Techie Feeds

Black Friday 2020: How to shop safely online

Malwarebytes - Fri, 11/20/2020 - 16:00

Black Friday 2020 promises to be somewhat different from years gone by thanks to COVID-19. The annual surge of in-store chaos and trolley dashes isn’t compatible with social distancing, and so retailers will be looking to drive shoppers online.

Friday 27th November is when things kick off this year, and yet some aspects will be radically different. If you intend to go to physical stores, then there’s a few things you’ll need to keep in mind.

Black Friday: Not spared from the lockdown

Some retailers are closing physical stores. Others are looking to extend how long their sales last, with the possibility of fewer sales in-store and more offered online to keep visitors to a minimum. One possible knock-on effect of so many online orders could be a delay in deliveries. Online shopping has increased as much as 75% already due to the pandemic, and Black Friday looms ominously in every retailer’s calendar.

Retailers are usually incredibly pleased about upcoming sales bumps. Now? It’s largely just the promise of in-store problems and offline capacity issues. While this may not concern the biggest retailers too much, small and medium businesses could well feel the pinch depending on what their 2020 Black Friday strategy is.

Sadly, this year’s sales bonanza comes with a possible increase in online scammers hunting for targets. Here are some ways you can beat the double threat of COVID-19 and internet scams this coming Black Friday.

Staying safe on Black Friday: Our tips
  1. Be suspicious of emails claiming to be from stores, especially if they ask for login details and/or supply you with links which look different to the URL you’re most familiar with. Spelling mistakes aren’t always a sign of a scam, but on the other hand, most businesses use proof-read templates, so errors are unusual. Similarly, HTTPS doesn’t mean the site is legitimate; only that data entered can’t be easily snooped by third parties. Pretty much anyone can get a free HTTPS certificate these days, so it’s not a sure-fire sign of legitimacy either way.
  2. Use a credit card if possible, as it’s generally the safer option online. Debit cards tied to your bank account are often more problematic when dealing with a scam situation—the money immediately leaves your account and it can be more difficult to get it back than with a credit card.
  3. Scammers may direct you to malware-laden sites or try to compromise legitimate sites in the run-up to Black Friday. Make sure your operating system is up to date, your security software is running the latest version, and you’ve got all the in-browser plugin protection you need before heading off to the virtual shopping races.
  4. Watch out for shortened links on social media, as they may be hiding nasty surprises.
  5. Don’t fall for “retweet/share to win a prize” tricks. Any giveaway is a tempting prospect but you’ll want to ensure the account running the promotion is legit. Do they have a verified presence on the social media platform? If not, how familiar with the account are you generally? Social etiquette top tip: some of your audience won’t like lots of competitions and raffles dropped into their curated timelines. Do them and yourself a favour, consider running a standalone account just for competitions. They’ll appreciate you not spamming their feed, and if you do end up retweeting something bad, you’ll be massively reducing its reach.
Further resources for keeping yourself secure

Here’s some blogs you may find useful to help with the above tips.

Shop safely in 2020

As has been mentioned, this year’s Black Friday is going to be a bit of an odd one. If you’d rather not venture out into possible crowds, or be stuck in very long distanced lines, that’s great. Stay home and reduce the potential COVID-19 risk. However, you’ll need to ensure your online security is similarly precaution filled. If your devices need a general spring cleaning to get things where they need to be security-wise, this could be the perfect moment to make a start.

Our very own Black Friday discount

It would be remiss in an article about safely shopping on Black Friday, not to mention that Malwarebytes is offering a Black Friday discount itself. You can save 50% on Malwarebytes Premium and 40% on Malwarebytes Premium + Privacy.

Whatever you do this Black Friday, we wish you safe and secure shopping for both Black Friday and beyond.

The post Black Friday 2020: How to shop safely online appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Demystifying two common misconceptions with e-commerce security

Malwarebytes - Fri, 11/20/2020 - 15:59

Online shopping has seen a dramatic increase in the months following the Covid-19 outbreak as more and more people opt-out of visiting physical stores. Such a phenomenon does not go unnoticed or without additional consequences. During the same time period, we have seen an increase in the usual scams but also digital skimming, the online equivalent of credit card theft.

As a consumer, you may be hearing different tips on how to shop online safely. A common one is to look for the “https” in the site’s URL, but what exactly does that mean in the case of a compromised site?

As a merchant, processing transactions securely is one of the top requirements in order to achieve SAQ-A level PCI DSS compliance. Many businesses choose to work with a Payment Service Provider (PSP) and use iframe containers. Once again, how do those fare when malicious code is at play?

When it comes to online security there is always a caveat, and the important thing is to understand the sometimes subtle nuances of technology concepts and their limitations.

The padlock

When we visit a website, our browser makes a series of requests to a web server via the HTTP protocol. The server will in turn reply with responses that include the text and images displayed on screen.

There was a time not so long ago when most websites were not using encryption and therefore exposed communications between server and browser. In other words, an attacker could capture sensitive data you might be typing into a website because that data was sent in clear text.

With the adoption of HTTPS, HTTP requests and responses are encrypted via the TLS (Transport Layer Security) protocol, the successor of SSL (Secure Sockets Layers). In addition, HTTPS authenticates web servers such that when you browse to https://www.facebook.com, private and public keys using the site’s SSL certificate are matched to guarantee the legitimacy of the server. (Note: we still commonly use the term “SSL certificate”, but the technology behind it is TLS).

Today, there really is no valid reason for a website not to have an SSL certificate anymore. Not only can they be obtained for free, but browsers will display a warning that could deter people from visiting your website.

One recommendation you might hear about when it comes to shopping online is that if the site is secure, its URL should start with “https://” and include a lock icon on the shopping cart page. While technically this is true, the meaning of ‘secure’ needs to be properly defined.

Indeed, a number of people will wrongly assume that a site using HTTPS is secure, and therefore can be trusted to buy from. The SSL certificate guarantees that the connection to the site is secure (meaning, encrypted) and that the site is who it pretends to be, but that’s it.

To drive the point home, at Malwarebytes we detect thousands of websites that all use HTTPS and are yet dangerous or outright malicious. In fact, when it comes to e-commerce, almost all of the sites that have been injected with a credit card skimmer do use HTTPS.

Figure 1: A number of merchant sites using HTTPS that have been hacked

When a website has been compromised, an SSL certificate does little to guarantee your online safety. This is why it’s important to understand the difference between a secure communication protocol and a secure website.

Websites run on software that can have vulnerabilities and be exploited by threat actors. A hacked site may contain malicious code that controls what you see and do within your browser, whether it uses HTTPS or not.

Figure 2: A web skimmer using HTTPS to load malicious code and exfiltrate data

The irony is that online criminals themselves have adopted SSL certificates too. And there’s not much comfort in knowing that your credit card data has been stolen and exfiltrated ‘safely’.

There is no doubt you should stay away from sites that have not adopted the latest secure communication protocols. However, you should not take for granted that a site is secure (in the sense of safe to shop) simply because you see a padlock.

iframe protection

A number of online shopping sites use a Content Management System (CMS) such as Magento where the checkout page relies on third-party forms to handle sensitive data. The integration is meant to be seamless in order to give shoppers the best experience possible.

One popular option is the iframe container, where a merchant site integrates a third-party script within an iframe on the checkout page. In technical terms, the provider script is inserted within an iframe container where the customer will enter their payment details (i.e. credit card number, month and year expiry and CVV). This means that no cardholder data is stored, processed or transmitted by the merchant.

Figure 3: Braintree Hosted Fields isolating payment data

The same-origin policy (SOP) enforced by modern browsers ensures that code contained in one page can only access data in another page if both web pages have the same origin. In other words, if the merchant site gets hacked, SOP prevents malicious code from stealing data within the protected iframe.

Unfortunately, there are many ways to bypass iframe protection and it usually comes down to having control of what is loaded onto a page. The PCI Security Standards Council states in one of its reports that “If an attacker has compromised the merchant’s website, however, they can create alternative content for the frame, which then allows completion of the payment process as well as creation of a copy of the cardholder data for the attacker.”

In an attack we observed recently, threat actors were targeting Braintree Hosted Fields to inject their very own iframe within the same container after disabling the legitimate one.

Figure 4: A rogue iframe takes the place of the Braintree iframe

As you can see in Figure 2, the legitimate Braintree iframe (braintree-hosted-field_number) has its display property set to none while a malicious iframe (fpmt) takes it place.

This means that the attackers now have direct access to the credit card number field and can steal it once the customer types it in, completely bypassing the iframe container protection.

Containers still have value for merchants as they can help them achieve PCI compliance and also generally augment their overall security posture. However, externalizing the payment process does not mean that your platform is secure from hackers.

Security in layers

There is no absolute in the security field, and if one technology claims to solve all problems it probably is too good to be true.

As the threats targeting online shoppers evolve, so must our response too. Credit card skimmers can target just about any platform and business, but there are some higher risk areas and behaviors. When evaluating a shopping site, you need to look well beyond the HTTPS padlock and even security seals.

