Techie Feeds

Cleaning up after Emotet: the law enforcement file

Malwarebytes - Fri, 01/29/2021 - 19:31

This blog post was authored by Hasherezade and Jérôme Segura

Emotet has been the most wanted malware for several years. The large botnet is responsible for sending millions of spam emails laced with malicious attachments. The once banking Trojan turned into loader was responsible for costly compromises due to its relationship with ransomware gangs.

On January 27, Europol announced a global operation to take down the botnet behind what it called the most dangerous malware by gaining control of its infrastructure and taking it down from the inside.

Shortly thereafter, Emotet controllers started to deliver a special payload that had code to remove the malware from infected computers. This had not been formally clarified just yet and some details around it were not quite clear. In this blog we will review this update and how it is meant to work.


Shortly after the Emotet takedown, a researcher observed a new payload pushed onto infected machines with a code to remove the malware at a specific date.

That updated bot contained a cleanup routine responsible for uninstalling Emotet after the April 25 2021 deadline. The original report mentioned March 25 but since the months are counted from 0 and not from 1, the third month is in reality April.

This special update was later confirmed in a press release by the U.S. Department of Justice in their affidavit.

On or about Janury 26, 2021, leveraging their access to Tier 2 and Tier 3 servers, agents from a trusted foreign law enforcement partner, with whom the FBI is collaborating, replaced Emotet malware on servers physically located in their jurisdiction with a file created by law enforcement

BleepingComputer mentions that the foreign law enforcement partner is Germany’s Federal Criminal Police (Bundeskriminalamt or BKA).

In addition to the cleanup routine, which we describe in the next section, this “law enforcement file” contains an alternative execution path that is followed if the same sample runs before the given date.

The uninstaller

The payload is a 32 bit DLL. It has a self-explanatory name (EmotetLoader.dll) and 3 exports which all lead to the same function.

If we look inside this exported function, we can see 3 subroutines:

The first one is responsible for the aforementioned cleanup. Inside, we can find the date check:

If the deadline already passed, the uninstall routine is called immediately. Otherwise the thread is run repeatedly doing the same time check, and eventually calling the deletion code if the date has passed.

The current time is compared with the deadline in a loop. The loop exits only if the deadline is passed, and then proceeds to the uninstallation routine.

The uninstall routine itself is very simple. It deletes the service associated with Emotet, deletes the run key, attempts (but fails) to move the file to %temp% and then exits the process.

Inside the function: “uninstall_emotet”

As we know by observing the regular Emotet, it achieves persistence in two alternative ways.

Run key


This type of installation does not require elevation. In such a case, the Emotet DLL is copied into %APPDATA%\[random dir name]\[random DLL name].[random extention].

System Service

HKLM\System\CurrentControlSet\Service\<emotet random name>

If the sample was run with Administrator privileges, it installs itself as a system service.. The original DLL is copied into C:\Windows\SysWow64\[random dir name]\[random DLL name].[random extention].

For this reason, the cleanup function has to take both scenarios into account.

We noticed the developers made a mistake in the code that’s supposed to move the law enforcement file into the %temp% directory:

GetTempFileNameW(Buffer, L"UPD", 0, TempFileName)

The “0” should have been a “1” because according to the documentation, if uUnique is not zero, you must create the file yourself. Only a file name is created, because GetTempFileName is not able to guarantee that the file name is unique.

The intention was to generate a temporary path, but because of using the wrong value in the parameter uUnique, not only was the path generated, but the file was also created. That lead to the further name collision and as a result, the file was not moved.

However, this does not change the fact that the malware has been neutered and is harmless since it won’t run as its persistence mechanisms have been removed.

If the aforementioned deletion routine was called immediately, the other two functions from the initial export are not getting run (the process terminates at the end of the routine, calling ExitProcess). But this happens only if the sample has been run after April 25.

The alternative execution path

Now let’s take a look at what happens in the alternative scenario when the uninstall routine isn’t immediately called.

After the waiting thread is run, the execution reaches two other functions. The first one enumerates running processes, and searches for the parent process of the current one.

Then it checks the process name if it is “explorer.exe” or “services.exe”, followed by reading parameters given to the parent.

Running the next stage

The next routine decrypts and loads a second stage payload from the hardcoded buffer.

The hardcoded buffer is decrypted with the above loop, and then executed

Redirection of the flow to the decrypted buffer (via “call edi“):

The next PE is revealed: X.dll:

After decrypting the payload, the execution is redirected to the beginning of the revealed buffer that starts with a jump:

This jump leads to a reflective loader routine. After mapping the DLL to a virtual format, in the freshly allocated area in the memory, the loader redirects the execution there.

First, the DllMain of X.dll is called (it is used for the initialization only). Then, the execution is redirected to one of the exported functions – in the currently analyzed case it is Control_RunDll.

The execution is continued by the second dll (X.dll). The functions inside this module are obfuscated.

The payload that is called now looks very similar to the regular Emotet payload. Analogical DLL, and also named X.dll such as: this one could be found in earlier Emotet samples (without the cleanup routine), for example in this sample.

The second stage payload: X.dll

The second stage payload X.dll is a typical Emotet DLL, loaded in case the hardcoded deadline didn’t pass yet.

This DLL is heavily obfuscated and all the used APIs are loaded dynamically. Also their parameters are not readable – they are dynamically calculated before use, sometimes with the help of a long chain of operations involving many variables:

This type of obfuscation is typical for Emotet’s payloads, and it is designed to confuse researchers. Yet, thanks to tracing we were able to reconstruct what APIs are being called at what offsets.

The payload has two alternative paths of execution. First it checks if it was already installed. If not, it follows the first execution path, and proceeds to install itself. It generates a random installation name, and moves itself under this name into a specific directory, at the same time adding persistence. Then it re-runs itself from the new location.

If the payload detects that it was run from the destination path, it takes an alternative execution path instead. It connects to the C2 and communicates with it.

The current sample sends a request to one of the sinkholed servers. Content:

L"DNT: 0\r\nReferer:\r\nContent-Type: multipart/form-data; boundary=--------------------GgmgQLhRJIOZRUuEhSKo\r\n"

The following image shows web traffic from a system infected via a malicious document downloading the special update file and reaching back to the command and control server owned by law enforcement:

Motives behind the uninstaller

The version with the uninstaller is now pushed via channels that were meant to distribute the original Emotet. Although currently the deletion routine won’t be called yet, the infrastructure behind Emotet is already controlled by law enforcement, so the bots are not able to perform their malicious action.

For victims with an existing Emotet infection, the new version will come as an update, replacing the former one. This is how it will be aware of its installation paths and able to clean itself once the deadline has passed.

Pushing code via a botnet, even with good intentions, has always been a thorny topic mainly because of the legal ramifications such actions imply. The DOJ affidavit makes a note of how the “Foreign law enforcement agents, not FBI agents, replaced the Emotet malware, which is stored on a server located overseas, with the file created by law enforcement”.

The lengthy delay for the cleanup routine to activate may be explained by the need to give system administrators time for forensics analysis and checking for other infections.

The post Cleaning up after Emotet: the law enforcement file appeared first on Malwarebytes Labs.

Categories: Techie Feeds

RDP abused for DDoS attacks

Malwarebytes - Fri, 01/29/2021 - 17:03

We have talked about RDP many times before. It has been a popular target for brute force attacks for a long time, but attackers have now found a new way to abuse it.

Remote access has become more important during the pandemic, with as many people as possible try to work from home. Which makes it all the more important to configure RDP services in a secure way.

Quick recap of RDP

RDP is short for Remote Desktop Protocol. Remote desktop is exactly what the name implies, an option to control a computer system remotely. It almost feels as if you are actually sitting behind that computer. Because of the current pandemic, many people are working from home and may be doing so for a while to come.

All this working from home has the side effect of more RDP ports being opened. Not only to enable the workforce to access company resources from home, but also to enable IT staff to troubleshoot problems on the workers’ devices. A lot of enterprises rely on tech support teams using RDP to troubleshoot problems on employee’s systems.

We warned about one of the consequences of exposing RDP in our post Brute force attacks increase due to more open RDP ports. And we provided some security measures in our post How to protect your RDP access from ransomware attacks. But this time we are going to talk about a different kind of attack that makes use of open RDP ports.

RDP as a DDoS attack vector

The RDP service can be configured by Windows systems administrators to run on TCP (usually port 3389) and/or on the UDP port (3389). When enabled on a UDP port, the Microsoft Windows RDP service can be abused to launch UDP reflection attacks with an amplification ratio of 85.9:1.

The traffic that is set off by this amplification attack is made up of non-fragmented UDP packets sourced from the UDP port and directed towards UDP ports on the victim’s IP address(es). From logs, these attack-induced packets are readily discernible from legitimate RDP session traffic because the amplified attack packets are consistently 1,260 bytes in length and are padded with long strings of zeroes.

Open RDP ports

At the time of writing, the Shodan search engine, which indexes online devices and their services, lists over 3.6 million results in a search for “remote desktop” and NetScout identified 33,000 Windows RDP servers that could potentially be abused in this type of DDoS attack.

