Home Blog Page 122

Bug in Accellion’s Software Exposes Data of 1.4 Mn Washington State Residents

Nearly Half of Global Consumers Affected by Data Breaches

The Office of the Washington State Auditor (SAO) is inspecting a security incident after unemployment claims data of over 1.4 million Washington state residents were exposed in a third-party data breach. State Auditor Pat McCarthy attributed the data breach to a third-party software vendor Accellion, whose services are used by SAO to transfer digital files.

“I know this is one more worry for Washingtonians who have already faced unemployment in a year scarred by both job loss and a pandemic. I am sorry to share this news and add to their burdens,” McCarthy said in a news report.

Accellion’s Software – The Culprit Again!

Accellion, a provider of hosted file transfer services, confirmed that an unauthorized threat actor obtained access to SAO files in late December 2020 by exploiting a vulnerability in Accellion’s file-transfer service.

The SAO stated that data files from the Employment Security Department (ESD) were impacted, which contained unemployment compensation claim information, including the names, social security numbers, driver’s license or state identification numbers, bank account numbers, bank routing numbers, and place of employment. All the residents who have filed for unemployment benefits with the SAO between January 1 to December 10, 2020, were impacted by the security incident. Besides, the compromised files include the personal data of other Washington residents who have not yet been identified but whose information was with the state agency.

The security incident is under Accellion’s investigation and reported to the law enforcement authorities for further probe. “At this time, SAO does not have enough information to conclude the timing or full scope of what took place. It was not until the week of January 25, 2021, that Accellion confirmed to SAO that SAO files were subject to this attack and provided the information needed for SAO to begin to identify which data files were impacted, and individuals whose personal information is in those files,” SAO said.

One Software Multiple Attacks

Other government agencies that used the Accellion software service have also been similarly impacted by outsider intrusions. Recently, the Australian Securities and Investment Commission (ASIC) became aware of a security incident that affected one of its servers used to transfer files like credit license applications. The securities regulator stated that the security incident occurred due to a vulnerability in Accellion’s file-sharing software, used by New Zealand’s Reserve Bank that also faced a cyberattack earlier.

U.K. Research and Innovation Agency Suffers Ransomware Attack

Cybersecurity Skill Shortage Leads U.K. Firms to Outsourced Security Services

The U.K. Research and Innovation (UKRI) center confirmed that it suffered a ransomware attack that encrypted sensitive data and affected two of its services – a portal for the U.K. Research Office (UKRO) based in Brussels and an extranet (also known as the BBSRC extranet) used by Councils.

The UKRO portal provides research information to the subscribers, and the BBSRC extranet is used for peer review processing. UKRI temporarily suspended both the services to avoid further damage.

UKRI is a government entity supported by the Department for Business, Energy, and Industrial Strategy (BEIS) to manage investments in science and research and support innovative business opportunities in the U.K. The compromised information included grant applications, expense claims, and review data hosted in the portals. However, there is no information on whether any financial information has been compromised in the incident.

UKRI has reported the security incident to the U.K. National Crime Agency (NCA), the National Cyber Security Centre (NCSC), and the Information Commissioner’s Office (ICO).

“UKRI councils and a number of cross-cutting schemes use the impacted extranet for some of their peer review activity as a result the data that has been compromised includes grant applications and review information. Although we do not know at this stage whether the data has been taken. We are working to securely re-instate impacted services as well as conducting forensic analysis to ascertain if any data was taken, including the potential loss of personal, financial or other sensitive data,” UKRI said.

The number of businesses in the U.K. affected by cyberattacks has increased after the country went into lockdown. Several organizations suffered over 177,000 targeted attacks between April and June 2020, which accounts for one cyberattack every 45 seconds. Organizations in the U.K. need to take the necessary actions to improve their cybersecurity resilience and keep their employees and data as secure as possible.

North Korean Cybercriminals Target Security Researchers: Google

Cryptocurrency Lazarus, North Korean TA406, Lazarus Group , Korea Atomic Energy Research Institute

Google’s Threat Analysis Group (TAG) has uncovered an ongoing cyber campaign targeting security experts working on vulnerability research and development at various organizations. In an official release, the security giant stated that threat actors behind the campaign are linked to North Korean government-backed entity. Google warned the security research community that they might be a target for attackers and asked to remain vigilant while connecting with unknown individuals on social networking platforms.