  • Is the site up to date? While technically this would require scanning the CMS core files to determine their version, some things such as copyright notices showing dates of years past are a giveaway.
  • Is this a small ‘mom and pop’ website? Those are generally at greater risk because the owners have fewer resources to invest in security.
  • Does the site offer payment options that may be more secure such as a separate payment gateway, or token system?
  • Does the checkout page render properly without any odd looking elements? Skimmers often try to inject phishing forms or hijack existing fields, which can sometimes be noticed visually.

After doing due diligence checks on the site, you can still thwart the risk of online skimming by using security software, and in particular browser extensions that can block malicious code from loading. Malwarebytes Browser Guard was designed to filter out ads, scams and malicious content.

As an online merchant, there are a number of security decisions to make when you run a website. It would be difficult to list them all here, but as a general rule it’s good to remember that security is not an end state but a constant process that requires resources. Being proactive to anticipate attacks and have a plan in case of a compromise is also critical.

There are a number of services that provide security hardening and monitoring with varying costs. These can be a good option for a merchant that does not have its own IT team. As a side note, most web developers or web agencies (unless specified otherwise) will only build a website but not provide ongoing security updates and monitoring.

The post Demystifying two common misconceptions with e-commerce security appeared first on Malwarebytes Labs.

Categories: Techie Feeds

IoT forecast: Running antivirus on your smart device?

Malwarebytes - Thu, 11/19/2020 - 17:47

In 2016, threat actors pulled off a basic but devastating botnet attack that harnessed the power of the Internet of Things (IoT).

After gathering a list of 61 default username and password combinations for IoT devices, threat actors scanned the Internet for open Telnet ports and, when they found a vulnerable device, gained entry, eventually amassing an army of IoT devices to launch a massive DDoS attack.

This was the Mirai botnet attack. Though it began as a simple get-rich-quick scheme involving, of all things, the popular video game Minecraft, it led to a widespread Internet outage on the US East Coast.

In terms of ingenuity, the attack was fairly crude. There was no social engineering element and no clever attack machinery.

But if that kind of rudimentary attack destabilized an entire region’s Internet, what would a focused IoT attack do instead? And what types of IoT security are protecting users today?

Last month, for Cybersecurity Awareness Month, Malwarebytes hosted multiple educational webinars and cybersecurity training sessions for its employees, offering advice on strong password creation, two-factor authentication, and how to spot a phishing email. 

In our final week of Cybersecurity Awareness Month, we hosted a live version of our podcast, Lock and Code, for our employees. In the episode, (which you can listen to in full here) we spoke to John Donovan, chief information security officer for Malwarebytes, and Adam Kujawa, security evangelist and a director of Malwarebytes Labs, about the future of cybersecurity for the Internet of Things.

What we learned was interesting enough to present to our audience in both our podcast and, today, as a blog on Malwarebytes Labs.

Crucially, the future of cybersecurity for IoT devices is not separate from the future of cybersecurity for all devices. In fact, as our use and reliance on IoT devices shifts from general convenience to full integration into daily routines, the two concepts may very well merge.

Here’s what is keeping us safe today, and what we can expect to keep us safe tomorrow.

IoT non-standardization: Boon or burden?

Perhaps non-intuitively, IoT devices are currently protected by the exact same infrastructure that leaves them vulnerable—they are not standardized. That means that many IoT devices out there today, from smart fridges to smart speakers to smart watches, are often built on different parts that run different operating systems that rarely, if ever, talk to one another.

From one perspective, that’s good, Kujawa said.

“Right now, the best security we have for IoT devices is that [development] isn’t standardized yet,” Kujawa said. “There are lots of different devices using different platforms, on different frameworks, with different protocols in some cases, and that confusion makes it difficult to do things like develop a serious security threat to these devices.”

From another perspective, though, this same non-standardization presents a threat to effective IoT security solutions.

“It also works against us in the sense that developing security tools in order to protect these devices is just as difficult because you can’t create one solution that will necessarily work on every single device,” Kujawa said.

Until that standardization arrives, Donovan said that a lot of IoT device cybersecurity hygiene falls to the users themselves. Donovan and Kujawa offered several best practices that consumers should be able to implement today, no matter their level of tech proficiency:

  • Change the default password on your IoT devices
  • Do not connect your IoT devices to networks you do not trust
  • Stay informed about any reported vulnerabilities for your devices
  • Update your devices

These four steps will better protect your IoT device from harm because, as we learned from the Mirai attacks, cybercriminals are primarily looking for easy targets. Think of it like actual burglary attempts: Thieves don’t often go looking for padlocks to try and pick, they look for doors that are unlocked.

Beyond these basic steps, Donovan noted that the lack of IoT standardization has created a higher bar for some users to fully secure their own devices and networks.

“All the things you would do to secure a corporate network? Now you have to do it in your house,” Donovan said. That includes several security best practices like segregating individual IoT devices and setting up a virtual LAN—or VLAN—to isolate IoT devices from the rest of a network.

No matter the level of tech proficiency, though, there’s more to cybersecurity than personal responsibility.

Donovan said that IoT developers should include automatic security updates by default. No automatic updates often result in no meaningful cybersecurity, and that goes for any popular device or software.

Where the problems really start to compound, though, is in the corporate world.

Cybersecurity issues for businesses

The Internet of Things is not there solely to help consumers set oven timers while cooking or to play a few rounds of the game show Jeopardy! when bored. In fact, countless manufacturing factories and hospitals utilize devices and equipment that routinely connect to the Internet for communication and operation. So, when one of those devices goes down, or if threat actors discover a vulnerability, the overall threat could be more severe.

Complicating the issue is that some of the companies that actually manufacture this type of equipment are small businesses that can sometimes fail, Kujawa said.

“I’ve heard about this plenty of times for plenty of hospitals, where they’ve got this equipment that’s running on Windows XP, and the company that built it doesn’t exist anymore, and they never released updates for it.” Kujawa said. “It puts the organization in a really tough spot.”

Imagine the many businesses in just this situation, saddled with a now-unsupported IoT device that is crucial to their daily operations. If a vulnerability is discovered, what options can they take? Remove the IoT device and lose days of production time, or risk running the device until a serious cyberattack hits, which would also incur high costs to resolve? 

Either way, relying on specialized IoT devices made by small companies that cannot support their own products is a recipe for disaster, Kujawa said.

“Especially the smaller stuff and the specialized stuff, it’s very unlikely you’ll get security updates for that,” Kujawa said. “This is basically a vulnerability machine you can plug into your network.”

Despite the difficult cybersecurity realities today, the future of IoT devices looks potentially simpler.

The future of IoT cybersecurity

Much like how IoT devices are becoming increasingly crucial to businesses, these devices are also becoming increasingly integrated into our day-to-day lives.

It’s important to remember that our smartphones are not excluded from the IoT conversation, and every extension of our smartphones—tablets, smart watches, even far-away concepts like augmented reality glasses—will present us with more ways to connect to the Internet than ever before. No longer will cyberspace be relegated to the computer screen. 

With that increase in popularity and daily integration, Kujawa predicted that the public would see the rise of about four to five primary IoT developers. It’s not hard to imagine today which companies will be included on that list; already, Apple, Google, and Amazon are cornering the market on smart speakers, smart watches, and, of course, cell phones.

Whatever those four major players will be, Kujawa said, there will also be a narrowing in the number of operating systems available for IoT devices. Once enough people have purchased enough IoT devices running on a limited number of operating systems, then, Kujawa said, the cybercriminals will strike.

“When we get to that point and more folks are using [IoT devices] for things like banking or social media, then that’s when we see the investment by cybercriminals,” Kujawa said.

But, Kujawa said, these cybercriminal waves will demand a cybersecurity response.

“When we see investment by the cybercriminals, that means that all of the security vendors, if they haven’t already been migrating to those platforms, they need to do that,” Kujawa said. “[If] that’s where the focus is going to be by the bad guys, that’s where the focus has to be by us as well.”

When asked if he could ever see a future where Malwarebytes and other similar antivirus tools run on IoT devices, Kujawa spoke matter-of-factly:

“Absolutely. We’re headed in that direction right now.”

The post IoT forecast: Running antivirus on your smart device? appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Chris Krebs, director of Cybersecurity and Infrastructure Security Agency, fired by President

Malwarebytes - Wed, 11/18/2020 - 16:16

On Tuesday evening, President Donald Trump fired Chris Krebs, director of the Cybersecurity and Infrastructure Security Agency (CISA), just days after CISA called the recent presidential election the “most secure in American history.”

In a tweet posted the same day, the President justified his removal of Krebs:

“The recent statement by Chris Krebs on the security of the 2020 Election was highly inaccurate, in that there were massive improprieties and fraud – including dead people voting, Poll Watchers not allowed into polling locations, “glitches” in the voting machines which changed…

…votes from Trump to Biden, late voting, and many more. Therefore, effective immediately, Chris Krebs has been terminated as Director of the Cybersecurity and Infrastructure Security Agency.”

