Exploit kit attacks DNS settings of over 50 different router models

Internet users that have not secured their wireless router may soon face potential issues. A French researcher has discovered an exploit kit that targets and attacks many well known router models from reputable manufacturers.

Photo by ShoutMeTech.com, Flickr

In recent times, home and office routers (SOHO) have become a primary target for hackers that are seeking to redirect web traffic to malicious websites. In this specific case, hackers are now using a complex exploit kit on your router DNS settings in order to carry out cross-site request forgery attacks.

A French researcher named Kafeine has discovered an exploit kit and published research about the attacks on Friday. Kafeine said that at the attacks peak on May 9, after a month long series of modifications from attackers including JavaScript obfuscations that the traffic from the campaign peaked at approximately a million hits.

Traffic redirection results from hijacked router DNS settings

Particularly, the attackers are driving a lot of web traffic from Chrome users. Such an occurrence is an example of a pharming attack and is considered to be dangerous because it puts online banking and sensitive transactions/communications at risk.

Kafeine stated:

“This kind of attack is really old, but that this is the first time that I’ve seen something with obfuscation, rotating domains and landing going after DNS.”

Office and home routers are infected in this malicious campaign via drive by downloads and malvertising. The attackers concentrate on Chrome and Chromium based users possibly because of their ability to discover local and public IP addresses by using tools such as WebRTC-ips. WebRTC-ips is present in popular web browsers such as Chrome and Firefox and allows browsers and mobile apps to communicate in realtime via API’s.

CSRF attacks force victims to submit malicious requests on behalf of a hacker, typically on sites where a victim is already logged in. Kafeine stated the original exploit code was written in the clear, but within a month had added obfuscation and many other improvements. There is a long list of routers vulnerable to this type of attack including D-Link, Belkin, Netgear, Asus, and others.

Kafeine wrote:

“In the attack, the DNS address was changed to 185[.]82[.]216[.]86; it has since been changed to 217[.]12[.]202[.93], and always uses Google’s DNS as a failover should the first IP fail.”

Update your router firmware

Users are at risk of financial loss, click-fraud, man-in-the-middle attacks, and even phishing. It is recommended that everyone updates their router firmware and software and secure their router using strong password and security settings.

Have a great (CSRF-free) day!

Related Posts:

• Firmware Vulnerabilities Discovered on Linksys and ASUS…


• NetUSB hack puts Millions of home users at risk


• Hacker group LizardSquad used home routers to attack Xbox…


• Caphaw Trojan Found in Youtube Ads


• Caphaw Trojan Found in Youtube Ads

Exploit kit attacks DNS settings of over 50 different router models

Malware masquerades as AdBlock Plus application

The merciless onslaught of advertisements in some parts of the web have forced people to use applications like AdBlock to get a cleaner and less cluttered browsing experience. But using AdBlock is safe, right? Well, only if you are using the right one. A recent Malwarebytes post shows a malicious LSP Hijacker that tries to disguise itself as the legitimate application, AdBlock Plus. Talk about irony!

Disguised application contains rootkit elements

It turns out, the malware pretending to be AdBlock is actually pretty advanced. It detects virtual machines and does not deliver most of its payloads there, in order to avoid detection. On a real system however, it acts as an LSP Hijacker and installs rootkit elements which are difficult to get rid of. Some of the hidden services installed can even run in safe mode making removal a problematic procedure.

Rootkit elements of fake adblock (Source- https://blog.malwarebytes.org)

“A Layered Service Provider is a file (.dll) using the Winsock API to insert itself into the TCP/IP stack.”

Thus by hijacking the LSP, this malware is able to intercept all traffic passing between the internet and applications on the infected system. This way more ads can be inserted forcefully, that’s just what you wanted from your new ad “blocker”.

Although the application appears like AdBlock it does not block any ads or perform any of the functions associated with the legitimate application. This fake adblocker named “Bylekh” also attempts to avoid suspicion by using a fake installation date. The installation date added by the program (as seen in the Add or Remove Programs section in control panel) is much older than the actual date. This is done to avoid being immediately spotted when programs are sorted by install dates.

Fake adblock using incorrect installation date (Source- https://blog.malwarebytes.org)

Programs like these blur the lines between PUP and malware, almost making the two categories equivalent. As adware continues to grow, users must know that no program can be easily trusted. As seen in this case, a program that promises to block ads may actually end up doing the very opposite.

Have a nice (malware-free) day!

Related Posts:

• Emsisoft Malware Library


• How downloading one program can give you six (!) PUPs


• How to use the new behavior blocker panel to quickly spot…


• SMS Trojan Podec bypasses CAPTCHA on Android phones


• Installer hijack vulnerability threatens almost half of all…

Malware masquerades as AdBlock Plus application

NitlovePOS: New Point of Sale malware that steals payment card information

In recent times we have seen the rise of POS or Point of Sale malware (Remember PoSeidon?) designed to extract and transmit payment card information. According to this post by FireEye, a new variant of this malware family has emerged, one that is capable of stealing track one and track two payment card data. This malware, Nitlove, scans the processes on a compromised system, and after obtaining the payment card data, sends it back to the controlling webserver using SSL. Nitlove is mostly spread through malicious macro files attached to spam emails.

Victims infected through malicious macro files found in spam emails

Instead of first targeting their victims, the cybercriminals send out bulk spam messages through spoofed Yahoo! Mail accounts with a generic subject like: “Any jobs?”, “Internships?”, “My Resume” and so on. This indiscriminate spam campaign began on Wednesday, May 20, 2015 with the obvious goal of infecting as many users as possible with the attached malware.

Each of the spam emails contained an attached document file named CV_[4 numbers].doc or My_Resume_[4 numbers].doc which were embedded with a malicious macro. In order to convince the user to allow the macro to run, the documents even proclaim to be “Protected”.

Source: FireEye

Once executed, the macro downloads one of many malicious files present in the included url: “80.242.123.155/exe/”. For example 80.242.123.155/exe/dro.exe. It turns our several of the malicious files are named “pos.exe” which suggests the intended target of the cybercriminals might be point of sale machines.

After infecting the system, the malware ensures its survival by creating a registry key that enables it to start-up automatically after reboot. The malware also sets up communications to one of three hardcoded C2 servers:

• systeminfou48[.]ru


• infofinaciale8h[.]ru


• helpdesk7r[.]ru

Then begins the memory scrapping. After searching for any data resembling the payment card format, the malware sends matching data back to its creators through a secure SSL channel, making detection at the network-level more difficult.

The cybercriminals may even have a control panel to help orchestrate their malicious operations. More and more variants of such POS malware emerge, as the existing ones are detected and blocked. It looks like the cybercriminals are not going to give up easily.

Have a nice (malware-free) day!

Related Posts:

• Half a million computers infected as Macro Malware makes a…


• Spam email delivers Microsoft Office macro trojan malware


• Sophisticated new breed of Point-of-Sale malware discovered


• Michaels Arts & Crafts Confirms Data Breach


• Un demi-million d’ordinateurs infectés par des…

NitlovePOS: New Point of Sale malware that steals payment card information

Logjam attack, similar to the FREAK vulnerability, breaks TLS security

Not so long ago, a massive vulnerability in SSL security forced browsers to use weak encryption under certain circumstances, which would allow hackers to spy on sensitive and otherwise secure data. This vulnerability was dubbed FREAK as it involved RSA export keys. Now, a similar issue has emerged concerning Diffie-Hellman keys and TSL security. All servers supporting export-grade 512-bit Diffie-Hellman cryptography are affected.

Use of weak encryption leads to man in the middle scenario

At the heart of the problem is a ’90s US government policy that restricted export of strong encryption keys.

The Logjam attack technique involves downgrading a vulnerable server to weak 512 bit encryption. Then, the attacker must break the weaker encryption key using computing resources. Once the encryption is broken, the attacker can view or modify any of the information passing through the affected connection. Thus, sensitive data passing between the server and client computers is leaked. Since the procedure requires cracking an encryption key, this type of attack is mostly going to be carried out by hackers with significant resources and computing power. This makes state-level organizations and intelligence agencies perfect candidates. In fact, the researchers behind the discovery also say that NSA documents leaked by Edward Snowden suggest that the agency may have been able to break the prime numbers used in the Diffie-Hellman key exchange.

