Oktacron - Cyber Security RSS Feeds History

What is NoReboot and how to protect yourself from such an attack | Kaspersky official blog

kaspersky Jan 10, 2022 Threats

To be absolutely sure your phone isnt tracking you or listening in on any conversations, you might turn it off. It seems logical; that way, even if the phone is infected with serious spyware, it cant do anything. In addition, turning off or restarting a smartphone is one of the most reliable ways to fight such show more ...

infections; in many cases, spyware lives only until the next reboot because it cannot gain a permanent foothold in the operating system. At the same time, the vulnerabilities that allow malware to work even after a reboot are rare and expensive to exploit. However, this tactic might not work forever. Researchers have come up with a technique to bypass it using a method they have named NoReboot. In essence, this attack is a fake restart. What is NoReboot, and how does the attack work? We want to note right off the bat that NoReboot is not a feature of any real spyware in use by attackers; rather, its a so-called proof of concept that researchers demonstrated under laboratory conditions. At this point it is hard to say whether the method will actually gain traction. For the demonstration, the researchers used an iPhone they infected beforehand. Unfortunately, they havent shared the technical details. Heres what happens in the demonstration: The spy malware, which transfers the image from the camera, runs on the iPhone; The user tries to shut off the phone the usual way, using the power and volume buttons; The malware takes control and shows a perfect fake instead of the standard iOS shutdown screen; After the user drags the power-off slider, which also looks perfectly normal, the smartphones screen goes dark and the phone no longer responds to any of the users actions; When the user presses the power button again, the malware displays a perfect replica of the iOS boot animation. During the entire process, the phone is continually transferring the image from the phones front camera to another device without the users knowledge. As is often the case, seeing is believing, and we recommend checking out the researchers video: How to protect yourself against NoReboot Again, at least for now NoReboot is only a demonstration of the feasibility of an attack. The attack is alarming, to be sure, but dont forget that malware needs to get onto a smartphone before it can do any damage. Here are some tips to help you prevent that from happening: Keep in mind that its much harder for attackers to infect a smartphone remotely than if they have physical access to it. Be careful not to let someone else get hold of your smartphone — especially for a long period of time — and install a reliable device lock. People most often install malware on their smartphones on their own, voluntarily. Be careful about what you download and avoid installing unnecessary apps — that is, those you can easily live without — as a general rule. Dont root or jailbreak your smartphone (at least if you havent been using *nix systems for many years). Superuser rights make malwares work exponentially easier. If you have an Android device, we recommend installing an antivirus solution — to block Trojans from penetrating the system. Let your smartphone die a natural death from time to time — that is, wait for the charge to run out completely. The phone will then most certainly restart without any fakes, and theres an excellent chance that spies will disappear from the system. You can speed up the process by using a resource-hungry app, such as a game or benchmark-test utility.

Phishing Kit Victim Workflow and Data Exflitration

cyware Jan 10, 2022 Trends, Reports, Analysis

Phishing designed to obtain credentials for retail brands or markets can contain very different stages compared to phishing designed to obtain online banking or credit card information from victims.

Patchwork APT Hackers Score Own Goal in Recent Malware Attacks

cyware Jan 10, 2022 Threat Actors

Researchers have shed light on the tactics, techniques, and procedures embraced by an Indian-origin hacking group called Patchwork as part of a renewed campaign that commenced in late November 2021.

Cerberus Sentinel announces acquisition of True Digital Security

cyware Jan 10, 2022 Companies to Watch

Cerberus Cyber Sentinel Corporation, a cybersecurity consulting and managed services firm, announced that it has acquired True Digital Security, a cybersecurity operations and compliance company.

Trojanized dnSpy app drops malware cocktail on researchers, devs

cyware Jan 10, 2022 Malware and Vulnerabilities

dnSpy is a popular debugger and .NET assembly editor used to debug, modify, and decompile .NET programs. Cybersecurity researchers commonly use this program when analyzing .NET malware and software.

US Cyber Command partners with universities to prepare graduates for military cyber roles

cyware Jan 10, 2022 Govt., Critical Infrastructure

US Cyber Command plans to work with these academic institutions in the next nine months in order to prepare an adequate curriculum for the next educational year this fall.

iProov raises $70 million to fuel businesss growth

cyware Jan 10, 2022 Companies to Watch

Headquartered in Silicon Valley, Sumeru invests in technology firms with the potential to change the world, with a particular emphasis on helping companies expand in North America.

City of Grass Valley Suffers Data Breach Impacting Employee and Citizen Information

cyware Jan 10, 2022 Breaches and Incidents

More details concerning an extensive data breach at the City of Grass Valley, California, revealed that the data of employees, citizens, and others was copied and transferred to another network.

Buffer overflow vulnerability spotted in AnyCubic Chitubox plugin

cyware Jan 10, 2022 Malware and Vulnerabilities

Cisco Talos recently discovered a heap-based buffer overflow flaw in the Chitubox AnyCubic plugin, which is an 3-D printing software for users to download, process, and send models to a 3-D printer.

Patient Data from Bangkok's Siriraj Hospital Sold on Online Forum

cyware Jan 10, 2022 Breaches and Incidents

About 39 million patient records from Siriraj Hospital have been offered for sale on an internet database-sharing forum in what appears to be the latest hack of Thailand's public health sector.

Abcbot Botnet Linked to Operators of Xanthe Cryptomining malware

cyware Jan 10, 2022 Malware and Vulnerabilities

New research into the infrastructure behind an emerging DDoS botnet named Abcbot has uncovered links with a cryptocurrency-mining botnet attack that came to light in December 2020.

Zloader Campaign Abuses Microsoft's Security Checks

cyware Jan 10, 2022 Malware and Vulnerabilities

The Malsmoke hacking group attacked over 2,100 victims worldwide in a new Zloader campaign by abusing a bug in Microsoft’s e-signature verification tool. Though it couldn't be confirmed, experts believe the group uses spear-phishing emails or pirated software resources to infect victims. Such attacks seem to be highly targeted in nature and may cause severe damage.

Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries

cyware Jan 10, 2022 Malware and Vulnerabilities

A study of 16 different URL parsing libraries has unearthed inconsistencies and confusions that could be exploited to bypass validations and open the door to a wide range of attack vectors.

GCHQ Rebuked For Ignoring Spy Law Safeguards As Pandemic Hit Britain

packetstormsecurity Jan 10, 2022 headline,government,britain,spyware,scie

Abcbot Botnet Is Linked To Xanthe Cryptojacking Group

packetstormsecurity Jan 10, 2022 headline,hacker,malware,cybercrime,botne

China Puts Walmart In The Naughty Corner Over 19 Vulnerabilities

packetstormsecurity Jan 10, 2022 headline,government,china,flaw