against ransomware intent on paralyzing their organization.

The best defensive strategies should include the following:

1. Provide user awareness training and friendly testing. This can reduce the human attack surface.

2. Maintain a comprehensive patch management program to keep all systems up to date and reduce the endpoint attack surface.

3. Limit users’ privilege and network drive connectivity to the minimum essential for job requirements.

4. Conduct frequent backups and store them offline because many ransomware variants will spread through drive shares and can even reconnect a disconnected drive share.

5. Use network segmentation that requires authentication. For example, a user must enter a password before traversing the network. This will reduce the network attack surface.

6. Deploy advanced threat intelligence tools. Threat intelligence can be used to identify IP addresses of known command and control sites. Blocking these sites can potentially prevent malware from being able to establish its encryption routine. It’s important to note this strategy may not work on some newer versions of ransomware that operate independently and create their own encryption keys without having to communicate with a command and control server.

7. Lastly, as a final fallback, know how to buy Bitcoin (or Monero, which is emerging as an alternative means of payment.) Consider pre-purchasing some in advance in the event a ransom needs to be paid on short notice.

Should you pay the ransom to continue operations, or do you refuse to pay it as a matter of principle? The tie-breaker is the cost of downtime — measured potentially in the range of thousands of dollars per hour. One should establish in advance the financial impact of losing access to critical information or business processes, and work through the decision before facing a crisis.

Ransomware is a clear and present danger. Companies can no longer afford to take a wait-and-see attitude. If you’re vulnerable to ransomware and take no precautions to mitigate those vulnerabilities, then the only thing you’re relying upon to prevent an infection is hope — and hope is not a strategy. By implementing the seven defensive actions listed above you can greatly reduce, and potentially eliminate, vulnerabilities. Review the list again, and remember that increased security awareness training with testing can be your most effective defense.

Dark Reading