Logjam was discovered through a joint study conducted by CNRS, Inria Nancy-Grand Est, Inria Paris-Rocquencourt, Microsoft Research, Johns Hopkins University, University of Michigan, and the University of Pennsylvania. Their findings are detailed in this post.

According to the post, all TLS-dependent services that support DHE_EXPORT ciphers are at risk:

• HTTPS (Top 1 million domains) – 8.4% vulnerable


• HTTPS (Browser Trusted Sites) – 3.4% vulnerable


• SMTP+StartTLS (IPv4 Address Space) -14.8% vulnerable


• POP3S (IPv4 Address Space) – 8.9% vulnerable


• IMAPS (IPv4 Address Space) – 8.4% vulnerable

The researchers also stated:

“Millions of HTTPS, SSH, and VPN servers all use the same prime numbers for Diffie-Hellman key exchange. Practitioners believed this was safe as long as new key exchange messages were generated for every connection. However, the first step in the number field sieve—the most efficient algorithm for breaking a Diffie-Hellman connection—is dependent only on this prime. After this first step, an attacker can quickly break individual connections”

Server administrators are recommended to disable support for export cipher suites and generate a unique 2048-bit Diffie-Hellman group. Internet Explorer has already been updated to eliminate the vulnerability and patches for other browsers are a work in progress. Almost ever transaction relies massively on maintaining secure client-server communication which is why any encryption breaking vulnerability a major concern.

Have a nice (secure) day!

Related Posts:

• Security flaw “FREAK” haunts millions of Android


• The end of FREAK: Massive SSL vulnerability finally patched


• Teleoperated surgery robots are vulnerable to malicious…


• Protecting Yourself from Heartbleed


• Urgent! Update your Windows to patch several critical…

Logjam attack, similar to the FREAK vulnerability, breaks TLS security

How to use the new behavior blocker panel to quickly spot potential threats

One of the biggest improvements of Emsisoft Anti-Malware and Emsisoft Internet Security version 10 is the new behavior blocker panel, which gives you full control over your running programs. If your PC seems to run slower or behaves erratically, it’s time to view which and what programs are running on your system and take action accordingly. Here’s how you can do so.

What is the purpose of a behavior blocker?

The best way to understand what a behavior blocker does is to imagine a layer that sits between your operating system and the programs on your computer. This layer checks for certain malicious behavior patterns in the actions of the programs and raises an alert as soon as something suspicious occurs. For example, if a program is not digitally signed, starts without a visible window, creates an auto-run entry in registry or sends data over the internet then chances are high this is a piece of spyware.

No matter how encrypted or complex a malware program is, it’s can’t hide its behavior. Because there are a limited amount of ways a malware can behave (e.g. a virus will always infect files), the behavior blocker can detect almost any type of malware.

The Emsisoft behavior blocker.

However, many legitimate programs behave quite similar to malware, such as software updaters that may also run in the background and send data over the internet. That’s where the Emsisoft Anti-Malware Network comes in: the behavior blocker uses our public malware database to perform a live cloud verification when it notices a program is exhibiting questionable behavior. If the Emsisoft Anti-Malware Network has a clear indication that a program is good or bad, the alert can be skipped and will automatically be allowed or blocked, drastically reducing the amount of false positives. The Emsisoft Anti-Malware Network knows over 163 million malware threats, and more than 200,000 threats are added daily!

The behavior blocker settings

The behavior blocker panel has several key settings:

Activate or deactivate the behavior blocker

You can activate or reactivate the behavior blocker by checking the “Activate Behavior Blocker” option. We don’t recommended to disable the behavior blocker as this will lower your overall protection against malware. If the need ever arises that you must disable the behavior blocker, simply uncheck this box.

Show or hide fully trusted programs

You can choose your preferred view of running processes by using the “Hide fully trusted applications” option. To view all running processes, uncheck the box and all processes that have good, bad, or unknown reputations will become visible. Checking the box will only show bad or unknown processes and hide the ones that are known to be safe.

View details about active running processes

You can view several details about each actively running program in the revamped behavior blocker panel. The most important columns in the panel to look at are the “Company” column and the “Reputation” column. A company name is marked in green if the file is digitally signed and the certificate is valid. This is important because any file property information can potentially be faked by malware authors. Therefore, if you only see a black color coded “Microsoft Corporation”, that does not guarantee that the file is from Microsoft. You should always pay attention to the reputation rating for each program in the last column (good, bad or unknown) as this is essential in distinguishing the good from the bad.

How to use the process list to spot potential threats

Now that you know where to find the key settings in the panel, you are ready to utilize the process list to find and remove potentially malicious applications running on your PC. If the behavior blocker indicates that a program’s reputation is unknown or bad, you can right-click on the program to perform several actions: create rule, lookup online, end process, quarantine process, open file location, and view file properties.

Right-click on any process to perform various tasks to find out more about it.

The quarantine and end process options are only available for new or bad processes in order to prevent you from harming your system by mistakenly performing one of these actions on a harmless or critical windows process. Each action will allow you to learn specific details about the program:

Create rule

Creating application rules for active running processes is simple: Right click on any individual process and select the “create rule” option from the context menu. You can then configure application rules and set your preferences on how you want the behavior blocker to behave, which is described in more detail in the next paragraph.

Lookup online

Use this feature to check a file in the Emsisoft Anti-Malware Network. After selecting the desired process, you’ll be directed to a page in which you can view several file properties and details about the executable process that you can use to make an informed decision about the safety of a file.

The process list “lookup online” feature using the Emsisoft Anti-Malware Network.

If a process is known to have a bad or unknown reputation, you are presented with options to either quarantine or end the process. If a file is classified as new or unknown, use caution. If a file status is classified as bad, we recommend you remove the file entirely.

Quarantine program

You can use the quarantine program option to move an unknown or malicious process or program safely to Emsisoft’s quarantine. Once you move a program or process to quarantine it can no longer be accessed or run because it is placed in an encrypted container that will keep it locked. In the event that you mistakenly quarantine a harmless file, you can restore the file from the quarantine at at any given time.

End process

You can use the end process option to end an unknown or active malicious process. This means that the the threat cannot harm your PC anymore since it is no longer running. The end process option may be a safer alternative than the quarantine option in the event you are unsure if a process is malicious, but still do not trust it or notice that it is potentially exhibiting suspicious behavior.

Open the file location

Navigate to a file location to get insight about where exactly a file is located. For example, if a supposed system process is typically located in the System32 directory but is now present in your Documents folder, it is most likely malware. Experienced users may wish to manually remove threats using this option.

View the file properties

File properties are traits of the file such as the size or type. Viewing file properties is helpful in determining whether a file is malicious because users can view the MD5 hash of any given file which can be compared to the authentic hash that can quickly be found online. The MD5 hash of a file is a sequence of 32 characters which help identify each file uniquely and comes in handy to see if a file as been manipulated or changed. If the hash is different, there is a high probability that the file is malicious. The date a file was first and last seen is a factor to take into consideration because if a file is relatively new and not classified yet, it in theory should not be trusted.

What to do when a malicious process is found

If a process is found to be malicious, it will most likely be blocked in realtime by the Emsisoft behavior blocker. Alternatively, use the process list to quarantine or end the active malicious program. If a program is classified as malicious, it is recommended that you quarantine the threat.

If the program is unknown, ending the process may be a safer option at the time as the program could potentially be harmless. At this point, running a scan with your security product may be a wise choice to ensure that your PC is free of other potential malware infections. Alternatively, feel free to consult with our malware removal experts on our support forum if you are unsure of which action to take.