Shodan search results for remote desktop The consequences of such an attack

The owner of the destination IP address(es) will experience a DDoS attack. DDoS stands for Distributed Denial of Service. It is a network attack that involves hackers forcing numerous systems to send network communication requests to one specific server. If the attack is successful, the receiving server will become overloaded by nonsense requests. It will either crash or become so busy that normal users are unable to use it.

A DDoS attack can cause:

  • Disappointed users
  • Loss of data
  • Loss of revenue
  • Lost work hours/productivity
  • Damage to the businesses’ reputation
  • Breach of contract between a victim and its users

We have discussed preventive measures for DDoS targets in our post DDoS attacks are growing: What can businesses do?

But there are consequences for the abused service owners as well. These may include an interruption or slow-down of remote-access services, as well as additional service disruption due to an overload of additional network hardware and services.

How to avoid helping a DDoS attack

There are a few things you can do to avoid being roped into an RDP DDoS attack. They are also useful against other RDP related attacks.

  • Put RDP access behind a VPN so it’s not directly accessible.
  • Use a Remote Desktop Gateway Server, which provides some additional security and operational benefits like 2FA, for example. Also, the logs of the RDP sessions can prove especially useful.
  • If RDP servers offering remote access via UDP cannot immediately be moved behind VPN concentrators, it is recommended to disable RDP via UDP.

Logging of the traffic will not be effective as a preventive measure, but it will enable you to figure out what might have happened and assist you in closing any gaps in your defenses.

Stay safe, everyone!

The post RDP abused for DDoS attacks appeared first on Malwarebytes Labs.

Categories: Techie Feeds

$12m Grindr fine shows GDPR’s got teeth

Malwarebytes - Thu, 01/28/2021 - 18:15

As thoughts turn to Data Privacy this week in a big way, GDPR illustrates it isn’t an afterthought. Grindr, the popular social network and dating platform, will likely suffer a $12 million USD fine due to privacy related complaints. What happened here, and what are the implications for future cases?

What is GDPR?

The General Data Protection Regulation is a robust set of rules for data protection created by the European Union (EU), replacing much older rules from the 1990s. It was adopted in 2016 and enforcement began in 2018. It’s not a static thing, and is often updated. There’s plenty of rules and requirements for things such as data breaches or poor personal data notifications. Crucially, should you get your data protection wrong somewhere along the way, big fines may follow.

Although mostly spoken of in terms of the EU, its impact is global. Your data may be sitting under the watchful eye of GDPR right now without you knowing it, which…would be somewhat ironic. Anyway.

The complaint

On the 24th January, Norway’s Data Protection Authority (NDPA) gave Grindr advance notification [PDF] of its intention to levy a fine. This is because they claim Grindr shared user data to third parties “without legal basis”. From the document:

Pursuant to Article 58(2)(i) GDPR, we impose an administrative fine against Grindr LLC of 100 000 000 – one hundred million – NOK for

– having disclosed personal data to third party advertisers without a legal basis, which constitutes a violation of Article 6(1) GDPR and

– having disclosed special category personal data to third party advertisers without a valid exemption from the prohibition in Article 9(1) GDPR

That doesn’t sound good. What does it mean in practice?

Noticing the notification

The Norwegian Consumer Council, in collaboration with the European Center for Digital Rights, put forward 3 complaints on behalf of a complainant. The complaints themselves related to third-party advertising partners. The privacy policy stated that Grindr shared a variety of data with third-party advertising companies, such as:

[…] your hashed Device ID, your device’s advertising identifier, a portion of your Profile Information, Location Information, and some of your demographic information with our advertising partners

Personal data shared included the below:

Hardware and Software Information; Profile Information (excluding HIV Status and Last Tested Date and Tribe); Location and Distance Information; Cookies; Log Files and Other Tracking Technologies.

Additional Personal Data we receive about you, including: Third-Party Tracking Technologies.

Where this all goes wrong for Grindr, is that NDPA object to how consent was gained for the various advertising partners. Users were “forced to accept the privacy policy in its entirety to use the app”. They weren’t asked specifically if they wanted to share with third parties. Your mileage may vary if this is worth the fine currently on the table or not, but it is a valid question.

Untangling the multitude of privacy policies

Privacy policies can cause headaches for developers and users alike, in lots of different areas besides dating. For example, there are games in mobile land with an incredible amount of linked privacy policies and data sharing agreements. Realistically there’s no way to genuinely read all of it [PDF, p.4], because it’s too complicated to understand.

Does the developer roll with a “blanket” agreement via one privacy policy to combat this, because thousands of words across multiple policies is too much? If so, how do they cope at a granular level where smaller decisions exist for each individual advertiser?

Removing an advertiser from a specific network might warrant a notification from an app, to let the user know things have changed. Even more so if replaced by another advertiser, entirely unannounced. Does the developer pop notifications every single time an ad network changes, or hope that their blanket policy covers the alteration?

Considering the imminent fine, many organisations may be racing to their policy teams to carve out an answer. A loss of approximately 10% of estimated global revenue isn’t the best of news for Grindr. It seems likely the fine will stick.

Batten down the data privacy hatches

Data privacy, and privacy policies, are an “uncool” story for many. Everyone wants to see the latest hacks, or terrifying takeovers. Yet much of the bad old days of Adware/spyware from 2005 – 2008 was dependent on bad policies and leaky data sharing. While companies would occasionally be brought before the FTC, this was rare.

GDPR is a lot more omnipresent than the FTC is in terms of showing up at your door and passing you a fine. With data being so crucial to regulatory requirements and basic security hygiene, GDPR couldn’t be clearer: its here, and it isn’t going away.

The post $12m Grindr fine shows GDPR’s got teeth appeared first on Malwarebytes Labs.

Categories: Techie Feeds

3 tips to top up your privacy

Malwarebytes - Thu, 01/28/2021 - 09:01

It’s Data Privacy Day—the perennial event that many internet users may have never heard of, but have strong feelings and opinions about the very things that birthed it in the first place.

Originally created to help businesses learn about why online privacy matters, its reach has since extended to other public organizations, governments, communities, and families on a global scale—yes, even when they continue to say “I have nothing to hide!”

Many high-traffic websites have improved on the aspects of security and privacy these past few years, so it shouldn’t surprise you to see privacy features when you visit your account settings. You just have to make use of them.

Here are three simple, practical, and sensible steps you can take now, to achieve a more private—and secure—online life.

1. Check your browser’s privacy options

Your browser is your gateway to the Internet. Unfortunately, few of them have ideal privacy and security settings set by default, even if they’re present.

It is in your best interest then to go ahead and tinker with your browser’s settings, carefully making sure that options are set in a way that are acceptable to you, privacy-wise.

You can read about some popular browsers’ privacy settings here:

While you’re reviewing your settings, you may want to clear out your browser history, too, and review your extensions—you might actually find one or several there that you have already forgotten—and remove those you hardly, or never, used. Vulnerable or malicious add-ons can easily become a privacy and security risk.

Do a browser settings review on your mobile devices as well. You can learn more about them here:

Now, if you find that what’s in there by default lacks the privacy and security settings you hope for, it’s time to ditch that browser for a new one.

Thankfully, most (if not all) desktop browsers that made taking care of your privacy their business, too, have mobile versions. Start by looking up Firefox, Brave, DuckDuckGo, and even the Tor Browser on the Google Play and Apple App stores.

2. Review your social privacy settings

If you use a lot of different social media sites, choose one platform you’re most active on and start there.

(It’s Facebook, isn’t it?)

With privacy in mind, update settings of certain fields in your profile that you feel would less likely make you a target of identity theft. You might also want to limit the way other users of that platform can reach you, such as a total stranger who doesn’t have connections within your closest circle adding you as a friend. To learn more about your options, read Facebook’s basic privacy settings and tools page.

Disable that feature wherein anyone can look you up using an email address or phone number tied to you. Lastly, if you have a friend or family member who likes tagging you on every photo they upload (even if you’re not on the photo), feel free to un-tag yourself. You won’t regret it.

3. Start sharing with caution

Sharing might be caring—not to mention, fun—but in some cases, that doesn’t really apply, especially in social media.

I think by now we’re quite familiar with the scenario of someone publicly sharing their vacation plans on social media only to find themselves a victim of robbery when they got back.

Yes, we should think twice before sharing such information. And not only that, we should also make it a habit to ask permission when sharing photos with other people in them, or stories that involve somebody else. This is not only polite, but this also demonstrates that you care about other people’s privacy, too. They are your friends and family after all.

Every day is data privacy day

Data Privacy Day may only be one day, but looking after our personal data and keeping it safe should be an everyday affair for every Internet user.

You have the tools; we have equipped you with the know-how. Improving your data privacy doesn’t have to be rocket science.

So, let’s take a little bit of our busy time to review and make changes to those settings. These changes might be slight but are incredibly significant overall.

Remember, eyes open, and stay safe!

The post 3 tips to top up your privacy appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Why Data Privacy Day matters

Malwarebytes - Thu, 01/28/2021 - 08:01

Our Lock and Code special episode on Data Privacy Day, featuring guests from Mozilla, DuckDuckGo, and Electronic Frontier Foundation can be listened to here.

Today, January 28, is Data Privacy Day, the annual, multinational event in which governments, companies, and schools can inform the public about how to protect their privacy online.

