Oktacron - Cyber Security RSS Feeds History

Review and analysis of fake Trezor cryptowallet | Kaspersky official blog

kaspersky May 10, 2023 Threats

Easy to steal and cash out, ?ryptocurrency is one of the most attractive digital assets for attackers. Accordingly, serious investors often use hardware cryptowallets to protect their crypto-investments. Such a wallet stores private keys away from vulnerable computers and smartphones and makes it much safer to sign show more ...

transactions. But unfortunately, owning a hardware wallet doesnt guarantee the safety of your funds, as one of our clients has learned the hard way. Hack symptoms Attackers worked stealthily: on a fateful day in the transaction history of a cryptowallet there appeared an operation in which a large sum of money was transferred to someone else. However, no transactions were performed on that day by the victim at all. Moreover, the cryptowallet wasnt even plugged into a computer! Aaand… Its gone! Dissecting the wallet The victim had purchased the rather popular hardware wallet Trezor Model T. It uses fully open-source code — both software and hardware-wise — and is based on the popular STM32F427 microcontroller. The Trezor Model T vendor has undertaken a wide range security measures that, in theory, should reliably protect the device from attackers. Both the box and the unit housing are sealed with holographic stickers, the microcontroller is in flash memory read-out protection mode (RDP 2). The bootloader checks the digital signature of the firmware and, if an anomaly is detected, displays an unoriginal firmware message and deletes all the data in the wallet. Accessing the device and confirming transactions require a PIN code that — even though it doesnt protect the master access key (a base for generating the mnemonic seed phrase) — is used to encrypt the storage where its kept. Optionally, in addition to the PIN, you can protect your master access key with a password as per the BIP-39 standard. Do not use me, I am unsafe! (Source) At first cursory glance, the wallet we examined appeared to be exactly the same as a genuine one, and showed no signs of tampering. The unit was bought from a trusted seller through a popular classifieds website, and the holographic stickers on the box and the wallet itself were all present and undamaged. When started-up in update mode, the wallet displayed firmware version 2.4.3 and bootloader version 2.0.4. Fake wallet update mode screen When handling the wallet, nothing felt suspicious either: all the functions worked as they should, and the user interface was no different from the original one. However, mindful of the theft that had occurred via it, we delved deeper. And thats where our interesting discoveries began. Right off the bat, we found that the vendor had never released bootloader version 2.0.4. The project change history at GitHub concisely states that this version was skipped due to fake devices. After such an intriguing statement, we just had to reach for the scalpel and begin our dissection, of course… What on earth is version 2.0.4? The housing was difficult to open: its two halves were held together with liberal quantities of glue and double-sided adhesive tape instead of the ultrasonic bonding used on factory-made Trezors. Even more curiously, inside there was an entirely different microcontroller showing traces of soldering! Instead of the original STM32F427, the unit had an STM32F429 with fully deactivated microcontroller flash-memory read-out protection mechanisms (RDP 0 instead of RDP 2 in genuine Trezors). It looked perfectly genuine from the outside; however… (left — original, right — fake) Thus, the fake cryptowallet theory was proved true: it was a classic supply-chain attack in which an unsuspecting victim buys an already-hacked device. But the actual cryptocurrency stealing mechanism was still unclear Trojan firmware We wont repeat the commonplace truths about cryptowallets that we covered earlier, but weve just one little reminder for you: a cryptowallet contains your private key, and whoever knows that key can sign any transaction and spend your money. The fact that the attackers were able to conduct a transaction while the offline wallet was stashed in its owners strongbox means that they either copied the private key after it was generated, or… they knew it all along! Thanks to the deactivated flash-memory read-out protection, which our attackers decided not to turn on after the new microcontroller was soldered in, we easily extracted the wallet firmware and, by reconstructing its code, discovered that the attackers indeed knew the private key in advance. But how? The original bootloader and wallet firmware received only three modifications: First, the bootloader-checks for protection mechanisms and digital signatures were removed, thus getting rid of the red screen problem during the firmware originality check at startup. Second, at the initialization stage or when resetting the wallet, the randomly generated seed phrase was replaced with one of 20 pre-generated seed phrases saved in the hacked firmware. The owner would begin using it instead of a new and unique one. Third, if the user chose to set an additional master-seed protection password, only its first symbol (a…z, A…Z, 0…9 or ! for any special character) was used, which, together with the no-password option, gave just 64 possible combinations. Thus, to crack a given fake wallet, only 64*20=1280 variants were to be considered. The fake cryptowallet would operate as normal, but the attackers had full control over it from the very beginning. According to the transaction history, they were in no hurry, waiting a whole month after the wallet was credited for the first time before they grabbed the money. The owner had no protection whatsoever: the game was lost from the very moment the money first arrived in the Trojan wallet. How to prevent the fake device threat Its not easy to tell a fake cryptowallet from a real one without special knowledge and experience. The main safeguard is to buy your wallet directly from the official vendor and choose models with special versions of protected microcontrollers (even original Trezors arent ideal in this sense: there are other brands wallets with better protected chips and extra protection mechanisms). It should be remembered that even an authentic and unmodified wallet can be vulnerable to a number of threats. The priority measures include the use of a password (if supported by your wallet), and, of course, protection for all computers and smartphones.

