Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for CVE-2021-26084: Conf ...

 Business

At the end of August, Atlassian, the company behind such tools as Jira, Confluence, and Hipchat, announced the release of an update to fix the CVE-2021-26084 vulnerability in its corporate wiki tool, Confluence. Since then, security experts have seen widespread searches for vulnerable Confluence servers and active   show more ...  

exploitation attempts. We recommend all Confluence Server administrators update as soon as possible. What is CVE-2021-26084? CVE-2021-26084 is a vulnerability in Confluence. It originates from the use of Object-Graph Navigation Language (OGNL) in Confluence’s tag system. The vulnerability permits the injection of OGNL code and thus execution of arbitrary code on computers with Confluence Server or Confluence Data Center installed. In some cases, even a user who is not authenticated can exploit the vulnerability (if the option Allow people to sign up to create their account is active). Atlassian considers this vulnerability critical. It has a 9.8 CVSS severity rating, and several proof-of-concepts for exploiting it, including a version that permits remote code execution (RCE), are already available online. Which versions of Confluence are vulnerable? The situation is a bit complicated. Atlassian’s clients use different versions of Confluence and are not known for performing timely updates. According to Atlassian’s  official description, the company has released updates for versions 6.13.23, 7.4.11, 7.11.6, 7.12.5, and 7.13.0. That leaves CVE-2021-26084 exploitable on Confluence Server versions preceding 6.13.23, from 6.14.0 to 7.4.11, from 7.5.0 to 7.11.6, and from 7.12.0 to 7.12.5. This vulnerability does not affect Confluence Cloud users. How to stay safe Atlassian recommends using the newest Confluence version, which is 7.13.0. If that is not an option, users of 6.13.x versions are advised to update to 6.13.23; 7.4.x to 7.4.11, 7.11.x to 7.11.6, and 7.12.x to 7.12.5, respectively. The company also offers several temporary workarounds for Linux-based and Microsoft Windows–based solutions, for those who cannot accomplish even those incremental updates. Machines running Confluence are endpoints, just like any other server. And just like any other server, they need a good security solution to make running arbitrary code significantly harder. Also, keep in mind that exploiting the vulnerability remotely would require attackers to get into the company’s network, and experts with Managed Detection and Response–class services can detect that kind of suspicious activity. It’s also worth noting that access to Confluence should be restricted — no one outside the company should have access to internal company services.

image for How to protect a sma ...

 Products

Smart speakers, autonomous vacuum cleaners, and all sorts of other smart home devices are becoming ever more affordable, and home networks are now capable of hosting dozens of such gadgets. On the one hand, it’s convenient and tech-progressive. On the other hand, the more connected devices in the home, the   show more ...  

greater the risk owners face. Having hacked a weak link such as a smart vacuum cleaner or even a fish tank, an attacker can steal confidential data from a computer or smartphone — anything connected to the same network. Fears and dangers In the past five years, the number of IoT-related cyberthreats has increased by a factor of 70(!) and continues to grow. That’s not surprising given that smart devices are easy targets for cybercriminals. In fact, 76% of IoT gadgets communicate over unencrypted channels, according to a recent Zscaler report; and last year, Israeli cybersecurity company JSOF discovered 19 zero-day vulnerabilities, some of them critical, in a TCP/IP library millions of IoT devices use to communicate with the Internet. We can see another aspect of the problem in the young and rapidly growing connected-device industry, where some vendors take little responsibility for updating firmware. Even the more responsible vendors tend to stop updating their products early on, leaving smart gadgets prone to hacking, as in the case of Western Digital’s My Book Live NAS, for example. A Kaspersky study showed that 89% of IoT device owners have security concerns. Here are the most common fears: A hacked device will infect the entire home network; Cybercriminals will lock a gadget and demand ransom; Attackers will spy through a camera or microphone; A device will malfunction and become bricked. Unfortunately, their fears are well-founded. If you think you are too small a fish to become a target, think again: Cybercriminals often carry out mass attacks, hacking hundreds of thousands of devices indiscriminately. How to protect your smart home The best way to prevent hackers from accessing IoT devices is to install protection on the home router — that is, between the Internet and connected gadgets. Router-level protection helps by intercepting threats before they get inside the home network. That’s precisely how our new solution for smart homes, Kaspersky Smart Home Security, works. It runs on the home router, and users can manage it through the mobile app. Broadly, here’s what the solution can do. Detect vulnerable network ports Many IoT device developers leave network ports open for connection, and attackers can then exploit those openings to take control of a device. On detecting an open port that poses a risk, Kaspersky Smart Home Security notifies the user and blocks all unauthorized connection attempts. Protect against brute-force attacks IoT devices are often subjected to brute-force attacks. Using specialized search engines, cybercriminals select gadgets with protocols available for connection and automatically brute-force common usernames and passwords. A careful search will always yield a baby monitor or camera whose vendors have set a crackable password. Kaspersky Smart Home Security monitors unsuccessful connection attempts, and if someone tries to access a device several times in a row, the solution temporarily blocks any further attempts to connect to it. Block dangerous links and downloads Kaspersky Smart Home Security blocks attempts to download malware to users’ routers and immediately notifies them about the attack. If a device has been hacked and is trying to connect to a malicious website, Kaspersky Smart Home Security prevents it from doing so. (Rest assured, your smart toaster will not be coopted for a DDoS attack or your speaker used as a surveillance tool.) Check password strength Password security relies on users having long, complex, and unique passwords — a tricky set of requirements. In the case of IoT devices, vendors often underestimate the threat and set short, weak passwords. Cybercriminals are well aware of this tendency, so after every password leak they use compromised credentials to hack IoT devices. Kaspersky Smart Home Security promptly warns users about unsafe passwords and does not permit the use of leaked credentials. Restrict Internet use Digital parenting just became a whole lot easier. Users can now create a schedule to manage children’s home Internet use on tablets, TVs, and other smart device, as well as restrict access to unwanted resources. How to connect Kaspersky Smart Home Security Installing a security solution (or any software) on a router is technically challenging. For this reason, and because most users buy or lease home routers from their Internet service providers anyway, we decided to distribute Kaspersky Smart Home Security through ISPs. If you are interested in the solution, contact your ISP and ask if they offer Kaspersky Smart Home Security. If you happen to represent an ISP, we invite you to join us in making smart homes safer. Please write to us at vas@kaspersky.com with any questions.