While we at Malwarebytes Labs appreciate this calendar reminder to address data privacy head-on, the truth is that data privacy is not a 24-hour talking point—it is a discussion that has evolved for years, shaped by public opinion, corporate mishap, Congressional inquiry, and an increasingly-hungry online advertising regime that hoovers up the data of non-suspecting Internet users every day. And that’s not even mentioning the influence of threat actors.

The good news is that there are many ways that users can reclaim their privacy online, depending on what they hope to defend. For users who want to prevent their personally identifiable information from ending up in the hands of thieves, there are best practices in avoiding malicious links and emails. For users who want to hide their activity from their Internet Service Provider, VPNs can encrypt and obscure their traffic. For users who want to prevent online ads from following them across the Internet, a variety of browser plug-ins provide strong guardrails against this activity, and several privacy-forward web browsers include similar features by default. And for those who want to keep their private searches private, there are services online that do not use search data to serve up ads. Instead, they simply give users what they want: answers.

Today, as Malwarebytes commemorates Data Privacy Day, so, too, do many others. First conceived in 2007 by the Council of Europe (as National Data Protection Day), the United States later adopted this annual public awareness campaign in 2009. It is now observed in Canada, Israel, and 47 other countries.

Importantly, Data Privacy Day serves as a reminder that data privacy should be a right, exercisable by all. It is not reserved for people who have something to hide. It is not a sole function for covering up wrong-doing.

It is, instead, for everyone.

Why does data privacy matter?

Privacy is core to a safer Internet. It protects who you are and what you look at, and it empowers you to go online with confidence. By protecting your data privacy, the sites you visit, the videos you watch, even the devices you favor, will be nobody’s business but your own.

Unfortunately, data privacy today is not the default.

Instead, every-day online activities lead to countless non-private moments for users, often by design. In these “accidentally unprivate” moments, someone, somewhere, is making a dollar off your compromised privacy.

When you sign up to use a major social media platform or mobile app, the companies behind them require you to sign an end-user license agreement that gives them near-total control over how your data is collected, stored, and shared.

Just this week, the editorial board for The New York Times zeroed in on this power imbalance between companies and their users, in which companies “may feel emboldened to insert terms that advantage them at their customers’ expense.”

“That includes provisions that most consumers wouldn’t knowingly agree to: an inability to delete one’s own account, granting companies the right to claim credit for or alter their creative work, letting companies retain content even after a user deletes it, letting them gain access to a user’s full browsing history and giving them blanket indemnity.”

Separate from potentially over-bearing user agreements, whenever you browse the Internet to read the news, shop online, watch videos, or post pictures, a cadre of data brokers slowly amass information to build profiles about your search history, age, location, interests, political affiliations, religious beliefs, sexual orientation, and more. In fact, some data brokers scour the web for public records, collating information about divorce and traffic records and tying it to your profile. The data brokers then serve as a middleman for advertisers, selling the opportunity to place an ad in front of a specific type of user.

Further, depending on where you live, your online activity may become the interest of your government, which could request more information about your Internet traffic from your Internet Service Provider. Or perhaps you’re attending a university that you would like to shield from your Internet traffic, as you may be questioning your sexuality or personal beliefs. Who we are online has increasingly blurred with who we are offline, and you deserve as much privacy in one realm as in the other.

In every situation described above, users are better equipped when they know who is collecting their data and where that data is going. Without that knowledge, users risk entering into skewed agreements with the titans of the web, who have more resources and more time to enforce their rules, whether or not those rules are fair.

Are you fighting alone?

You are not alone in fighting to preserve your data privacy. In fact, there are four major bulwarks aiding you today.

First, many tools can help protect your online privacy:

  • Certain browser plug-ins can prevent online ad tracking across websites, and they can warn you about malicious websites looking to steal your sensitive information
  • VPNs can prevent ISPs from getting detailed information about your Internet traffic
  • Private search engines can keep your searches private and your search data away from any advertising schemes
  • Privacy-forward web browsers can default to the most private setting, preventing advertisers from following you around the web and profiling your activity

Second, several lawmakers across the United States have heeded the data privacy call. Since mid-2018, Senators and Representatives for the country have introduced at least 10 data privacy bills that aim to provide meaningful data privacy protections for Americans. Even more state lawmakers have forwarded statewide data privacy bills in the same time period, including proposals in Washington, Nevada, and Mainewhich successfully turned its bill into law in 2019.

Across the world, the legislative appetite for data privacy rights has outpaced the United States. Since May 2018, more than 450 million Europeans have been protected by the General Data Protection Regulation (GDPR), which demands strict controls over how their data is used and stored, and violations are punishable by stringent fines. That law’s impact cannot be understated. Following its passage, many countries began to follow suit, extending new rights of data protection, access, portability, and transparency to their residents.

Third, a variety of organizations routinely defend user rights by engaging directly with Congress members, advocating for better laws, and building grassroots coalitions.  Electronic Frontier Foundation, American Civil Liberties Union, Fight for the Future, Common Sense Media, Privacy International, Access Now, and Human Rights Watch are just a few to remember.

Fourth, a handful of companies increasingly recognize the value of user privacy. Apple, Mozilla, Brave, DuckDuckGo, and Signal, among others, have become privacy darlings for some users, implementing privacy features that have angered other companies, and sometimes pushing one another to do better. Companies that have taken missteps on user privacy, on the other hand, have drawn the ire of Congress and suffered dips in user numbers.

Through many of these developments, Malwarebytes has been there—providing thoughtful analysis on the Malwarebytes Labs blog and releasing products that can directly benefit user privacy. We know the companies who care, we talk to the advocates who fight, and we embrace a pro-user stance to guide us.

Which is why we’re proud to present today a special episode of our podcast, Lock and Code, which you can listen to here.

The future of data privacy

Data privacy has only increased in importance for the public with every passing year. That means that tomorrow, just like today and just like the many yesterdays, Malwarebytes will be there to defend and advocate for data privacy.

We will cover the developments that could help—or could be detrimental—to data privacy. We will release tools that can provide data privacy. We will talk to the experts in this field and we will routinely take pro-user stances because it is the right thing to do.

We look forward to helping you in this fight.  

The post Why Data Privacy Day matters appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Why Data Privacy Day matters: A Lock and Code special with Mozilla, DuckDuckGo, and EFF

Malwarebytes - Thu, 01/28/2021 - 08:01

You can read our full-length blog here about the importance of Data Privacy Day and data privacy in general

Today is a special day, not just because January 28 marks Data Privacy Day in the United States and in several countries across the world, but because it also marks the return of our hit podcast Lock and Code, which closed out last year with an episode devoted to educators and the struggles of distance learning.

For Data Privacy Day this year, we knew we had to do something big.

After all, data privacy is far from a new topic for Malwarebytes Labs, which ramped up its related coverage more than two years ago, giving readers in-depth analyses of the current laws that shape their data privacy rights, the proposed legislation that could grant them new rights, the corporate heel-turns on privacy, the big-name mishaps, and the positive developments in the space, whether enacted by companies or authored by Congress members.

Along the way, Malwarebytes also released products that can help bolster online privacy, and we at Labs wrote about some of the many best practices and tools that people can use to maintain their privacy online.

We’ve been in this space. We know its actors and advocates. So, for Lock and Code, we thought we’d give them the opportunity to talk.

Today, in the return of our Lock and Code podcast, we gathered a panel of data privacy experts that includes Mozilla Chief Security Officer Marshall Erwin, DuckDuckGo Vice President of Communications Kamyl Bazbaz, and Electronic Frontier Foundation Director of Strategy Danny O’Brien.

Together, our guests talk about the state of online privacy today, why online privacy information can be so hard to find, and how users can protect themselves. Tune in to hear all this and more on the latest episode of Lock and Code, with host David Ruiz.

You can also find us on the Apple iTunes store and Spotify, plus whatever preferred podcast platform you use.

The post Why Data Privacy Day matters: A Lock and Code special with Mozilla, DuckDuckGo, and EFF appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Pow! Emotet’s down. Is it out?

Malwarebytes - Wed, 01/27/2021 - 19:19

In a coordinated action, multiple law enforcement agencies have seized control of the Emotet botnet. Agencies from eight countries worked together to deliver what they hope will be a decisive blow against one of the world’s most dangerous and sophisticated computer security threats.

The Emotet threat

In a statement announcing the action,  Europol described Emotet as “one of the most significant botnets of the past decade” and the world’s “most dangerous” malware.

The malware has been a significant thorn in the side of victims, malware researchers and law enforcement since it first emerged in 2014. Originally designed as a banking Trojan, the software became notorious for its frequent shapeshifting and its ability to cause problems for people trying to detect it. This lead to it being used as a gateway for other kinds of malware. Emotet’s criminal operators succeeded in infiltrating millions of Windows machines, and then sold access to those machines to other malware operators.

Taking down Emotet’s infrastructure not only hobbles Emotet, it also disrupts an important pillar of the malware delivery ecosystem.

The takedown

Successful botnets are typically highly distributed and very resilient to takedown attempts. Effective law enforcement cooperation is therefore vital, so that all parts of the system are tackled at the same time, ensuring the botnet can’t reemerge from any remnants that go untouched.

