Oktacron - Cyber Security RSS Feeds History

LofyLife: malicious packages in npm repository | Kaspersky official blog

kaspersky Jul 29, 2022 Business

Open-source code is a blessing for the IT industry — it helps programmers save time and build products faster and more efficiently by eliminating the need of writing repetitive common code. To facilitate this knowledge sharing, there are repositories — open platforms where any developer can publish their own show more ...

packages with their code to speed up the development process for other people. Such repositories serve countless needs of the IT community and are widely used in development of basically any modern software: web app, mobile app, smart appliance, robot, you name it. Most popular packages get millions of weekly downloads and are at the foundation of many applications, from pet projects to well-known tech startups. By some estimates 97% of code in modern web applications comes from npm modules. However, their popularity and openness in uploading any packages inevitably attracts cybercriminals. For example, in 2021 unknown attackers compromised several versions of a popular JavaScript library, UAParser.js, by injecting malicious code. This library was downloaded 6 to 8 million times every week. By infecting it, cybercriminals were able to mine cryptocurrency and steal confidential information such as browser cookies, passwords and operating system credentials from infected devices. And heres more recent example: on July 26, 2022, our researchers discovered a new threat that appeared in the open-source npm repository that they dubbed LofyLife. So what is LofyLife? Using an internal automated system for monitoring open-source repositories, our researchers identified a malicious campaign LofyLife. The campaign employed four malicious packages spreading Volt Stealer and Lofy Stealer malware in the npm repository to gather various information from victims, including Discord tokens and linked credit card information, and to spy on them over time. The identified malicious packages appeared to be used for ordinary tasks such as formatting headlines or certain gaming functions. The descriptions of the packages were incomplete and overall it looks like the attackers did not put too much effort into them. Yet, the formatting headlines package was in Brazilian Portuguese with a #brazil hashtag, which points to the attackers looking to target users based in Brazil. Other packages were presented in English, so they could be targeting users from other countries. Description of one of the infected packages called proc-title (Translation from Portuguese: This package correctly capitalizes your titles as per the Chicago manual of style) These packages, however, contained highly obfuscated malicious JavaScript and Python code. This made them harder to analyze when being uploaded to the repository. The malicious payload consisted of malware written in Python dubbed Volt Stealer — an open-source malicious script, and a JavaScript malware dubbed Lofy Stealer, which has numerous features. Volt Stealer was used to steal Discord tokens from the infected machines along with the victims IP address, and upload them via HTTP. The Lofy Stealer, a new development from the attackers, is able to infect Discord client files and monitor the victims actions — detecting when a user logs in, changes registered e-mail or password, enables or disables multi-factor authentication and adds new payment methods (in which case it steals full credit card details). It uploads collected information to the remote endpoint. How to protect from malicious packages Open-source repositories allow anyone to publish their own packages, and not all of them are completely secure. For example, attackers can impersonate popular npm packages by changing one or two letters in the name to fool the user into thinking they are downloading the genuine package. Therefore, we recommend to be on guard and not to treat packages as trusted. In general, development or build environments are convenient targets for attackers trying to organize supply chain attacks. That means such environments urgently require strong antimalware protection such as Kaspersky Hybrid Cloud Security. Our products successfully detect LofyLife attack with verdicts HEUR:Trojan.Script.Lofy.gen and Trojan.Python.Lofy.a. If you want to be among the first to know about new malicious campaigns spreading via open-source code, subscribe to threat intelligence feeds and reports, such as the ones provided via Threat Intelligence Portal.

