Oktacron - Cyber Security RSS Feeds History

Transatlantic Cable podcast, episode 165

kaspersky Oct 07, 2020 News

The SAS is here — digitally, of course; it is 2020, after all. To kick off the latest iteration of the Transatlantic Cable podcast, Dave and I chat about a topic presented at the conference. We begin with Mark Lechtik, Igor Kuznetsov, and Yury Parshin’s research on MosaicRegressor. This new malware uses a UEFI show more ...

foothold to plant a second, more traditional piece of spyware on a target computer’s hard drive. From there, we jump to the state of New Jersey, where a hospital hit with a ransomware attack paid a partial ransom. For our third story, we head over to the world of dating apps and discuss a vulnerability in Grindr. It’s been patched, but it was pretty bad. To close things out, we look at the misuse of Excel in the UK when it comes to COVID-19 case tracking. If you liked the podcast, please consider subscribing or sharing with your friends. For more information on the stories that we covered, please visit the links below: A China-linked group repurposed Hacking Team’s stealthy spyware New “MosaicRegressor” UEFI bootkit malware found active in the wild MosaicRegressor: Lurking in the shadows of UEFI Join SAS@Home New Jersey hospital paid ransomware gang $670K to prevent data leak Hacking Grindr accounts with copy and paste Excel: Why using Microsoft’s tool caused COVID-19 results to be lost

Malware delivery through UEFI bootkit with MosaicRegressor

kaspersky Oct 07, 2020 Business

Recently, our researchers uncovered a sophisticated targeted attack aimed at diplomatic institutions and NGOs in Asia, Europe, and Africa. As far as we can determine, all of the victims were connected to North Korea in one way or another, whether through nonprofit activity or diplomatic ties. The attackers used a show more ...

sophisticated modular cyberspy framework that our researchers call MosaicRegressor. Our investigation revealed that in some cases the malware entered victims’ computers through modified UEFIs, an extremely rare occurrence in the wild. However, in most cases, the attackers used spear-phishing, a more traditional method. What is UEFI, and why is the bootkit dangerous? UEFI, like BIOS (which it replaces), is software that runs right when the computer starts, even before the operating system launches. Moreover, it is stored not on the hard drive, but on a chip on the motherboard. If cybercriminals modify the UEFI code, they can potentially use it to deliver malware to a victim’s system. That is precisely what we found in the campaign described above. What’s more, in creating their modified UEFI firmware, the attackers used the source code of VectorEDK, a Hacking Team bootkit that was leaked online. Although the source code became publicly available way back in 2015, this is the first evidence we’ve seen of its use by cybercriminals. When the system starts, the bootkit places the malicious file IntelUpdate.exe in the system startup folder. The executable downloads and installs another MosaicRegressor components on the computer. Given the relative insularity of UEFI, even if this malicious file is detected, it is almost impossible to remove. Neither deleting it nor reinstalling the operating system helps. The only way to fix the problem is by reflashing the motherboard. How is MosaicRegressor dangerous? MosaicRegressor components that made it onto victims’ computers (through either a compromised UEFI or targeted phishing) connected to their C&C servers, downloaded additional modules, and ran them. Next, these modules were used to steal information. For example, one of them sent recently opened documents to the cybercriminals. Various mechanisms were used to communicate with the C&C servers: the cURL library (for HTTP/HTTPS), the Background Intelligent Transfer Service (BITS) interface, the WinHTTP programming interface, and public mail services that use the POP3S, SMTPS, or IMAPS protocol. This Securelist post provides a more detailed technical analysis of the malicious MosaicRegressor framework, together with indicators of compromise. How to protect from MosaicRegressor To protect from MosaicRegressor, the first threat to neutralize is spear-phishing, which is how most sophisticated attacks begin. For maximum employee computer protection, we recommend using a combination of security products with advanced antiphishing technologies and education to raise employee awareness about attacks of this type. Our security solutions detect malicious modules tasked with data theft. As for the compromised firmware, unfortunately we don’t know exactly how the bootkit got onto victims’ computers. Based on data from the HackingTeam leak, the attackers presumably needed physical access and used a USB drive to infect the machines. However, other methods of UEFI compromise cannot be ruled out. To protect against the MosaicRegressor UEFI bootkit: Check your computer or motherboard manufacturer’s website to find out if your hardware supports Intel Boot Guard, which prevents the unauthorized modification of UEFI firmware. Use full-disk encryption to prevent a bootkit from installing its payload. Use reliable security solutions that can scan and identify threats of this nature. Since 2019, our products have been able to search for threats hiding in the ROM BIOS and UEFI firmware. In fact, our dedicated Firmware Scanner technology initially detected this attack.