In this case, that meant tackling hundreds of servers simultaneously. Describing the level of cooperation required, Malwarebytes’ Director of Threat Intelligence, Jerome Segura said:

Going after any botnet is always a challenging task, but the stakes were even higher with Emotet. Law Enforcement agencies had to neutralize Emotet’s three different botnets and their respective controllers.

Although it gives few details, the Europol press release hints that a novel and sophisticated approach was used in the action, stating that the Emotet botnet was compromised “from the inside”. According to the agency, “This is a unique and new approach to effectively disrupt the activities of the facilitators of cybercrime.”

Segura added:

Unlike the recent and short-lived attempt to take down TrickBot, authorities have made actual arrests in Ukraine and have also identified several other individuals that were customers of the Emotet botnet. This is a very impactful action that likely will result in the prolonged success of this global takedown.

It remains to be seen if this is the final chapter of the Emotet story, but even if it is, we aren’t at the end of the story just yet.

This action removes the threat posed by Emotet, by preventing it from contacting the infrastructure it uses to update itself and deliver malware. However, the infections remain, albeit in an inert state. To complete the eradication of Emotet, those infections will need to be cleaned up too.

The knockout?

In a highly unusual step, it looks as if the clean up isn’t going to be left to chance. A few hours after the takedown was announced, ZDNet broke the news that law enforcement in the Netherlands are in the process of deploying an Emotet update, and that will remove any remaining infections on March 25th, 2021.

Malwarebyes Threat Intelligence has since pointed out that the actual removal date is April 25th, 2021, because, as any programmer can tell you, the first item in an array is zero, not one.

We are checking on the #Emotet 'cleanup binary'.

It seems the actual date to trigger the uninstall routine is April 25.

More details to come.

/cc @campuscodi @LawrenceAbrams

— Malwarebytes Threat Intelligence (@MBThreatIntel) January 28, 2021

The post Pow! Emotet’s down. Is it out? appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Google FLoC puts ad trackers on a cookie-free diet

Malwarebytes - Wed, 01/27/2021 - 16:15

Cookie tracking is dying and Google needs a replacement. It’s betting on FLoC, an ad tracking technology that lets it understand people’s behaviour while respecting their privacy.

Google has announced that its tests show promising signs that FLoC is working. Is this a milestone on the road to more privacy, or just better concealed tracking technology? Let’s have a look.

What are cookies?

Cookies are small pieces of information that websites store in your browser. If they contain a unique ID, they can be used to track you. That tracking can be used to provide information about your browsing behavior to the websites that you visit. On the one hand, cookies are useful for making your Internet experience more efficient. It is how you automatically get logged in on sites you’ve already visited, even if you closed the browser tab, for example. But on the other hand, cookies are a critical part of the advertising ecosystem that knows which ads are most likely to draw your attention.

Why replace cookies at all?

Several browsers, including Google Chrome, have announced privacy changes that aim to share less data with ad companies, and other third parties. And cookies are essential to the way third-party data is gathered and used by the websites you visit. Also good to know is that Chrome is trailing behind the competition, mainly Firefox and Safari, in this regard. And not only that, but privacy-focused browsers are becoming more popular, and more of them are entering the browser landscape.

What is FLoC?

The Federated Learning of Cohorts (FLoC) is a privacy-focused solution intent on delivering relevant ads “by clustering large groups of people with similar interests”. Accounts are anonymized, grouped into interests, and most importantly, user information is processed on-device rather than broadcast across the web.

FLoC runs in the browser and uses machine learning algorithms to analyze a user’s browser history. According to Google, it might look at “the URLs of the visited sites, on the content of those pages, or other factors.”

It then bundles the user with thousands of others into a group, called a Cohort. The data gathered locally from the browser is never shared. Instead, websites can ask the browser what Cohort it belongs to. In this way, the data about the much wider group of thousands of people is shared, instead of the individual user, and used to target ads.

How do users benefit?

Does that mean that sites are going to run advertisements based on what your Cohort is interested in, and not targeted at you, the individual? Ideally, yes, and that would be progress. But cookies aren’t the only way to track somebody. It may be possible to convert collective data into personalized data by using fingerprinting techniques. Browser fingerprints include details such as browser name, operating system, timezone, and much more. So, will these details be blocked as well?

Once advertisers have figured out how FLoC’s machine learning algorithms operate, they will become smarter at showing you the advertisements that are the most effective based on your interests. Informed readers will remember how popular SEO poisoning was before Google improved its search algorithms.

FLoC will make it harder for advertisers to find out any personal information about you. But that is something you can accomplish right now, by using other tools like a more privacy oriented browser or an ad tracking blocker, which are still more trustworthy companions in our opinion.

What are the downsides?

Of course, there is always a downside. The FLoC solution should be designed so that nobody can access your personal data before it is anonymized and grouped. That includes the users themselves, which denies them any control over the data stored locally. As annoying as some of us may find them, cookies are easy to control.

You are grouped with people of similar interests, but machine learning is a “black box”, so it’s likely there will be no way of you knowing what the criteria were. Does one wrong click get you in a group with interests that you find repulsive? Bad luck, and good luck figuring out how to get out of that group.

Advertisers, and the sites that earn revenue from ads, may feel that Chrome is taking some of their power away in order to take control over their visitors themselves. As it is, this may be Google’s compromise between owning a browser and living off advertising. A compromise other tech giants didn’t have to make since they live predominantly on one side of the privacy fence or another.

What’s the verdict?

FLoC will open for testing in March. For now, let’s wait and see how this pans out. Advertisers and users will have something to say when the technology is worked out, fine tuned, and implemented. Trying to please both sides will end up in a compromise for sure. There is no way yet to try out the final version, but at least now you have some idea about what’s on the horizon, and why.

Guard your privacy, everyone!

The post Google FLoC puts ad trackers on a cookie-free diet appeared first on Malwarebytes Labs.

Categories: Techie Feeds

A week in security (January 18 – January 24)

Malwarebytes - Mon, 01/25/2021 - 13:12

Last week on Malwarebytes Labs, we looked at changes to WhatsApp’s privacy policy, we provided information about Malwarebytes being targeted by the same threat actor that was implicated in the SolarWinds breach, we told the story of ZeroLogon, looked at the pros and cons of Zoom watermarking, studied the vulnerabilities in dnsmasq called DNSpooq, asked if TikTok’s new settings are enough to keep kids safe, and looked at how Google Chrome wants to make your passwords stronger.

Other cybersecurity news
  • The European Medicines Agency (EMA) revealed that some of the unlawfully accessed documents relating to COVID-19 medicines and vaccines have been leaked on the internet. (Source: EMA website)
  • Some laptops provided by the UK’s Department for Education (DfE) came with malicious files identified as the Gamarue worm. (Source: InfoSecurity Magazine)
  • Cisco emitted patches for four sets of critical-severity security holes in its products, along with other fixes. (Source: The Register)
  • The Brave team has been working with Protocol Labs on adding InterPlanetary File System (IPFS) support to its desktop browser. (Source: Brave website)
  • Sharing an eBook with your Kindle could have let hackers hijack your account. (Source: The Hacker News)
  • Attackers behind a phishing campaign exposed the credentials they had stolen to the public Internet, across dozens of drop-zone servers. (Source: CheckPoint)
  • QNAP urged customers to secure their NAS devices against a malware campaign that infects and exploits them to mine bitcoins. (Source: BleepingComputer)
  • Singapore widened its security labelling to include all consumer IoT devices. (Source: ZDNet)
  • Thousands of Business Email Compromise (BEC) lures used Google Forms in a recon campaign. (Source: SCMagazine)

Stay safe, everyone!

The post A week in security (January 18 – January 24) appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Chrome wants to make your passwords stronger

Malwarebytes - Fri, 01/22/2021 - 18:05

A common sentiment, shared by many people down the years, is that storing passwords in browsers is a bad idea. Malware, for example, would specifically target password storage in browsers and plunder everything in sight.

Password managers weren’t exactly flying off the shelves back in 2007, your only real options were home grown. People ended up saving logins in all sorts of odd places: Text files, email accounts…you name it. Naturally, security-minded folks gravitated towards saving passwords in browsers, because what else were they going to do?

The browser password wars

Even just 8 years ago, it was still a hotly contested debate. The problem then was that passwords were stored in plain text. They aren’t now, but if the device you’re using is compromised it doesn’t matter. Malware files can decrypt your passwords, or wait for you to do it. So, no matter how recently you look, many of the same threats still exist for browser passwords. And new ones emerge, like the rogue advertisers trying to grab autofill data.

Let’s be clear: things are better now for passwords in browsers than they used to be. Even something as basic as having to enter your Windows password to view or copy saved passwords is reassuring. Making use of encryption, instead of leaving data lying around in plaintext, is excellent. Browsers taking things one step beyond simply storing, and checking for stolen passwords is great. Real time phishing protection is the icing on an ever-growing cake.

With that in mind, Chrome continues to make inroads in the name of beefing up browser password safety.

Weak password? Chrome 88 can help

Beginning with Chrome version 88, you can now check for weak passwords (open Settings and search for “Passwords”) and alter them on the fly, with just a few clicks. The “Change password” button doesn’t alter anything inside the browser, which may disappoint. It simply takes you to the site where you use that feeble password. At this point, you’ll have to manually alter the details. The browser should then detect you’ve altered the password and update its password database, as it normally would.