Donald Trump announces the firing of Chris Krebs on Twitter

Krebs responded cordially to his firing:

“Honored to serve. We did it right. Defend Today, Secure Tomrorow [sic]. #Protect2020”

Chris Krebs responds to his firing on his personal Twitter account

For nearly one month, under Krebs’ direction, CISA has batted away rumors about the US presidential election on a website that the agency officially launched on October 20, dubbed “Rumor Control.” The website has gained enormous popularity, often ranking as the number one most-visited page that is owned and operated by the Department of Homeland Security, where CISA is situated.

Rumor Control provided election fact checks for cybersecurity and non-cybersecurity issues. Some of the website’s recent statements include:

  • Robust safeguards including canvassing and auditing procedures help ensure the accuracy of official election results.
  • Voter registration list maintenance and other election integrity measures protect against voting illegally on behalf of deceased individuals.
  • Election results reporting may occur more slowly than prior years. This does not indicate there is any problem with the counting process or results. Official results are not certified until all validly cast ballots have been counted, including ballots that are counted after election night.

Though Krebs received the brunt of the President’s ire, he and CISA were far from alone in their evaluation of the election’s security.

Earlier this week, 59 election security researchers and computer science experts published a joint letter rejecting the President’s recent claims of election fraud.

“We are aware of alarming assertions being made that the 2020 election was ‘rigged’ by exploiting technical vulnerabilities. However, in every case of which we are aware, these claims either have been unsubstantiated or are technically incoherent,” the group of experts said in a letter published online. “To our collective knowledge, no credible evidence has been put forth that supports a conclusion that the 2020 election outcome in any state has been altered through technical compromise.”

Further, 16 federal prosecutors tasked specifically with catching election tampering told Attorney General William Barr last week that they found no such evidence.

Despite these mounting facts, Krebs’ departure was largely anticipated. According to an exclusive report by Reuters last week, Krebs had told several associates that he expected to be fired after his agency refused to remove factual information from Rumor Control, as requested by The White House:

“In particular, one person said, the White House was angry about a CISA post rejecting a conspiracy theory that falsely claims an intelligence agency supercomputer and program, purportedly named Hammer and Scorecard, could have flipped votes nationally. No such system exists, according to Krebs, election security experts and former US officials.”

A bipartisan selection of Congress members and a handful of cybersecurity researchers lamented the firing of Krebs.

Matt Blaze, election security expert and McDevitt Chair of Computer Science and Law at Georgetown University, said on Twitter that “protecting our national infrastructure is a vitally important and extremely difficult job, one Chris Krebs performed with both extraordinary integrity and exceptional skill.”

“Firing him, especially so abruptly, has made our country less safe,” Blaze said.

Republican US Senator Ben Sasse of Nebraska spoke similarly: “Chris Krebs did a really good job — as state election officials all across the nation will tell you — and he obviously should not be fired.”

Democratic Representatives Bennie Thompson of Mississippi and Lauren Underwood of Illinois—who respectively serve as chairman of the Committee on Homeland Security and chairwoman of the Subcommittee on Cybersecurity, Infrastructure Protection, and Innovation—spoke far more harshly.

“The fact is that, since Election Day, President Trump has sought to delegitimize the election results by engaging in a disinformation campaign that could shatter public confidence in our elections for generations,” the two said in a joint statement. “Director Krebs put national security ahead of politics and refused to use his position to do the President’s bidding, so the President fired him.”

The post Chris Krebs, director of Cybersecurity and Infrastructure Security Agency, fired by President appeared first on Malwarebytes Labs.

Categories: Techie Feeds

WebNavigator Chromium browser published by search hijackers

Malwarebytes - Tue, 11/17/2020 - 17:05

A mystery Chromium browser recently made a sudden appearance, and is certainly proving popular. But what is it, and where did it come from?

Malwarebytes detects the browser as PUP.Optional.WebNavigator, and we found several clues that this browser was brought to you by a notorious family of search hijackers.

That family isn’t new to us—we reported about them before when they changed a Chrome policy to remote administration, and lied about the permissions they asked of their users.

Search hijackers in general

We have written before about the interests of shady developers in the billion-dollar search industry and reported on the different tactics these developers resort to in order to get users to install their extensions or use their search sites.

Every time someone clicks on a sponsored advertisement, the requisite search engine earns money on a pay-per-click basis. They are paid by advertisers, who shell out for beneficial placement in the search results for keyword phrases of their choice.

As a result of the popularity of these search engines—Google in particular—US companies spend an estimated $80 billion on search engine optimization (SEO) alone. And the leading search engines are owned by some of the most valuable technology companies around.

What is WebNavigator?

The WebNavigator Browser is a Chromium-based web-browser that promises to simplify your browsing experience.


Note the pre-ticked checkboxes

The simplification is done by keeping the browser running in the background. I fail to see the advantage of that method over minimizing your normal browser, but at least the authors made an effort to explain why the process remains running even after you closed the browser.

I did not have that many tabs open

Another checkbox that is ticked by default is the “Set as default browser” which is pretty cheeky.

Where do people find WebNavigator?

The websites that promote the WebNavigator browser show up in advertisements and get visitors from redirectors. I found them when I was searching for new variants of the family of search hijackers that have become my “special friends” over the past years. That was my first clue that they might be related.

But using the same advertising networks is no definite proof whatsoever. As many shady website owners, they switch domains a lot so they don’t end up on every blocklist. Another detail they have in common.

What was your second clue?

The second clue was the layout and makeup of their website.

This type of layout is typically used to tell users how to install a Chrome extension, and the hijackers just changed the text in the boxes to make it fit them. Also note the line about Yahoo and other third-party search providers, that reminded me of a few search hijack extensions that were removed from the Webstore a while ago.

So, how is WebNavigator a search hijacker?

That was actually my third and most definitive clue. The WebNavigator Browser adds graphic search recommendations to the user’s search results, labelled “Search Recommendations”.

WebNavigator search recommendations

This ties them to the family of search hijackers which we have written about in detail before. For example, I found this set of search recommendations when I installed an extension called “IStreamingSearch”:

IStreamingSearch search recommendations

The difference in results could be caused by my use of a fresh Virtual Machine and a rotation of the VPN  servers I use in Malwarebytes Privacy. But they sure look similar.

How can I stop and remove WebNavigator Browser?

Malwarebytes Premium users are protected against this PUP, and Malwarebytes will warn them when they try to install the WebNavigator Browser.

Malwarebytes Browser Guard, Premium, and EDR will block the domains promoting WebNavigator Browser.

If you’ve already installed the browser but now want to remove it, I have posted full removal instructions for the WebNavigator Browser on our forums.

IOCs

Domains:

  • webnavigator.co
  • fileleauncher.co
  • tvlauncher.co
  • digitalfileconverter.com
  • fastmaps.net
  • gamelauncher.co
  • officelauncher.com
  • streaminglauncher.com

Filenames:

  • webnavigatorbrowser.exe
  • CLICK HERE TO START THE WEBNAVIGATOR BROWSER INSTALLER_********_.EXE (where ******** are random letters and numbers)

Stay safe, everyone!

The post WebNavigator Chromium browser published by search hijackers appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Malsmoke operators abandon exploit kits in favor of social engineering scheme

Malwarebytes - Mon, 11/16/2020 - 18:00

Exploit kits continue to be used as a malware delivery platform. In 2020, we’ve observed a number of different malvertising campaigns leading to RIG, Fallout, Spelevo and Purple Fox, among others.

And, in September, we put out a blog post detailing a surge in malvertising via adult websites. One of those campaigns we dubbed ‘malsmoke’ had been active since the beginning of the year. What made it stand out was the fact it was going after top adult portals and had been continuing unabated for months.

Starting mid-October, the threat actors behind malsmoke appear to have phased out the exploit kit delivery chains in favor of a social engineering scheme instead. The new campaign is tricking visitors to adult websites with a fake Java update.

This change is significant because it drastically increases the target audience, no longer limiting it to Internet Explorer users running outdated software.

Top malvertiser for months

The malsmoke campaign derives its name from the most frequent payload it dropped via the Fallout exploit kit, namely Smoke Loader.

While we see a number of malvertising chains, the majority of them come from low quality traffic and shady ad networks. Malsmoke goes for high traffic adult portals, hoping to yield the maximum number of infections. For example, malsmoke has been present on xhamster[.]com, a site with 974 million monthly visits, on and off for months.

#Malsmoke malvertising campaign continues on xhamster and other top sites.

Also, #FalloutEK seems to have added a new anti-vm check that returns a 404 on the payload session. If your sandbox looks good, that last session should return a 200 and contain the binary. pic.twitter.com/qPaF6z9PKt

— MB Threat Intel (@MBThreatIntel) September 21, 2020 Figure 1: Tweet about continued malvertising attacks on popular adult site

Despite this successful run, malsmoke fell off our radar and we recorded its last activity on October 18. A couple of days prior (October 16), our telemetry registered a new malvertising campaign that uses a decoy page filled with adult images purporting to be movies.