Promising Infusions of Cash, Fake Investor John Bernard Walked Away With $30M

krebsonsecurity Oct 07, 2020 A Little Sunshine

September featured two stories on a phony tech investor named John Bernard, a pseudonym used by a convicted thief named John Clifton Davies who’s fleeced dozens of technology companies out of an estimated $30 million with the promise of lucrative investments. Those stories prompted a flood of tips from show more ...

Davies’ victims that paints a much clearer picture of this serial con man and his cohorts, including allegations of hacking, smuggling, bank fraud and murder. KrebsOnSecurity interviewed more than a dozen of Davies’ victims over the past five years, none of whom wished to be quoted here out of fear of reprisals from a man they say runs with mercenaries and has connections to organized crime. As described in Part II of this series, John Bernard is in fact John Clifton Davies, a 59-year-old U.K. citizen who absconded from justice before being convicted on multiple counts of fraud in 2015. Prior to his conviction, Davies served 16 months in jail before being cleared of murdering his third wife on their honeymoon in India. The scam artist John Bernard (left) in a recent Zoom call, and a photo of John Clifton Davies from 2015. After eluding justice in the U.K., Davies reinvented himself as The Private Office of John Bernard, pretending to a be billionaire Swiss investor who made his fortunes in the dot-com boom 20 years ago and who was seeking investment opportunities. In case after case, Bernard would promise to invest millions in tech startups, and then insist that companies pay tens of thousands of dollars worth of due diligence fees up front. However, the due diligence company he insisted on using — another Swiss firm called Inside Knowledge — also was secretly owned by Bernard, who would invariably pull out of the deal after receiving the due diligence money. Bernard found a constant stream of new marks by offering extraordinarily generous finders fees to investment brokers who could introduce him to companies seeking an infusion of cash. When it came time for companies to sign legal documents, Bernard’s victims interacted with a 40-something Inside Knowledge employee named “Katherine Miller,” who claimed to be his lawyer. It turns out that Katherine Miller is a onetime Moldovan attorney who was previously known as Ecaterina “Katya” Dudorenko. She is listed as a Romanian lawyer in the U.K. Companies House records for several companies tied to John Bernard, including Inside Knowledge Solutions Ltd., Docklands Enterprise Ltd., and Secure Swiss Data Ltd (more on Secure Swiss data in a moment). Another of Bernard’s associates listed as a director at Docklands Enterprise Ltd. is Sergey Valentinov Pankov. This is notable because in 2018, Pankov and Dudorenko were convicted of cigarette smuggling in the United Kingdom. Sergey Pankov and Ecaterina Dudorenco, in undated photos. Source: Mynewsdesk.com According to the Organized Crime and Corruption Reporting Project, “illicit trafficking of tobacco is a multibillion-dollar business today, fueling organized crime and corruption [and] robbing governments of needed tax money. So profitable is the trade that tobacco is the world’s most widely smuggled legal substance. This booming business now stretches from counterfeiters in China and renegade factories in Russia to Indian reservations in New York and warlords in Pakistan and North Africa.” Like their erstwhile boss Mr. Davies, both Pankov and Dudorenko disappeared before their convictions in the U.K. They were sentenced in absentia to two and a half years in prison. Incidentally, Davies was detained by Ukrainian authorities in 2018, although he is not mentioned by name in this story from the Ukrainian daily Pravda. The story notes that the suspect moved to Kiev in 2014 and lived in a rented apartment with his Ukrainian wife. John’s fourth wife, Iryna Davies, is listed as a director of one of the insolvency consulting businesses in the U.K. that was part of John Davies’ 2015 fraud conviction. Pravda reported that in order to confuse the Ukrainian police and hide from them, Mr. Davies constantly changed their place of residence. John Clifton Davies, a.k.a. John Bernard. Image: Ukrainian National Police. The Pravda story says Ukrainian authorities were working with the U.K. government to secure Davies’ extradition, but he appears to have slipped away once again. That’s according to one investment broker who’s been tracking Davies’ trail of fraud since 2015. According to that source — who we’ll call “Ben” — Inside Knowledge and The Private Office of John Bernard have fleeced dozens of companies out of nearly USD $30 million in due diligence fees over the years, with one company reportedly paying over $1 million. Ben said he figured out that Bernard was Davies through a random occurrence. Ben said he’d been told by a reliable source that Bernard traveled everywhere in Kiev with several armed guards, and that his entourage rode in a convoy that escorted Davies’ high-end Bentley. Ben said Davies’ crew was even able to stop traffic in the downtown area in what was described as a quasi military maneuver so that Davies’ vehicle could proceed unobstructed (and presumably without someone following his car). Ben said he’s spoken to several victims of Bernard who saw phony invoices for payments to be made to banks in Eastern Europe appear to come from people within their own organization shortly after cutting off contact with Bernard and his team. While Ben allowed that these invoices could have come from another source, it’s worth noting that by virtue of participating in the due diligence process, the companies targeted by these schemes would have already given Bernard’s office detailed information about their finances, bank accounts and security processes. In some cases, the victims had agreed to use Bernard’s Secure Swiss Data software and services to store documents for the due diligence process. Secure Swiss Data is one of several firms founded by Davies/Inside Knowledge and run by Dudorenko, and it advertised itself as a Swiss company that provides encrypted email and data storage services. In February 2020, Secure Swiss Data was purchased in an “undisclosed multimillion buyout” by SafeSwiss Secure Communication AG. Shortly after the first story on John Bernard was published here, virtually all of the employee profiles tied to Bernard’s office removed him from their work experience as listed on their LinkedIn resumes — or else deleted their profiles altogether. Also, John Bernard’s main website — the-private-office.ch — replaced the content on its homepage with a note saying it was closing up shop. Incredibly, even after the first two stories ran, Bernard/Davies and his crew continued to ply their scam with companies that had already agreed to make due diligence payments, or that had made one or all of several installment payments. One of those firms actually issued a press release in August saying it had been promised an infusion of millions in cash from John Bernard’s Private Office. They declined to be quoted here, and continue to hold onto hope that Mr. Bernard is not the crook that he plainly is.