Attackers with Fake Personas

Cybercriminals created multiple fake profiles on various social media handles, including Twitter, Telegram, LinkedIn, Discord, and Keybase, to reach out to security professionals working in various vulnerability disclosure programs. Besides, hackers prepared research blogs containing write-ups and vulnerability disclosure analysis, illicitly obtained from legitimate security researchers, to build credibility and connect with the security research community.

“The actors established a research blog and multiple Twitter profiles to interact with potential targets. They’ve used these Twitter profiles for posting links to their blog, posting videos of their claimed exploits and for amplifying and retweeting posts from other accounts that they control,” Google said.

Hacker-controlled Websites and Social Media Accounts

 Exploit Research Blog:

https://blog.br0vvnn[.]io

Twitter Handles:

  • https://twitter.com/br0vvnn
  • https://twitter.com/BrownSec3Labs
  • https://twitter.com/dev0exp
  • https://twitter.com/djokovic808
  • https://twitter.com/henya290
  • https://twitter.com/james0x40
  • https://twitter.com/m5t0r
  • https://twitter.com/mvp4p3r
  • https://twitter.com/tjrim91
  • https://twitter.com/z0x55g

LinkedIn

  • https://www.linkedin.com/in/billy-brown-a6678b1b8/
  • https://www.linkedin.com/in/guo-zhang-b152721bb/
  • https://www.linkedin.com/in/hyungwoo-lee-6985501b9/
  • https://www.linkedin.com/in/linshuang-li-aa696391bb/
  • https://www.linkedin.com/in/rimmer-trajan-2806b21bb/

Keybase

  • https://keybase.io/zhangguo

 Telegram

  • https://t.me/james50d

Social Engineering Attacks on Researchers

Google stated that threat actors have been targeting security researchers using social engineering tactics. The computers of several security researchers were compromised after visiting attackers’ blogs or by clicking on fraudulent links on social media accounts.

“After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together, and then provide the researcher with a Visual Studio Project. Within the Visual Studio Project would be source code for exploiting the vulnerability, as well as an additional DLL that would be executed through Visual Studio Build Events. The DLL is custom malware that would immediately begin communicating with actor-controlled C2 domains,” Google added.

Is Trickbot Botnet Back?

Trojans, RAT, remote access trojan, Snip3 Crypter-as-a-Service

The infamous Trickbot botnet is back again with new phishing and malware campaigns mostly targeting insurance and legal enterprises in North America. An analysis from Menlo Security found an ongoing malware campaign in which Trickbot operators leveraged various phishing techniques to trick users into clicking and downloading the Trickbot malware on their devices.

Once the user clicks on the malicious link in the email, it redirects the user to a compromised server that prompts the victim into downloading the malicious payload. The redirected page contains a Download Photo Proof button, which, if clicked, downloads the malicious JavaScript to compromise the victim’s device.

“The initial vector appears to be an email, which includes a link to a URL. While in the past, Trickbot has used weaponized documents, the infection mechanism detailed in this campaign seems to be a new modus operandi used by this group,” Menlo Security said.

The Trickbot Botnet

Previously, Trickbot malware was a banking Trojan and evolved as a prolific malware used in several cyberattacks against businesses and individuals across the globe. Trickbot is specially crafted malware used to access victim’s online accounts to obtain personally identifiable information (PII). Trickbot malware was linked to numerous malware and ransomware attacks in 2020, leveraging COVID-19 themed emails.

Trickbot’s Capabilities

  • Lateral movement in the network for maximum damage
  • Exfiltrating user credentials from browsers
  • Exfiltrating Active Directory Services databases
  • Stealing cookies and OpenSSH keys
  • Theft of RDP, VNC, and PuTTY Credentials
  • Installing additional payloads like ransomware

The Comeback

In October 2020, Microsoft disrupted Trickbot operations and infrastructure by working along with telecommunications providers around the world. “We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems,” Microsoft said.

While the actions of Microsoft and its partners resulted in a dip in Trickbot’s operations, the latest signs of its phishing campaigns are again fueling fears of the forgotten malware.

Fonix Ransomware Gang Locks Shop and Releases Master Decryption Key

ransomware, fonix, fonix ransomware, Cybereason Partners with Intel for Hardware-Enabled Ransomware Prevention, Kronos

Fonix ransomware, which notoriously seemed to be picking up in the last few months of 2020, has reportedly suspended operations and released a master decryption key for all its victims. Fonix operators had noticeably begun operations in June 2020 only in the wake of the economic crisis; however, it’s unclear if it was due to the pandemic or any personal reasons. The gang is proposing a launch of a malware analysis website and put its abilities to use in “positive ways.”