image for “FudCo” Spam Emp ...

 A Little Sunshine

In May 2015, KrebsOnSecurity briefly profiled “The Manipulaters,” the name chosen by a prolific cybercrime group based in Pakistan that was very publicly selling spam tools and a range of services for crafting, hosting and deploying malicious email. Six years later, a review of the social media postings   show more ...  

from this group shows they are prospering, while rather poorly hiding their activities behind a software development firm in Lahore that has secretly enabled an entire generation of spammers and scammers. The Web site in 2015 for the “Manipulaters Team,” a group of Pakistani hackers behind the dark web identity “Saim Raza,” who sells spam and malware tools and services. The Manipulaters’ core brand in the underground is a shared cybercriminal identity named “Saim Raza,” who for the past decade across dozens of cybercrime sites and forums has peddled a popular spamming and phishing service variously called “Fudtools,” “Fudpage,” “Fudsender,” etc. The common acronym in nearly all of Saim Raza’s domains over the years — “FUD” — stands for “Fully Un-Detectable,” and it refers to cybercrime resources that will evade detection by security tools like antivirus software or anti-spam appliances. One of several current Fudtools sites run by The Manipulaters. The current website for Saim Raza’s Fud Tools (above) offers phishing templates or “scam pages” for a variety of popular online sites like Office365 and Dropbox. They also sell “Doc Exploit” products that bundle malicious software with innocuous Microsoft Office documents; “scampage hosting” for phishing sites; a variety of spam blasting tools like HeartSender; and software designed to help spammers route their malicious email through compromised sites, accounts and services in the cloud. For years leading up to 2015, “admin@manipulaters.com” was the name on the registration records for thousands of scam domains that spoofed some of the world’s top banks and brand names, but particularly Apple and Microsoft. When confronted about this, The Manipulaters founder Madih-ullah Riaz replied, “We do not deliberately host or allow any phishing or any other abusive website. Regarding phishing, whenever we receive complaint, we remove the services immediately. Also we are running business since 2006.” The IT network of The Manipulaters, circa 2013. Image: Facebook Two years later, KrebsOnSecurity received an email from Riaz asking to have his name and that of his business partner removed from the 2015 story, saying it had hurt his company’s ability to maintain stable hosting for their stable of domains. “We run web hosting business and due to your post we got very serious problems especially no data center was accepting us,” Riaz wrote in a May 2017 email. “I can see you post on hard time criminals we are not criminals, at least it was not in our knowledge.” Riaz said the problem was his company’s billing system erroneously used The Manipulators’ name and contact information instead of its clients in WHOIS registration records. That oversight, he said, caused many researchers to erroneously attribute to them activity that was coming from just a few bad customers. “We work hard to earn money and it is my request, 2 years of my name in your wonderful article is enough punishment and we learned from our mistakes,” he concluded. The Manipulaters have indeed learned a few new tricks, but keeping their underground operations air-gapped from their real-life identities is mercifully not one of them. ZERO OPERATIONAL SECURITY Phishing domain names registered to The Manipulaters included an address in Karachi, with the phone number 923218912562. That same phone number is shared in the WHOIS records for 4,000+ domains registered through domainprovider[.]work, a domain controlled by The Manipulaters that appears to be a reseller of another domain name provider. One of Saim Raza’s many ads in the cybercrime underground for his Fudtools service promotes the domain fudpage[.]com, and the WHOIS records for that domain share the same Karachi phone number. Fudpage’s WHOIS records list the contact as “admin@apexgrand.com,” which is another email address used by The Manipulaters to register domains. As I noted in 2015, The Manipulaters Team used domain name service (DNS) settings from another blatantly fraudulent service called ‘FreshSpamTools[.]eu,’ which was offered by a fellow Pakistani who also conveniently sold phishing toolkits targeting a number of big banks. The WHOIS records for FreshSpamTools briefly list the email address bilal.waddaich@gmail.com, which corresponds to the email address for a Facebook account of a Bilal “Sunny” Ahmad Warraich (a.k.a. Bilal Waddaich). Bilal Waddaich’s current Facebook profile photo includes many current and former employees of We Code Solutions. Warraich’s Facebook profile says he works as an IT support specialist at a software development company in Lahore called We Code Solutions. The We Code Solutions website. A review of the hosting records for the company’s website wecodesolutions[.]pk