Report: Critical Infrastructure Cyber Attacks A Global Crisis

securityledger Oct 07, 2020 Claroty

The systems we rely on to keep the lights on, heat our homes, make our medicines and move our goods are increasingly connecting to the Internet, and increasingly vulnerable to devastating cyber attacks in what a new report calls a looming "global crisis." The post Report: Critical Infrastructure Cyber Attacks show more ...

A Global Crisis appeared first on The...Read the whole entry... » Related StoriesPKI Points the Way for Identity and Authentication in IoTChina Attacks Surge as Cyber Criminals Capitalize on COVID-19As Cybercrooks Specialize, More Snooping, Less Smash and Grab

Foreign spies use front companies to disguise their hacking, borrowing an old camouflage tactic

cyware Oct 07, 2020 Geopolitical, Terrorism

While advertising offensive hacking tests, Chengdu 404 used phishing and other means to breach more than 100 organizations in the U.S., South Korea, Japan, and more, according to DoJ charges.

Corporate Credentials on the Dark Web Up by 429% This Year

cyware Oct 07, 2020 Trends, Reports, Analysis

There has been a 429% rise in the number of corporate credentials with plaintext passwords on the dark web so far this year, according to Arctic Wolf’s 2020 Security Operations Annual Report.

PoetRAT: Malware targeting public and private sector in Azerbaijan evolves

cyware Oct 07, 2020 Malware and Vulnerabilities

The Azerbaijan public sector and other important organizations are still targeted by new versions of PoetRAT using malicious Microsoft Word documents alleged to be from the Azerbaijan government.

10 Years Since Stuxnet: Is Your Operational Technology Safe?

cyware Oct 07, 2020 Trends, Reports, Analysis

Operational technology will continue to become a prime target for malicious cyber mafia actors if organizations don't take the proper steps to secure their systems against pernicious threats.

UEFI malware named MosaicRegressor found on Diplomat computers

cyware Oct 07, 2020 Malware and Vulnerabilities

According to Kaspersky researchers, the malware is in the form of a “compromised UEFI firmware image” with an implant that installs additional malware on the victim devices.