How to configure application rules

You can configure application rules in order to define your own preferences on how you want the Emsisoft behavior blocker to react to specific programs. If you notice there is already a rule available for that program, then double click on the process to open an “edit rule box” instead of creating a new rule. You can configure application rules under the protection tab or by right-clicking on an individual program in the process list. You have the following options:

Configure an “all allowed” application rule.

All allowed should be used when the application is undoubtedly safe and is a common everyday application with favorable reputation status among many users.

Configure  a “custom monitoring” application rule.

Monitor this application but, allow/block specific activities should be used when a safe or unknown application is not necessarily malicious, but exhibits suspicious behavior at times that triggers the behavior blocker to prompt you frequently.

Configure an “always block this application” rule.

Always block this application should be used if you are certain a program is behaving in a malicious manner. An example of such a scenario is if an unknown application is attempting to capture your keystrokes or injecting code into another process.

Conclusion

The revamped behavior blocker panel offers new ways to spot potential threats. You can use the new process list to weed out suspected threats and learn several details about which programs are running on your PC. When a malicious process is found, simply use the end or quarantine option to remove the threat from memory. In addition, you can create application rules control the manner in which the behavior blocker handles certain applications and activities. You can use the new panel to your advantage to get the most out of your Emsisoft protection.

Please share your feedback about the new behavior blocker panel, we always like to hear your thoughts!

Have a great (malware-free) day!

Related Posts:

• Efficient protection against new malware: Emsisoft’s…


• Stable update: Emsisoft Anti-Malware and Internet Security…


• Emsisoft Anti-Malware & Emsisoft Internet Security…


• Is this file safe? Re-launch of the Emsisoft Anti-Malware…


• Emsisoft Malware Spotlight: Blackbeard and Pigeon

How to use the new behavior blocker panel to quickly spot potential threats

How to use the new behavior blocker panel to quickly spot potential threats

One of the biggest improvements of Emsisoft Anti-Malware and Emsisoft Internet Security version 10 is the new behavior blocker panel, which gives you full control over your running programs. If your PC seems to run slower or behaves erratically, it’s time to view which and what programs are running on your system and take action accordingly. Here’s how you can do so.

What is the purpose of a behavior blocker?

The best way to understand what a behavior blocker does is to imagine a layer that sits between your operating system and the programs on your computer. This layer checks for certain malicious behavior patterns in the actions of the programs and raises an alert as soon as something suspicious occurs. For example, if a program is not digitally signed, starts without a visible window, creates an auto-run entry in registry or sends data over the internet then chances are high this is a piece of spyware.

No matter how encrypted or complex a malware program is, it’s can’t hide its behavior. Because there are a limited amount of ways a malware can behave (e.g. a virus will always infect files), the behavior blocker can detect almost any type of malware.

The Emsisoft behavior blocker.

However, many legitimate programs behave quite similar to malware, such as software updaters that may also run in the background and send data over the internet. That’s where the Emsisoft Anti-Malware Network comes in: the behavior blocker uses our public malware database to perform a live cloud verification when it notices a program is exhibiting questionable behavior. If the Emsisoft Anti-Malware Network has a clear indication that a program is good or bad, the alert can be skipped and will automatically be allowed or blocked, drastically reducing the amount of false positives. The Emsisoft Anti-Malware Network knows over 163 million malware threats, and more than 200,000 threats are added daily!

The behavior blocker settings

The behavior blocker panel has several key settings:

Activate or deactivate the behavior blocker

You can activate or reactivate the behavior blocker by checking the “Activate Behavior Blocker” option. We don’t recommended to disable the behavior blocker as this will lower your overall protection against malware. If the need ever arises that you must disable the behavior blocker, simply uncheck this box.

Show or hide fully trusted programs

You can choose your preferred view of running processes by using the “Hide fully trusted applications” option. To view all running processes, uncheck the box and all processes that have good, bad, or unknown reputations will become visible. Checking the box will only show bad or unknown processes and hide the ones that are known to be safe.

View details about active running processes

You can view several details about each actively running program in the revamped behavior blocker panel. The most important columns in the panel to look at are the “Company” column and the “Reputation” column. A company name is marked in green if the file is digitally signed and the certificate is valid. This is important because any file property information can potentially be faked by malware authors. Therefore, if you only see a black color coded “Microsoft Corporation”, that does not guarantee that the file is from Microsoft. You should always pay attention to the reputation rating for each program in the last column (good, bad or unknown) as this is essential in distinguishing the good from the bad.

How to use the process list to spot potential threats

Now that you know where to find the key settings in the panel, you are ready to utilize the process list to find and remove potentially malicious applications running on your PC. If the behavior blocker indicates that a program’s reputation is unknown or bad, you can right-click on the program to perform several actions: create rule, lookup online, end process, quarantine process, open file location, and view file properties.

Right-click on any process to perform various tasks to find out more about it.

The quarantine and end process options are only available for new or bad processes in order to prevent you from harming your system by mistakenly performing one of these actions on a harmless or critical windows process. Each action will allow you to learn specific details about the program:

Create rule

Creating application rules for active running processes is simple: Right click on any individual process and select the “create rule” option from the context menu. You can then configure application rules and set your preferences on how you want the behavior blocker to behave, which is described in more detail in the next paragraph.

Lookup online

Use this feature to check a file in the Emsisoft Anti-Malware Network. After selecting the desired process, you’ll be directed to a page in which you can view several file properties and details about the executable process that you can use to make an informed decision about the safety of a file.

The process list “lookup online” feature using the Emsisoft Anti-Malware Network.

If a process is known to have a bad or unknown reputation, you are presented with options to either quarantine or end the process. If a file is classified as new or unknown, use caution. If a file status is classified as bad, we recommend you remove the file entirely.

Quarantine program

You can use the quarantine program option to move an unknown or malicious process or program safely to Emsisoft’s quarantine. Once you move a program or process to quarantine it can no longer be accessed or run because it is placed in an encrypted container that will keep it locked. In the event that you mistakenly quarantine a harmless file, you can restore the file from the quarantine at at any given time.

End process

You can use the end process option to end an unknown or active malicious process. This means that the the threat cannot harm your PC anymore since it is no longer running. The end process option may be a safer alternative than the quarantine option in the event you are unsure if a process is malicious, but still do not trust it or notice that it is potentially exhibiting suspicious behavior.

Open the file location

Navigate to a file location to get insight about where exactly a file is located. For example, if a supposed system process is typically located in the System32 directory but is now present in your Documents folder, it is most likely malware. Experienced users may wish to manually remove threats using this option.

View the file properties

File properties are traits of the file such as the size or type. Viewing file properties is helpful in determining whether a file is malicious because users can view the MD5 hash of any given file which can be compared to the authentic hash that can quickly be found online. The MD5 hash of a file is a sequence of 32 characters which help identify each file uniquely and comes in handy to see if a file as been manipulated or changed. If the hash is different, there is a high probability that the file is malicious. The date a file was first and last seen is a factor to take into consideration because if a file is relatively new and not classified yet, it in theory should not be trusted.

What to do when a malicious process is found

If a process is found to be malicious, it will most likely be blocked in realtime by the Emsisoft behavior blocker. Alternatively, use the process list to quarantine or end the active malicious program. If a program is classified as malicious, it is recommended that you quarantine the threat.

If the program is unknown, ending the process may be a safer option at the time as the program could potentially be harmless. At this point, running a scan with your security product may be a wise choice to ensure that your PC is free of other potential malware infections. Alternatively, feel free to consult with our malware removal experts on our support forum if you are unsure of which action to take.

How to configure application rules

You can configure application rules in order to define your own preferences on how you want the Emsisoft behavior blocker to react to specific programs. If you notice there is already a rule available for that program, then double click on the process to open an “edit rule box” instead of creating a new rule. You can configure application rules under the protection tab or by right-clicking on an individual program in the process list. You have the following options:

Configure an “all allowed” application rule.

All allowed should be used when the application is undoubtedly safe and is a common everyday application with favorable reputation status among many users.

Configure  a “custom monitoring” application rule.