Microsoft Patch Tuesday, May 2023 Edition

krebsonsecurity May 10, 2023 Time to Patch

Microsoft today released software updates to fix at least four dozen security holes in its Windows operating systems and other software, including patches for two zero-day vulnerabilities that are already being exploited in active attacks. First up in May’s zero-day flaws is CVE-2023-29336, which is an show more ...

“elevation of privilege” weakness in Windows which has a low attack complexity, requires low privileges, and no user interaction. However, as the SANS Internet Storm Center points out, the attack vector for this bug is local. “Local Privilege escalation vulnerabilities are a key part of attackers’ objectives,” said Kevin Breen, director of cyber threat research at Immersive Labs. “Once they gain initial access they will seek administrative or SYSTEM-level permissions. This can allow the attacker to disable security tooling and deploy more attacker tools like Mimikatz that lets them move across the network and gain persistence.” The zero-day patch that has received the most attention so far is CVE-2023-24932, which is a Secure Boot Security Feature Bypass flaw that is being actively exploited by “bootkit” malware known as “BlackLotus.” A bootkit is dangerous because it allows the attacker to load malicious software before the operating system even starts up. According to Microsoft’s advisory, an attacker would need physical access or administrative rights to a target device, and could then install an affected boot policy. Microsoft gives this flaw a CVSS score of just 6.7, rating it as “Important.” Adam Barnett, lead software engineer at Rapid7, said CVE-2023-24932 deserves a considerably higher threat score. “Microsoft warns that an attacker who already has Administrator access to an unpatched asset could exploit CVE-2023-24932 without necessarily having physical access,” Barnett said. “Therefore, the relatively low CVSSv3 base score of 6.7 isn’t necessarily a reliable metric in this case.” Barnett said Microsoft has provided a supplementary guidance article specifically calling out the threat posed by BlackLotus malware, which loads ahead of the operating system on compromised assets, and provides attackers with an array of powerful evasion, persistence, and Command & Control (C2) techniques, including deploying malicious kernel drivers, and disabling Microsoft Defender or Bitlocker. “Administrators should be aware that additional actions are required beyond simply applying the patches,” Barnett advised. “The patch enables the configuration options necessary for protection, but administrators must apply changes to UEFI config after patching. The attack surface is not limited to physical assets, either; Windows assets running on some VMs, including Azure assets with Secure Boot enabled, also require these extra remediation steps for protection. Rapid7 has noted in the past that enabling Secure Boot is a foundational protection against driver-based attacks. Defenders ignore this vulnerability at their peril.” In addition to the two zero-days fixed this month, Microsoft also patched five remote code execution (RCE) flaws in Windows, two of which have notably high CVSS scores. CVE-2023-24941 affects the Windows Network File System, and can be exploited over the network by making an unauthenticated, specially crafted request. Microsoft’s advisory also includes mitigation advice. The CVSS for this vulnerability is 9.8 – the highest of all the flaws addressed this month. Meanwhile, CVE-2023-28283 is a critical bug in the Windows Lightweight Directory Access Protocol (LDAP) that allows an unauthenticated attacker to execute malicious code on the vulnerable device. The CVSS for this vulnerability is 8.1, but Microsoft says exploiting the flaw may be tricky and unreliable for attackers. Another vulnerability patched this month that was disclosed publicly before today (but not yet seen exploited in the wild) is CVE-2023-29325, a weakness in Microsoft Outlook and Explorer that can be exploited by attackers to remotely install malware. Microsoft says this vulnerability can be exploited merely by viewing a specially-crafted email in the Outlook Preview Pane. “To help protect against this vulnerability, we recommend users read email messages in plain text format,” Microsoft’s writeup on CVE-2023-29325 advises. “If an attacker were able to exploit this vulnerability, they would gain remote access to the victim’s account, where they could deploy additional malware,” Immersive’s Breen said. “This kind of exploit will be highly sought after by e-crime and ransomware groups where, if successfully weaponized, could be used to target hundreds of organizations with very little effort.” For more details on the updates released today, check out roundups by Action1, Automox and Qualys, If today’s updates cause any stability or usability issues in Windows, AskWoody.com will likely have the lowdown on that. Please consider backing up your data and/or imaging your system before applying any updates. And feel free to sound off in the comments if you experience any problems as a result of these patches.

