Oktacron - Cyber Security RSS Feeds History

Three ways to unmask a mobile spy

kaspersky Dec 14, 2020 Privacy

On their face, spying apps might seem like something out of a thriller, of concern to high-rolling politicians, prominent business people, and celebrities, not regular folks. In reality, though, you don’t have to be Jeff Bezos for someone to want to track you. It could be that your employer (or other half) wants show more ...

to know what you’re getting up to outside the office (or home). If you suspect that someone might be spying on you through your smartphone — or even if you don’t — use these tips to investigate. How to find a mobile spy by yourself Although spying apps try to conceal themselves, most reveal their presence in one way or another. Mobile data running out quicker than expected or the battery dying similarly fast are two red flags. If you notice either problem, be on your guard and check which apps are consuming your phone’s resources. The settings you need have different names depending on the device; look for something like Data usage and Battery, respectively. If the device turns on Wi-Fi, mobile Internet, or geolocation, even though you turned them off, again, look at which apps are eating data and accessing your location. For more information, see our post about checking Android permissions, or read about iOS permissions on Apple’s website. If you don’t find anything on your Android phone, but you still suspect someone may be spying on you, check which apps have access to Accessibility (Settings -> Accessibility). Accessibility lets apps snoop on other programs, alter settings, and do a lot of other things acting as the user. That makes the permission very useful to spyware. When we say Accessibility is one of the most potentially dangerous permissions in Android, we really mean it. Give that kind of access to your antivirus utility, but nothing else. How to find a mobile spy using Kaspersky Internet Security for Android Not up for a manual search and destroy? Android device owners should check out our mobile security solution. Kaspersky Internet Security for Android will unmask any traitors, even if you have the free version. Because of the legally disputed status of stalkerware, many security solutions classify some problem apps as not-a-virus. You’ll still get a warning about it, though, so always read antivirus alerts carefully. That said, that method does have one drawback: Some surveillance apps notify their owners if antivirus protection is installed on the device. If you’re worried about being tracked by, say, a jealous spouse, it may be better not to let them know about your suspicions, so, to help users spot a spy without giving themselves away, we created a mobile spycatcher called TinyCheck. TinyCheck works equally well for Android and iOS. How to find a mobile spy with TinyCheck We originally developed TinyCheck to help victims of domestic abuse, but we quickly realized it could be of use to anyone at all. The current version does require some technical know-how and a willingness to fiddle with hardware, however. That’s because TinyCheck is installed on a separate device, like a Raspberry Pi microcomputer, not on a smartphone. This separate device must be configured to act as an intermediary between the router and the Wi-Fi-connected gadget — but the payoff for that work is knowing that any spyware on the phone can’t see our software. Once it’s installed, all of your Internet traffic will pass through TinyCheck, which analyzes it in real time. If your smartphone sends a lot of data to a known spyware server, for example, TinyCheck will notify you. Here’s how it looks in practice: Detailed technical requirements and instructions for setting up TinyCheck are available on the solution’s GitHub page. TinyCheck addendum for the nongeeky If you think a Raspberry Pi is something to buy in a bakery, you’ll probably be better off getting an IT pro to configure TinyCheck for you. Better yet, find someone you know and trust 100%. You should obviously avoid asking anyone you suspect might be connected to the spyware; if you give them access, they’ll probably whitelist the app to keep it off TinyCheck’s radar. In any case, soon you’ll be able to go the TinyCheck route without IT friends, when we release a user version of TinyCheck, which will be much easier to work with. How to avoid surveillance If one of the above methods unearths spyware on your smartphone, think twice before deleting it. The person who installed it will notice, and that could make things worse. (Uninstalling the program also could erase evidence that you might need later.) As with all facets of security, take protective measures first. For example, if you’re being tracked by a potentially violent partner, before doing anything with the spy app, contact a help center for victims of domestic abuse (see here for information). In some cases, it’s easier to replace your smartphone altogether, and then make sure that no one can install spying apps on the new device: Protect it with a strong password that you never share with your partner, friends, or colleagues; Install a reliable security solution immediately, and scan the device regularly; Change the passwords for all of your accounts, and don’t share them with anyone either; Download apps only from official sources such as Google Play or the App Store. For more information about spyware and how to deal with it, visit the Coalition Against Stalkerware, which brings together domestic abuse organizations and the security community.