Monitor this application but, allow/block specific activities should be used when a safe or unknown application is not necessarily malicious, but exhibits suspicious behavior at times that triggers the behavior blocker to prompt you frequently.

Configure an “always block this application” rule.

Always block this application should be used if you are certain a program is behaving in a malicious manner. An example of such a scenario is if an unknown application is attempting to capture your keystrokes or injecting code into another process.

Conclusion

The revamped behavior blocker panel offers new ways to spot potential threats. You can use the new process list to weed out suspected threats and learn several details about which programs are running on your PC. When a malicious process is found, simply use the end or quarantine option to remove the threat from memory. In addition, you can create application rules control the manner in which the behavior blocker handles certain applications and activities. You can use the new panel to your advantage to get the most out of your Emsisoft protection.

Please share your feedback about the new behavior blocker panel, we always like to hear your thoughts!

Have a great (malware-free) day!

Related Posts:

• Efficient protection against new malware: Emsisoft’s…


• Stable update: Emsisoft Anti-Malware and Internet Security…


• Emsisoft Anti-Malware & Emsisoft Internet Security…


• Is this file safe? Re-launch of the Emsisoft Anti-Malware…


• Emsisoft Malware Spotlight: Blackbeard and Pigeon

How to use the new behavior blocker panel to quickly spot potential threats

Malvertising makes use of the Magnitude exploit kit to deliver ransomware

Online advertisements can be annoying. But what if they spread malware too? The excessive greed of few has lead to the rise of malvertising, advertisements that redirect or lead to malware. A recent Zscalar study revealed that several compromised websites contained ads that led to ransomware.

Compromised websites lead to drive-by-download attacks serving ransomware

In these attacks, the malicious payload is delivered to vulnerable systems using a popular technique known as drive-by-download. Essentially, compromised websites host the Magnitude exploit kit, a community  name choosen for an Exploit Kit previously referred to as “Popads, which drops malware into the system using vulnerabilities found in the browser.

The following websites were found to redirect to malicious content:

• hymedoraw[dot]com/search[dot]php


• awerdeall[dot]com/search[dot]php


• index-html[dot]com/


• joomla-green[dot]com/


• bestcool-search[dot]com/


• joyo-search[dot]com/


• megas-search[dot]com/


• speeds-search[dot]com/


• sample-data[dot]com/


• lazy-summer[dot]com/


• tundra-search[dot]com/


• death-tostock[dot]com/


• adoncorst[dot]com/search[dot]php


• demo-content[dot]com/


• enable-bootstrap[dot]com/


• rospecoey[dot]com/search[dot]php


• aranfleds[dot]com


• adoncorst[dot]com/search[dot]php


• malpithia[dot]com/search[dot]php


• noutademn[dot]com/search[dot]php

The malvertising networks lead to redirector domains using “302 cushioning” i.e. displaying a 302 HTTP redirection warning, in order to avoid detection.

The “magnitude” of damage

Magnitude delivers a Flash and (highly obfuscated) JavaScript payload, exploiting the MS13-009 integer overflow vulnerability. After compromising the system, a shellcode is dumped which fetches a list of urls within it, which lead to ransomware. In this case, the first link led to CryptoWall 3.0, an updated version of a notorious ransomware family that has made headlines several times.

As stated by Zscalar:

“This is a highly profitable ransomware payload that leverages Bitcoin transactions executed over the Tor Anonymizer to monetize the attack, Threat Actors utilize this method of collection because it can’t be reliably traced back to the them. Victims are especially vulnerable to this type of extortion since very few people seem to backup their critical files such as documents and pictures.”

As with any ransomware attack, backups are a lifesaver here. We strongly recommend making regular backups of your data and running up to date malware protection to keep malvertising strikes at bay.

Have a nice (malware-free) day!

Related Posts:

• ALERT: Ads on Disney, Facebook, Guardian Lead to Ransomware


• Ransomware Alert: Digitally Signed CryptoWall through…


• CryptoWall Malvertisments on Yahoo, AOL, Match.com and More


• Xtube compromised, exploits lead to Cryptowall infection


• New Cryptolocker variant attacks games

Malvertising makes use of the Magnitude exploit kit to deliver ransomware

NetUSB hack puts Millions of home users at risk

A vulnerability has been discovered in a software component called NetUSB, which comes pre-equipped on many modern home routers, such as Netgear, TP-Link and TrendNet. The vulnerability is only partially fixed since this February whilst being really simple to exploit.

NetUSB is a technology developed by the Taiwanese company KCodes, allowing users to access their printers, flash drives and other USB devices connected to their router over the network, also called “USB over IP” functionality.

Many home devices at risk

The flaw was initially found on a TP-Link router, and it soon turned out many more brands are at risk because many devices use the NetUSB technology. Because NetUSB is often used as a licensed technology, it makes it harder to discover because each vendor uses different terminology when referring to the NetUSB feature. SEC Consult checked whether devices contain the NetUSB kernel driver and discovered that many devices, including recently released products, are at risk.

“Because of insufficient input validation, an overly long computer name can be used to overflow the “computer name” kernel stack buffer”, according to SEC Consult. The resulting memory corruption can be exploited by an attacker to easily take over the router by installing malware, spy on its users or simply wipe it clean or make it crash.

At the time of this article, it was not yet clear whether the flaw is exploitable remotely or only within the network. Some vendors already scheduled patches for their firmware (see full list) but others have yet to address the issue. KCodes was not available for comments and has not released an official statement (yet).

How to protect yourself?

If possible, completely disable the NetUSB service via the web interface of your router (unfortunately not supported by Netgear routers) and also block port 20005 on the router’s firewall. Check with your router’s manufacturer whether they are planning to schedule a patch for their device.

Home router (pixabay.com)

Related Posts:

• Firmware Vulnerabilities Discovered on Linksys and ASUS…


• Hacker group LizardSquad used home routers to attack Xbox…


• Research Compares USB devices to Dirty Needles – What…


• Another Flash vulnerability


• Trouble Ahead: BadUSB exploit code has been made public

NetUSB hack puts Millions of home users at risk

NetUSB hack puts Millions of home users at risk

A vulnerability has been discovered in a software component called NetUSB, which comes pre-equipped on many modern home routers, such as Netgear, TP-Link and TrendNet. The vulnerability is only partially fixed since this February whilst being really simple to exploit.

NetUSB is a technology developed by the Taiwanese company KCodes, allowing users to access their printers, flash drives and other USB devices connected to their router over the network, also called “USB over IP” functionality.

Many home devices at risk

The flaw was initially found on a TP-Link router, and it soon turned out many more brands are at risk because many devices use the NetUSB technology. Because NetUSB is often used as a licensed technology, it makes it harder to discover because each vendor uses different terminology when referring to the NetUSB feature. SEC Consult checked whether devices contain the NetUSB kernel driver and discovered that many devices, including recently released products, are at risk.

“Because of insufficient input validation, an overly long computer name can be used to overflow the “computer name” kernel stack buffer”, according to SEC Consult. The resulting memory corruption can be exploited by an attacker to easily take over the router by installing malware, spy on its users or simply wipe it clean or make it crash.

At the time of this article, it was not yet clear whether the flaw is exploitable remotely or only within the network. Some vendors already scheduled patches for their firmware (see full list) but others have yet to address the issue. KCodes was not available for comments and has not released an official statement (yet).

How to protect yourself?

If possible, completely disable the NetUSB service via the web interface of your router (unfortunately not supported by Netgear routers) and also block port 20005 on the router’s firewall. Check with your router’s manufacturer whether they are planning to schedule a patch for their device.