  • Adult site: bravoporn[.]com/v/pop.php
  • Ad network: tsyndicate[.]com
  • BeMob Ad: d8z1u.bemobtrcks[.]com/
  • Decoy adult site: pornguru[.]online/B87F22462FDB2928564CED

A couple of weeks later, this campaign added a new domain as part of its redirect chain, but we can see that they are related (including the. same identifier marker in the URL)

  • Adult site: xhamster[.]com
  • Ad network: tsyndicate[.]com
  • Redirect: landingmonster[.]online
  • Decoy adult site: pornislife[.]online/B87F22462FDB2928564CED

That portal is used as a lure to get people to play adult videos that do not actually exist. Instead, users will be asked to download a fake Java update that is malicious.

Figure 2: Decoy adult template luring users with fake videos

A closer look at the template used and network indicators revealed that this latest malvertising campaign actually belongs to the same malsmoke threat actors that had previously used exploit kits.

Figure 3: Comparing template and traffic sequences between exploit kit and soc. engineering

We notice the same adult movie page template, with one minor fix (the typo in the page title which could have been due to the Russian keyboard layout).

Additionally, the latest domain name pornislife[.]online was registered with the same email address mikami9722@hxqmail[.]com tied to a number of other web properties previously related to malsmoke gates.

Figure 4: Same registrant email address used by malsmoke actors

The malsmoke operators ran successful exploit kit campaigns for several months but in October decided to switch them over to a new social engineering scheme. However, the malvertising chains remained similar as they kept abusing high traffic adult portals and the Traffic Stars ad network.

New social engineering trick

The new scheme works across all browsers, including the one with the largest market share, Google Chrome. Here’s how it works: when clicking to play an adult video clip, a new browser window pops up with what looks a grainy video (black bars are ours):

Figure 5: Adult video clip used as lure

The movies plays for a few seconds with audible sound in the background until an overlay message is displayed telling users that the “Java Plug-in 8.0 was not found”.

The movie file is a 28 second MPEG-4 clip that has been rendered with a pixelated view on purpose. It is meant to let users believe they need to download a missing piece of software even though this will not help in any way at all.

Figure 6: Video clip was customized by the threat actor

The threat actors could have designed this fake plugin update in any shape or form. The choice of Java is a bit odd, though, considering it is not typically associated with video streaming. However, those who click and download the so-called update may not be aware of that, and that’s really all that matters.

Figure 7: Fake Java update dialog

This fake dialog is reminiscent of the missing ‘HoeflerText font’ campaign used in the EITest traffic redirection schemes. EITest was also known for using exploit kits to distribute malware and at some point switched to a similar social engineering trick to target more users, especially those running the Chrome browser.

Payload analysis

The threat actors essentially developed their own utility to download a remote payload that had the advantage of not being easily detected. If you recall, malsmoke previously relied on Smoke Loader to distribute its payloads, whereas now it has its very own loader, thanks a new evasive MSI installer.

Figure 8: Payload installation flow, leading to ZLoader

The fake Java update (JavaPlug-in.msi) is a digitally signed Microsoft installer that contains a number of libraries and executables, most of which are legitimate.

Figure 9: Contents of MSI installer

On installation, lic_service.exe loads HelperDll.dll which is the most important module responsible for deploying the final payload.

Figure 10: Code invoking HelperRun DLL

HelperDll.dll uses the curl library that is present in the MSI archive to download an encrypted payload from moviehunters[.]site.

Figure 11: Request to backend server for actual payload

This is the ZLoader malware, which is then written to disk and ran as:

%AppData%\Roaming\microsoft_shared.tmp

ZLoader injects itself into a new msiexec.exe process to contact its command and control server using a Domain Generation Algorith (DGA). Once it identifies a domain that responds, it starts downloading different modules and optionally an update to ZLoader itself.

Figure 12: Post infection traffic, showing ZLoader gate

On the left of Figure 12, we can see the traffic generated by ZLoader implants injected into msiexec.exe. On the right, we can see those implants dumped from the same process. You can find more information on ZLoader and its implants in our paper The “Silent Night” Zloader/Zbot.

Evolving web threats

Malsmoke was one of the most noticeable distributors of malvertising and exploit kits striking on high profile websites.

While we thought the threat actor had gone silent, they simply changed tactics in order to further grow their operations. Instead of targeting a small fraction of visitors to adult sites that were still running Internet Explorer, they’ve now extended their reach to all browsers.

In the absence of high value software vulnerabilities and exploits, social engineering is an excellent option as it is cost effective and reliable. As far as web threats go, such schemes are here to stay for the foreseeable future.

Malwarebytes Browser Guard already protected users from this malvertising campaign. Additionally, we detect the MSI installer and ZLoader payloads via our Malwarebytes for Windows.

Figure 13: Malwarebytes Browser Guard blocking redirector Indicators of Compromise

Redirector:

landingmonster[.]online

Decoy adult portal:

pornislife[.]online

MSI installer:

87bfbbc345b4f3a59cf90f46b47fc063adcd415614afe4af7afc950a0dfcacc2

First C2:

moviehunters[.]site

ZLoader:

4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab

ZLoader C2s:

iqowijsdakm[.]ru
wiewjdmkfjn[.]ru
dksaoidiakjd[.]su
iweuiqjdakjd[.]su
yuidskadjna[.]su
olksmadnbdj[.]su
odsakmdfnbs[.]com
odsakjmdnhsaj[.]com
odjdnhsaj[.]com
odoishsaj[.]com

The post Malsmoke operators abandon exploit kits in favor of social engineering scheme appeared first on Malwarebytes Labs.

Categories: Techie Feeds

A week in security (November 9 – November 15)

Malwarebytes - Mon, 11/16/2020 - 17:35

Last week on Malwarebytes Labs, we reported on multiple patch releases: from Mozilla’s Firefox and Thunderbird to Google’s Chrome. We also had a chat with our resident experts, Adam Kujawa and John Donovan, about the future of IoT cybersecurity in our latest Lock and Code podcast episode. Lastly, we took a look at a new ransomware called RegretLocker, and guided college students on how they can keep themselves cybersecure while distance learning in the middle of a pandemic.

Other cybersecurity news
  • Pay2Key, a new ransomware family first discovered by Check Point, was found to have ties with Iranian hackers. (Source: The Algemeiner)
  • Doctors were found to be easy targets for hospital-related cyberattacks (Source: MedPage Today)
  • Phishers and scammers were found taking advantage of gaming console players who are looking forward to getting their hands on the new Playstation 5 (Source: Hindustan Times)
  • Speaking of scams: The Better Business Bureau (BBB) warned recipients of text messages offering money to join a “COVID clinical study”. (Source: News Leader)
  • Researchers identified the Google Play Store as “the main distribution vector for most Android malware”. Ouch. (Source: ZDNet)
  • TroubleGrabber, a new family of information stealers, were found to target Discord messaging users by spreading as an attachment. (Source:BleepingComputer)
  • Emotet and TrickBot were deemed “most prolific malware strains”, according to new analysis… (Source: InfoSecurity Magazine)
  • …and targeted spear-phishing attacks are on the uptick, too, according to security experts. (Source: Security Boulevard)
  • With Black Friday just around the corner, be wary of incoming scams and phishing attempts, such as an Amazon scam that is circulating in the wild. (Source: Daily Express)
  • According to KnowBe4, phishing emails purporting to have originated from LinkedIn are the most clicked compared to phishing campaigns on other social media platforms. (Source: MarTech Series)

Stay safe, everyone!

The post A week in security (November 9 – November 15) appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Hat trick for Google as it patches two more zero-days in Chrome

Malwarebytes - Thu, 11/12/2020 - 21:16

Slightly over a week ago we advised you to update your Chrome browser. That warning came only a week or so after we advised you to update your Chrome browser. Things are getting a bit repetitive round here.

Today, we are compelled to repeat that statement as Google has issued patches for two new zero-day vulnerabilities. Someone tipped Google off about them, although the source(s) wish to remain anonymous. Again, the vulnerabilities being zero-days means they are already being used in real life attacks.

Zero-days are a valuable commodity for cybercriminals since there are (until yesterday) no patches for the vulnerability and every unpatched system is another potential victim. Which is exactly why we advise to update your Chrome as soon as possible.

What is the problem that’s being fixed?

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) list—a dictionary that provides definitions for publicly disclosed cybersecurity vulnerabilities and exposures. The goal of CVE is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services).

In this case, the two vulnerabilities were catalogued as:

CVE-2020-16013: Inappropriate implementation in V8. Sound familiar? V8 was also the subject of CVE-2020-16009 where researchers stated it must have something to do with the way the Chrome browser handles Javascript.

CVE-2020-16017: Use after free in site isolation. Site isolation is the feature that makes every website run in a separate process without interaction with each other. Each will be running in a sandbox which provides an additional line of defense. Use after free may indicate that after closing a site the memory location for it may not be freed up properly.

How do I install Chrome patches?

The easiest way to do it is to allow Chrome to update automatically, which basically uses the same method as outlined below but does not require your attention. But you can end up lagging behind if you never close the browser or if something goes wrong, such as an extension stopping you from updating the browser.

So, it doesn’t hurt to check now and then. And now would be a good time, given the zero-day vulnerabilities. My preferred method, which also allows me to keep track, is to have Chrome open the page chrome://settings/help which you can also find by clicking Settings > About Chrome.