U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

krebsonsecurity Dec 14, 2020 Data Breaches

Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds, a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the company’s customer base, show more ...

experts say the incident may be just the first of many such disclosures. Some of SolarWinds’ customers. Source: solarwinds.com According to a Reuters story, hackers believed to be working for Russia have been monitoring internal email traffic at the U.S. Treasury and Commerce departments. Reuters reports the attackers were able to surreptitiously tamper with updates released by SolarWinds for its Orion platform, a suite of network management tools. In a security advisory, Austin, Texas based SolarWinds acknowledged its systems “experienced a highly sophisticated, manual supply chain attack on SolarWinds Orion Platform software builds for versions 2019.4 HF 5 through 2020.2.1, released between March 2020 and June 2020.” In response to the intrusions at Treasury and Commerce, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) took the unusual step of issuing an emergency directive ordering all federal agencies to immediately disconnect the affected Orion products from their networks. “Treat all hosts monitored by the SolarWinds Orion monitoring software as compromised by threat actors and assume that further persistence mechanisms have been deployed,” CISA advised. A blog post by Microsoft says the attackers were able to add malicious code to software updates provided by SolarWinds for Orion users. “This results in the attacker gaining a foothold in the network, which the attacker can use to gain elevated credentials,” Microsoft wrote. From there, the attackers would be able to forge single sign-on tokens that impersonate any of the organization’s existing users and accounts, including highly privileged accounts on the network. “Using highly privileged accounts acquired through the technique above or other means, attackers may add their own credentials to existing application service principals, enabling them to call APIs with the permission assigned to that application,” Microsoft explained. Malicious code added to an Orion software update may have gone undetected by antivirus software and other security tools on host systems thanks in part to guidance from SolarWinds itself. In this support advisory, SolarWinds says its products may not work properly unless their file directories are exempted from antivirus scans and group policy object restrictions. The Reuters story quotes several anonymous sources saying the intrusions at the Commerce and Treasury departments could be just the tip of the iceberg. That seems like a fair bet. SolarWinds says it has over 300,000 customers including: -more than 425 of the U.S. Fortune 500 -all ten of the top ten US telecommunications companies -all five branches of the U.S. military -all five of the top five U.S. accounting firms -the Pentagon -the State Department -the National Security Agency -the Department of Justice -The White House. It’s unclear how many of the customers listed on SolarWinds’ website are users of the affected Orion products. But Reuters reports the supply chain attack on SolarWinds is connected to a broad campaign that also involved the recently disclosed hack at FireEye, wherein hackers gained access to a slew of proprietary tools the company uses to help customers find security weaknesses in their computers and networks. The compromises at the U.S. federal agencies are thought to date back to earlier this summer, and are being blamed on hackers working for the Russian government. FireEye said its breach was the work of APT 29, a.k.a. “Cozy Bear,” a Russian hacker group believed to be associated with one or more intelligence agencies of Russia. In its own advisory, FireEye said multiple updates poisoned with a malicious backdoor program were digitally signed with a SolarWinds certificate from March through May 2020, and posted to the SolarWindws update website. FireEye posits the impact of the hack on SolarWinds is widespread, affecting public and private organizations around the world. “The victims have included government, consulting, technology, telecom and extractive entities in North America, Europe, Asia and the Middle East,” the company’s analysts wrote. “We anticipate there are additional victims in other countries and verticals.”

Hacked Subway UK marketing system used in TrickBot phishing campaign

cyware Dec 14, 2020 Malware and Vulnerabilities

Customers received emails from Subcard about the processing of an alleged Subway order. The malicious emails were including a link to a weaponized Excel document containing confirmation of the order.

'MountLocker' Ransomware Adds to Affiliate Extortion Racket

cyware Dec 14, 2020 Malware and Vulnerabilities

The ransomware was first spotted by BlackBerry in July, and its code was updated in November to allow MountLocker to better target certain files and evade security tools, according to the report.