show that over the past three years it has shared a server with just a handful of other domains, including: -saimraza[.]tools -fud[.]tools -heartsender[.]net -fudspampage[.]com -fudteam[.]com -autoshopscript[.]com -wecodebilling[.]com -antibotspanel[.]com -sellonline[.]tools FUD CO The profile image atop Warraich’s Facebook page is a group photo of current and former We Code Solutions employees. Helpfully, many of the faces in that photo have been tagged and associated with their respective Facebook profiles. For example, the Facebook profile of Burhan Ul Haq, a.k.a. “Burhan Shaxx” says he works in human relations and IT support for We Code Solutions. Scanning through Ul Haq’s endless selfies on Facebook, it’s impossible to ignore a series of photos featuring various birthday cakes and the words “Fud Co” written in icing on top. Burhan Ul Haq’s photos show many Fud Co-themed cakes the We Code Solutions employees enjoyed on the anniversary of the Manipulaters Team. Yes, from a review of the Facebook postings of We Code Solutions employees, it appears that for at least the last five years this group has celebrated an anniversary every May with a Fud Co cake, non-alcoholic sparkling wine, and a Fud Co party or group dinner. Let’s take a closer look at that delicious cake: The head of We Code Solutions appears to be a guy named Rameez Shahzad, the older individual at the center of the group photo in Warraich’s Facebook profile. You can tell Shahzad is the boss because he is at the center of virtually every group photo he and other We Code Solutions employees posted to their respective Facebook pages. We Code Solutions boss Rameez Shahzad (in sunglasses) is in the center of this group photo, which was posted by employee Burhan Ul Haq, pictured just to the right of Shahzad. Shahzad’s postings on Facebook are even more revelatory: On Aug. 3, 2018, he posted a screenshot of someone logged into a WordPress site under the username Saim Raza — the same identity that’s been pimping Fud Co spam tools for close to a decade now. “After [a] long time, Mailwizz ready,” Shahzad wrote as a caption to the photo: We Code Solutions boss Rameez Shahzad posted on Facebook a screenshot of someone logged into a WordPress site with the username Saim Raza, the same cybercriminal identity that has peddled the FudTools spam empire for more than 10 years. Whoever controlled the Saim Raza cybercriminal identity had a penchant for re-using the same password (“lovertears”) across dozens of Saim Raza email addresses. One of Saim Raza’s favorite email address variations was “game.changer@[pick ISP here]”. Another email address advertised by Saim Raza was “bluebtcus@gmail.com.” So it was not surprising to see Rameez Shahzad post a screenshot to his Facebook account of his computer desktop, which shows he is logged into a Skype account that begins with the name “game.” and a Gmail account beginning with “bluebtc.” Image: Scylla Intel KrebsOnSecurity attempted to reach We Code Solutions via the contact email address on its website — info@wecodesolutions[.]pk — but the message bounced back, saying there was no such address. Similarly, a call to the Lahore phone number listed on the website produced an automated message saying the number is not in service. None of the We Code Solutions employees contacted directly via email or phone responded to requests for comment. FAIL BY NUMBERS This open-source research on The Manipulaters and We Code Solutions is damning enough. But the real icing on the Fud Co cake is that sometime in 2019, The Manipulaters failed to renew their core domain name — manipulaters[.]com — the same one tied to so many of the company’s past and current business operations. That domain was quickly scooped up by Scylla Intel, a cyber intelligence firm that specializes in connecting cybercriminals to their real-life identities. Whoops. Scylla co-founder Sasha Angus said the messages that flooded their inbox once they set up an email server on that domain quickly filled in many of the details they didn’t already have about The Manipulaters. “We know the principals, their actual identities, where they are, where they hang out,” Angus said. “I’d say we have several thousand exhibits that we could put into evidence potentially. We have them six ways to Sunday as being the guys behind this Saim Raza spammer identity on the forums.” Angus said he and a fellow researcher briefed U.S. prosecutors in 2019 about their findings on The Manipulaters, and that investigators expressed interest but also seemed overwhelmed by the volume of evidence that would need to be collected and preserved about this group’s activities. “I think one of the things the investigators found challenging about this case was not who did what, but just how much bad stuff they’ve done over the years,” Angus said. “With these guys, you keep going down this rabbit hole that never ends because there’s always more, and it’s fairly astonishing. They are prolific. If they had halfway decent operational security, they could have been really successful. But thankfully, they don’t.”