Cisco moves to buy cloud and container security startup

cyware Oct 07, 2020 Companies to Watch

Technology conglomerate Cisco is making a play in the cloud application security market, announcing plans to acquire cybersecurity startup Portshift. Terms of the deal were not disclosed.

FireEye’s Mandiant debuts new SaaS threat intelligence suite

cyware Oct 07, 2020 Security Products & Services

Mandiant said the new solution is the first SaaS offering in its portfolio and will combine threat intelligence gathered by Mandiant together with data from cyber incident response engagements.

Release the Kraken: Fileless APT attack abuses Windows Error Reporting service

cyware Oct 07, 2020 Malware and Vulnerabilities

On September 17th, researchers at Malwarebytes discovered a new attack called Kraken that injected its payload into the Windows Error Reporting (WER) service as a defense evasion mechanism.

Attacker builds malware variant with leaked Mirai source code

cyware Oct 07, 2020 Malware and Vulnerabilities

A threat actor going by the online handle “Priority” has been found using the infamous Mirai malware source code to launch their own version of the malware by researchers at Juniper Threat Labs.

CISA alert warns of Emotet attacks on US govt entities

cyware Oct 07, 2020 Threat Intel & Info Sharing

The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert to warn of a surge of Emotet attacks that have targeted multiple state and local governments in the U.S. since August.

Microsoft awards $374,300 in bug bounties to secure Azure Sphere

cyware Oct 07, 2020 Security Culture

Microsoft has awarded $374,300 in bug bounties to security researchers who spotted bugs in Azure Sphere which itself offers high-end security for Cloud-connected Internet of Things (IoT) devices.

Using a WordPress flaw to leverage Zerologon vulnerability and attack companies’ Domain Controllers

cyware Oct 07, 2020 Malware and Vulnerabilities

Researchers found that attackers are using a flaw in the File-Manager WordPress plugin (CVE-2020-25213) to leverage Zerologon (CVE-2020-1472) and attack companies’ Domain Controllers.

GitLab patches Elasticsearch private group data leak bug

cyware Oct 07, 2020 Malware and Vulnerabilities

Submitted by a security researcher in November 2019, the issue is described as a failure to remove code from Elasticsearch API search results when transferring a public group to a private group.

Cisco Ordered to Pay $1.9 Billion in Cybersecurity Patent Infringement Case

cyware Oct 07, 2020 Security Products & Services

In a lawsuit filed in the Eastern District of Virginia in March 2018, Centripetal claimed that numerous Cisco product series have been infringing on five of its patents for years.

Food Delivery Service Chowbus Exposes 800,000 Customer Records

cyware Oct 07, 2020 Breaches and Incidents

In an email to customers, Chowbus CEO Linxin Wen said the data had been “illegally accessed” and dumped online, but he did not say how. Credit card numbers were not compromised, Wen said.

Android's October 2020 Security Update Patches 48 Vulnerabilities

cyware Oct 07, 2020 Malware and Vulnerabilities

The October 2020 security updates for Android patch a total of 48 vulnerabilities, including critical and high-severity flaws that affect Qualcomm closed-source components and Android System.

New HEH Botnet Wipes Off All Data From Routers and IoT Devices

cyware Oct 07, 2020 Malware and Vulnerabilities

If the device uses default or easy-to-guess SSH credentials, the botnet gains access to the system, where it immediately downloads one of seven binaries that install the HEH malware.

Canada Bombarded with COVID-19-Themed Cyber-attacks

cyware Oct 07, 2020 Trends, Reports, Analysis

More than a quarter of Canadian IT workers say their organization has suffered a COVID-19-themed cyber-attack, according to a new survey by the Canadian Internet Registration Authority (CIRA).

Hackers Breached Telegram and Email Accounts of 20 Israeli Crypto Executives

cyware Oct 07, 2020 Breaches and Incidents

According to research by Pandora, the hackers had launched an SMSC spoofing attack to hijack the SMS verification process for password renewal in the online accounts of the victims.

Security Flaws in Comcast TV Remote can be Exploited to Snoop on Users

cyware Oct 07, 2020 Malware and Vulnerabilities

Researchers from segmentation solutions provider Guardicore have identified a series of vulnerabilities that could have been exploited by a hacker to turn a TV remote into a spying device.