If you really want to know what the stored password is but can’t remember it, you’ll need your Windows login, as mentioned earlier.

There’s not a huge amount to add about this new feature, as it is indeed incredibly simple to use. A list of all your potentially weak passwords is displayed, and off you go to fix them all. This is to its benefit. It’s easy to get bogged down in password minutiae and end up not bothering.

You don’t need bells and whistles while looking for weak passwords. You just want a list of sites, and to be told where there’s a problem. In this regard, the new functionality more than delivers.

Browser or password manager?

Having said all of that…you may still wish to ignore all the above and stick with a dedicated password manager. No matter what password features are added to browsers, some folks will never want anything to do with that. There are a wealth of choices available. Totally offline, or online functionality: the choice really is yours. I’d be surprised if there isn’t something for everyone in the options available. But if you really don’t want a password manager, then browsers are a better solution than nothing at all.

Do you prefer to keep all your tools in the browser basket, or cast passwords away into dedicated password managers? Either way, we wish you many years of secure password management to come.

The post Chrome wants to make your passwords stronger appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Are TikTok’s new settings enough to keep kids safe?

Malwarebytes - Fri, 01/22/2021 - 14:42

TikTok, the now widely popular social media platform that allows users to create, share, and discover, amateur short clips—usually something akin to music videos—has been enjoying explosive growth since it appeared in 2017. Since then, it hasn’t stopped growing—more so during the current pandemic. Although the latest statistics continue to show that in the US the single biggest age group (32.5 percent, at the time of writing) is users between 10 and 19 years of age, older users (aged 25 to 34 years) in countries like China, Indonesia, Malaysia, Saudi Arabia, and the UAE are quickly overtaking their younger counterparts.

Suffice to say, we can no longer categorize TikTok as a “kids’ app”.

This, of course, further enforces the many concerns parents already have about the app. We’re not even talking about the possibilities of young children, tweens, and teens seeing dangerous challenges and trends, or pre-teens lip-synching to songs that make grown up eyes go wide, or watching some generally inappropriate content. We’re talking about potential predators befriending your child, cyberbullies who are capable of following targeted kids from one social media platform to another, and a stream of unrestricted content from users they don’t even follow, or aren’t even friends with.

Limitations and guardrails

Eric Han, TikTok’s Head of Safety in the US, announced last week that all registered accounts of users aged 13 to 15 years have been set to private. This means that people who want to follow those accounts need to be pre-approved first, before they can see a user’s videos. It’s a way for TikTok to give tweens an opportunity to make informed choices about who they welcome into their account.

Furthermore, TikTok will be rolling out more changes and adjustments, such as:

  • Limitations to video commenting. Users within this age group will be able to decide whether they want their friends, or no one, to comment. Currently, anyone can comment, by default.
  • Limitations to availability of Duet and Stitch. In September last year, TikTok introduced two editing tools: Duet and Stitch. These were made available only to users ages 16 years and above. TikTok also limited the use of video clips to Friends only, among 16 to 17-year-old users.
  • Limitations to video downloads. Users ages 16 years and above only can download content within TikTok’s app. This feature is turned off by default for users ages 16 to 17, but they have the option to enable it.

Read: TikTok is being discouraged and the app may be banned

  • Limitations to suggested accounts. Users who are 16 years and under are not allowed to suggest their TikTok account to others.
  • Limitations to direct messaging and live streaming. Users who are 16 years and under are not allowed to live stream, and can’t be messaged privately by anyone.
  • Limitations in virtual gifting. Only users who are 18 years and over can purchase, send, and receive virtual gifts.
Growing pains

This isn’t the first time TikTok has tried to prove that they’re serious about making and implementing such changes for the benefit of their userbase. Here is a rundown of the social media platform’s security and privacy growth and challenges from a couple of years back.

  • After making a $5.7 million USD settlement with the Federal Trade Commission (FTC) in 2019, for violating the Children’s Online Privacy Protection Act by failing to seek parental consent for users under the age of 13, TikTok had set out to delete profiles of users who are within this age bracket.
  • TikTok introduced account linking for parents and/or guardians in April 2019. Called Family Pairing, responsible grown-ups are now equipped to connect their TikTok accounts with their teen’s, enabling them to remotely modify settings of their accounts.
  • In December 2019, TikTok teamed up with Family Online Safety Institute (FOSI) to host internet safety seminars. Its aim was “to help parents better understand the tools and controls they have to navigate the digital environment and the resources FOSI offers through its Good Digital Parenting initiative.”
  • In January 2020, TikTok updated their community guidelines, to clarify how it moderates harmful or unsafe content. It said it wanted to “maintain a supportive and welcoming environment”, so that “users feel comfortable expressing themselves openly”.
  • In February 2020, the company partnered with popular content creators in the US, to create videos reminding users to, essentially, stop scrolling their phone and take a break—in true TikTok fashion. This is part of their “You’re in Control” initiative, a user-centric series of videos that tries to informs users of TikTok’s “safety features and best practices”.
  • At the same time, TikTok was also trying to curb online misinformation, (which is rampant on social media platforms), by working with third-party fact checking and media literacy organizations, such as the Poynter Institute.
Are TikTok’s changes enough?

Tools provided by social media platforms like TikTok can be helpful and useful. However, these companies can only do so much for their users. Parents and/or guardians should never expect their child’s favorite social network to do all the heavy lifting when it comes to keeping young users safe. More than anything, grown-ups should be more involved in their children’s digital lives. Not just as an observer, but by being an active participant in one form or another.

There is no substitute for educating yourself about social media. Look into the pros and cons of using it, and then educate your kids about it.

Tell them it’s okay to say “no”, to not follow the herd, that although something may look fun and cool, to stop and think about it first before reacting (or doing).

Everything starts in the home. Choosing security and privacy is no different. You are their first line of defense, not those default settings. So, let’s take up that mantle, and be one.

The post Are TikTok’s new settings enough to keep kids safe? appeared first on Malwarebytes Labs.

Categories: Techie Feeds

DNSpooq bugs haunt dnsmasq

Malwarebytes - Thu, 01/21/2021 - 15:56

The research team at JSOF found seven vulnerabilities in dnsmasq and have dubbed them DNSpooq, collectively. Now, some of you may shrug and move on, probably because you haven’t heard of dnsmasq before. Well, before you go, you should know that dnsmasq is used in a wide variety of phones, routers, and other network devices, besides some Linux distributions like Red-Hat. And that’s just a selection of what may be affected.

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) database. Its goal is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services). The vulnerabilities disclosed by the JSOF team have been listed as CVE-2020-25687, CVE-2020-25683, CVE-2020-25682, CVE-2020-25684, CVE-2020-25685, CVE-2020-25686 and CVE-2020-25681.

What is DNSpooq?

DNSpooq is the name the researchers gave to a collection of seven vulnerabilities they found in dnsmasq, an open-source DNS forwarding software in common use. Dnsmasq is very popular, and so far JSOF has identified approximately 40 vendors that use it in their products, as well as some major Linux distributions. DNSpooq includes some DNS cache poisoning vulnerabilities, and buffer overflow vulnerabilities that could potentially be used to achieve remote code execution (RCE).

Domain Name System (DNS) is an internet protocol that translates user-friendly, readable URLs, such as, to their numeric IP addresses, allowing the computer to identify a server without the user having to remember and input its actual IP address. Basically, you could say DNS is the phonebook of the internet. DNS name resolution is a complex process that can be interfered with at many levels.

Dnsmasq (short for DNS masquerade) is free software that can be used for DNS forwarding and caching, and DHCP services. It is intended for smaller networks and can run under Linux, macOS, and Android. In essence, dnsmasq accepts DNS queries and either answers them from a local cache or forwards them to an actual DNS server.

What is DNS cache poisoning?

If you have ever moved your website to a different server, you will have noticed how long it can take before everyone actually lands on the new IP address. This happens because DNS records are normally cached in a number of different places, for performance. Records can be cached in your browser, by your operating system, on your network, by your ISP, and so on. When a cache entry expires it will update from the next upstream cache. Because of this, it can take a while for new records to get updated in all the places they’re stored. This phenomenon is referred to as DNS propagation.

If false information is added to a compromised DNS cache, that information can spread downstream to other caches. This method of providing a false IP address is called DNS cache poisoning. Cache poisoning can be done at all levels, local, router and even at the DNS server level.

What is a buffer overflow?

A buffer overflow is a type of software vulnerability that exists when an area of memory within a software application reaches an address boundary and writes into an adjacent memory region. Buffer overflows can be used to overwrite useful data, cause network crashes, or replace memory with arbitrary code that the instruction pointer later executes. In that last case it may offer an opportunity for RCE.

Who should worry?

JSOF has identified over 40 companies and respective products they believe are using dnsmasq. You can find a complete list on their website about DNSpooq, under Vendors. Some names worth mentioning: Asus, AT&T, Cisco, Dell, Google, Huawei, Linksys, Motorola, Netgear, Siemens, Ubiquiti, and Zyxel. Check out the list if you want to verify whether you are using one of the affected devices.

What can be done about DNSpooq?

For users of dnsmasq the quickest fix is to update it to version 2.83 or above.