If there is an update available, Chrome will notify you and start downloading it. Then it will tell you all you have to do to complete the update is Relaunch the browser.

What version do I need?

After the update, your version number should be 86.0.4240.198 or later. You will now be protected against the vulnerabilities. Google states that the stable channel has been updated to 86.0.4240.198 for Windows, Mac, and Linux which will roll out over the coming days/weeks. Also keep an eye on your Chromium based browsers (Opera, Edge, and others) since they may require updates as well.

Stay safe, everyone!

The post Hat trick for Google as it patches two more zero-days in Chrome appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Surviving college distance learning during the pandemic: a cybersecurity guide

Malwarebytes - Thu, 11/12/2020 - 16:45

Social distancing, the wearing of face masks, practicing hand hygiene, and disinfecting often-touched surfaces have become human necessities during the pandemic era. For schools, they’ve also had to adapt quickly to incorporate distance learning methods that let students continue their studies.

But being in crisis management mode didn’t give higher educational institutions much time to think carefully and plan around issues concerning cybersecurity and privacy, even though it was a struggle for them pre-pandemic. The thing is, cybersecurity and privacy isn’t just a job for the school’s IT department, students and staff have a responsibility to stay secure, too, especially with distance learning in full or partial effect.

So, what’s the TL;DR version?

Wondering how to stay secure while in your online classes, or doing homework? Try a multilayered approach.

What do we mean by this?

In privacy and security, a multilayered approach is about using multiple methods of security. It’s considered the best way of protecting yourself, whether you’re an entity that wants to protect everything important that belongs to you or you’re a person who wants to keep their data safe. A multilayered approach is paramount because a single failure in one layer wouldn’t automatically lead to the complete breakdown of security.

So, how can you create security layers to stay protected while attending classes online and/or doing homework? Before we break that down, remember that these steps not only protect you, your machine, and your data from potential cyberattacks, it also protects others as a consequence, such as your school network and everyone else who connects to it.

Protect your device

Whether you’re using your own computer or one provided by your school, it’s vital that you:

  • Keep your device in a space where it can be physically safe and away from potential theft, or be accessed by other people in your home or flat.
  • When you need to step away from your computer, ensure that you lock your screen. You can do this by setting up a password—or, in some cases, a picture password—and never share it with anyone, so that only you can access your own machine.
  • Enable a firewall on your device.
  • Download and install endpoint protection if your school hasn’t provided this, and confirm it’s running in real time.
  • Ensure that all software installed on your device is up to date. And while you’re at it, uninstall software you don’t use as they could become security risks if you don’t update them.
  • Turn off your device when not in use.
  • Do non-school related browsing or other activities within a virtual environment. Using your personal computer for distance learning shouldn’t hinder you from using your computer like you normally do. But whether you keep school files on your computer or not, it’s best to get used to scrolling the internet within a virtual network in your personal time. This lessens the chances of you getting your computer infected if you encounter online threats.
Protect your Wi-Fi network

Whether you’re using your own internet or the Wi-Fi hotspot your school provided, it is vital that you:

  • Check you are not using your router or hotspot’s default admin credentials. Using them only makes it easier for those with ill intent to hack into your device and network.
  • And, while you’re there, ensure your router or hotspot is secured with a strong password—that’s at least 20 random characters long. These characters shouldn’t follow a pattern. If you don’t want to sweat this out, much less remember a complicated string without writing it down, a password manager can help you with these.
  • Set up a reminder to yourself to change your router or hotspot password. This will help keep potential attacks against these devices at bay. A password manager can come in handy here, too.
  • Turn on your router’s firewall.
  • Enable the highest encryption option available for your Wi-Fi hotspot/router, which could be the WPA2 (Wi-Fi Protected Access 2) or WPA3 (Wi-Fi Protected Access 2) protocol.
  • Change your default SSID (service set identifier), which is the network name broadcasted by your wireless router for your computer and/or device to see and connect to.
  • Keep your router/hotspot firmware updated.
  • Disable features that would allow any device that isn’t your own to connect to the school-provided hotspot. We’re referring to WPS (Wi-Fi Protected Setup) and UPnP (Universal Plug and Play) here.
Protect your school’s network

Infecting your school’s network—whether knowingly or unknowingly—is the last thing we want to happen. Both students and staff alike are expected to adhere to rules, which may look like the following, when connecting to a school network:

  • Whatever computing device you use for distance learning, make sure you scan it first with endpoint protection software before connecting to your school’s network.
  • Never download and run or share files that are of questionable origin. This includes email attachments.
  • Remain informed about the types of online threats students like you might encounter. This includes phishing attempts, scams, and ransomware infections.
Protect your data
  • Back up your data, especially if you’re using your own computer for studying.
  • Use two-factor authentication on your school-related accounts.
  • Use a virtual private network (VPN) when connecting to your school’s network.
  • Avoid reusing passwords.
  • Never share school-related account credentials with anyone.
Protect your virtual class sessions

A number of Zoombombing attacks have happened because students shared their Zoom details with third parties via a public, social space (think Discord, Reddit, Twitter, and even Instagram). And recordings of these Zoombombings have been floating around on YouTube and Twitch.

Please do not share your Zoom or other video communication software details to anyone. It might seem fun and that there’s “no harm done there really”—plus the class gets to be suspended for the day woo!—you’re not only hindering your other classmates from learning, you’re also getting yourself in trouble.

Understand that Zoombombing is a federal offense, and anyone found involved in such an act could be prosecuted and imprisoned. Nowadays, affected schools are encouraged to report any Zoombombing incidents to law enforcement, which may include the local or state police department and the FBI’s Joint Terrorism Task Force, to kickstart investigations. Here’s a great post containing tips on how to curb Zoombombing.

College cybersecurity is a student’s responsibility, too

Schools have the duty and responsibility to physically protect their students and staff from harm, especially during this ongoing pandemic. The same is true for ensuring that students have what they need to continue their studies in the best conceivable way they can. This includes protecting systems that house confidential information and financial data.

Yet some schools are unequipped to address every cybersecurity and privacy challenge they encounter, even before COVID-19 struck. In fact, they can only do so much. Students and staff must start recognizing their part in keeping their school network safe from cyberattacks.

Security is everyone’s responsibility. And there’s no better time than today to take this duty seriously.

The post Surviving college distance learning during the pandemic: a cybersecurity guide appeared first on Malwarebytes Labs.

Categories: Techie Feeds

RegretLocker, new ransomware, can encrypt Windows virtual hard disks

Malwarebytes - Wed, 11/11/2020 - 20:20

Cybersecurity researchers discovered a new ransomware last month called RegretLocker that, despite a no-frills package, can do serious damage to virtual hard disks on Windows machines.

Through a clever trick, RegretLocker can bypass the often-long encryption times required when encrypting a machine’s virtual hard disks, and it can close any files currently opened by a user to then encrypt those files, too.

Chloé Messdaghi, vice president of strategy at Point3 Security, described RegretLocker as having “broken through the speed-of-execution barrier for encryption [of] virtual files.”

She continued: “[RegretLocker] actually seizes the virtual disk and is much faster in execution than previous ransomware attacking virtual files.”

Despite the ransomware’s state-of-the-art machinery, its appearance remains quite plain.

RegretLocker does not offer its victims a lengthy ransomware note—a common practice for many ransomware types today—and it asks victims to contact threat actors through an email address. That email address is hosted on CTemplar, which, according to Silicon Angle, is an anonymous email hosting service based in Iceland.

The short note that victims receive, titled “HOW TO RESTORE FILES.TXT” contains the following text:

“Hello, friend.

All your files were encrypted.

If you want to restore them, please email us : petro@ctemplar.com”

As of Tuesday, our threat intelligence team only knew of one in-the-wild reported sample, with no known or reported victims. However, this ransomware should still be watched because of its ability to quickly encrypt virtual hard disks, a potential breakthrough in ransomware capabilities.  

Often, ransomware avoids any attempts to encrypt virtual disks found on machines because those virtual disks can be enormous in size, and the time to encrypt those files would simply delay the ransomware’s purpose—to get into a machine and lock it up.

RegretLocker treats virtual disks differently, though. It utilizes the OpenVirtualDisk, AttachVirtualDisk, and GetVirtualDiskPhysicalPath functions to mount virtual disks as physical disks on Windows machines. Once the virtual disk has been mounted, RegretLocker encrypts the disk’s files individually, which speeds up the overall process.

RegretLocker’s virtual hard disk mounting capabilities potentially came from research that was recently published on GitHub by the security researcher smelly__vx. The researchers at MalwareHunterTeam also analyzed a sample of RegretLocket and found that it can run offline as well as online.

Further, RegretLocker can tamper with the Windows Restart Manager API to terminate active programs or Windows services that keep files open. According to IT Pro Portal, the same API is utilized by other ransomware types, including Sodinokibi, Ryuk, Conti, Medusa Locker, ThunderX, SamSam, and LockerGoga. Files encrypted with RegretLocker use the .mouse extension.

Malwarebytes users should know that we protect them from this new threat, as shown below.