Home router (pixabay.com)

Related Posts:

• Firmware Vulnerabilities Discovered on Linksys and ASUS…


• Hacker group LizardSquad used home routers to attack Xbox…


• Research Compares USB devices to Dirty Needles – What…


• Another Flash vulnerability


• Trouble Ahead: BadUSB exploit code has been made public

NetUSB hack puts Millions of home users at risk

Chinese hacker group APT use Microsoft’s Technet web portal to obfuscate their CnC servers

Hackers and malware writers are now using the legitimate functions of popular websites to obfuscate or hide their malicious operations. In a recent attack on Technet, Microsoft’s blog for IT professionals, a Chinese hacker group APT17 used the ability to create profiles and posts to embed encoded CnC (Command and Control) to be used with a variant of the malware known as BlackCoffee. This was done to make it difficult for security professionals to trace the actual location on the CnC server, thus allowing it to remain hidden and operational. According to FireEye, several hacking groups are using the same obfuscation tactics on legitimate websites in order to prolong the lifetime of their CnC servers and thus spread more malware.

Hacker group based in China using notorious “BlackCoffee” malware

The culprits in this case, China-based hacker group APT17 (also known as DeputyDog) are notorious for their network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. The malware used, BlackCoffee is capable of uploading and downloading files; creating a reverse shell; enumerating files and processes; renaming, moving, and deleting files; terminating processes; and expanding its functionality by adding new backdoor commands. In short, a pretty troubling set of malicious operations. This malware, prevalent since 2013, is orchestrated by CnC servers. The communications between the infected system and the CnC server are carried out, disguised as search engine queries.

The BlackCoffee malware works by linking to the biography section of a profile or forum thread created by the attacker. As stated in this report by FireEye:

This BLACKCOFFEE variant contains one or more URLs that link to the biography sections of attacker-created profiles as well as forum threads that contain comments from those same profiles. A URL is randomly selected and the malware searches at that location for an encoded IP address located between two tags, “@MICR0S0FT” and “C0RP0RATI0N”.

This illustration shows how APT17 managed to maliciously use Technet:

Source: www.fireeye.com

New challenges for security researchers

In this case, the issue was resolved by encoding a sinkhole IP addresss into the profile pages and forum threads. The deviously created profiles were also identified and locked to prevent the attackers from making any changes. Microsoft have updated the signatures of their security products and FireEye have released Indicators of Compromise (IOCs) for BlackCoffee. A collaborative approach was helpful in identifying this threat, and its victims. As hackers develop new techniques, security experts must also be prepared to meet new challenges.

Have a nice (malware-free) day!

Related Posts:

• Hackers Anonymous declare (cyber)war on terrorists after…


• New Sefnit Variant Adopts SSH to Commit Click Fraud


• China capable of massive DDoS attacks


• Mysterious DDOS Attack Against Top 50 Website


• CozyDuke malware is being used to spy on high profile US…

Chinese hacker group APT use Microsoft’s Technet web portal to obfuscate their CnC servers

Microsoft Word Intruder, the tool that creates document based malware

In the modern era of cyber security, the use of malware has become a highly profitable business. This captures the interest of several crooks who are willing to make quick cash of unsuspecting victims. Microsoft Word Intruder (MWI) is a new tool that allows even inexperienced crooks to write advanced malware. As stated by nakedsecurity, the malicious tool generates “booby-trapped” MS Office files. The malware creating application was probably developed in Russia with the obvious intention of making money by selling it to novice hackers.

The malware creation tool that can drop or download and then infect

MWI was advertised in the underground by an individual who goes by the handle Objekt. The malicious tool creates infected Rich Text Format (RTF) documents that exploit multiple vulnerabilities in MS Word to infect the victim’s computer.

The malware created by MWI can be of two types:

• Droppers – In this case, the malicious payload used by the infecting application is present locally. This means the infection process can take place offline as all the required components come in one package (the main malware component is extracted or dropped after execution).


• Downloaders – These only come with the URL of the malicious payload meaning that the infection process requires downloading additional stuff from the internet. Although this may seem like a more difficult infection process, it also means that a new and more dangerous malware can be downloaded whenever the threat is executed.

Droppers are more common but both these infections mechanisms are widely used.

MWI malware can be tracked by attackers and used to steal financial information

Since December 2014, MWI has also developed a special tracking feature known as MWISTAT which writes a distinct URL to the generated RTF files. This allows cyber criminals to keep track of their malware campaigns and the samples involved.

To avoid general user suspicion, The MWI malware also comes with a legitimate looking decoy document which hides the abnormal behavior (Word crashing or quitting) immediately after loading a file. The recent versions of this kit attempt to exploit four different vulnerabilities namely, CVE-2010-3333, CVE-2012-0158, CVE-2013-3906 and CVE-2014-1761 with the 2010 and 2012 vulnerabilities being the most prevalent attack vector. It was also found that variants of Zbot or Zeus malware were the ones being predominantly used. This malware family is often used to steal important financial information and login credentials, sometimes with the use or ransomware like CryptoLocker.

It is clear that document based malware is being spread widely, especially with the help of spam emails. Thus a cautious approach towards attachments and up to date anti-malware protection is the key to keeping such rats out of your system.

Have a nice (malware-free) day!

 

Related Posts:

• Half a million computers infected as Macro Malware makes a…


• Microsoft Word Zero Day Alert!


• Dorifel crypto malware paralyzes Dutch companies and public…


• Banking Trojan Alert: MS Word macros spreading Dridex


• Urgent! Update your Windows to patch several critical…

Microsoft Word Intruder, the tool that creates document based malware

Professional hackers available for hire, charge over US$200 for hacking Facebook and WhatsApp

The fact that hacking websites is illegal does not stop the ones in the trade from setting public prices for doing so. According to this hilarious post on hackread, hackers charge US$90 to hack Gmail, US$200 to US$350 for Facebook and WhatsApp. In fact, the website HackersList.com allows you to hire a “professional hacker” to gain unauthorized access to several web locations for a fee. Of course there is no assurance that you will get what you requested. Making such underground dealings often opens a box of surprises, in most cases bad ones. The rate chart is also a diverse one, with costs varying from as little as US$1.25 to a hefty 2000 Euro.

For using illegal services, you always pay the price

Some of the prices listed, depending on the task are as follows:

• Hacking Lessons : Yeah! Now anyone can be a cyber criminal, just pay US$20 and you are good to go. DDoS for the win!


• Yelp reviews : The cost of positive reviews on Yelp varies from US$3 to US$350 depending on the number of reviews and their duration. The expensive package also removes negative reviews.


• Netflix passwords : Due to their easy availability, hacked Netflix account passwords can be bought for as cheap as US$1.25.


• Crypting services : A malicious file is encrypted again and again until it becomes virtually undetectable. Once ready, the malware is sold for US$5.


• WhatsApp : Popularity means this service comes at a price. Hackers usually charge US$200 to US$300 for unauthorized access here.


• Gmail : Gmail account access is provided for US$90


• Facebook : Hackers are selling a tool which (they claim) can hack into Facebook for US$19.99 on a three month basis.


• Facebook Account Access : US$350, get ready to pay up.

Source: hackerslist.com

This is not the first time illegal services are being advertised openly. As stated by Hackread:

“It is no secret that the internet is a familiar place for black market offerings such as firearms and drugs or hackers offering fees for hacking lessons. These hackers also provide an array of services most likely to be illegal.”

Not only is it wrong, there is a strong possibility of this little game backfiring

Even if we take ethics, morality and conscience out of the way, it is still hard to understand why anyone would use a service like this. The first question is, why would you trust this “professional hacker”? Why should you think that someone who is happy to steal and do illegal things for a small financial reward wouldn’t turn on you for the same reason? Not only that, there may be serious legal repercussions that one might have to face. All this however, isn’t enough to deter everyone, which is why these services exist. The internet can sometimes be a dark place, but here at Emsisoft, we strive to live within the light, and strongly recommend that you do the same.

Have a nice (hacking-free) day!

Related Posts:

• Small business owners beware, phone system hacks can cost…


• Keysweeper: proof that it’s relatively simple to hack…


• 5 Million Gmail Usernames and Passwords Compromised


• Emsisoft Alert: Netflix Tech Support Scam


• Hack Your Facebook Friends? More Like Hack Yourself.