In the long run it would be better for all of us if we started using a less vulnerable method than DNS, like DNSSEC, which protects against cache poisoning. Unfortunately is still not very widely deployed. Neither is HSTS, which is a web security policy mechanism that helps to protect websites against man-in-the-middle attacks.

Stay safe, everyone!

Header image and research courtesy of JSOF

The post DNSpooq bugs haunt dnsmasq appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Zoom watermarking: pros and cons

Malwarebytes - Wed, 01/20/2021 - 19:13

Metadata, which gives background information on pieces of data, is typically hidden. It becomes a problem when accidentally revealed. Often tied to photography mishaps, it can be timestamps. It might be location. In some cases, it can be log analysis. Many tutorials exist to strip this information out. This is because it can reveal more than intended when it hits the public domain. Default settings are often to blame. For example, a mobile photography app or camera may embed GPS data by default.

Some people may find this useful; quite a few more may object to it as a creepy privacy invasion.

Well, that’s metadata. Now you have an idea what kind of things can lurk without knowledge. We can see what happens when we deliberately enable a data / tagging related function.

Watermarking: what’s the deal?

An interesting story has recently emerged on The Intercept, of voluntary data (in the form of watermarks) wrapped into Zoom recordings, which could cause headaches in unexpected ways. Watermarks aren’t hidden—they’re right there by design, if people choose to use them. And the visual side of this data is supposed to be viewable during the call.

The Intercept talks about accidental identity reveals, via data embedded into calls, in relation to the ever-present videoconferencing tool. You’d be forgiven for thinking the identity reveal referenced in the article had something to do with the watermarks, but no.

The reveal happened because someone recorded a video call and dropped it online, with participant’s faces on display. The people involved appear to be at least reasonably well known. The secret identity game was up regardless of what was under the hood.

Cause and effect

What the rest of the article is about, is theorising on the ways embedded metadata could cause issues for participants. Zoom allows for video and audio watermarking, with video of course being visual and so easier to spot. Video displays a portion of a user’s email address when someone is sharing their screen. Audio embeds the information of anyone recording the call into the audio, and Zoom lets you know who shared it. You must ask Zoom to do this, and the clip has to be more than 2 minutes in length.

Essentially, video watermarking is to help you know who is sharing and talking during the call. Audio watermarking is to allow you to figure out if someone is sharing without permission. The Intercept explores ways this could cause problems where confidentiality is a concern.

Some identity caveats

If Zoom content is shared online without permission, it may not matter much if revealing metadata is included, unless the video call is audio only. This is because people can be easy to identify visually. Is a public figure of some sort involved? The game is already lost. If they’re not normally a public facing persona, people could still find them via reverse image search or other matching tools. And if they can’t, a well-known location, or a name-badge, could give them away. There are so many variables at work, only the participants may know for sure.

Hunting the leaker: does it matter?

While the other concern of identifying the leaker is still important, your mileage may vary in terms of how useful it is, versus how much of an inadvertent threat it presents. It’s possible the leaker may not care much if they’re revealed. They may have used a fake identity, or even compromised a legitimate account in order to do the leaking.

It’s also possible that someone with a grudge could leak something then pretend they’d been compromised. If this happened, would you have a way of being able to determine the truth of the matter? Or would you simply take their word for it?

Weighing up the risk

All good questions, and a valuable reminder to consider which videoconferencing tools you want to make use of. For some organisations and individuals, there’s a valid use for the metadata dropped into the files. For others, it might be safer on balance to leave them out. It might even be worth using a virtual background instead of something which reveals personal information. It might be worth asking if you even need video at all, depending on sensitivity of call.

The choice, as always, is yours.

The post Zoom watermarking: pros and cons appeared first on Malwarebytes Labs.

Categories: Techie Feeds

The story of ZeroLogon

Malwarebytes - Tue, 01/19/2021 - 18:37

This is the story of a vulnerability that was brought about by the incorrect use of an encryption technique. After it was discovered by researchers, the vulnerability was patched and that should have been the end of the story. Unfortunately the patch caused problems of its own, which made it very unpopular. Cybercriminals seized the opportunity to use the vulnerability for their own purposes. This is the story of ZeroLogon.

What is ZeroLogon?

The ZeroLogon vulnerability was discovered by researchers at Secura and is listed in the Common Vulnerabilities and Exposures (CVE) database under CVE-2020-1472:

“An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka ‘Netlogon Elevation of Privilege Vulnerability’.”

This vulnerability exploits a cryptographic flaw in Microsoft’s Active Directory Netlogon Remote Protocol (MS-NRPC), which allows users to log on to servers that are using NTLM (NT LAN Manager). Researchers explained that the issue stems from the incorrect use of AES-CFB8 encryption, which requires randomly generated initialization vectors for each authentication message. Sadly, Windows didn’t take this requirement into consideration. An attacker can use zeros for the initialization vector, allowing them to take over a domain controller in a matter of seconds.

How bad is this vulnerability?

Very bad, is the short answer. ZeroLogon has been successfully weaponized by malware authors, who use it for the lateral infection of corporate endpoints. The sophisticated Trickbot Trojan uses ZeroLogon, which means that it can spread across a vulnerable network easily. Ryuk ransomware has also been seen using the ZeroLogon vulnerability.

Is there a patch?

Yes, but there’s a “but”. The vulnerability was actually patched in August 2020, and it wasn’t until a researcher published a report about the vulnerability in September that we started to see it used in malicious activity.

In late October, Microsoft warned that threat actors were actively exploiting systems that were unpatched against ZeroLogon privilege escalation.

In November Microsoft also added detection rules to Microsoft Defender to “detect adversaries as they try to exploit this vulnerability against your domain controllers.”

The general advice is to use Secure RPC to prevent these attacks. Secure RPC is an authentication method that authenticates both the host and the user who is making a request for a service. Secure RPC uses the Diffie-Hellman authentication mechanism, which uses DES encryption rather than AES-CFB8.

Why isn’t everything patched against ZeroLogon by now?

The problem with the patch is that it is not enough to update the server side (Domain Controller), because clients also need to be updated for the protocol to work. And even though Microsoft took care to issue patches for Windows devices, it didn’t provide a solution for legacy operating systems that are no longer supported, or for third-party products. This means that enforcing Secure RPC may break operations for these incompatible systems.

So, what’s next?

Now, Microsoft has announced that it will enforce the use of Secure RPC .

“beginning with the February 9, 2021 Security Update release we will be enabling Domain Controller enforcement mode by default.  This will block vulnerable connections from non-compliant devices.  DC enforcement mode requires that all Windows and non-Windows devices use Secure RPC with Netlogon secure channel unless customers have explicitly allowed the account to be vulnerable by adding an exception for the non-compliant device.”

Having read that you might be thinking: “But you said it might break incompatible systems!” True, so Microsoft has made a list of actions that will result in a detailed update plan.

The update plan outlined by Microsoft includes the following actions:

  • UPDATE your Domain Controllers with an update released August 11, 2020 or later.
  • FIND which devices are making vulnerable connections by monitoring event logs.
  • ADDRESS non-compliant devices making vulnerable connections.
  • ENABLE enforcement mode to address CVE-2020-1472 in your environment.

This probably means there is still no happy ending to this story. Addressing the non-complaint devices will not be as easy at it sounds, in many cases. In many cases it will end with sysadmins making an exception for such a device. It is advisable however to at least try and follow the steps. Because in the end it will pay off to remove (or at least limit) the vulnerable devices and machines on your network. The cybercriminals will not let go of this treasure so easily.

Stay safe, everyone!

The post The story of ZeroLogon appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Malwarebytes targeted by Nation State Actor implicated in SolarWinds breach. Evidence suggests abuse of privileged access to Microsoft Office 365 and Azure environments

Malwarebytes - Tue, 01/19/2021 - 17:14

A nation state attack leveraging software from SolarWinds has caused a ripple effect throughout the security industry, impacting multiple organizations. We first reported on the event in our December 14 blog and notified our business customers using SolarWinds asking them to take precautionary measures.

While Malwarebytes does not use SolarWinds, we, like many other companies were recently targeted by the same threat actor. We can confirm the existence of another intrusion vector that works by abusing applications with privileged access to Microsoft Office 365 and Azure environments. After an extensive investigation, we determined the attacker only gained access to a limited subset of internal company emails. We found no evidence of unauthorized access or compromise in any of our internal on-premises and production environments.

How did this impact Malwarebytes?

We received information from the Microsoft Security Response Center on December 15 about suspicious activity from a third-party application in our Microsoft Office 365 tenant consistent with the tactics, techniques and procedures (TTPs) of the same advanced threat actor involved in the SolarWinds attacks.

We immediately activated our incident response group and engaged Microsoft’s Detection and Response Team (DART). Together, we performed an extensive investigation of both our cloud and on-premises environments for any activity related to the API calls that triggered the initial alert. The investigation indicates the attackers leveraged a dormant email protection product within our Office 365 tenant that allowed access to a limited subset of internal company emails. We do not use Azure cloud services in our production environments.

Considering the supply chain nature of the SolarWinds attack, and in an abundance of caution, we immediately performed a thorough investigation of all Malwarebytes source code, build and delivery processes, including reverse engineering our own software. Our internal systems showed no evidence of unauthorized access or compromise in any on-premises and production environments. Our software remains safe to use.