The post RegretLocker, new ransomware, can encrypt Windows virtual hard disks appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Mozilla patches critical security issues in Firefox and Thunderbird

Malwarebytes - Tue, 11/10/2020 - 15:22

Mozilla has issued a critical patch for Firefox, Firefox ESR, and Thunderbird after a security issue was discovered at the Tianfu Cup 2020 International Cybersecurity Contest

The security issue has been assigned CVE-2020-26950 which has the “reserved” status. Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) list—a dictionary that provides definitions for publicly disclosed cybersecurity vulnerabilities and exposures. The goal of CVE is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services).

What is the problem that’s being fixed?

The description Mozilla published itself reveals that write side effects in MCallGetProperty opcode were not accounted for. In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition.

Use-after-free is a naming convention for vulnerabilities related to the incorrect use of dynamic memory during an operation by a program. It means that after freeing a memory location, a program does not clear the pointer to that memory, which could allow an attacker to abuse the error and launch a buffer overflow attack. In a “worst case” scenario this could allow for a remote code execution (RCE) attack, but whether that is true in this case is unknown at the moment.

Which versions are vulnerable?

Make sure you are on the latest versions of the following:

  • Firefox should be updated to version 82.0.3 or later
  • Firefox ESR (Extended Support Release) should be updated to version 78.4.1 or later
  • Thunderbird should be updated to 78.4.2

Firefox Extended Support Release (ESR) is a version of the popular browser for large organizations that need to deploy and maintain Firefox at a large scale. It does not have all the latest functions, to limit the number of updates, but it does receive security and stability updates.

How do I check my version and update?

To find out which version you are using on a Windows machine, open the application menu and click on Help > About. On a Mac, look at the top menu and click Firefox > About Firefox. This will show which version you currently have and whether an update is available.

Version screen Firefox

The screens and the way to access are largely the same for all the Mozilla programs, so we will only show the Firefox example.

After the update you should see a screen similar to this:

The next stable version of Firefox will be released on November 17, 2020.

Stay safe, everyone!

The post Mozilla patches critical security issues in Firefox and Thunderbird appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Lock and Code S1Ep19: Forecasting IoT cybersecurity with John Donovan and Adam Kujawa

Malwarebytes - Mon, 11/09/2020 - 18:36

This week on Lock and Code, we offer something special for listeners—a backstage pass to a cybersecurity training that we held for employees during Cybersecurity Awareness Month, which ended in October.

The topic? The future of cybersecurity for the Internet of Things.

Our guests, Chief Information Security Officer John Donovan and Security Evangelist and a Director for Malwarebytes Labs Adam Kujawa guide us through some of the future’s most pressing questions. Will we ever run antivirus software on IoT devices? What predictions can we make for how the cybersecurity industry will respond to the next, possible big IoT attack? And what can we do today to stay safe?

This episode was recorded live in front of our fellow Malwarebytes employees (over Zoom, of course, as is tradition during the coronavirus pandemic). The episode even includes a Q&A with our employees.

Tune in to get a glimpse into how Malwarebytes helped its own employees during Cybersecurity Awareness Month, on the latest episode of Lock and Code, with host David Ruiz.

You can also find us on the Apple iTunes storeGoogle Play Music, and Spotify, plus whatever preferred podcast platform you use.

We cover our own research on: Other cybersecurity news

Stay safe, everyone!

The post Lock and Code S1Ep19: Forecasting IoT cybersecurity with John Donovan and Adam Kujawa appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Update your iOS now! Apple patches three zero-day vulnerabilities

Malwarebytes - Fri, 11/06/2020 - 17:28

Apple has patched three vulnerabilities in iOS (and iPadOS) that were actively being exploited in targeted attacks. Vulnerabilities that are being exploited in the wild without a patch being available are referred to as zero-days. The vulnerabilities were found and disclosed by Google’s Project Zero team, and patches were issued yesterday.

What has Apple patched in the update?

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) list. CVE is a dictionary that provides definitions for publicly disclosed cybersecurity vulnerabilities and exposures. The goal of CVE is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services).

The zero-days are listed under the ID numbers:

CVE-2020-27930: Affected by this issue is some unknown processing of the component FontParser. Manipulation with an unknown input could lead to a memory corruption vulnerability. This means a font could be created which leads to memory corruption, allowing for a remote code execution (RCE) attack .

CVE-2020-27932: A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild. Using such a vulnerability could allow malware to bypass security restrictions on an affected system.

CVE-2020-27950: A malicious application may be able to disclose kernel memory. Apple is aware of reports that an exploit for this issue exists in the wild. Disclosed kernel memory may contain sensitive data like encryption keys and memory addresses used to defeat the address space layout randomization.

What is Project Zero?

Formed in 2014, Project Zero is a team of security researchers at Google who find and study zero-day vulnerabilities in hardware and software systems. Their mission is to make the discovery and exploitation of security vulnerabilities more difficult, and to significantly improve the safety and security of the Internet for everyone.

Update your iOS now

Since Apple has flagged that at least two of these vulnerabilities are being exploited in the wild and told us of the possible consequences, users should install the update as soon as possible.

Owners of an iPhone or iPad are advised to update to iOS 14.2 and iPadOS 14.2 or iOS 12.4.9. Apple patched the same vulnerabilities in the Supplementary Update for macOS Catalina 10.15.7. You can always find the latest Apple security updates at its security updates site.

Stay safe, everyone!

The post Update your iOS now! Apple patches three zero-day vulnerabilities appeared first on Malwarebytes Labs.

Categories: Techie Feeds

RegTech explained: a crucial toolset for the financial industry

Malwarebytes - Fri, 11/06/2020 - 16:30

Every organization in the financial industry needs to meet certain regulatory obligations, even if it’s just filing a tax return or submitting an annual report. In certain industries, such as financial services, they’ve added their own additional sets of rules that must be adhered to. For example, organizations who take and process credit card payments have an obligation to meet the Payment Card Industry Data Security Standard (PCI DSS).

To make keeping up with new regulations easier, financials are turning to RegTech. RegTech is the contraction of the words Regulatory Technology. In the financial word it is one of the hot topics. What is it and why is it so popular? Read on.

What is RegTech?

By definition, RegTech is an innovative technology that enables organizations to effortlessly adjust to the weight of always expanding needs for regulatory reporting. In essence, RegTech providers are an industry within the financial industry that provides other members of the financial world with the technology that helps them to stay current with ever-changing rules and regulations.

The wins for the users of RegTech consist mainly of these elements:

  • Gain efficiency by streamlining and harmonizing processes within the organization.
  • Reporting of compliance and issues is made easier by prefabricated, but often customized, modules.
  • Risk can be identified and countered quicker by using smart technology.

To achieve these goals, RegTech uses 5 different types of technology:

  • Monitoring processes to obtain a real-time objective about what is going on in the organization. This is essential for reporting and risk identification goals.
  • Reporting is often a mandatory part of new regulations and, by constant monitoring, the required reports can be produced at the touch of a button.
  • Data exchange is another part of many new regulations, specifically those that help startups on their way. Technology to enable and monitor the exchange of data helps to comply with these regulations while keeping an eye on data streams.
  • Internal legal departments are supported with tools to make the implementation of new regulations more efficient and thus cheaper.
  • Automation is introduced where possible to avoid human mistakes. The jungle of regulations can easily lead to human error. Monitoring and streamlining can help to avoid such errors. Reporting will have to record them if they should occur, nonetheless. And corrections can be applied where needed.
What makes RegTech so popular?

At one point, the financial industry was under a lot of stress due to new regulations. Depending on the country financials are working from and the regions they plan to do business with, the range of regulations they have to comply with can be challenging. RegTech helps financials to respond in a cost-efficient and versatile way, while maintaining a high standard of quality and security.

How does Regtech work?

This is a very hard question to answer as developments are happening at a fast pace. Every new regulation creates opportunities for the RegTech companies to work on new technology and offer it to banks, financial institutions and FinTech companies. On the other side, RegTech companies supply the supervisory agencies that lay down the rules and regulations with the technology to check compliance by the constituents. This branch is sometimes referred to as SupTech.

For example, by combining Artificial Intelligence (AI) and Big Data it is possible to predict suspicious behavior by monitoring transactions in real-time and scanning for irregularities. This technology will pick up the signals much sooner than any human possibly can, and helps to find patterns indicating money laundering and terrorist funding.

Security implications of RegTech

Many of the regulations are laid down with privacy and security in mind. A correct implementation of these regulations should not pose a problem in this field. On the contrary, if the regulators are accomplishing what they set out to do, these regulations should lift the privacy and security demands to a higher level.

Also, implementation of RegTech gives the in-house security teams at financial organizations the opportunity to focus on other issues as the technology takes over one part of their job. This doesn’t mean internal teams should let go of the process entirely, even though that might sound appealing as they often have a lot of other things on their plate, but it should ease the burden somewhat.

