Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for How scammers steal c ...

 News

The best way to avoid falling for scams is to always think critically, even skeptically. What would you do, say, if someone sent you a DM on Twitter with the login credentials for some cryptocurrency account asking for help to withdraw money from it? The right thing to do would be to ignore the message. But maybe,   show more ...  

just maybe, its for real? What if this is your chance to get rich? Together lets take a look at what doesnt smell right and list all the red flags, especially since Kaspersky experts recently discovered a spam campaign of this type. First, lets take a look at a screenshot of the message: Great news. Youre rich! But hang on a sec A stranger on Twitter sends you the credentials supposedly for the account of a certain Adam on some cryptocurrency platform that they say holds a six-figure amount. The sender apparently needs your help to withdraw this amount. Surprisingly, if you go to the site and enter the credentials, you will be taken to an actual personal account containing the amount specified or thereabouts. But we havent yet sniffed out the fraud. While we were logging in to the site, Adam just got $90,000 richer. Think critically and look for red flags Lets start with the basics: if you had a few hundred thousand dollars, would you ask a complete stranger to help manage it? No? And no one else in their right mind would! This reasoning alone is enough to consign the message (and all other 419 fraud spam) to the trash can. But our task is to investigate all the red flags, so lets find a reason to carry on: suppose circumstances have indeed forced a complete stranger to seek help and their choice has landed on you. What else looks out of place? What a popular account our mystery benefactor has! First, lets get to know the anonymous do-gooder a bit better. Their Twitter account has precisely zero followers, and they follow the exact same number of other accounts: another clear red flag, since the whole point of creating a social media account is to communicate and follow others. Second, our counterparty is not sociable: we tried sending them messages, but got no response for a week. Thats also a red flag, indicating that the message is a mass mailing, which means that tens, hundreds, even thousands of people were sent the same username and password. How many of them do you think already tried to log in? Third, a reddish flag this one, the username and password suggest the user is called Adam (Adams password, incidentally, is rather weak), while the Twitter handle the message came from has nothing to do with any Adam. Is it that our counterparty wants to get us to empty a hijacked cryptocurrency account and make us a partner in crime?! (Actually there is no cryptocurrency at all in this account, but more about that later.) Lastly, experts will spot another red flag — a space in the URL of the site where the cryptocurrency is supposedly located. This is how scammers try to bypass security in the e-mail account where you are notified about a new message on Twitter. After you actually go to the site, the red flags pop up one after another: the design is simple and slapdash, and googling the domain name serves up only results about scams. A real, even little-known cryptocurrency exchange would surely have some reviews in media or on forums. This one has none, which screams the word fake. And thats even before we get to the killer red flag, exposing the whole essence of the scam. Paying to withdraw cryptocurrency It turns out that in order to withdraw funds outside the platform, one more password is required: a so-called Trade key, which no one gave us. But it is possible to transfer money within the platform itself, for which you need to create a new account with VIP status and fill it up with Adams money. That done, well be able to withdraw it without a hitch, because we have all the necessary passwords, right? Feel like a Very Idiotic Person To get VIP status, you need to deposit some money to the new account by giving your cryptocurrency wallet details. When you do, therell be nothing to withdraw anyway, while your own wallet will be bled dry using the credentials kindly provided by you. The platform itself is just a phishing site, with no whiff of cryptocurrency. In the recent campaign, scammers set up several such sites and sent out login details to various Twitter accounts. As for the cryptocurrency platform, there are two suspicious signs. First, cryptocurrency is never sent by the give-us-your-wallet-details method; rather you receive a payment address to send the required amount to from your wallet interface. Second, no financial platform worthy of the name would ask you to use third-party funds for handling money already on it. Charge a transfer fee, be our guest, but demand payment using one card to withdraw money from another? Thats downright weird. And we havent even mentioned the bad English and crooked layout — the ever-present hallmarks of phishing sites. How to avoid phishing nets So as not to fall victim, you need to understand how scammers work and be able to spot all the inconsistencies. To that end, we have identified all the red flags in the above cryptoscam. Questions to ask yourself when confronted with any juicy offer are: Why is a complete stranger asking me for help and not someone they know? Could it be a bot? Isnt it odd that they dont reply? Does the message look suspicious (for example, in the domain name mentioned theres a space for fooling mail filters)? What sort of site am I being asked to visit? What are people saying about it online? Do its design and interface inspire trust (sure, half of all websites dont, but you dont use them for sending money, right)? Does it seem logical what youre being asked to do? Is it normal to have to pay using third-party funds to perform transactions with money already on the platform? Am I being hurried so that I would let my guard down? Does it sound too good to be true? By taking a deep breath and answering them to yourself, you will better understand what is going on and not lose your head over the thought of easy money that seems so close. The abundance of red flags in this case clearly indicates youre dealing with scammers. But even just one should be enough to alert you. Even if such a message came not from a random user, but from a friend, you should still be vigilant: who knows, maybe your friend was hacked? Sadly, scammers thrive due to the fact that even vigilant people are human, and sometimes swallow well-crafted bait. So its better to adopt a belt-and-braces approach and use a reliable security solution that spots suspicious links and blocks access to fraudulent sites. And be sure to read our blog post about how to protect yourself from phishing — a very useful skill that will guard against a variety of troubles.

image for Microsoft Patch Tues ...