End of FonixCrypter Project

The operators of Fonix took to Twitter to announce the “End of FonixCrypter Project.” The person who claimed to be one of the admins in the project stated that not all team members were happy with this move and thus, indicated that the source code could be duplicated for future use.

In a separate tweet, the admin shared a link, which has a downloadable RAR file named ‘Fonix_decrypter.rar,’ which contains a decryptor and the master private decryption key, proving that he was indeed serious about shutting shop. However, this decryption tool is not a decryptor that allows victims to get their encrypted files back. Instead, it is an admin tool used by the ransomware gang internally.

Most ransomware operations follow a modus operandi where they ask their victims to send a few encrypted files for decryption as proof that they can indeed decrypt them. The said decryptor does exactly that. It allows the user to decrypt only a few files and not the entire set on the infected computer.

But this dark cloud has a silver lining because experts have found that the generated master keys work. On the other hand, the best news comes from Emsisoft, a cybersecurity firm providing anti-malware and ransomware products. Emsisoft said its decryptor tool effectively decrypts all versions of the ransomware, including [.]Fonix, [.]FONIX, [.]repter, [.]XINOF encrypted file extensions. This means the victims can hope for a solution soon.

Earlier in late 2020, Maze ransomware gang had announced similar suspension of operations.

Read more about that story here – Are We Really Out of the Maze? The Ransomware Gang Announces Retirement

BlastDoor: New Security Feature in Apple iOS 14 to Counter Zero-click Exploits

Apple iMessage

Samuel Grob, a security researcher at Google Project Zero, uncovered a new security feature that Apple added in its iOS 14 version without any revelation. Dubbed “BlastDoor,” the improved sandbox system feature was introduced due to the zero-click exploits that leveraged the Apple iMessage flaw in iOS 13.5.1. Reportedly, iPhones of 36 Al Jazeera journalists were infected with malware, leaving their devices open to cyber espionage.

The introduction of BlastDoor is a major change in iOS 14. BlastDoor is a tightly sandboxed service responsible for parsing untrusted data in iMessage.

“One of the major changes in iOS 14 is the introduction of a new, tightly sandboxed BlastDoor service which is now responsible for almost all parsing of untrusted data in iMessages. Furthermore, this service is written in Swift, a (mostly) memory-safe language which makes it significantly harder to introduce classic memory corruption vulnerabilities into the code base,” Grob said.  

How BlastDoor Works

Grob stated that BlastDoor possesses a variety of new security protections. The strong sandbox of the BlastDoor service prevents the exploitation of a privilege escalation vulnerability after compromising the BlastDoor process. Whenever a message arrives in iMessage, it will pass via several security protocols that scan for malicious codes or links in the incoming message before allowing Apple’s push notification service to display the message.

BlastDoor
Image Courtesy: Google Project Zero

“The sandbox profile is quite tight. Only a handful of local IPC services can be reached, almost all file system interaction is blocked, any interaction with IOKit drivers is forbidden, outbound network access is denied. With this change, an exploit that relied on repeatedly crashing the attacked service would now likely require in the order of multiple hours to roughly half a day to complete instead of a few minutes. Overall, these changes are probably very close to the best that could’ve been done given the need for backwards compatibility, and they should have a significant impact on the security of iMessage and the platform as a whole,” Grob added. 

Related Story: Why Apple Dropped macOS Big Sur Feature ‘ContentFilterExclusionList’

Cybercriminals Do Not Retire

Cybercrime, internet crime

MAZE, a “famous” and active Criminal Hacker group notorious for its Ransomware attacks that made even multinational corporations tremble — has officially decided to close its doors. At the end of last year, MAZE made an announcement on a Dark Web page, about its termination of activities with immediate effect.

By Pierguido Iezzi, CEO of Swascan

This, on the surface, seemed like a piece of “good news” in 2020.

A few months have passed but can we breathe a sigh of relief? Should we be happy because one of the great “enemies” that sided with cybercrime has decided to throw in the towel?

Not so fast!

Look at the announcement, and you’ll notice it is filled with grammatical errors and published within the same corner of the dark web. A corner where, for a long time, these attackers used to “post” all the data they had been able to steal from their victims, as some sort of trophy room.

Victims also included companies linked to big names like Tesla and SpaceX.

Is it possible that these Criminal Hackers have decided to pull the oars in the boat because they were already satisfied with the earnings obtained with their attacks?

At first glance, it could be a hypothesis to consider. On the other hand, MAZE has been an innovator in the world of Criminal Hacking for a long time.