It’s not only necessary to measure the effectiveness of your organization’s security controls against the regulations, but also to check whether new and anticipated legislation does not interfere with your existing security standards. An obligation to offer information to your competitors should not reduce your defenses against a data breach. The Know Your Customer (KYC) documentation not only authenticates the customer’s credentials but also helps maintain a verified record of customers. Regulatory compliance mechanisms like the KYC registry store extremely sensitive personally identifiable information (PII) and elaborate customer data. So, it is important to devise systems that prevent unauthorized access, minimize cyber risks, and limit the possible consequences of a data breach.

Risk and compliance functions use different methods to keep up with regulatory challenges. They use software as a service (SaaS) in the cloud to identify risks, strategize risk tolerance, and facilitate regulatory requirements across various regions and financial services.

How does RegTech provide data security and privacy?

There are some key areas where RegTech contributes to keep our data safe:

  • Fraud prevention. Information provided by criminals can be checked against existing KYC data. This helps to prevent identity theft and abuse of stolen data.
  • Money laundering and terrorist funding are other areas that are monitored by using KYC data.
  • Compliance with national regulations. On top of worldwide and business standards you will often find local standards are applied.
  • Cloud security tools to keep data stored in the cloud at the same safety level as locally stored data.
  • Authentication methods to ensure a high level of security. For example, multi-factor authentication (MFA) methods, cryptography, and encryption.

As more and more business collect PII, customers are concerned about their personal data security and their privacy. And as cybercriminals get more sophisticated, the need for more advanced and effective tools has risen. RegTech companies provide an important part of this new technology for the financial industry.

The post RegTech explained: a crucial toolset for the financial industry appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Prop 24 passes in California, will change data privacy law

Malwarebytes - Thu, 11/05/2020 - 14:12

First-day returns in California showed voters firmly approving to change their state’s current data privacy law—which already guarantees certain privacy protections that many states do not—through the passage of Prop 24.

As of the morning of November 4, according to The Sacramento Bee, 56.1 percent of California voters said “Yes” to Prop 24. At that time, 65.3 percent of the state’s votes had been counted. Though far from a complete tally, the numbers proved advantageous enough for celebration for the “Yes on 24” campaign.

“With tonight’s historic passage of Prop 24, the California Privacy Rights Act, we are at the beginning of a journey that will profoundly shape the fabric of our society by redefining who is in control of our most personal information and putting consumers back in charge of their own data,” said Alastair Mactaggart, chair of Californians for Consumer Privacy and sponsor for Prop 24. “I’m looking forward to the work ahead and the next steps in implementing this law, including setting up a commission that is dedicated to protecting consumers online.”

Proposition 24 represented one of the rarer examples in data privacy law that split advocates in two. The typical roster of data privacy supporters in the state—including Electronic Frontier Foundation, ACLU of Northern California, Consumer Watchdog, Common Sense Media, Color of Change, and Oakland Privacy—divided themselves into three separate categories: Support, oppose, or neither.

The disagreement was well-founded. As we reported, while some groups praised Prop 24 because of its increased protections on data that could reveal race and ethnicity, other groups opposed the proposition because of new loopholes that could disproportionately harm minority communities.  

Adding a potential sense of voter whiplash to the ballot proposition was that its biggest supporter and primary funder Mactaggart actually served as one of the lead architects on the very law that the proposition was trying to amend. Two years ago, after announcing an intention to bring a ballot proposition to Californians to better secure their data privacy rights, Mactaggart instead worked directly with California lawmakers to get a bill drafted, passed, and signed by then-governor Jerry Brown.

That law, called the California Consumer Privacy Act, barely went into effect in January of this year, and details on its enforcement and on how the public could assert their rights were released only this summer.

In the end, though, none of that drama appeared to matter much to California voters. With the passage of Prop 24, Californians can expect additional protections on what the proposition has defined as “sensitive personal information,” as well as the country’s first government agency established entirely to enforce a data privacy law.  

The post Prop 24 passes in California, will change data privacy law appeared first on Malwarebytes Labs.

Categories: Techie Feeds

QBot Trojan delivered via malspam campaign exploiting US election uncertainties

Malwarebytes - Wed, 11/04/2020 - 20:10

This blog post was authored by Jérôme Segura and Hossein Jazi.

The 2020 US elections have been the subject of intense scrutiny and emotions, while happening in the middle of a global pandemic. As election night ended and uncertainty regarding the results began to creep in, threat actors decided to jump in on it too.

Those tracking the threat landscape know very well that major world events do not go unnoticed by criminals. In this case, we began observing a new spam campaign delivering malicious attachments that exploit doubts about the election process.

The QBot banking Trojan operators return with yet another themed spam wave using the same hijacked email thread technique enticing victims with malicious election interference attachments.

Hijacked email threads pushing bogus DocuSign documents

The malicious emails come as thread replies, similar to what Emotet does to add legitimacy and make detection harder. They contain zip attachments aptly named ElectionInterference_[8 to 9 digits].zip.

While the election results are still being evaluated and debated, victims are enticed to open up the document to read about alleged election interference:

Figure 1: Malicious email with ElectionInterference attachment

The extracted file is an Excel spreadsheet that has been crafted as if it were a secure DocuSign file. Users are tricked to allow macros in order to ‘decrypt’ the document.

Figure 2: Excel document containing malicious macro

This tried and tested trick will download a malicious payload onto the victim’s machine. The URL for that payload is encoded in a cell of a Cyrillic-named sheet “Лист3”.

Figure 3: Payload URL obfuscation

Once executed, the QBot Trojan will contact its command and control server and request instructions. In addition to stealing and exfiltrating data from its victims, QBot will also start grabbing emails that will later be used as part of the next malspam campaigns.

Figure 4: QBot process flow execution World events are the best lure

At the core of the malware attacks we witness each day are typical social engineering schemes. Threat actors need to get victims to perform a certain set of actions in order to compromise them.

Spam campaigns routinely abuse email delivery notifications (Fedex, DHL, etc.) or bank alerts to disguise malicious payloads. But world events such as the Covid pandemic or the US elections provide ideal material to craft effective schemes resulting in high infection ratios.

Malwarebytes users were already protected against this attack thanks to our Anti-Exploit technology. Additionally, we detect the payload as Backdoor.Qbot.

Figure 5: Malwarebytes blocking the macro from delivering its payload Indicators of Compromise

Malicious Excel documents

b500a3c769e22535dfc0c0f2383b7b4fbb5eb52097f001814d8219ecbb3048a1
f2fb3e7d69bf1b8c0c20484e94b20be33723b4715e7cf94c5cbb120b800328da
0282a796dec675f556a0bf888eda0fe84f63558afc96321709a298d7a0a4f8e5
e800b0d95e02e6e46a05433a9531d7fb900a45af7999a262c3c147ac23cd4c10
7dec31d782ab776bcbb51bd64cbbd40039805ad94733d644a23d5cf16f85552c
0bec208127e4a021dccb499131ea91062386126b75d098947134a37e41c4b035
30de8dcd4e894549d6d16edb181dd1a7abec8f001c478cf73baf6075756dc8c2
a8329913c8bbccb86b207e5a851f7696b1e8a120929ca5c0a5709bd779babedf
ef8a17c3bb01d58bfea74a19f6cb8573cfb2d94d9e6159709ac15a7e0860dbce
7ddc225ad0ed91ce90b3bde296c5ce0b4649447fb3f02188e5303e22dc7cb5f0

QBot

china[.]asiaspain[.]com/tertgev/1247015.png

1edfe375fafa1f941dc4ee30702f4af31ba636e4b639bcbb90a1d793b5d4b06c 06be75b2f3207de93389e090afd899f392da2e0f1c6e02226db65c61f291b81b

QBot C2s

142.129.227[.]86
95.77.144[.]238 MITRE ATT&CK techniques TacticIDNameDetailsExecutionT1059Command-Line InterfaceStarts CMD.EXE for commands executionT1106Execution through APIApplication launched itselfT1053Scheduled TaskLoads the Task Scheduler COM APIPersistenceT1050New ServiceExecuted as Windows ServiceT1060Registry Run Keys / Startup FolderChanges the autorun value in the registryT1053Scheduled TaskLoads the Task Scheduler COM APIPrivilege EscalationT1050New ServiceExecuted as Windows ServiceT1055Process InjectionApplication was injected by another processT1053Scheduled TaskLoads the Task Scheduler COM APIDefense EvasionT1553Install Root CertificateChanges settings of System certificatesT1055Process InjectionApplication was injected by another processDiscoveryT1087Account DiscoveryStarts NET.EXE to view/change users groupT1135Network Share DiscoveryStarts NET.EXE for network explorationT1069Permission Groups DiscoveryStarts NET.EXE to view/change users groupT1012Query RegistryReads the machine GUID from the registryT1018Remote System DiscoveryStarts NET.EXE for network explorationT1082System Information DiscoveryReads the machine GUID from the registryT1016System Network Configuration DiscoveryUses IPCONFIG.EXE to discover IP address

The post QBot Trojan delivered via malspam campaign exploiting US election uncertainties appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Update your Chrome again as Google patches second zero-day in two weeks

Malwarebytes - Tue, 11/03/2020 - 18:30

Before you start to Google for election news, we’d like you to check whether your browser is at the latest and safest version. “Again?”, Chrome users may say. Yes, because Google has found another zero-day vulnerability – that means it’s a hole that is actively being exploited right now.