image for Episode 225: Unpacki ...

 Azure

We’re joined by Nir Ohfeld of Wiz. Nir helped discover the recent CHAOS DB flaw in Azure COSMOS DB, the flagship database for Microsoft’s Azure cloud platform. The post Episode 225: Unpacking the Azure CHAOS DB Flaw with Nir Ohrfeld of Wiz appeared first on The Security Ledger with Paul F. Roberts. Related   show more ...  

StoriesEpisode 224: Engineering Trust In The Cyber Executive OrderEncore Podcast: Chris Valasek on Hacking The Jeep CherokeeEncore Podcast: Is Autonomous Driving Heading for a Crash?

image for Episode 225: Unpacki ...

 Azure

We’re joined by Nir Ohfeld of Wiz. Nir helped discover the recent CHAOS DB flaw in Azure COSMOS DB, the flagship database for Microsoft’s Azure cloud platform. The post Episode 225: Unpacking the Azure CHAOS DB Flaw with Nir Ohfeld of Wiz appeared first on The Security Ledger with Paul F. Roberts. Related   show more ...  

StoriesEpisode 224: Engineering Trust In The Cyber Executive OrderEncore Podcast: Chris Valasek on Hacking The Jeep CherokeeEncore Podcast: Is Autonomous Driving Heading for a Crash?

 Malware and Vulnerabilities

Kaspersky provided a detailed technical analysis of QakBot, a decade-old Trojan that is active since 2007. It also underlines the stats of victims. In the first seven months of this year, Kaspersky spotted 181,869 attempts to download or execute QakBot. Experts say one must track its activities and ensure the right security measures are in place across different endpoints.

 Trends, Reports, Analysis

According to NCC Group's report, the number of ransomware attacks analyzed has increased by 288% between January-March 2021 and April-June 2021, with organizations continuing to face waves of digital extortion in the form of targeted ransomware.

 Breaches and Incidents

The bank was hit by AVOS Locker Ransomware operators who claim to have stolen sensitive documents from the financial institution. The ransomware gang added the bank to its leak site and published some screenshots as proof of the hack.

 Threat Intel & Info Sharing

Hackers purchase access to a victim's network on dark web marketplaces and from other threat actors. Analyzing their want ads makes it possible to get an inside look at the types of companies ransomware operations are targeting for attacks.

 Threat Actors

Gardaí have seized the cyberinfrastructure used by the cyber gang involved in the HSE cyber attack earlier this year. The operation is believed to have prevented more than 750 ransomware attacks, the Irish Times has reported.

 Feed

End-to-end encrypted email service provider ProtonMail has drawn criticism after it ceded to a legal request and shared the IP address of anti-gentrification activists with law enforcement authorities, leading to their arrests in France. The Switzerland-based company said it received a "legally binding order from the Swiss Federal Department of Justice" related to a collective called Youth for

 Feed

An ongoing campaign has been found to leverage a network of websites acting as a "dropper as a service" to deliver a bundle of malware payloads to victims looking for "cracked" versions of popular business and consumer applications. "These malware included an assortment of click fraud bots, other information stealers, and even ransomware," researchers from cybersecurity firm Sophos said in a

 Feed

Networking, storage and security solutions provider Netgear on Friday issued patches to address three security vulnerabilities affecting its smart switches that could be abused by an adversary to gain full control of a vulnerable device. The flaws, which were discovered and reported to Netgear by Google security engineer Gynvael Coldwind, impact the following models - GC108P (fixed in firmware

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Recorded Future. Thanks to the great team there for their support! Predict 21 is the virtual event where intelligence analysts, network defenders, and cybersecurity executives will join together to discuss the constantly expanding cyber threat   show more ...  

landscape, and the importance of intelligence in proactive … Continue reading "Save your free seat for Recorded Future Predict 21: The intelligence summit"

2021-09
Aggregator history
Monday, September 06
WED
THU
FRI
SAT
SUN
MON
TUE
SeptemberOctoberNovember