Insecure Communication From WinZip 24 Lets Hackers Drop Malware

cyware Dec 14, 2020 Malware and Vulnerabilities

In the course of searching for WinZip network communications changes, security experts noticed that through the unsecured tcp, the WinZip archiver was vulnerable to many attacks.

Scam bitcoin ads using unauthorised Australian celebrity images traced to Moscow addresses

cyware Dec 14, 2020 Identity Theft, Fraud, Scams

The fake celebrity ads have run on news websites since at least 2018, but with people stuck at home during the COVID-19 pandemic, many more have been caught out by the scams.

WordPress Easy WP SMTP zero-day potentially exposes hundreds of thousands of sites to hack

cyware Dec 14, 2020 Malware and Vulnerabilities

The zero-day vulnerability affects WP SMTP 1.4.2 and earlier versions, it resides in a feature that creates debug logs for all emails sent by the site and store them in the installation folder.

US Treasury and Commerce Departments Targeted by Using SolarWinds Software Backdoor

cyware Dec 14, 2020 Breaches and Incidents

The motive and the full scope of what intelligence was compromised remains unclear, but signs are that adversaries tampered with a software update released by Texas-based IT infrastructure provider SolarWinds.

AI Processor Firm Habana Labs Suffers Pay2Key Ransomware Attack and Data Theft

cyware Dec 14, 2020 Breaches and Incidents

The ransomware operators leaked stolen data, including Windows domain account information, DNS zone information for the domain, and a file listing from its Gerrit development code review system.

Steam vulnerabilities allowed remote take over of users’ computers

cyware Dec 14, 2020 Malware and Vulnerabilities

CheckPoint identified several critical vulnerabilities (CVE-2020-6016 through CVE-2020-6019) in Steam that would allow attackers to hack and take over hundreds of thousands of computers remotely.

Facebook Takedown Infrastructure of Hacker Groups

cyware Dec 14, 2020 Threat Actors

The operation from Bangladesh primarily focused on compromising the integrity of accounts across the social media platform and had targeted local activists, journalists, and religious minorities.

PgMiner botnet attacks weakly secured PostgreSQL databases

cyware Dec 14, 2020 Malware and Vulnerabilities

Security researchers have discovered this week a botnet operation that targets PostgreSQL databases to install a cryptocurrency miner. It targets web-tech for monetary profits.

Russia had nothing to do with suspected U.S. Treasury email snooping, says Kremlin

cyware Dec 14, 2020 Geopolitical, Terrorism

People familiar with the matter told Reuters the hackers were believed to be working for Russia and that they feared the hacks uncovered so far may be the tip of the iceberg.

Third-party online assets a growing security risk for retailers

cyware Dec 14, 2020 Trends, Reports, Analysis

83% of the top U.S. retailers have connections to a vulnerable third-party asset, and 43% have vulnerabilities that pose an immediate cybersecurity risk, Cyberpion reveals.

How Apple sweats the security details—and sometimes gets it wrong

cyware Dec 14, 2020 Expert Blogs and Opinion

Just this past week, it was announced that the Cupertino-based company had teamed up with web infrastructure and security company Cloudflare to help develop a more secure method for DNS requests.

Hacking group’s new malware abuses Google and Facebook services

cyware Dec 14, 2020 Malware and Vulnerabilities

The Molerats threat actor used in its recent operations two new backdoors - called SharpStage and DropBook, and one previously undocumented malware downloader named MoleNet.

Hacked Software Firm SolarWinds' Clients Include Ford, Microsoft, AT&T

cyware Dec 14, 2020 Breaches and Incidents

A probe into the purported "nation-state" hack is ongoing, spearheaded by the FBI and the Cybersecurity and Infrastructure Security Agency (CISA), after Reuters reported on Sunday.

Spotify security vulnerability exposed personal data to business partners

cyware Dec 14, 2020 Breaches and Incidents

In a breach notification filed with California’s Attorney General on December 9, Spotify said it found the flaw on November 12, but “estimate[s] that this vulnerability existed as of April 9, 2020”.