For instance, the group was the first to introduce the “double blackmail” strategy. In addition to completely blocking the systems of its victims in exchange for a ransom, the attackers threatened to release all the targeted companies’ data until this was paid (strictly in bitcoin).

Do not celebrate yet

All these innovations, unfortunately, have also borne their fruits and reaped illustrious victims. More fuel on the fire of the theory that the announcement could be true, then?

Unfortunately, it is not that simple.

Although criminalistic, these groups operate in a business-like manner: profit is the ultimate goal. And which business closes its doors after a good year?

We should therefore take this announcement with a great deal of skepticism.

Related News:

Are We Really Out of the Maze? The Ransomware Gang Announces Retirement

Surely there are people within this group who are “satisfied” with what they have achieved over years of criminal activity and are happy to “enjoy” the spoils, but it is also likely that this closure is simply a strategic move to reorganize under a different name – a rebranding if you will.

Whatever the future of MAZE may be, the possibility that all its operators (another name for those Criminal Hackers who decide to work as part of a single group) are currently holding their suitcases – COVID permitting – with sombreros on their heads ready to enjoy their “retirement” on a Caribbean island is almost zero.

On the contrary – the dissolution of the Group leaves many questions open, especially regarding this sudden skill surplus and the collaborative relationship they had with other Cyber-criminal organizations.

These, probably, having closed the MAZE chapter, are already looking for something else to put their criminal “skills” to good use.

On the contrary, it is not even a hypothetical question.

We already know that MAZE had close relations with two other groups of Criminal Hackers: LockBit and Ragnar Locker, as well as having been compared several times, for methodology and code, to the new entry Egregor.

The latter two groups have already claimed victims in Italy.

A hydra

In short, the most plausible scenario is that nobody really “retired” or decided to dedicate their time to activities that did not include cybercrime.

Those who greeted MAZE’s closure with a sigh of relief will be forced to think again.

In a certain way, MAZE became the Hydra of cybercrime: once one head was cut off, two (or maybe even three!) were born.

All its expertise has not been lost, nor taken off the market. It has been divided and passed on to other groups that have picked up right where MAZE decided to stop — hitting small and big organizations and causing huge economic and brand reputation damages.

They may have also tried to put on a good face with their statement, claiming they were not a cybercrime cartel, but MAZE had been working with its “descendants” for some time already — and now they have already taken its place.

Hardly anything will change, Criminal Hackers and ransomware will always be “out there” and will continue to target public and private organizations with their vast arsenal of tactics and techniques honed over years and years of practice.

We will just have to maintain a high state of alert and not let our guard down!

About the Author

Pierguido IezziPierguido Lezzi is the Cyber Security Director and Co-founder of Swascan with over 30 years of experience in the world of cybersecurity. With a degree in Information Sciences, he has had the opportunity to work nationally and internationally in large corporate contexts and in the largest multinationals as a cybersecurity representative. Author of several publications, he regularly collaborates as author and contributor to a number of newspapers and publications. He has also been a keynote speaker and testimonial at universities, national, and international events.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Related News:

Fonix Ransomware Gang Locks Shop and Releases Master Decryption Key

Attackers are Using Fake Office 365 Pages to Phish C-Suite Executives

Hackers Target Office 365 Users with SurveyMonkey Phishing Campaign

Security experts from Trend Micro uncovered an ongoing phishing campaign spreading fake Office 365 password expiration reports to compromise email accounts of C-Suite executives. The campaign has been active since 2019. In an official release, Trend Micro stated that the phishing campaign has targeted multiple organizations in the finance, government, real estate, manufacturing, and IT sectors in several countries like Japan, the U.S., the U.K., Canada, Australia, and Europe.

Image Courtesy: Trend Micro

“We found over 300 unique compromised URLs and 70 email addresses from eight compromised sites, including 40 legitimate emails of company CEOs, directors, owners, and founders, among other enterprise employee targets. We are now working with the respective authorities for further investigation,” Trend Micro said.

Leveraging Compromised Infrastructure

The attackers targeted unsuspecting victims with emails attached with fake Office 365 password expiration reports to trick them into clicking the embedded link in the email. The email prompts the users to click on the “Keep Password” option if they want to continue using the same password. Once clicked, the option leads the user to the phishing page, which asks the user to enter login credentials.