Professional hackers available for hire, charge over US$200 for hacking Facebook and WhatsApp

Microsoft Word Intruder, the tool that creates document based malware

In the modern era of cyber security, the use of malware has become a highly profitable business. This captures the interest of several crooks who are willing to make quick cash of unsuspecting victims. Microsoft Word Intruder (MWI) is a new tool that allows even inexperienced crooks to write advanced malware. As stated by nakedsecurity, the malicious tool generates “booby-trapped” MS Office files. The malware creating application was probably developed in Russia with the obvious intention of making money by selling it to novice hackers.

The malware creation tool that can drop or download and then infect

MWI was advertised in the underground by an individual who goes by the handle Objekt. The malicious tool creates infected Rich Text Format (RTF) documents that exploit multiple vulnerabilities in MS Word to infect the victim’s computer.

The malware created by MWI can be of two types:

• Droppers – In this case, the malicious payload used by the infecting application is present locally. This means the infection process can take place offline as all the required components come in one package (the main malware component is extracted or dropped after execution).


• Downloaders – These only come with the URL of the malicious payload meaning that the infection process requires downloading additional stuff from the internet. Although this may seem like a more difficult infection process, it also means that a new and more dangerous malware can be downloaded whenever the threat is executed.

Droppers are more common but both these infections mechanisms are widely used.

MWI malware can be tracked by attackers and used to steal financial information

Since December 2014, MWI has also developed a special tracking feature known as MWISTAT which writes a distinct URL to the generated RTF files. This allows cyber criminals to keep track of their malware campaigns and the samples involved.

To avoid general user suspicion, The MWI malware also comes with a legitimate looking decoy document which hides the abnormal behavior (Word crashing or quitting) immediately after loading a file. The recent versions of this kit attempt to exploit four different vulnerabilities namely, CVE-2010-3333, CVE-2012-0158, CVE-2013-3906 and CVE-2014-1761 with the 2010 and 2012 vulnerabilities being the most prevalent attack vector. It was also found that variants of Zbot or Zeus malware were the ones being predominantly used. This malware family is often used to steal important financial information and login credentials, sometimes with the use or ransomware like CryptoLocker.

It is clear that document based malware is being spread widely, especially with the help of spam emails. Thus a cautious approach towards attachments and up to date anti-malware protection is the key to keeping such rats out of your system.

Have a nice (malware-free) day!

 

Related Posts:

• Half a million computers infected as Macro Malware makes a…


• Microsoft Word Zero Day Alert!


• Dorifel crypto malware paralyzes Dutch companies and public…


• Banking Trojan Alert: MS Word macros spreading Dridex


• Urgent! Update your Windows to patch several critical…

Microsoft Word Intruder, the tool that creates document based malware

Professional hackers available for hire, charge over US$ 200 for hacking Facebook and WhatsApp

The fact that hacking websites is illegal does not stop the ones in the trade from setting public prices for doing so. According to this hilarious post on hackread, hackers charge US$ 90 to hack Gmail, US$ 200 to 350 for Facebook and WhatsApp. In fact a website, HackersList.com allows you to hire a “professional hacker” to gain unauthorized access to several web locations for a fee. Of course there is no assurance that you will get what you requested. Making such underground dealings often opens a box of surprises, in most cases bad ones. The rate chart is also a diverse one, with costs varying from as little as US$ 1.25 to a hefty 2000 Euro.

For using illegal services, you always pay the price

Some of the prices listed, depending on the task are as follows:

• Hacking Lessons : Yeah! Now anyone can be a cyber criminal, just pay US$ 20 and you are good to go. DDoS for the win!


• Yelp reviews : The cost of positive reviews on Yelp varies from US$ 3 to 350 depending on the number of reviews and their duration. The expensive package also removes negative reviews.


• Netflix passwords : Due to their easy availability, hacked Netflix account passwords can be bought for as cheap as US$ 1.25.


• Crypting services : A malicious file is encrypted again and again until it becomes virtually undetectable. Once ready, the malware is sold for US$ 5.


• WhatsApp : Popularity means this service comes at a price. Hackers usually charge US$ 200 to 300 for unauthorized access here.


• Gmail : Gmail account access is provided for US$ 90


• Facebook : Hackers are selling a tool which (they claim) can hack into Facebook for US$ 19.99 on a three month basis.


• Facebook Account Access : US$ 350, get ready to pay up.

Source: hackerslist.com

This is not the first time illegal services are being advertised openly. As stated by Hackread:

“It is no secret that the internet is a familiar place for black market offerings such as: Firearms and drugs or hackers offering fee for hacking lessons. These hackers also provide an array of services most likely to be illegal.”

Not only is it wrong, there is a strong possibility of this little game backfiring

Even if we take ethics, morality and conscience out of the way, it is still hard to understand why anyone would use a service like this. The first question is, why would you trust this “professional hacker”? Why should you think that someone who is happy to steal and do illegal things for a small financial reward wouldn’t turn on you for the same reason? Not only that, there may be serious legal repercussions that one might have to face. All this however, isn’t enough to deter everyone, which is why these services exist. The internet can sometimes be a dark place, but here at Emsisoft, we strive to live within the light, and strongly recommend that you do the same.

Have a nice (hacking-free) day!

Related Posts:

• Small business owners beware, phone system hacks can cost…


• Keysweeper: proof that it’s relatively simple to hack…


• 5 Million Gmail Usernames and Passwords Compromised


• Emsisoft Alert: Netflix Tech Support Scam


• Hack Your Facebook Friends? More Like Hack Yourself.

Professional hackers available for hire, charge over US$ 200 for hacking Facebook and WhatsApp

Curiosity arousing Facebook scams lead to nothing but malware

Facebook users are the prime target for online phishes and scams. A very common trend, one we are seeing a lot lately involves some “shocking video”. Such links are shared on Facebook with one intention, making money by stealing innocent people’s information or making them complete paid surveys. Not only do these scams leave you filled with junk promotional emails and phone calls, they also infect your computer with malware, not to mention, there is no “shocking video” at the other end. This further fuels the desperation and excitement of users, making some of them complete the whole scam process multiple times (trying to get to that video), compounding the damage for themselves and filling the cyber criminal’s bank accounts.

Shocking scam, not video

It all begins with a headline like this:  “[Shocking video] When you see what happens to this pregnant lady at the beach, your jaw will drop” meant to lure as many victims as possible. Then, the user is sent to a phony Facebook page asking them to share the post before viewing. The scam post looks something like this:

Facebook scam (source- http://www.hoax-slayer.com)

Clicking on the link redirects the user to several fake pages that will attempt to steal their personal information. Viewers may be asked to download some plug-in required to view the video, which is actually a piece of malware that will compromise the security of the system and lead to further scams. There are several and sometimes endless hurdles that the user must cross to complete the scam process only to realize that there was no reward waiting at the other end the whole time. This may also include fake surveys to “prove you are human” and redirects to third party websites which ask you to enter all your personal information “to win exciting prizes”.

As stated by Hoax-Slayer:

“The great irony here is that you can freely view the actual video directly on YouTube without the need to spam your Facebook friends, participate in dodgy surveys, or download any malware.”

These scams rely on the unawareness of users and the quick click behavior to make easy steals before the users even realize what they are doing. We have comprehensively covered some of the most common scams in this post. Apart from having a keen eye, a good anti-phishing or web security module, like the one found in Emsisoft Anti-Malware helps a lot in preventing such scams.

Have a nice (scam-free) day!

Related Posts:

• Naked Videos of Your Facebook Friends – Translation:…


• WhatsApp scam falsely promises early access to voice calling


• Fraud attempts on social networks How Facebook scams work


• How to stay safe on Facebook and avoid the top 5 scams


• Hack Your Facebook Friends? More Like Hack Yourself.

Curiosity arousing Facebook scams lead to nothing but malware

Lenovo’s system update vulnerability allows man in the middle attacks

Lenovo is facing the heat once again as three major vulnerabilities are discovered in their system update software. This is a big blow to the Chinese PC manufacturer after Superfish, the pre-installed Lenovo adware contained a massive security flaw. This time, it’s even worse as it turns out that Lenovo’s own system update software could lead to a man in the middle (MiTM) attack.