PyMICROPSIA: New Information-Stealing Trojan from AridViper

cyware Dec 14, 2020 Malware and Vulnerabilities

Unit 42 researchers have been tracking the threat group AridViper, which has been targeting the Middle Eastern region, and identified a new information stealer with relations to the MICROPSIA malware.

Googles Gives a New Perspective to Web Security Threats via XS-Leaks

cyware Dec 14, 2020 Security Products & Services

Google has announced the launch of a knowledge base called XS-Leaks to help web browser developers and security engineers prepare defense mechanisms against rising side-channel threats.

Cyber Threats Crawling Across Manufacturing Organizations

cyware Dec 14, 2020 Trends, Reports, Analysis

Manufacturers are increasingly being targeted not just by traditional malicious actors such as unorganized cybercriminals, but by competing companies and nations engaged in corporate espionage.

This New Zero-Click Cross-platform Flaw in Microsoft Teams Could Spread Like a Worm

cyware Dec 14, 2020 Malware and Vulnerabilities

Security researchers have uncovered a critical flaw in Microsoft Teams that could allow an attacker to access confidential conversations and files from the communications service.

Cyberattacks on the Rise for Digital Media and Entertainment Organizations

cyware Dec 14, 2020 Trends, Reports, Analysis

Cybercrime against digital media and entertainment organizations is on the rise. Hackers formulate new and innovative ways to defeat security measures and controls to pilfer sensitive data.

PLEASE_READ_ME Ransomware Campaign Targeting MySQL Servers

cyware Dec 14, 2020 Malware and Vulnerabilities

Guardicore first spotted the attack back in January 2020. After that, it witnessed a total of 92 attacks emanate from 11 IP addresses, with most based in Ireland and the UK at the time of analysis.

Office 365 users put on alert about critical bugs with SharePoint, here's how to fix it

cyware Dec 14, 2020 Malware and Vulnerabilities

The two critical remote code execution flaws in SharePoint are classified as CVE-2020-17121 and CVE-2020-17118, with the latter can be exploited remotely without any authentication.

Text messages promising $1,200 stimulus checks are actually scams, IRS warns

cyware Dec 14, 2020 Identity Theft, Fraud, Scams

Scammers are sending texts promising a $1,200 stimulus check. The IRS and a coalition of state tax agencies and tax industry officials are warning individuals who receive such messages not to respond.

SolarWinds Releases Security Advisory on Supply Chain Attack

cyware Dec 14, 2020 Malware and Vulnerabilities

SolarWinds confirmed a highly sophisticated, manual supply chain attack on SolarWinds Orion Platform software builds for versions 2019.4 HF 5 through 2020.2.1, released between March and June 2020.

Cisco re-patches wormable Jabber RCE flaw

cyware Dec 14, 2020 Malware and Vulnerabilities

Of these, the first one is the most critical and received a CVSS score of 9.9, as it can be used by an unauthenticated attacker to achieve RCE, requires no user interaction, and is wormable.

CISA Published Emergency Directive on SolarWinds Orion Code Compromise

cyware Dec 14, 2020 Threat Intel & Info Sharing

SolarWinds Orion products (affected versions are 2019.4 through 2020.2.1 HF1) are currently being exploited by malicious actors. This tactic permits an attacker to gain access to network traffic management systems.

SolarWinds Supply Chain Attack Compromised Multiple Global Victims With SUNBURST Backdoor

cyware Dec 14, 2020 Threat Intel & Info Sharing

The attacker’s post-compromise activity leverages multiple techniques to evade detection and obscure their activity, but these efforts also offer some opportunities for detection.

Suspected Russian Hackers Spied On U.S. Treasury Emails

packetstormsecurity Dec 14, 2020 headline,hacker,government,email,usa,rus

Microsoft, FireEye Confirm SolarWinds Supply Chain Attck

packetstormsecurity Dec 14, 2020 headline,hacker,microsoft,flaw,cyberwar

Zodiac Killer Cipher Is Cracked After Eluding Sleuths For 51 Years

packetstormsecurity Dec 14, 2020 headline