 Latest Warnings

Microsoft today released updates to fix nearly 100 security flaws in its Windows operating systems and other software. Highlights from the first Patch Tuesday of 2023 include a zero-day vulnerability in Windows, printer software flaws reported by the U.S. National Security Agency, and a critical Microsoft SharePoint   show more ...  

Server bug that allows a remote, unauthenticated attacker to make an anonymous connection. At least 11 of the patches released today are rated “Critical” by Microsoft, meaning they could be exploited by malware or malcontents to seize remote control over vulnerable Windows systems with little or no help from users. Of particular concern for organizations running Microsoft SharePoint Server is CVE-2023-21743. This is a critical, security bypass flaw that could allow a remote, unauthenticated attacker to make an anonymous connection to a vulnerable SharePoint server. Microsoft says this flaw is “more likely to be exploited” at some point. But patching this bug may not be as simple as deploying Microsoft updates. Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, said sysadmins need to take additional measures to be fully protected from this vulnerability. “To fully resolve this bug, you must also trigger a SharePoint upgrade action that’s also included in this update,” Childs said. “Full details on how to do this are in the bulletin. Situations like this are why people who scream ‘Just patch it!’ show they have never actually had to patch an enterprise in the real world.” Eighty-seven of the vulnerabilities earned Redmond’s slightly less dire “Important” severity rating. That designation describes vulnerabilities “whose exploitation could result in compromise of the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources.” Among the more Important bugs this month is CVE-2023-21674, which is an “elevation of privilege” weakness in most supported versions of Windows that has already been abused in active attacks. Satnam Narang, senior staff research engineer at Tenable, said although details about the flaw were not available at the time Microsoft published its advisory on Patch Tuesday, it appears this was likely chained together with a vulnerability in a Chromium-based browser such as Google Chrome or Microsoft Edge in order to break out of a browser’s sandbox and gain full system access. “Vulnerabilities like CVE-2023-21674 are typically the work of advanced persistent threat (APT) groups as part of targeted attacks,” Narang said. “The likelihood of future widespread exploitation of an exploit chain like this is limited due to auto-update functionality used to patch browsers.” By the way, when was the last time you completely closed out your Web browser and restarted it? Some browsers will automatically download and install new security updates, the protection from those updates usually only happens after you restart the browser. Speaking of APT groups, the U.S. National Security Agency is credited with reporting CVE-2023-21678, which is another “important” vulnerability in the Windows Print Spooler software. There have been so many vulnerabilities patched in Microsoft’s printing software over the past year (including the dastardly PrintNightmare attacks and borked patches) that KrebsOnSecurity has joked about Patch Tuesday reports being sponsored by Print Spooler. Tenable’s Narang points out that this is the third Print Spooler flaw the NSA has reported in the last year. Kevin Breen at Immersive Labs called special attention to CVE-2023-21563, which is a security feature bypass in BitLocker, the data and disk encryption technology built into enterprise versions of Windows. “For organizations that have remote users, or users that travel, this vulnerability may be of interest,” Breen said. “We rely on BitLocker and full-disk encryption tools to keep our files and data safe in the event a laptop or device is stolen. While information is light, this appears to suggest that it could be possible for an attacker to bypass this protection and gain access to the underlying operating system and its contents. If security teams are not able to apply this patch, one potential mitigation could be to ensure Remote Device Management is deployed with the ability to remotely disable and wipe assets.” There are also two Microsoft Exchange vulnerabilities patched this month — CVE-2023-21762 and CVE-2023-21745. Given the rapidity with which threat actors exploit new Exchange bugs to steal corporate email and infiltrate vulnerable systems, organizations using Exchange should patch immediately. Microsoft’s advisory says these Exchange flaws are indeed “more likely to be exploited.” Adobe released four patches addressing 29 flaws in Adobe Acrobat and Reader, InDesign, InCopy, and Adobe Dimension. The update for Reader fixes 15 bugs with eight of these being ranked Critical in severity (allowing arbitrary code execution if an affected system opened a specially crafted file). For a more granular rundown on the updates released today, see the SANS Internet Storm Center roundup. Nearly 100 updates is a lot, and there are bound to be a few patches that cause problems for organizations and end users. When that happens, AskWoody.com usually has the lowdown. Please consider backing up your data and/or imaging your system before applying any updates. And please sound off in the comments if you experience any problems as a result of these patches.

image for CES Overlooks New Re ...

 authentication

Automakers swear that the security of their connected vehicles is their top priority. So how come researchers just found dozens of software flaws that could give hackers access to millions of cars? The post CES Overlooks New Report That Finds Auto Cyber Is A Dumpster Fire appeared first on The Security Ledger with   show more ...  