The surveys speak: supply chain threats are freaking people out

securityledger May 10, 2023 application development

A bunch of recent surveys of IT and security pros send a clear message: threats and risks from vulnerable software supply chains are real, and they’re starting to freak people out. The post The surveys speak: supply chain threats are freaking people out appeared first on The Security Ledger with Paul F. Roberts. show more ...

Related StoriesForget the IoT. Meet the IoZ: our Internet of Zombie thingsEpisode 249: Intel Federal CTO Steve Orrin on the CHIPS Act and Supply Chain SecurityIoCs vs. EoCs: What’s the difference and why should you care?

RapperBot Crew Drops DDoS/CryptoJacking Botnet Collab

darkreading May 10, 2023 Feed

Cryptomining is a logical partner for an existing IoT-focused DDoS botnet, so the RapperBot authors customized XMRig to make it happen.

New Startup SquareX Targets Brower-Based Attacks

darkreading May 10, 2023 Feed

SquareX runs headless browsers in data centers on the user's behalf so that threats never reach the user's machine.

Free Tool Unlocks Some Encrypted Data in Ransomware Attacks

darkreading May 10, 2023 Feed

"White Phoenix" automated tool for recovering data on partially encrypted files hit with ransomware is available on GitHub.

Leak of Intel Boot Guard Keys Could Have Security Repercussions for Years

darkreading May 10, 2023 Feed

While Intel is still investigating the incident, the security industry is bracing itself for years of potential firmware insecurity if the keys indeed were exposed.

Microsoft Fixes Failed Patch for Exploited Outlook Vulnerability

darkreading May 10, 2023 Feed

Adding a single character to a function in the previous Outlook patch rendered that fix useless, researchers say.

The Industrywide Consequences of Making Security Products Inaccessible

darkreading May 10, 2023 Feed

Accessibility won't solve all of the industry's problems, but it can help tackle a few.

Dark Reading Goes Global

darkreading May 10, 2023 Feed

While the goal of the site's new DR Global section is to expand international coverage, the initial focus will be cybersecurity professionals in the Middle East and Africa.