What we know: SolarWinds Attackers Also Target Administrative and Service Credentials

As the US Cybersecurity and Infrastructure Security Agency (CISA) stated, the adversary did not only rely on the SolarWinds supply-chain attack but indeed used additional means to compromise high-value targets by exploiting administrative or service credentials.

In 2019, a security researcher exposed a flaw with Azure Active Directory where one could escalate privileges by assigning credentials to applications. In September 2019, he found that the vulnerability still existed and essentially lead to backdoor access to principals’ credentials into Microsoft Graph and Azure AD Graph.

Third-party applications can be abused if an attacker with sufficient administrative privilege gains access to a tenant. A newly released CISA report reveals how threat actors may have obtained initial access by password guessing or password spraying in addition to exploiting administrative or service credentials. In our particular instance, the threat actor added a self-signed certificate with credentials to the service principal account. From there, they can authenticate using the key and make API calls to request emails via MSGraph.

For many organizations, securing Azure tenants may be a challenging task, especially when dealing with third-party applications or resellers. CrowdStrike, which was also targeted but in an unsuccessful attempt, has released a tool to help companies identify and mitigate risks in Azure Active Directory.

Coming together as an industry

While we have learned a lot of information in a relatively short period of time, there is much more yet to be discovered about this long and active campaign that has impacted so many high-profile targets. It is imperative that security companies continue to share information that can help the greater industry in times like these, particularly with such new and complex attacks often associated with nation state actors.

We would like to thank the security community, particularly FireEye and Microsoft for sharing so many details regarding this attack. In an already difficult year, security practitioners and incident responders responded to the call of duty and worked throughout the holiday season, including our own dedicated employees. The security industry is full of exceptional people who are tirelessly defending others, and today it is strikingly evident just how essential our work is moving forward.

Update: Clarified statement about “Azure Active Directory weakness”.
Update 2: Clarified that the attack on CrowdStrike was not successful

The post Malwarebytes targeted by Nation State Actor implicated in SolarWinds breach. Evidence suggests abuse of privileged access to Microsoft Office 365 and Azure environments appeared first on Malwarebytes Labs.

Categories: Techie Feeds

What’s up with WhatsApp’s privacy policy?

Malwarebytes - Mon, 01/18/2021 - 12:18

WhatsApp has been in the news recently after changes to its privacy policy caused a surge of interest in rival messaging app Signal. Initial reports may have worried a lot of folks, leading to inevitable clarifications and corrections. But what, you may ask, actually happened? Is there a problem? Are you at risk? Or should you keep using your apps as you were previously?

Setting the scene

WhatsApp users found themselves facing down an in-app notification this past week, letting them know of upcoming privacy policy changes. The message read:

By tapping Agree, you accept the new terms, which take effect on February 8, 2021. After this date, you’ll need to accept the new terms to continue using WhatsApp. You can also visit the Help Center if you would prefer to delete your account.

Generally, I’m somewhat suspicious whenever a trusted app starts popping messages, or anything else I wasn’t expecting. After the initial burst of “Is this genuine?”, follows the part where I try to dig out the parts that have changed and see how it compares to what went before.

What worked…

Giving users a bit of time to see the upcoming changes, and work out if they want to be part of it, is good and should be encouraged. Often, privacy policy and EULA changes spring from nowhere, giving little to no time at all to digest them. Regardless of how everything else about this notification panned out, WhatsApp should be applauded for giving everyone plenty of forewarning.

…and what didn’t

The key focus of concern around the update, was how data would be shared going forward. Aspects which people objected to included some data remaining on a device even after deleting an account, lines about “respecting privacy” being removed from the privacy policy, and things like phone numbers being shared with Facebook.

This would naturally be a cause for concern for some people.

The messaging fixer-upper

This situation wasn’t ideal for WhatsApp, who had to clarify the mixed messages spreading online. They stressed that the upcoming update is related to messaging businesses on WhatsApp. Messages are still subject to the same privacy they were previously, and neither WhatsApp nor Facebook can read your messages or hear your calls.

Additionally, more clarifications had to be made that the changes don’t apply to EU/EEA/UK regions despite people in those areas being shown a different privacy policy popup. This is not ideal and tends to lead to confusion. What happens after that, is lots of articles appear explaining what to do if you want to switch to other services. [Updated 19th January: Article amended to clarify which policies were displayed, and to whom].

Writers have described this potential migration away from WhatsApp as “self-inflicted”, and that seems to be an accurate summary. Simply by having to explain the differences between forms of messaging, data collection is thrown into sharp relief. That is to say, you may not have known prior to this how much…or little…your favourite apps collect.

But now you do. The data collection genie is out of the bottle, and yet it may not matter too much.

Decisions, decisions

People will use what they feel most comfortable with. This misstep isn’t going to kill WhatsApp, and if you still want to use it, don’t worry. It won’t be going anywhere. As with all things, informed choices are the best choices. We regularly remind people that it’s time for a security password spring clean whenever a major breach takes place.

On a similar note, this may be a good time to brush up on all those T&Cs tied to your favourite apps. Dig into what they do, which pieces of data they collect and use. At the absolute minimum, ensure your messages are as secure as can be and that only you and the recipients can read them (look for “end-to-end encryption”). Some people are fine with data collection, for others it’s a deal breaker.

Ultimately, the decision is down to you.

The post What’s up with WhatsApp’s privacy policy? appeared first on Malwarebytes Labs.

Categories: Techie Feeds

A week in security (January 11 – January 17)

Malwarebytes - Mon, 01/18/2021 - 11:30

Last week on Malwarebytes Labs, we looked at IoT problems, Microsoft’s Patch Tuesday, and how cybercriminals want access to your cloud services. We also explored how VPNs can protect your privacy, and asked if MSPs have picked the right PSA.

Other cybersecurity news

Stay safe, everyone!

The post A week in security (January 11 – January 17) appeared first on Malwarebytes Labs.

Categories: Techie Feeds

MSPs, have you picked the right PSA for you yet?

Malwarebytes - Fri, 01/15/2021 - 18:54

Not long ago, we helped MSPs pick the right remote monitoring and management (RMM) platform for them, and make it an essential part of their service toolkit. As you may recall, an RMM is a tool that helps MSPs do the work. And what better way to track the work—and other elements associated with it—than to have professional service automation (PSA) software do it for you?

“Do we really need a PSA?”

A PSA is, essentially, an all-in-one tool that helps MSPs manage an array of tasks, such as project management, collaboration, invoicing, ticketing, resource planning, and reporting and data analysis (to name a few), of every client project, throughout its lifecycle. It keeps all data and processes about a project available and linked in one place, so MSPs can see the big picture and waste no time making decisions or adjustments as needed. Some may think and liken PSA software to Enterprise Resource Planning (ERP) software for MSPs.

Many MSPs are realizing that they have little time and patience to waste on tedious and time-consuming tasks when they could have been doing more productive things. If you’re an organization that is just breaking into the MSP world, or already have years of experience, “Do we really need a PSA?” should no longer be the question you ask.

A PSA is not just a nice-to-have anymore. It has become an integral and critical platform that MSPs must have to scale effectively and profitably. What you should be asking instead is “Which PSA is right for my business?”

Benefits of using a PSA

Gone are the days when PSAs were akin to helpdesk software. They have evolved beyond merely managing support tickets and tasks. The modern-day PSA’s kit can offer (but is not limited to) the following benefits:

  • Significantly cut the time it takes to search for documentation
  • Reduced time spent on doing repetitive tasks
  • Improved service level agreements (SLAs)
  • Accurate tracking and recording of onsite services from start to finish
  • Automatic generation of billing statements
  • Efficient management of customer engagement
  • Automatic patching and system updating
  • Increased customer satisfaction
  • A uniform consolidation of data used to make mission critical decisions

Know that each PSA in the market right now offers different solutions and bundles, and that MSPs could be impacted by them differently as well.

Of course, not every benefit above is what MPSs would want.

Not all MSPs, for example, want a suite that automatically applies patches to the system, because they would rather do some rigorous testing themselves first, before deployment. Picking the right PSA eventually boils down to what your organization needs, what you want to automate and/or improve on, and what best fits into your business practices and processes.

PSA considerations for the smart MSP

Before MSPs can take a deep dive into implementing a PSA suite, they must realize that this is no easy feat. It is a time-consuming, disruptive, and sometimes expensive task to undertake. But patience and perseverance have their rewards. Here are three simple questions MSPs should ask when deciding which PSA to pick.

“How well does it integrate with our other tools?”

While a PSA houses all of an MSP’s data under one virtual roof and boasts an assortment of other tools for their employees to use, it’s not the only system the business uses. An MSP could have its own bespoke customer relationship management (CRM) tool or use other systems from third parties, too, such as an accounting, data backup and recovery, RMM, and, of course, endpoint security software. Make sure that the PSA of your choice can achieve deep integrations with the tools you rely on.

“Is it scalable?”

Every organization’s goal is to grow its customer base, making it especially important for MSPs to have a PSA that can scale with its growth. Pick a PSA that has been designed and built with scalability in mind, so it can cope with these “growing pains”.

On an additional note, you will want to know how the cost of the PSA will change as your business grows. Make sure that it’ll still be within a reasonable budget and sustainable in the long run.