Paul F. Roberts. Related StoriesEpisode 241: If Its Smart, Its Vulnerable a Conversation with Mikko HyppönenEpisode 241: If Its Smart, Its Vulnerable a Conversation wit Mikko HyppönenDEF CON DOOM Patrol: Deere Jailbreak Raises Questions on Security, Competition

image for New Report Finds Aut ...

 authentication

Automakers swear that the security of their connected vehicles is their top priority. So how come researchers just found dozens of software flaws that could give hackers access to millions of cars? The post New Report Finds Auto Cyber Is A Dumpster Fire appeared first on The Security Ledger with Paul F. Roberts.   show more ...  

Related StoriesEpisode 241: If Its Smart, Its Vulnerable a Conversation with Mikko HyppönenEpisode 241: If Its Smart, Its Vulnerable a Conversation wit Mikko HyppönenDEF CON DOOM Patrol: Deere Jailbreak Raises Questions on Security, Competition

 Security Products & Services

Initially introduced in 2011, SSE-S3 handles both encryption and decryption, along with key management. An opt-in feature until now, SSE-S3 relies on Advanced Encryption Standard (AES) encryption with 256-bit keys managed by AWS.

 Threat Actors

The Turla threat actor group, mostly associated with Russian intelligence, was observed gaining access to victim networks by registering the expired domains of about decade-old malware infrastructure. Turla has been using advanced tactics, including victim profiling, to tailor its exploitation efforts to target specific information of interest to Russia.

 Identity Theft, Fraud, Scams

Cybercriminals are targeting Pokemon NFT enthusiasts via a couple of Pokemon-based NFT card game sites that can lead to the compromise of victims' devices. How? The fake site pushes the NetSupport remote access tool on users’ devices. Security analysts at ASEC observed the first signs of this campaign in December 2022.

 Breaches and Incidents

As if colonoscopies weren't invasive enough, nearly a quarter-million patients who underwent an intestinal probe since 2019 now must grapple with a data breach tied to a hacking incident at a third-party vendor to gastroenterologists.

 Breaches and Incidents

It was found that the Russian hacking group Callisto, aka Cold River), targeted the Argonne, Brookhaven, and Lawrence Livermore National Laboratories between August and September 2022. The group attempted to create fake login pages for the three labs and sent phishing emails with links to these pages to trick nuclear scientists into revealing their passwords.

 Trends, Reports, Analysis

In November 2011, the FBI-led Operation Ghost Click raided malicious servers run by the Rove Digital cyber group. This was only after it had used the DNSChanger Trojan to infect over four million computers and generate $14 million in illicit profits.

 Incident Response, Learnings

Meta Platforms has agreed to pay $725 million to settle a long-running lawsuit that allowed third parties, including Cambridge Analytica, to access users’ personal information without their consent for political advertising.

 Trends, Reports, Analysis

Triple Data Encryption Algorithm is used widely across many industries and in many popular network protocols to encrypt data at rest and data in motion. NIST deprecated the algorithm in 2018, however, and Triple DES use will be disallowed after 2023.

 Malware and Vulnerabilities

The StrongPity group has been found using a fake website since 2021 that impersonates the actual Shagle site to trick victims into downloading a malicious Android. Once installed, this app enables hackers to conduct espionage on the targeted victims.

 Malware and Vulnerabilities

Security researcher Abdulraheem Khaled has discovered a coding scheme that can allow attackers to perform prototype pollution-like attacks on Python programs. He calls it ‘class pollution’ in a blog post documenting his findings.

 Feed

Ubuntu Security Notice 5797-1 - Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

 Feed

Red Hat Security Advisory 2023-0032-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.10.47. Issues addressed include a bypass vulnerability.

 Feed

Red Hat Security Advisory 2023-0050-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include a denial of service vulnerability.