The security flaws were discovered by IOActive who found out that Lenovo’s system update doesn’t fully verify executables downloaded from the internet. Due to this, it is possible for attackers to replace the legitimate update software with malware in a classic man in the middle scenario.

Free System privileges for everyone!

The system update software allows even the least privileged users to run the update. In order to do that the application includes a service called SUService.exe. This service runs as system user and allows any user to execute commands with higher privileges. This vulnerability present in Lenovo System Update (5.6.0.27 and earlier versions) presents a great security risk as it could allow malicious commands from an unprivileged user to be executed with system privileges, thus putting the malware in the driver’s seat. But wait, Lenovo software update must be checking the signatures of the downloaded files before running them, right? Unfortunately that is where the problem exists. As stated by IOActive:

“When performing the signature validation, Lenovo failed to properly validate the CA (certificate authority) chain. As a result, an attacker can create a fake CA and use it to create a code-signing certificate, which can then be used to sign executables. Since the System Update failed to properly validate the CA, the System Update will accept the executables signed by the fake certificate and execute them as a privileged user.”

Thankfully though, Lenovo worked together with IOActive to release an update that addresses this issue (CVE-2015-2233). Other vulnerabilities fixed include:

• CVE-2015-2219 – allows a local least privileged user to run commands as a System user


• CVE-2015-2234 – allows local unprivileged users to run commands as an administrative user

As stated by Kevin Bocek, vice president of security, strategy and threat intelligence at Venafi:

The system of trust that keeps the internet running safely is “very fragile.”

Hopefully Lenovo and other PC manufacturers will improve security testing procedures for their software to ensure that their users are not exposed to such security risks.

Have a nice (vulnerability-free) day!

Related Posts:

• PrivDog, a Comodo add-on also bypasses SSL security


• Warning! Lenovo pre-loads “Superfish” adware…


• Urgent! Update your Windows to patch several critical…


• Security flaw “FREAK” haunts millions of Android


• Unauthorized certificates being used for Google domains

Lenovo’s system update vulnerability allows man in the middle attacks

Half a million computers infected as Macro Malware makes a comeback

A recent Microsoft study has revealed that macro malware attacks have been rapidly increasing in number and intensity. In the last year alone, the number of active malware and infected machines has increased by over four times of the count in early 2014. These document based malware attacks are usually carried out through spam emails, arousing the user’s curiosity to open the infected attachment. Such attacks have infected over 500,000 unique machines, making macro malware a major threat once again.

Macro malware is mostly spread through spam emails. Users open the attached documents and enable the macro, thinking it is necessary to view the document properly. This allows the macro downloader to execute, and create a gateway for other malware to get into the system. As stated by Microsoft:

“When a malicious macro code runs, it either downloads its final payload, or it downloads another payload courier in the form of a binary downloader.”

The infection procedure is illustrated below:

Macro malware infection chain. Source: http://blogs.technet.com/

A Gateway to greater threats

Some of the main threats downloaded by recent macro downloaders include malware like Drixed, and the banking trojan Vawtrak. The downloaded malware packages have advanced capabilities including screenshot, video capture and launching man in the middle attacks. However, like most other malware, the primary goal of these threats is to steal sensitive information. Although macro malware is a worldwide threat, most recent attacks have been mostly targeting the U.S. and the U.K. The next most infected countries are Mexico, Poland, Italy, France and Germany.

Although macro malware comes disguised in the form of a document and can easily infect a computer, it still requires the user’s consent to execute. Microsoft noted:

“Macro threats, as payload couriers, seem to gain popularity as an effective infection vector. But unlike exploit kits, these macro threats require user consent to run.”

Despite that fact, the sheer number of infected computers shows that macro malware is a very large scale and serious threat. This is a surprising find in a time when we were beginning to think that document based macro malware is a thing of the past. In order to prevent getting infected through a macro downloader, users must ensure that they have up to date malware protection and be careful about enabling macros.

Have a nice (malware-free) day!

Related Posts:

• Spam email delivers Microsoft Office macro trojan malware


• Des mails indésirables vous livrent un malware troyen du…


• Banking Trojan Alert: MS Word macros spreading Dridex


• Trojan downloader Waski steals login credentials


• Chthonic trojan on the rise!

Half a million computers infected as Macro Malware makes a comeback

Former JP Morgan employee charged with selling customer information to thieves

“FBI Badge & gun” by not stated – FBI Photosimage source Dead links as of January 7, 2014. Licensed under Public Domain via Wikimedia Commons

Banking scams are widely prevalent now days. The FBI has charged a former JP Morgan employee Peter Persaud with charges of selling customer information to thieves that wanted to empty bank accounts without triggering any apparent alarms. Unsealed court records confirm that he did in fact unknowingly contact an undercover FBI agent and offer to sell him the account details of a customer.

The Register reports that unsealed court records also confirm that for the sum of $2,500, Persaud offered to release the customer’s account number, PIN, and other identifying information so withdrawals could be made. The court records show that last November, the undercover agent met with Persaud in which he handed over the cash along with a sheet of paper containing sensitive details such as the account holder’s social security number, date of birth, debit card number, and three digit security code.

Bank employees can potentially give your account information to criminals

It was reported that within the following month, Persaud and the agent met again. During this time, a second customer’s details were sold for an additional sum of $2,500 with more to come after the victim’s account had been emptied. The FBI agent was wearing a wire that recorded the entire conversation as told to the court.

On New Year’s Eve, Persaud met with the agent yet again and sold him another client’s account details. Two weeks later, Persaud was persuaded to meet the undercover agent and a man introduced as an underworld boss that was in fact another undercover agent serving for the agency’s financial cybercrime unit CY-6.

The g-man agreed to buy more account data over the course of the next few months. The scam came to a ceasing halt in February when Persaud was temporarily suspended from the bank, allegedly. Once the suspension ended, Persaud continued to sell a large number of accounts for even greater sums of money.

Persaud now faces trial for his crimes

In March, Persaud reportedly offered four accounts totaling up to an approximate balance of $150,000 in exchange for $16,000 to $17,000. The FBI then rushed in for an arrest. Persaud now faces a trial and is due to appear at a bail hearing in Brooklyn New York.

Have a great (crook-free) day!

 

Related Posts:

• Hackers steal up to $1 billion from banks through malware…


• Nigerian man accused of hacking a bank computer to steal…


• Banking Alert: JPMorgan Chase Hack Affects Over 76 Million…


• ALERT: You need to change your eBay password, now.


• NY hacker sentenced to 3 years in prison for cyber attacks…

Former JP Morgan employee charged with selling customer information to thieves

Smart city technology could be potentially vulnerable to hacking

“Led traffic lights” by Petey21 – Own work. Licensed under Public Domain via Wikimedia Commons

As technology continues to evolve, the threat posed by hackers is increasingly dangerous. According to the Argentine security expert Cesar Cerrudo, a chief technology officer at IOActive Labs, smart cities using wireless sensors to control everything may be vulnerable to cyber attacks. Everything from traffic lights to water management may be at risk.

Smart Cities’ technology enables the cutting-edge intelligence and flexibility necessary to help cities use resources more efficiently – to improve everything from quality of the air and water to transportation, energy and communication systems. According the the New York Times, Cesar Cerrudo demonstrated how 200,000 traffic control sensors installed in major hubs such as the ones in Washington, New York, and San Francisco were vulnerable to attacks. The sensors used could be intercepted from up to 1,500 feet away or even by a drone because one company failed to encrypt its traffic.

Hackers can potentially bring down major cities that use unsecured technology

Cerrudo said he is increasingly uncovering similar problems: software bugs, poorly installed encryption, or no encryption in other products and systems incorporated in smart cities. Many are wide open to a denial of service attack. Several ways were discovered to make red or green traffic lights stay the same color, tweak electronic speed limited signs, and mess with ramp meters to send cars onto the freeway all at once.