Sysco Data Breach Exposes Customer, Employee Data

darkreading May 10, 2023 Feed

Food distribution company first learned of the cyberattack in March 2023.

Infamous Twitter Hacker Cops to Cybercrimes, Extradited to US for Trial

darkreading May 10, 2023 Feed

Confessed cybercriminal hijacked Twitter, TikTok, and Snapchat accounts; defrauded victims; and more.

New Linux kernel NetFilter flaw gives attackers root privileges

cyware May 10, 2023 Malware and Vulnerabilities

The security problem stems from Netfilter nf_tables accepting invalid updates to its configuration, allowing specific scenarios where invalid batch requests lead to the corruption of the subsystem's internal state.

Microsoft Patch Tuesday for May 2023 fixed two actively exploited zero-day flaws

cyware May 10, 2023 Malware and Vulnerabilities

The flaws addressed by these Patch Tuesday updates affect Microsoft Windows and Windows Components; Office and Office Components; Microsoft Edge (Chromium-based); SharePoint Server; Visual Studio; SysInternals; and Microsoft Teams.

SideCopy Breaches Indian Organizations with Action and AllaKore RATs

cyware May 10, 2023 Breaches and Incidents

Pakistani cyberespionage group, SideCopy APT, was found targeting employees at India’s Defence Research and Development Organization (DRDO), to pilfer confidential military secrets. Instead of using CACTUSTORCH to deploy code obfuscated via JavaScript and VBScript, SideCopy's latest campaign appears to have utilized SILENTTRINITY,

RapperBot DDoS Botnet Expands into Cryptojacking

cyware May 10, 2023 Malware and Vulnerabilities

FortiGuard Labs has encountered new samples of the RapperBot campaign active since January 2023. RapperBot is a malware family primarily targeting IoT devices. It has been observed in the wild since June 2022.

Threat Assessment: Royal Ransomware

cyware May 10, 2023 Malware and Vulnerabilities

It is suspected that this group is made up mainly of former members of the Conti ransomware group, who operate covertly and behind closed doors. The ex-members that formed this group are known as Team One.

56,000+ cloud-based apps at risk of malware exfiltration

cyware May 10, 2023 Trends, Reports, Analysis

The technology sector had the highest number of malware-infected employees, the most exposed corporate credentials, and the majority of all stolen cookies, according to SpyCloud.

FBI-led Operation Medusa kills Russian FSB malware network

cyware May 10, 2023 Incident Response, Learnings

The FBI has sabotaged a suite of malicious software used by elite Russian spies, U.S. authorities said on Tuesday, providing a glimpse of the digital tug-of-war between two cyber superpowers.

Kubernetes Bill of Materials (KBOM) open-source tool enhances cloud security response to CVEs

cyware May 10, 2023 Security Products & Services

Available in an open-source CLI tool, this KBOM enables cloud security teams to understand the scope of third-party tooling in their environment to respond quicker to new vulnerabilities, which have become frequent in recent months.

Spanish Police Arrest 40 in Phishing Gang Bust

cyware May 10, 2023 Incident Response, Learnings

Spanish police have arrested dozens of individuals on suspicion of their involvement in a serious organized crime gang said to have made over €700,000 ($767,000) from phishing victims.

More Than 45,000 Affected by December Cyberattack on Metropolitan Opera

cyware May 10, 2023 Breaches and Incidents

The organization notified that the names, financial account information, tax identification numbers, Social Security numbers, payment card information, and driver’s license numbers of 45,094 people were leaked during the cyberattack.

Update: Capita says responding to ransomware attack will cost up to $25 million

cyware May 10, 2023 Incident Response, Learnings

The expenses have been attributed to “specialist professional fees, recovery and remediation costs and investment to reinforce Capita’s cyber security environment,” according to a statement sent to The Record.