911 Proxy Service Implodes After Disclosing Breach

krebsonsecurity Jul 29, 2022 A Little Sunshine

The 911 service as it existed until July 28, 2022. 911[.]re, a proxy service that since 2015 has sold access to hundreds of thousands of Microsoft Windows computers daily, announced this week that it is shutting down in the wake of a data breach that destroyed key components of its business operations. The abrupt show more ...

closure comes ten days after KrebsOnSecurity published an in-depth look at 911 and its connections to shady pay-per-install affiliate programs that secretly bundled 911’s proxy software with other titles, including “free” utilities and pirated software. 911[.]re is was one of the original “residential proxy” networks, which allow someone to rent a residential IP address to use as a relay for his/her Internet communications, providing anonymity and the advantage of being perceived as a residential user surfing the web. Residential proxy services are often marketed to people seeking the ability to evade country-specific blocking by the major movie and media streaming providers. But some of them — like 911 — build their networks in part by offering “free VPN” or “free proxy” services that are powered by software which turns the user’s PC into a traffic relay for other users. In this scenario, users indeed get to use a free VPN service, but they are often unaware that doing so will turn their computer into a proxy that lets others use their Internet address to transact online. From a website’s perspective, the IP traffic of a residential proxy network user appears to originate from the rented residential IP address, not from the proxy service customer. These services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they can make it difficult to trace malicious traffic to its original source. As noted in KrebsOnSecurity’s July 19 story on 911, the proxy service operated multiple pay-per-install schemes that paid affiliates to surreptitiously bundle the proxy software with other software, continuously generating a steady stream of new proxies for the service. A cached copy of flashupdate[.]net circa 2016, which shows it was the homepage of a pay-per-install affiliate program that incentivized the silent installation of 911’s proxy software. Within hours of that story, 911 posted a notice at the top of its site, saying, “We are reviewing our network and adding a series of security measures to prevent misuse of our services. Proxy balance top-up and new user registration are closed. We are reviewing every existing user, to ensure their usage is legit and [in] compliance with our Terms of Service.” At this announcement, all hell broke loose on various cybercrime forums, where many longtime 911 customers reported they were unable to use the service. Others affected by the outage said it seemed 911 was trying to implement some sort of “know your customer” rules — that maybe 911 was just trying to weed out those customers using the service for high volumes of cybercriminal activity. Then on July 28, the 911 website began redirecting to a notice saying, “We regret to inform you that we permanently shut down 911 and all its services on July 28th.” According to 911, the service was hacked in early July, and it was discovered that someone manipulated the balances of a large number of user accounts. 911 said the intruders abused an application programming interface (API) that handles the topping up of accounts when users make financial deposits with the service. “Not sure how did the hacker get in,” the 911 message reads. “Therefore, we urgently shut down the recharge system, new user registration, and an investigation started.” The parting message from 911 to its users, posted to the homepage July 28, 2022. However the intruders got in, 911 said, they managed to also overwrite critical 911[.]re servers, data and backups of that data. “On July 28th, a large number of users reported that they could not log in the system,” the statement continues. “We found that the data on the server was maliciously damaged by the hacker, resulting in the loss of data and backups. Its [sic] confirmed that the recharge system was also hacked the same way. We were forced to make this difficult decision due to the loss of important data that made the service unrecoverable.” Operated largely out of China, 911 was an enormously popular service across many cybercrime forums, and it became something akin to critical infrastructure for this community after two of 911’s longtime competitors — malware-based proxy services VIP72 and LuxSocks — closed their doors in the past year. Now, many on the crime forums who relied on 911 for their operations are wondering aloud whether there are any alternatives that match the scale and utility that 911 offered. The consensus seems to be a resounding “no.” I’m guessing we may soon learn more about the security incidents that caused 911 to implode. And perhaps other proxy services will spring up to meet what appears to be a burgeoning demand for such services at the moment, with comparatively little supply. In the meantime, 911’s absence may coincide with a measurable (if only short-lived) reprieve in unwanted traffic to top Internet destinations, including banks, retailers and cryptocurrency platforms, as many former customers of the proxy service scramble to make alternative arrangements. Riley Kilmer, co-founder of the proxy-tracking service Spur.us, said 911’s network will be difficult to replicate in the short run. “My speculation is [911’s remaining competitors] are going to get a major boost in the short term, but a new player will eventually come along,” Kilmer said. “None of those are good replacements for LuxSocks or 911. However, they will all allow anyone to use them. For fraud rates, the attempts will continue but through these replacement services which should be easier to monitor and stop. 911 had some very clean IP addresses.”