Trend Micro researchers also found several advertisements of malicious actors selling account credentials of CEOs, CFOs, and other C-suite executives in multiple English- and Russian-speaking underground darknet forums. “The attackers are reusing compromised infrastructure and victims’ account credentials to host phishing pages and gain more victims. The kit, which is available for sale, can validate the credentials’ details and accuracy once the victim interacts with the embedded link,” Trend Micro added.

Infamous Emotet Malware Campaign Disrupted in an International Action

Rootkits, Mobile Malware in Asia

Law enforcement authorities across Europe and judicial agencies worldwide have disrupted the operations of Emotet, an infamous malware strain that affected multiple organizations over the years. Dubbed “Operation Ladybird,” the international coordinated action has taken control of Emotet group’s infrastructure.

The operation is a collaborative effort between authorities in the Netherlands, Europe, Germany, the U.S., the U.K., France, Lithuania, Canada, and Ukraine, and carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).

The Emotet malware was linked to various other botnet-based cyber campaigns and delivered malicious payloads like TrickBot and Ryuk ransomware by renting its botnet to other cybercriminal groups. Industry experts said that the successful action would help various organizations and over a million Microsoft Windows systems that are compromised with Emotet malware.

“The infected machines of victims have been redirected towards this law enforcement-controlled infrastructure.  This is a unique and new approach to effectively disrupt the activities of the facilitators of cybercrime,” Europol said.

The Emotet operators mostly used malicious email attachments to distribute the malware into victims’ computers. Besides, the operators used a variety of phishing tactics to trick users into downloading malicious attachments. These attachments contained fake Word docs, macros, or malicious links, either attached for download or in the email text. Once a user clicks the link or downloads the attachment, the Emotet malware code hidden in the Word file installs automatically on the victim’s device.

“Emotet was much more than just a malware. What made EMOTET so dangerous is that the malware was offered for hire to other cybercriminals to install other types of malware, such as banking Trojan or ransomware, onto a victim’s computer. This type of attack is called a ‘loader’ operation, and Emotet is said to be one of the biggest players in the cybercrime world as other malware operators like TrickBot and Ryuk have benefited from it. Its unique way of infecting networks by spreading the threat laterally after gaining access to just a few devices in the network made it one of the most resilient malware in the wild,” Europol added.

Google Chrome OS Update: No Passwords, Only Fingerprint Required

Google WebAuthn, Google, WebAuthn, web authentication
Image Credit: Google

WebAuthn, or web authentication, which has been regarded as an official web standard since 2019, has finally been introduced for passwordless authentication on Chromebooks. Using this, users can sign into their favorite websites, including Google, Dropbox, GitHub, Okta, Twitter, and Microsoft, by simply scanning their fingerprint that is registered to unlock their Chromebook. Alternatively, users can also use a PIN.

What is Google’s WebAuthn?

WebAuthn primarily allows users to register and authenticate on websites or applications using any “authenticator.” This authenticator could be a fingerprint or PIN, which can be easily used instead of a password. However, the catch is that you need a fingerprint scanner/reader to do this in the first place. Thus, Google has come up with a smart solution of using the fingerprint reader of a Chromebook to scan users’ fingerprints; match it with the one saved to unlock the Chromebook, and allow users to sign in.

Today, when remote working is at an all-time high and the uptake of Chromebooks, especially among students, is breaking the roof, Google’s WebAuthn feature will let its users breathe a sigh of relief. It lessens the burden of remembering multiple passwords and makes web sign-in faster and easier.

Alexander Kuscher also confirmed that if users “use 2-Step Verification to sign-in, your Chromebook PIN or fingerprint ID can be used as the second factor, so you no longer need to pull out your security key or phone to authenticate.”

Personalize Your Lock Screen

Apart from the web authentication feature, Google has also allowed its users to add their personal touch to the lock screen. It has turned the screen into an art display where users can add their favorite photos or albums from Google Photos or the device gallery. Additionally, this screen can also be used to check the current weather and control music functions like play, pause, or skip, all without unlocking the device. To turn ON this feature, go to your Chrome OS Settings and select Personalization > Screen saver.

How to Get the Latest Chrome Update

To get the latest version of the Chrome OS installed on your device, follow these simple steps:

  1. On your computer, open Chrome.
  2. At the top right, click More.
  3. Click Update Google Chrome. (Note: If this button is not visible, then you have the latest version installed already.)
  4. Click Relaunch.

Incidentally, Chrome 88 also has a feature that allows fixing weak passwords for better online security. Read the story here: Google Chrome 88 To Fix Weak Passwords for Better Online Security

1...121122123...410Page 122 of 410