Oktacron - Cyber Security RSS Feeds History

FBI Issues Warning of Hackers Spoofing Its Internet Domain

softpedia Nov 23, 2020 Security

The Federal Bureau of Investigation, or the FBI, has issued a warning about a series of spoofed domains that are being used by cybercriminals in an attempt to steal user information. Spoofed domains typically look like real domains, only that malicious actors turn to a very simple trick: they change one letter, the show more ...

Internet domain, or add more words that make sense for each target, all in an attempt to trick users into thinking they’re loading the legitimate site. In most cases, hackers publish content that encourages users to provide information like personal details and credit card numbers. The FBI says it has already detected a number of spoofed domains, as well as others that no longer resolve, which means they have been suspended (though there’s also a chance they might be reactivated at a later time). Users who want to visit the FBI’s official site should check the URL in the address bar and make sure ... (read more)

Malware in Minecraft mods

kaspersky Nov 23, 2020 Threats

The first version of Minecraft was released way back in 2009, but the game remains incredibly popular to this day. That should come as no surprise; not only is it enormous fun, but it’s a platform for kids and adults alike to create their own worlds. Some even use it for urban planning — and some teachers use show more ...

it in the classroom. Unfortunately, as with any successful project, cybercriminals are eager for a piece of the action. Since July of this year, we have detected more than 20 apps on Google Play claiming to be modpacks for Minecraft, when in fact their primary purpose is to display ads on smartphones and tablets in an extremely intrusive manner. We explain what these apps are and how to protect Android devices against such threats. Fake Minecraft mods on Google Play At the time of this writing, most of the unscrupulous apps we found on Google Play had already been removed. The five that remained were: Zone Modding Minecraft, Textures for Minecraft ACPE, Seeded for Minecraft ACPE, Mods for Minecraft ACPE, Darcy Minecraft Mod. The humblest of them had more than 500 installations, and the most popular more than 1 million. Although the apps have different publishers, two of the fake modpacks carried almost the exact same description, down to the typos. Apps with different publishers, same description The app reviews are contradictory. Average ratings hover around the 3-star mark, but overall, scores are highly polarized, mostly 5s and 1s. That kind of spread suggests that bots are leaving rave reviews but real users are very unhappy. Unfortunately, in this case, the cybercriminals are targeting kids and teenagers, who may not pay attention to ratings and reviews before installing an app. The apps receive either five stars or one. Suspicious! We informed Google about the malicious apps mentioned above, and the apps were deleted from Google Play by the time this post was published. Nevertheless, it’s worth mentioning that: After apps are deleted from Google Play, they remain on the smartphones of any users who already installed them; The malware creators can try to get their apps back in the store by modifying them and publishing them from a different developer’s account. Fake mods on the device Meanwhile, users rightly curse the apps for not doing what they promised. Having landed on a smartphone, the “modpack” lets itself be opened once, but it doesn’t load any mods (in fact, the app we studied closely did nothing useful at all). The frustrated user closes the app, which promptly vanishes. More precisely, its icon disappears from the smartphone’s menu. Users complain that the app doesn’t work and seemingly deletes itself Because the “modpack” seemed glitchy from the start, most users, especially kids and teens, won’t waste time looking for it. They may even forget it and not bother trying to remove it. Unbeknownst to the user, however, the app remains on the smartphone — and not merely there, but hard at work. Concealed from the user, the fake modpack starts displaying ads. The sample we examined automatically opened a browser window with ads every two minutes, greatly interfering with normal smartphone use. In addition to the browser, the apps can open Google Play and Facebook or play YouTube videos, depending on the C&C server’s orders. Whatever the case, the constant stream of full-screen ads makes the phone practically unusable. How to remove malicious Minecraft modpacks Perhaps the most annoying thing about the fake Minecraft mods is that their victims have a very hard time figuring out why their browser (or Google Play, or Facebook, or YouTube) keeps opening. They are likely to conclude that the problem lies in the browser (or whichever app the fake modpack loads). However, uninstalling and reinstalling the browser will not fix the issue, and neither will tinkering with settings. The only way to defeat the problem is to get rid of the malicious app. But that means locating it, which may be tricky; affected users may not remember what exactly they installed before their phones started acting up. After identifying the malicious app, you’ll need to find it in device settings (Settings → Apps and notifications → Show all apps) and delete it from there. Fortunately, the misbehaving modpacks get removed entirely with deletion and do not try to restore themselves. If you’re having trouble figuring out which app is to blame for the smartphone’s odd behavior, or you just want to clean your child’s gadget quickly and easily, install a reliable security solution and scan the device. For example, Kaspersky Internet Security for Android recognizes fake Minecraft modpacks with the verdict not-a-virus:HEUR:AdWare.AndroidOS.HiddenAd.os, and prompts the user to delete any that are already on the smartphone or tablet. For the future, to prevent your child from downloading malware, teach them about the potential dangers of apps, including ones on Google Play. In particular, focus on poorly written descriptions and wildly varying ratings and reviews — warning signs the developer or publisher might not be on the up-and-up. And just to repeat, be sure to install a mobile antivirus utility on their smartphone.