US Brokerage Firms Being Targeted by Widespread Survey Phishing Attacks

cyware Oct 07, 2020 Identity Theft, Fraud, Scams

The U.S. Financial Industry Regulatory Authority (FINRA) has issued a notice warning member brokerage firms of widespread phishing attacks using surveys to harvest information.

Spies hacked Azerbaijan government officials as Nagorno-Karabakh conflict escalated

cyware Oct 07, 2020 Geopolitical, Terrorism

Unidentified spies have been quietly breaching Azerbaijani government IT networks and accessing the diplomatic passports of certain officials, according to new research from Cisco Talos.

MTI acquired by Ricoh

cyware Oct 07, 2020 Companies to Watch

MTI Technology has been acquired by Ricoh in a move that will bolster its IT capabilities across Europe. MTI will continue to operate under its own brand as part of Ricoh's European operation.

Phishing attack spoofs IRS COVID-19 relief to steal personal data

cyware Oct 07, 2020 Identity Theft, Fraud, Scams

The phishing campaign exploits the IRS, the coronavirus, and SharePoint to obtain email credentials, Social Security numbers, driver's license numbers, and tax numbers, according to Armorblox.

Australia's cyber dollars are full of stale hot air

cyware Oct 07, 2020 Expert Blogs and Opinion

The "additional $201.5 million" announced to help deliver Australia's Cyber Security Strategy is just another part of the AU$1.7 billion over 10 years already announced in August.

Ping acquires blockchain identity startup ShoCard

cyware Oct 07, 2020 Companies to Watch

Ping accelerated its push into the personal identity management market with the acquisition of ShoCard, which uses a blockchain-based platform to manage consumer identities.

New Valak Variant Makes "Most Wanted Malware" List for First Time

cyware Oct 07, 2020 Trends, Reports, Analysis

First detected back in 2019, Valak garnered the attention of Cybereason in May 2020 for its ability to function beyond a malware loader and independently operate as an information stealer.

'Mercenary' Hacker Group Runs Rampant in Middle East

cyware Oct 07, 2020 Threat Actors

Saudi diplomats, Sikh separatists, and Indian business executives have been among those targeted by a group of hired hackers, according to research published by software firm BlackBerry Corp.

Israeli cybersecurity firm Illusive raises $24 million in private round

cyware Oct 07, 2020 Companies to Watch

Participants in the financing round included Spring Lake Equity Partners, Marker, New Enterprise Associates, Bessemer Venture Partners, Innovation Endeavors, Cisco, Microsoft, and Citi.

Chrome 86 delivers more security features for mobile users

cyware Oct 07, 2020 Computer, Internet Security

Chrome 86 will warn users when they are about to submit information through a non-secure form embedded in an HTTPS page and when they are about to initiate insecure downloads over non-secure links.

Ukraine plan to tackle hackers sparks privacy fears

cyware Oct 07, 2020 Laws, Policy, Regulations

Ukraine is hoping to tackle an ever-growing list of cyberattacks with a new law that rights experts warn could give authorities excessive powers to pry into the lives of citizens.

Phishing alert: AgentTesla and Others Spotted Leveraging Pastebin-Like Services

cyware Oct 07, 2020 Malware and Vulnerabilities

Researchers reveal that AgentTesla, LimeRAT, W3Cryptolocker, and Redline Stealer are now using Paste[.]nrecom.net service in their spear-phishing attacks.

Watch Out! Hackers are After Legacy Software

cyware Oct 07, 2020 Trends, Reports, Analysis

Regardless of the rationale, ignoring End-of-Life (EOL) or End-of-Service (EOS) warnings can leave organizations exposed to a variety of unforeseen cyberattacks.

Fullz House Introduces Enhancements into Card Skimming Attacks

cyware Oct 07, 2020 Breaches and Incidents

Fullz House skimmer group injected a single line of JavaScript code, disguised as a Google Analytics script, into the website of U.S. mobile virtual network operator (MVNO), Boom! Mobile.

Comcast TV Remote Hack Opens Homes To Snooping

packetstormsecurity Oct 07, 2020 headline,privacy,flaw,spyware

Hackers Exploit Windows Error Reporting Service In New Fileless Attack

packetstormsecurity Oct 07, 2020 headline,microsoft,flaw

Chrome Can Now Find Hacked Passwords On Phones

packetstormsecurity Oct 07, 2020 headline,phone,google,password,chrome