Threat Actors Exploit Zero-day in PrestaShop

cyware Jul 29, 2022 Breaches and Incidents

Researchers discovered a zero-day vulnerability affecting older versions of PrestaShop websites. The bug can be exploited to harvest customers’ payment information. After the attack, the remote attackers erase their traces that stops the site owner from knowing that they were breached. Experts suggest disabling the MySQL Smarty cache storage features until a patch is issued.

CosmicStrand Malware Found on ASUS and Gigabyte Motherboards

cyware Jul 29, 2022 Malware and Vulnerabilities

Kaspersky observed a UEFI rootkit malware, dubbed CosmicStrand, on machines with ASUS and Gigabyte motherboards. CosmicStrand has a lengthy, intricate execution chain to infect Windows machines with a kernel-mode implant while remaining undetected and persist in a system as long as feasible.

Keys to LockBit's Success: Self-Promotion, Technical Acumen

cyware Jul 29, 2022 Threat Actors

When the Conti ransomware brand imploded earlier this year, the big question was who would seize its position and become the world's worst - or best, depending on perspective - criminal encryption gang. One clear winner has emerged: LockBit.

Idaho-based St. Luke's Health System Discloses Vendor Data Breach Affecting Thousands of Customers

cyware Jul 29, 2022 Breaches and Incidents

St. Luke’s said the breach happened in late May, and impacted customers billed in that same month. The vendor discovered the breach in June and informed St. Luke’s on July 6th.

How DDoSecrets built the go-to home for Russian leaks

cyware Jul 29, 2022 Trends, Reports, Analysis

It has distributed hacked and leaked data from more than 200 entities, including U.S. law enforcement agencies, fascist groups, shell companies, tax havens, and the far-right social media sites Gab and Parler.

Ransomware Group Demands Around $608,000 From UK's Wooton Upper School

cyware Jul 29, 2022 Breaches and Incidents

The attack, said to be the work of the Hive ransomware group, also affected Kimberley college for 16-19-year-olds. Both Wooton Upper School and Kimberley college are part of the Wootton Academy Trust.

IBM 2022 Report: Cost of a Data Breach at an All-Time High

cyware Jul 29, 2022 Trends, Reports, Analysis

IBM’s Cost of a Data Breach report revealed that the total cost of a data breach is $4.35 million, a 13% increase since 2020. Stolen credentials are responsible for 19% of all breaches, followed by phishing at 16%. However, the share of organizations deploying zero-trust has grown from 35% in 2021 to 41% in 2022.

Latest Critical Atlassian Confluence Vulnerability Under Active Exploitation

cyware Jul 29, 2022 Malware and Vulnerabilities

The bug in question is CVE-2022-26138, which concerns the use of a hard-coded password in the app that could be exploited by a remote, unauthenticated attacker to gain unrestricted access to all pages in Confluence.

City of Detroit retirees data breach causes concern

cyware Jul 29, 2022 Breaches and Incidents

There is a new warning about an alleged data breach affecting some City of Detroit retirees. Personal information, including Social Security Numbers, appears to have been exposed online.

22 million US health records breached thus far in 2022

cyware Jul 29, 2022 Trends, Reports, Analysis

A new report by GlobalData estimates that up to 22 million US health records have been breached so far in 2022. The healthcare industry is often a prime target of ransomware attacks as they store valuable and confidential data on their customers.

Akamai blocked the largest DDoS attack ever on its European customers

cyware Jul 29, 2022 Breaches and Incidents

An Akamai customer in Eastern Europe was targeted 75 times in a month with multiple types of DDoS attacks, including UDP, UDP fragmentation, ICMP flood, RESET flood, SYN flood, TCP anomaly, TCP fragment, PSH ACK flood, FIN push flood, and PUSH flood.

Billion-record Chinese data leak's host booms

cyware Jul 29, 2022 Trends, Reports, Analysis

The popularity of stolen data bazaar BreachForums surged after it was used to sell a giant database of stolen information describing Chinese citizens, threat intelligence firm Cybersixgill said on Thursday.