It’s the second zero-day in Google found in the past two weeks. Last week we reported about CVE-2020-15999 and advised to upgrade to at least version 86.0.4240.111. Today it is the turn of CVE-2020-16009 which is patched in Chrome version 86.0.4240.183 and later.

How do I install Chrome patches?

The easiest way to do it is to allow Chrome to update automatically which basically uses the same method as outlined below but does not require your attention. But you can end up lagging behind if you never close the browser or if something goes wrong, such as an extension stopping you from updating the browser. So, it doesn’t hurt to check now and then. And now would be a good time, given the zero-day vulnerability. My preferred method, which also allows me to keep track, is to have Chrome open the page chrome://settings/help which you can also find by clicking Settings > About Chrome.

If there is an update available, Chrome will notify you and start downloading it. Then it will tell you all you have to do to complete the update is Relaunch the browser.

What is this Chrome patch for?

Google has not disclosed what the 0-day does or how it is used. This is habitual as they want to give users a chance to update before giving threat-actors the chance to design their own exploits. But researchers came to the conclusion that it must have something to do with the way the Chrome browser handles Javascript by looking at the changelog.

After the update, the security hole should be patched and your settings page should say:

Version 86.0.4240.183

If so, you’re good to go for now.

Stay safe, everyone!

The post Update your Chrome again as Google patches second zero-day in two weeks appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Maze ransomware gang announces retirement

Malwarebytes - Tue, 11/03/2020 - 17:38

The threat actors behind Maze ransomware have announced their retirement. On November 1, they posted the retirement announcement on the website where they would normally name and shame their victims that were unwilling to pay the ransom.

image courtesy of Graham Cluley

“The Project is closed.

Maze Team Project is announcing it is officially closed.

All the links to out project, using of our brand, our work methods should be considered to be a scam.

We never had partners or official successors. Our specialists do not works with any other software. Nobody and never will be able to host new partners at our news website. The Maze cartel was never exists and is not existing now. It can be found only inside the heads of the journalists who wrote about it. Attention to everyone who wants for its private information to be deleted from our news website. You can contact to Maze support chat. Support will be continued for a month after the press release.”

The Maze gang was known for introducing an extra way to create leverage against victims. Not only did the attackers lock organizations’ data up, they also stole the data and threatened to publish it if the ransom was not paid, giving victims another compelling reason to pay up, especially if the data was of a sensitive nature.

So it’s ironic that in the rest of the spelling error-ridden statement, the cybercriminals assume the posture of a group of people out to improve the world rather than line its own pockets. As if raising awareness of security flaws and the danger of Bitcoin was the attackers real goal. If they set out to ease their conscience, we would have preferred them to publish their master decryption keys.

Did the Maze gang retire unexpectedly?

Not really. At Malwarebytes we saw detections drop over the last month after a steep peak in August.

Number of Maze detections since June 2019

We suspect this is a result of the fact that many of their affiliates have moved to a new family, Egregor aka Ransom.Sekhmet. A week earlier, BleepingComputer reported that the Maze gang had stopped seeking out and encrypting new victims some time in September. The gang also cleaned up its data leak site and seemed to be busy extorting its final victims.

Will the Maze ransomware gang truly retire?

We will have to wait and see—history has shown us that when a crime group decides to close its doors, it’s rarely because the criminals have seen the error of their ways and it’s more often due to a new, more powerful threat that the threat actors would prefer to use.

So, with businesses now being targeted with the next ransomware and no sign of hope for victims of the past we see no reason to be particularly happy about this. We do, however, see plenty of reasons for businesses to look at their protection against brute force and other attacks on their RDP ports.

We will keep you posted of any new developments, as always.

Stay safe, everyone!

The post Maze ransomware gang announces retirement appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Hospital ransomware: Gangs are back to target healthcare

Malwarebytes - Tue, 11/03/2020 - 12:50

Healthcare is not in a good place right now.

With some countries and states deciding to go back in to lockdown due to the continued rise of reported COVID-19 infections—and several garnering record-high numbers compared to when almost every country initially went into lockdown—it seems horrible timing that hospital ransomware is back in the news.

Early on in the coronavirus crisis, a promise was made by some ransomware gangs to leave hospitals alone. But cybercriminals behaving like criminals—whether we’re in the middle of a pandemic or not—isn’t something that we should be shocked about.

In the last few months, we’ve seen rising hospital ransomware attacks.

In late September, a chain of hospitals under the Universal Health Services (UHS), one of the largest healthcare providers in the United States, were hit with what appeared to be Ryuk ransomware. According to their official statement, they successfully provided patient care despite not being able to access their IT applications, largely because of back-up processes and offline documentation methods they already had in place. Thankfully, no patient and/or employee data were compromised during the attack.

UHS hospitals and patients were, in a way, lucky. But this isn’t always the case.

Several weeks ago, we reported on Uniklinikum, a German hospital, being hit with a still-unknown strain of ransomware. And because the hospital stopped admitting new patients due to its systems behaving abnormally—a method that many ransomware-hit hospitals have adopted—a woman in need of serious medical attention had to be driven to another hospital 20 miles further. She died. This is considered the first case of death linked to a cyberattack.

“The stereotype of a cybercriminal is that of a bored teenager who is computer literate and socially maladjusted. This is far from the truth and every time there is a crisis we can see that cybercriminals are in reality ruthless and heartless individuals looking to inflict suffering on their victims in whatever way they can, and if a global crisis, such as COVID-19, plays to their advantage they will do so,” Brian Honan, head of BH Consulting, told ISMG in March of this year. “We should not relax any of our defenses but be more aware of criminals looking to leverage the crisis to spread misinformation, set up scams, launch phishing attacks and launch cyberattacks. Contrary to popular belief, there are no common, decent criminals in the online world.”

Last week, the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the US Department of Health and Human Services (HSS) released a joint alert on ransomware activity targeting hospitals and other healthcare providers. The malware families they named that actively target such organizations are TrickBot, BazarLoader (aka BazarBackdoor), Ryuk, and Conti.

This alert also highlights the importance of having and maintaining an offline, encrypted backup of data; creating, maintaining, and exercising a threat incident response plan—even a basic one—so staff would know how to respond in the event of a ransomware attack; and knowing and following the Ransomware Response Checklist, which is included in this CISA guide page.

Healthcare organizations might think that it’s only sensible to pay the ransom as lives could be severely impacted by a ransomware attack. However, in many cases, this scenario can be avoided by being prepared, expecting to be hit, and knowing what to do when—not if—it comes.

The post Hospital ransomware: Gangs are back to target healthcare appeared first on Malwarebytes Labs.

Categories: Techie Feeds

A week in security (October 26 – November 1)

Malwarebytes - Mon, 11/02/2020 - 17:46

We had a very busy week at Malwarebytes Labs.

We offered advice on Google’s patch for an actively exploited zero-day bug that affects Chrome users, our podcast talked about finding consumer value in Cybersecurity Awareness Month with Jamie Court, we provided guidance about keeping ransomware cash away from your business, pointed out how scammers are spoofing bank phone numbers to rob victims, analyzed how a fake COVID-19 survey hides ransomware in a Canadian university attack, and discussed how a new Emotet delivery method was spotted during a downward detection trend.

Believe it or not, we also found time to explain what was going on with the HP printer issue on Mac, analyzed how California’s Prop 24 splits data privacy supporters and discussed Vastaamo, a data breach with unprecedented consequences.

Other cybersecurity news
  • Federal agencies are warning of an increased and imminent cybercrime threat to US hospitals and healthcare providers, especially with regard to ransomware attacks. (Source: NBC)
  • Despite their own claims, questions have been raised as to whether the SunCrypt gang are indeed the newest members of the Maze cartel. (Source: Security Boulevard)
  • The five biggest cybersecurity threats for the healthcare industry as seen by cloud-first security firm Wandera. (Source: TechRepublic)
  • CVE-2020-14882 A bug in Oracle Weblogic is being actively exploited, and the exploitation is trivial. (Source: InfoSec Handlers Diary Blog)
  • Foreign cyber threats to the 2020 US presidential election are predominantly sophisticated disinformation campaigns. (Source: digital shadows)
  • Why satellite hacking has become the biggest global threat for countries like the US, China, Russia, and India? (Source: The Eurasia Times)
  • Facebook warned of perception hacks undermining trust in democracy. (Source: Axios)
  • Microsoft warned that threat actors are actively exploiting systems unpatched against the ZeroLogon privilege escalation vulnerability in the Netlogon Remote Protocol. (Source: BleepingComputer)
  • Email compromise attacks are on the increase as threat actors shift their focus from finance employees to group mailboxes. (Source: BetaNews)
  • Zoom has kicked off end-to-end encryption for its mobile and desktop apps. (Source: ZDNet)

Stay safe, everyone!

The post A week in security (October 26 – November 1) appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Pages

Subscribe to Furiously Eclectic People aggregator - Techie Feeds