“Will it help us achieve accountability and efficiency?”

One of the main reasons for using a PSA is to bridge those gaps that are inherently found in disparate systems used by different departments in an organization. A good PSA should be able to eradicate siloed data by tracking, recording, and reporting everything. This way, employees are expected to perform tasks efficiently and in a timely manner, clients are provisioned with the best resources to get issues resolved quickly, and bills are issued accurately.

“Can it provide data that’ll help us make informed decisions?”

A PSA can also help MSPs handle unforeseen hurdles, such as customer security issues, or delays in project deliveries. Your choice of PSA should be capable of not only collecting and keeping data from different departments but also processing, analyzing, and presenting it to your users in a way that shows trends, reveals problem points, and forecasts needs, so that you can make improvements, create plans months ahead, and effectively respond to security threats.

All we need is time

Of all the different assets MSPs must manage efficiently in order to be profitable and remain competitive, the most important is time. And what better way to manage time than to automate important but mundane daily tasks, so employees can make better use of their time and provide a higher level of security to customers. That said, the choice of investing or not investing in a PSA is no longer up for debate for MSPs. The benefits of having one as part of your toolkit just far outweighs the costs and initial challenges that naturally come with change. At the end of the day, you’ll be glad you went for one.

The post MSPs, have you picked the right PSA for you yet? appeared first on Malwarebytes Labs.

Categories: Techie Feeds

How a VPN can protect your online privacy

Malwarebytes - Fri, 01/15/2021 - 15:08

Have you ever experienced the feeling of relief that comes when you do something silly, but you’re glad you did it where people don’t know you? Or maybe you wished you were somewhere like that, but alas…

That is what a Virtual Private Network (VPN) can do for you: it can put you in a place where you are unknown.

To determine if and when you need a VPN, you must define what your goal is. If your main goal is to improve your privacy online, then a VPN is one of the possible solutions. Privacy is a right that is yours to value and defend. If you don’t fall into the categories of people who say “I have nothing to hide” or “they already know everything about me” then you may care enough about your privacy to use a VPN.

For the latest Malwarebytes Labs reader survey we asked “Do you use a VPN?” 2,330 responded and an impressive 36 percent said they now used a VPN. For perspective, ten years ago, only 1.5 percent of Americans used VPNs.

So, how does a VPN work?

In short and easy terms, a VPN acts as a middle-man between a user and the Internet. When the user wants to visit a site, they send information to the VPN over an encrypted connection, the VPN visits the site, and then it sends the data to the user over the same encrypted connection. These connections are not limited to web browsing, even though that is the first one that usually comes to mind.

In this post we will focus on the consumer using a VPN to browse the web. But it is good to know that many organizations use a VPN to allow secure, remote access to company resources. For example, an employee working from home can log in on a VPN to get access to systems, files or email, for example.

Hide your IP address

Your IP address is the address your home network uses on the Internet. It is usually assigned to you by your Internet Service Provider (ISP). The first thing a website you visit will receive is your IP address, because it’s the return address for the information that you requested. If you are using a VPN the website will receive the IP address of the VPN server instead. The VPN will reroute the information so that it reaches your screen, without the website ever seeing your IP address.

Not everyone is willing to share their IP address because it can be used to determine their approximate location, and to identify their ISP (who can, in turn, identify who the IP is assigned to).

Hide your traffic from your ISP

Speaking of which, people who distrust their ISP and don’t want them to know which sites they’re visiting, route their traffic through a VPN. The encrypted tunnel between the user and the VPN stops anyone, including their ISP, from seeing their traffic. And this isn’t a theoretical or unlikely problem: In the USA ISPs can sell information about their users’ browsing habits to the highest bidder.

If you use a VPN to hide your traffic from your ISP it’s important to keep in mind that you are now putting your trust in the hands of that VPN provider instead. In theory, the VPN provider can now track your online behavior.

Pretend to be in another country

Another reason we often hear for using a VPN, is when you want to pretend you are in another country. Certainly, a VPN is the easiest solution to accomplish that. Some websites or services are only available in certain territories (geofenced), so pretending to be somewhere you aren’t can give you access to resources that would otherwise be hidden from you.

Imagine being a foreign correspondent in a country where news media from abroad are blocked or redacted. Or you are having a vacation in a country where Facebook is forbidden, and you want to check up on your family and friends. That is where using a VPN comes in very handy. Keep in mind however that in many such countries the use of a VPN is forbidden as well and using one could get you into trouble.

Disadvantages of using a VPN

So far, we have discussed the advantages and reasons for choosing a VPN. Why does there always have to be a downside? In this case, it’s a typical you win some, you lose some scenario.

  • It can make browsing slower. Even though Internet traffic can theoretically move at the speed of light, taking a detour takes time. Using a VPN can have a performance impact that varies from hardly noticeable to considerable. Another point to research when you are deciding which one to use.
  • Some websites will block known VPN servers. Usually this is for reasons that would be grounds for not wanting to visit those sites anyway, but it can be annoying to disable your VPN for a specific site.
  • Some sites don’t work correctly. Some sites are designed without considering that a visitor might be using a VPN. This can sometimes result in a partial loss of the information being sent back and forth so you may have to fill out a form twice or you may have to temporarily disable the VPN to complete the data transaction.
  • Overconfidence can come back to bite you. Just because you are hiding behind a VPN, that doesn’t mean it’s impossible to find out who you are. And if your actions might put you in danger where you are using the VPN, some extra measures may be needed.
Choosing a VPN

To achieve the goal of enhancing privacy it is most important to choose a VPN that you can trust. A VPN provider that logs your activities and either sells them to advertisers or surrenders them to the authorities may not have the same goals as you do.

Another important feature for a VPN is that it encrypts the traffic between your computer and the VPN server, so that nobody can tap into the connection to find out what you are doing. That encryption stops at the VPN server, so anyone with access to that server can see see or modify the traffic. Again, putting too much trust in such a feature can prove to be misguided.

To go back to our comparison, even if they can’t conclusively prove that it was you, sometimes a strong suspicion can be just as damaging for your reputation.

Stay safe, everyone!

The post How a VPN can protect your online privacy appeared first on Malwarebytes Labs.

Categories: Techie Feeds

Cybercriminals want your cloud services accounts, CISA warns

Malwarebytes - Thu, 01/14/2021 - 20:29

On January 13 the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about several recent successful cyberattacks on various organizations’ cloud services.

What methods did the attackers use?

In the initial phase, the victims were targeted by phishing emails trying to capture the credentials of a cloud service account. Once the attackers had stolen a set of valid credentials, they logged into the compromised account and used it to send phishing emails to other accounts within the organization. Those phishing emails used links to what appeared to be existing files on the organization’s file hosting service.

In some cases, threat actors modified victims’ email rules. On one user’s account an existing rule was set up to forward mail to their personal account. The threat actors updated the rule to forward all email to their own accounts. In other cases, the attackers created new rules that forwarded mails containing certain keywords to their own accounts.

As an alternative to the phishing attempts, attackers also used brute force attacks on some accounts.

Perhaps most eye-catching of all though, in some cases multi-factor authentication (MFA) logins were defeated by re-using browser cookies. These attacks are called “pass-the-cookie” attacks and rely on the fact that web applications use cookies to authenticate logged-in users.

Once a user has passed an MFA procedure, a cookie is created and stored in a user’s browser. Browsers use the cookie to authenticate each subsequent request, to spare visitors from having to log in over and over again in the same session. If an attacker can capture an authentication cookie from a logged-in user they can bypass the login process completely, including MFA checks.

Who is behind these attacks on cloud services?

Even though the attacks that CISA noticed had some overlap in the tactics they used, it is unlikely that they were all done by the same group. While some were clear attempts at a business email compromise (BEC) attack, there could be other groups active that are after different targets.


Educate users on cybersecurity in general and point out the extra risks that are involved in working from home (WFH). For these specific attacks, extra training to recognize phishing certainly wouldn’t hurt.

Use a VPN to access an organization’s resources, such as its file hosting service. The temptation to leave these resources openly accessible for remote employees is understandable, but dangerous.

Sanitize email forwarding rules or at least let the original receiver of the mail be notified when a forwarding rule has been applied. If there are rules against forwarding mails outside of the environment (and maybe there should be) it should not be too hard to block them.

Use MFA to access all sensitive resources. (It’s important to note that although the CISA report mentions a successful attack where MFA was bypassed, it also mentions unsuccessful attacks that were defeated by MFA.)

Ensure resources are only be accessible to people authorized to use them, and enable logging so you can review who has used their access.

Set the lifespan of authentication cookies to a sensible time. Find a balance between keeping session duration short, without annoying legitimate users and “allowing” attackers to use stale cookies to get access.

Verify that all cloud-based virtual machine instances with a public IP do not have open Remote Desktop Protocol (RDP) ports. Place any system with an open RDP port behind a firewall and require users to use a VPN to access it through the firewall.


The CISA report also links to a downloadable copy of IOCs for those that are interested.

The post Cybercriminals want your cloud services accounts, CISA warns appeared first on Malwarebytes Labs.

Categories: Techie Feeds


Subscribe to Furiously Eclectic People aggregator - Techie Feeds