SAP Patches Critical Vulnerabilities With May 2023 Security Updates

cyware May 10, 2023 Malware and Vulnerabilities

German enterprise software maker SAP this week announced the release of 18 new security notes on its May 2023 Security Patch Day, including two ‘hot news’ notes that deal with critical vulnerabilities.

Food Distribution Giant Sysco Warns of Data Breach After Cyberattack

cyware May 10, 2023 Breaches and Incidents

In an internal memo sent to employees on May 3rd and seen by BleepingComputer, Sysco revealed that customer and supplier data in the U.S. and Canada, as well as personal information belonging to U.S. employees, may have been impacted in the incident.

Privacy breach hits Japanese convenience stores

cyware May 10, 2023 Trends, Reports, Analysis

Japan's minister for digital transformation and digital reform, Tono Karo, has apologized after a government app breached citizens' privacy. The app is called the "Certificate Issuing Server."

Siemens, Schneider Electric Address Few Dozen ICS Vulnerabilities

cyware May 10, 2023 Malware and Vulnerabilities

Siemens has published six new advisories describing 26 vulnerabilities in Siveillance Video products, Cloud Connect 7, and more. Schneider Electric has published four new advisories that describe half a dozen vulnerabilities.

Smashing Pumpkins frontman paid ransom to a hacker who threatened to leak the band’s songs

cyware May 10, 2023 Incident Response, Learnings

The frontman of the alternative rock band Smashing Pumpkins, Billy Corgan, revealed that he paid a ransom after a hacker stole the band’s songs and threatened to leak them.

Adobe Patches 14 Vulnerabilities in Substance 3D Painter

cyware May 10, 2023 Malware and Vulnerabilities

Adobe has announced security updates for its Substance 3D Painter product to address more than a dozen vulnerabilities. This is the only product for which the software giant released updates this Patch Tuesday.

Australia's TechnologyOne halts trading after being hit by cyberattack

cyware May 10, 2023 Breaches and Incidents

Australia's TechnologyOne Ltd said on Wednesday it had detected an unauthorised third-party access to its back-office systems, becoming the latest target in a series of cyberattacks that has bogged companies in the country since last year.

Intel, AMD Address Over 100 Vulnerabilities on Patch Tuesday

cyware May 10, 2023 Malware and Vulnerabilities

Intel has released 38 advisories covering over 80 vulnerabilities. The company has addressed nearly two dozen issues rated ‘high severity’ — the remaining bugs have been rated ‘medium severity’ and one is ‘low severity’.

Fake Windows System Update Drops Aurora Stealer via Invalid Printer Loader

cyware May 10, 2023 Malware and Vulnerabilities

Attackers are using malicious ads to redirect users to what looks like a Windows security update. The scheme is very well designed as it relies on the web browser to display a full-screen animation resembling what you'd expect from Microsoft.

Researchers Find Bypass for a Fixed Bug; MSFT Patches Again

cyware May 10, 2023 Malware and Vulnerabilities

Microsoft patched the modified attack - tracked as CVE-2023-29324 - during this month's dump of fixes, rating the bug as "important" but not "critical." Researchers from Akamai, which found and disclosed the bug, say it merits a critical rating.

Mastermind Behind Twitter 2020 Hack Pleads Guilty and Faces up to 70 Years in Prison

cyware May 10, 2023 Incident Response, Learnings

Joseph James O'Connor, who also went by the online alias PlugwalkJoe, admitted to "his role in cyberstalking and multiple schemes that involve computer hacking, including the July 2020 hack of Twitter," the U.S. Department of Justice (DoJ) said.

How One Of Vladimir Putin's Most Prized Hacking Units Got Pwned By The FBI

packetstormsecurity May 10, 2023 headline,hacker,government,usa,russia,cy

Fujitsu Triggers Privacy Breach At Japanese Convenience Stores

packetstormsecurity May 10, 2023 headline,privacy,data loss,flaw,japan

Windows For Gamers Rolls Dice With Your Security

packetstormsecurity May 10, 2023 headline,microsoft