Discord Becoming a Lucrative Target for Malicious Actors

cyware Nov 23, 2020 Trends, Reports, Analysis

TroubleGrabber is a credential stealer that spreads through Discord attachments and leverages Discord webhooks to deliver the stolen information to the malware operators.

Google Is Testing End-to-End Encryption in Android Messages

cyware Nov 23, 2020 Mobile Security

Google has begun rolling out end-to-end encryption for Rich Communication Service, the text-messaging standard the industry giant is pushing as an alternative to the older SMS protocol.

Hundreds of female sports stars and celebrities have their naked photos and videos leaked online

cyware Nov 23, 2020 Breaches and Incidents

“The hack, which the athletes became aware of this week, has caused panic and one leading sports agency has advised its clients to take extra measures to protect their private data,” as per The Times.

TrickBot turns 100: Latest malware released with new features

cyware Nov 23, 2020 Malware and Vulnerabilities

With this release, TrickBot is now injecting its DLL into the legitimate Windows wermgr.exe (Windows Problem Reporting) executable directly from memory using code from the 'MemoryModule' project.

Romanians arrested for running underground malware services

cyware Nov 23, 2020 Threat Actors

Romanian police forces have arrested this week two individuals suspected of running two malware crypter services called CyberSeal and DataProtector, and a malware testing service called CyberScan.

Rising Ransomware Threats in Manufacturing Sector

cyware Nov 23, 2020 Trends, Reports, Analysis

Dragos researchers have found multiple ransomware strains, such as Clop, EKANS, and Megacortex, adopting ICS-aware functionality, including the ability to kill industrial processes.

Threat Actors Trick Adult Site Visitors With Malvertising Attacks

cyware Nov 23, 2020 Trends, Reports, Analysis

Researchers at Malwarebytes discovered yet another Malsmoke campaign that appears to have begun mid-October, using malvertising attacks to trick adult site users into downloading a fake Java update.

South Korean Retail Giant E-Land Forced to Close Nearly Half of its Stores Due to Ransomware Attack

cyware Nov 23, 2020 Breaches and Incidents

South Korean fashion and retail conglomerate E-Land Group said Sunday it has suspended operations at nearly half of its stores (23 out of 50) in the country due to a ransomware attack.

GoDaddy Employees Exploited in Attacks on Multiple Cryptocurrency Services

cyware Nov 23, 2020 Breaches and Incidents

In March, a voice phishing scam targeting GoDaddy support employees allowed attackers to assume control over at least a half-dozen domain names, including transaction brokering site escrow.com.

Watch Out! URL Redirection Attacks are Here to Catch You Unaware

cyware Nov 23, 2020 Trends, Reports, Analysis

This year, URL redirection has featured in a variety of attacks campaigns, including malvertising attacks, tech support scams, brand impersonation attacks, and more.

Hacker Publishes Exploits for Over 49,000 Vulnerable Fortinet VPNs

cyware Nov 23, 2020 Breaches and Incidents

The exploit posted by the hacker lets attackers access the sslvpn_websession files from Fortinet VPNs to steal login credentials which could then be used to compromise a network and deploy ransomware.

Drupal-based sites open to attack via double extension files

cyware Nov 23, 2020 Malware and Vulnerabilities

The Drupal team did not say that they aware of the vulnerability being actively exploited, but recommended admins to audit all previously uploaded files to check for malicious extensions.

Nearly $20 Million Stolen From Decentralized Finance Protocol Pickle Finance

cyware Nov 23, 2020 Breaches and Incidents

The liquidity mining project lost about $20 million of users' funds in DAI tokens. The attacker exploited the vulnerability of Pickle Finance smart contract called DAI PickleJar using fake swaps.

Organizations plan to use AI and ML to tackle unknown attacks faster

cyware Nov 23, 2020 Trends, Reports, Analysis

A report by Wipro provides fresh insights on how AI will be leveraged as part of defender stratagems as more organizations lock horns with sophisticated cyberattacks and become more resilient.

Joe Biden’s Campaign Website Defaced by Turkish Hackers

cyware Nov 23, 2020 Breaches and Incidents

Turkish hackers hacked and defaced Joe Biden’s Presidential campaign 'Vote Joe’ website. As per the note left by the hackers on the hacked site, “RootAyyildiz” has claimed responsibility for the hack.