 Feed

Ubuntu Security Notice 5796-1 - It was discovered that w3m incorrectly handled certain HTML files. A remote attacker could use this issue to cause w3m to crash, resulting in a denial of service, or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5793-2 - It was discovered that the io_uring subsystem in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. It was   show more ...  

discovered that a race condition existed in the Android Binder IPC subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5795-1 - It was discovered that Net-SNMP incorrectly handled certain requests. A remote attacker could possibly use these issues to cause Net-SNMP to crash, resulting in a denial of service.

 Feed

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek has successfully bridged   show more ...  

the traditional gap between academia and operations since its inception. Today, it is relied upon operationally in particular by many scientific environments for securing their cyber-infrastructure. Zeek's user community includes major universities, research labs, supercomputing centers, and open-science communities. This is the source code release.

 Feed

Red Hat Security Advisory 2023-0045-01 - Virtual Network Computing is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Issues addressed include out of bounds access and use-after-free vulnerabilities.

 Feed

The Mali driver tries to use the KBASE_REG_NO_USER_FREE flag to ensure that the memory region referenced by kbase_csf_tiler_heap::buf_desc_reg cannot be freed by userspace. However, this flag is only a single bit, and there can be multiple tiler heaps referencing the same memory region. This can lead to a use-after-free condition.

 Feed

Red Hat Security Advisory 2023-0049-01 - The grub2 packages provide version 2 of the Grand Unified Boot Loader, a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Issues addressed include buffer overflow, bypass, and out of bounds write vulnerabilities.

 Feed

Ubuntu Security Notice 5782-3 - USN-5782-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. It was discovered that Firefox was using an out-of-date libusrsctp library. An attacker could possibly use this library to perform a reentrancy issue on Firefox.   show more ...  

Nika Layzell discovered that Firefox was not performing a check on paste received from cross-processes. An attacker could potentially exploit this to obtain sensitive information. Pete Freitag discovered that Firefox did not implement the unsafe-hashes CSP directive. An attacker who was able to inject markup into a page otherwise protected by a Content Security Policy may have been able to inject an executable script. Matthias Zoellner discovered that Firefox was not keeping the filename ending intact when using the drag-and-drop event. An attacker could possibly use this issue to add a file with a malicious extension, leading to execute arbitrary code. Hafiizh discovered that Firefox was not handling fullscreen notifications when the browser window goes into fullscreen mode. An attacker could possibly use this issue to spoof the user and obtain sensitive information. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code.

 Feed

Ubuntu Security Notice 5792-2 - Mingwei Zhang discovered that the KVM implementation for AMD processors in the Linux kernel did not properly handle cache coherency with Secure Encrypted Virtualization. A local attacker could possibly use this to cause a denial of service. It was discovered that a race condition   show more ...  

existed in the Android Binder IPC subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5791-2 - It was discovered that a race condition existed in the Android Binder IPC subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. David Leadbeater discovered that the   show more ...  

netfilter IRC protocol tracking implementation in the Linux Kernel incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this to cause a denial of service or bypass firewall filtering.

 Feed

Red Hat Security Advisory 2023-0046-01 - X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Issues addressed include out of bounds access and use-after-free vulnerabilities.

 Feed

nVisium's cloud and application security experts join NetSPI to support, scale, and deliver the most comprehensive suite of offensive security solutions.

 Feed

A high-severity security flaw has been disclosed in the open source jsonwebtoken (JWT) library that, if successfully exploited, could lead to remote code execution on a target server. "By exploiting this vulnerability, attackers could achieve remote code execution (RCE) on a server verifying a maliciously crafted JSON web token (JWT) request," Palo Alto Networks Unit 42 researcher Artur Oleyarsh

 Feed

A comprehensive analysis of the cryptographic protocols used in the Swiss encrypted messaging application Threema has revealed a number of loopholes that could be exploited to break authentication protections and even recover users' private keys. The seven attacks span three different threat models, according to ETH Zurich researchers Kenneth G. Paterson, Matteo Scarlata, and Kien Tuong Truong,

 Feed

A new malware campaign has been observed targeting Italy with phishing emails designed to deploy an information stealer on compromised Windows systems. "The info-stealer malware steals sensitive information like system info, crypto wallet and browser histories, cookies, and credentials of crypto wallets from victim machines," Uptycs security researcher Karthickkumar Kathiresan said in a report.

 Feed

The advanced persistent threat (APT) group known as StrongPity has targeted Android users with a trojanized version of the Telegram app through a fake website that impersonates a video chat service called Shagle. "A copycat website, mimicking the Shagle service, is used to distribute StrongPity's mobile   show more ...  

backdoor app," ESET malware researcher Lukáš Štefanko said in a technical report. "The app is

2023-01
Aggregator history
Tuesday, January 10
SUN
MON
TUE
WED
THU
FRI
SAT
JanuaryFebruaryMarch