U.S. Justice Department Probing Cyber Breach of Federal Court Records System

cyware Jul 29, 2022 Breaches and Incidents

The U.S. Justice Department is investigating a cyber breach involving the federal court records management system, the department's top national security attorney told lawmakers on Thursday.

Microsoft SQL Servers Hacked to Steal Bandwidth for Proxy Services

cyware Jul 29, 2022 Trends, Reports, Analysis

The attackers receive compensation for the bandwidth by setting their email address for the user, while the victims might only notice some connectivity slowdowns and hiccups.

US Expands Cybersecurity Partnership With Ukraine

cyware Jul 29, 2022 Geopolitical, Terrorism

The US Cybersecurity and Infrastructure Security Agency (CISA) announced yesterday that it had signed a Memorandum of Cooperation (MoC) with the Ukrainian State Service of Special Communications and Information Protection of Ukraine (SSSCIP).

New HiddenAds Malware Affects Over One Million Users and Hides on the Google Play Store

cyware Jul 29, 2022 Malware and Vulnerabilities

This malware uses the Contact Provider. The Contact Provider is the source of data you see in the device’s contacts application, and you can also access its data in your own application and transfer data between the device and online services.

Mirroring Actual Landing Pages for Convincing Credential Harvesting

cyware Jul 29, 2022 Identity Theft, Fraud, Scams

It is incredibly clever since it matches the login page that the end-user is accustomed to seeing. It adds a Google reCAPTCHA form to boost legitimacy and get past automated scanners.

This phishing attack uses a countdown clock to panic you into handing over passwords

cyware Jul 29, 2022 Identity Theft, Fraud, Scams

A sneaky new phishing attack attempts to manipulate victims into entering their username and password by claiming their account will be deleted if they don't - and it uses a countdown timer to pile on the pressure.

OneTouchPoint Discloses Data Breach Impacting Over 30 Healthcare Firms

cyware Jul 29, 2022 Breaches and Incidents

In a data breach notice on its website, OneTouchPoint lists 34 healthcare insurance carriers and healthcare services providers that have been impacted, but the number appears to be larger.

Microsoft experts linked the Raspberry Robin malware to Evil Corp operation

cyware Jul 29, 2022 Threat Actors

The malware uses cmd.exe to read and execute a file stored on the infected external drive, it leverages msiexec.exe for external network communication to a rogue domain used as C2 to download and install a DLL library file.

XSS vulnerabilities in Google Cloud, Google Play could lead to account hijacks

cyware Jul 29, 2022 Malware and Vulnerabilities

A pair of vulnerabilities in Google Cloud, DevSite, and Google Play could have allowed attackers to achieve cross-site scripting (XSS) attacks, opening the door to account hijacks.

Ransom payments fall as fewer victims choose to pay hackers

cyware Jul 29, 2022 Trends, Reports, Analysis

Ransomware statistics from the second quarter of the year show that the ransoms paid to extortionists have dropped in value, a trend that continues since the last quarter of 2021.

Dahua IP Camera Vulnerability Could Let Attackers Take Full Control Over Devices

cyware Jul 29, 2022 Malware and Vulnerabilities

Details have been shared about a security vulnerability in Dahua's Open Network Video Interface Forum (ONVIF) standard implementation, which, when exploited, can lead to seizing control of IP cameras.

US Court System Suffered Incredibly Significant Attack - Sealed Files At Risk

packetstormsecurity Jul 29, 2022 headline,hacker,government,usa,data loss

BreachForums Booms On The Back Of Billion Record Chinese Data Leak

packetstormsecurity Jul 29, 2022 headline,hacker,government,privacy,china

JPMorgan, UBS Among Trio Accused Of Shoddy ID Theft Protection

packetstormsecurity Jul 29, 2022 headline,government,privacy,bank,usa,cyb

Threat Actors Pivot Around Microsoft's Macro-Blocking In Office

packetstormsecurity Jul 29, 2022 headline,hacker,malware,microsoft,flaw