Which countries and hackers are targeting Covid vaccine developers?

cyware Nov 23, 2020 Trends, Reports, Analysis

Threat actors from Russia, China, Iran, and North Korea, including Fancy Bear, Cozy Bear, APT41, Charming Kitten, and Lazarus, have launched targeted attacks against vaccine research efforts.

Massive threat campaign strikes open-source repos, researchers spot new CursedGrabber malware

cyware Nov 23, 2020 Malware and Vulnerabilities

The malware called “xpc.js” includes next-generation machine learning algorithms that automatically detect potentially malicious activity associated with open source ecosystems.

MPs Bombarded by Nearly Three Million Email Attacks Per Month

cyware Nov 23, 2020 Govt., Critical Infrastructure

The think tank Parliament Street collected Freedom of Information (FOI) responses to reveal that over 22.3 million cyberattacks were blocked by parliament from January 1, 2020, to August 31, 2020.

GitHub fixes 'high severity' security flaw spotted by Google

cyware Nov 23, 2020 Malware and Vulnerabilities

The bug affected GitHub's Actions feature – a developer workflow automation tool – that Google Project Zero researcher Felix Wilhelm said was "highly vulnerable to injection attacks".

Companies rely on crowdsourced security to boost security efforts

cyware Nov 23, 2020 Trends, Reports, Analysis

Organizations that qualify as leaders recognize their own limitations and are much more likely to supplement their security efforts with crowdsourced penetration testing and bug bounty programs.

VMware fixed SD-WAN flaws that could allow hackers to target enterprise networks

cyware Nov 23, 2020 Malware and Vulnerabilities

VMware last week addressed six vulnerabilities in its SD-WAN Orchestrator product, including some issues that can be chained by an attacker to hijack traffic or shut down an enterprise network.

FBI Alerts Private Industry Partners on Ragnar Locker Ransomware Activity

cyware Nov 23, 2020 Malware and Vulnerabilities

The U.S. Federal Bureau of Investigation issued a flash alert to warn private industry partners of an increase of the Ragnar Locker ransomware activity following a confirmed attack from April 2020.

State-Sponsored APTs Run Rampant After COVID-19 Research

cyware Nov 23, 2020 Trends, Reports, Analysis

As the need for healthcare and pharmaceutical organizations during the pandemic increases more than ever, APT groups are ramping up their attacks on these institutions to steal critical research.

This Bluetooth Attack Can Steal a Tesla Model X in Minutes

cyware Nov 23, 2020 Malware and Vulnerabilities

A hacker could rewrite the firmware of a Tesla key fob via Bluetooth connection, lift an unlock code from the fob, and use it to steal a Model X in just a matter of minutes.

ImageMagick PDF-parsing flaw allowed attacker to execute shell commands via maliciously crafted image

cyware Nov 23, 2020 Malware and Vulnerabilities

Alex Inführ discovered a new shell injection vulnerability related to the parsing of PDF files by ImageMagick while investigating ‘ImageTragick’, a set of vulnerabilities discovered in 2016.

Be Prepared for Increased DDoS Attacks Ahead of Black Friday

cyware Nov 23, 2020 Trends, Reports, Analysis

This year’s Black Friday DDoS attacks may be especially challenging for online retailers' operations globally if they accompany exceptionally high volumes of normal traffic.

WISekey Completes the First Phase of the Acquisition of arago by Taking Controlling Interest

cyware Nov 23, 2020 Companies to Watch

WISeKey will acquire a majority interest in arago, a leading German technology company that provides artificial intelligence to enterprises globally through knowledge automation.

TikTok patches reflected XSS bug, one-click account takeover exploit

cyware Nov 23, 2020 Malware and Vulnerabilities

TikTok has patched a reflected cross-site scripting security flaw and a vulnerability leading to account takeover impacting the firm's web domain, which were reported by a security researcher.

Telefónica Invests in Spanish Cyber Security Startup Smart Protection

cyware Nov 23, 2020 Companies to Watch

Telefónica, via Telefónica Tech Ventures, its vehicle for investment in cybersecurity startups, has invested in Smart Protection, a startup that protects brands against counterfeiting on the internet.

Attackers Dupe GoDaddy Staff Into Helping Them Take Down Cryptocurrency Services

packetstormsecurity Nov 23, 2020 headline,hacker,dns,social,cryptography

Smart Doorbells Are Easy Targets For Hackers

packetstormsecurity Nov 23, 2020 headline,hacker,privacy

TikTok Patches XSS And Account Takeover Exploit

packetstormsecurity Nov 23, 2020 headline,flaw