Last year, security researchers at the Black Hat Europe conference in Amsterdam were able to demonstrate how to black out parts of cities by manipulating smart meters and exploiting encryption issues in power line communication technology.

Smart cities should use basic security measures and prepare for the worst

City governments will invest approximately $41 trillion over the next 20 years to upgrade their infrastructure to benefit from the Internet of Things (IoT). With these huge investments, the IoT will transform the quality of life for citizens in cities. Mr. Cerrudo said that municipal leaders have to start thinking of their cities as vast attack surfaces that require security protection. He encourages them to adopt basic security measures such as encryption, passwords, authentication schemes, and a mechanism for patching security holes. He suggests that cities should create their own emergency response teams to address security incidents and coordinate responses. Cities should also restrict access to their data.

In a worst case scenario Cerrudo stated:

“When we see that the data that feeds smart city systems is blindly trusted and can be easily manipulated — the systems can be easily hacked and there are security problems everywhere — that is when smart cities become dumb cities”

Have a great (malware-free) day!

Related Posts:

• Emsisoft Connects to The Internet of Things


• Surveillance – a fair exchange of freedom and privacy…


• Teleoperated surgery robots are vulnerable to malicious…


• Hackers can potentially hack WIFI systems on aircrafts to…


• A Samsung Galaxy S5 flaw allows hackers to clone your…

Smart city technology could be potentially vulnerable to hacking

Password Alert, Google’s new form of defense against Phishing

Google recently launched a new extension for the massively popular web browser, Chrome. This open source program called “Password Alert” is designed to prevent phishing attacks by warning users when they enter their Google login credentials on an illegitimate page. The source code for the software is available at GitHub and can be used by both home and business users. This tool is a response to a Google research which found phishing to be a potent attack vector.

Phishing, a powerful and pervasive threat

A combination of research and surveys conducted by Google and the University of California, San Diego has revealed that not only are phishing attacks very common, they are also very successful. According to the findings:

• The most effective phishing attacks have a success rate of 45 percent!


• 2 percent of all Gmail messages are traps that attempt to make users spill out their passwords.


• There are also millions of scam and phishing emails being sent every single day.

The statistics clearly depict that the threats posed by phishing are extensive. Password Alert is Google’s response to these threats. Fighting such a large scale threat requires universal tools but considering the popularity of both Chrome and Google accounts (almost everyone has one), a powerful software that prevents Google account information falling into the wrong hands can be very useful.

How Password Alert prevents Phishing

The extension Password Alert works by remembering a “scrambled version” of the user’s password. This data is securely stored and whenever the user attempts to enter the same password on a page that is not authorized by Google, the extension pops up a warning, as seen below.

Password Alert, source -http://googleonlinesecurity.blogspot.co.uk/

This way several Phishing attempts can be thwarted. The tool also encourages users to use different passwords for different sites, which is a good security practice.

It is important to remember though, that this tool is designed only to protect your Google login information. Important credentials for banking websites, other email clients and services are still at risk. However, several people also use their Google accounts to log into other websites (many services allow that these days), in which case this browser extension can be very effective. It is already available and can be easily downloaded from the Chrome webstore.

Although we welcome the use of this great tool by Google, it is still advisable to enter any login information with caution, and use solid web protection.

Have a nice (phishing-free) day!

 

 

Related Posts:

• ALERT: Google Drive Phishing Scam


• ALERT: The Google Drive Phishing Scam Returns!


• 5 Million Gmail Usernames and Passwords Compromised


• Spam email Emotet steals bank account credentials from…


• Alert: CHASE Phishing Emails Steal Credentials, Serve Dyre…

Password Alert, Google’s new form of defense against Phishing

Teleoperated surgery robots are vulnerable to malicious hijacking

“Cmglee Cambridge Science Festival 2015 da Vinci” by Cmglee – Own work. Licensed under CC BY-SA 3.0

With advances in technology, telesurgical procedures are not uncommon and date as far back as 2001. Researchers at the University of Washington in Seattle examined a product of their own University known as the Raven II and found that it is vulnerable to cyber threats. It was discovered that the robotic could be forced to ignore or override a surgeons commands among other unwanted actions.

According to the information composed in a paper by the researchers, it is also possible for a hacker to initiate a man-in-the-middle attack on the connecting router that will intercept data traffic between the surgeon and robot which means the attacker can remove, modify, or insert commands.

Hackers could potentially hold your life in their hands

According to MIT Tech, the researchers tried out three types of attacks on the robotics.

The first attack changes the commands sent by the operator to the robot by deleting, delaying, or reordering them which causes the robot’s movement to become jerky and difficult to control.

The second attack modifies the intention of signals from the operator to the robot by changing the distance an arm should move or the degree it should rotate. Researchers Bonaci and Co. stated that:

“Most of these attacks had a noticeable impact on the Raven immediately upon launch”

The final category of attack is a complete hijacking that takes over the robot. Bonaci and Co. also stated:

“We effectively took control over the teleoperated procedure”

In an additional test, researchers worked out how to generate movements that triggered the automatic stop mechanism within the robot that resulted in a successful denial of service attack. Afterwards, they easily stopped the robot from being properly reset thus making a surgical procedure impossible.

Encryption can be a life saver but still is not foolproof

It has been determined that the best way to prevent and combat a man-in-the-middle attack is to use encryption to secure the communications between the control console and the robot. As we all know, even with the best, strongest security systems and practices in place, there is always a possibility that a hacker can find a way around the defenses.

Under the circumstances, would you trust a remote robotic operation?

Have a safe robotic (hack-free) day!

Related Posts:

• Trouble Ahead: BadUSB exploit code has been made public


• GiTHub hit with massive DDoS attack


• Updated ‘Cryptowall 2.0′ Targets Windows Using…


• A Samsung Galaxy S5 flaw allows hackers to clone your…


• Hackers can potentially hack WIFI systems on aircrafts to…

Teleoperated surgery robots are vulnerable to malicious hijacking

Chinese government seemingly blocked access to Facebook.net causing a DDoS scare

Photo by claudiodivizia, 123rf

The government is seemingly controlling more aspects of our online digital world these days. The Chinese government censors controlling the “Great Firewall of China” are suspected to have inadvertently blocked access to pages that call out to connect.facebook.net. It is a resource used by Facebook like buttons.

According to Krebs Security, the apparent mistake was quickly fixed, but in the meantime the block was cached by many Chinese networks effectively blocking millions of Chinese web users from visiting a large number of websites that are typically uncensored. Over the course of the 24 hours during the incident, web requests from China for a large number of websites were being redirected to wpkg.org.

Incident considered to be a likely mistake, not an intentional act

Wpkg.org is a harmless site that hosts an open-source, automated software deployment upgrade removal program for Windows. A researcher named Nicholas Weaver has delved deep into the subject of Chinese censorship tools at the International Computer Science Institute and the University of California, Berkeley. He agrees that the blocking of connect.Facebook.net is likely a mistake.

Nicholas Weaver stated the following about the incident:

“Any page that had a Facebook Connect element on it that was unencrypted and was visited from within China would instead get this thing which would reload the main page of wpkg.org, Weaver said, noting that while Facebook.com always encrypts users’ connections, sites that rely on Facebook “like” buttons and related resources draw those from connect.facebook.net.”

This censorship is considered to be nothing more than a likely mistake on part of government officials because the issue was quickly corrected and the Chinese censors do not benefit from an act such as this. The overall result of this event was massive confusion and paranoia.

This is not the first time that something like this has happened. In January 2014, Chinese censors attempted to block Greatfire.org and instead ended up inadvertently blocking all Chinese web surfers from accessing a majority of internet sites resulting in one of the largest internet outages ever in China.

Have a safe (malware-free) day!

Related Posts:

• China capable of massive DDoS attacks


• Global Security Alert: China Bans Windows 8 on Government…


• GiTHub hit with massive DDoS attack


• U.S. Charges Chinese Military Hackers with Cyber Espionage


• Emsisoft Anti-Malware 8.1.0.33 released!

Chinese government seemingly blocked access to Facebook.net causing a DDoS scare