Oktacron - Cyber Security RSS Feeds History

Privacy and security threats of short links | Kaspersky official blog

kaspersky Aug 25, 2023 Privacy

Short links are everywhere these days. All these bit.ly, ow.ly, t.co, t.me, tinyurl.com and the like have long since become a familiar part of the online landscape. So familiar, in fact, that most users click on them without thinking twice. But thinking is never a bad thing. With that in mind, we explain below how show more ...

short links work and what privacy and security threats they can pose. What happens when you click on a short link? When you click on a short link, you almost go straight to the intended destination, which is the address specified by the user who created the link. Almost, but not quite: the actual route takes a quick detour via the URL shortener service. The more efficient the service, the quicker this takes, and the smoother the transition to the end stop. Of course, the delay feels insignificant only to a person — we humans are rather slow. But for an electronic system, its more than long enough to get up to all kinds of activity, which well discuss below. Why short links? The main reason is one of space: making a long link shorter means it takes up less of the screen (think mobile devices) and doesnt eat up the character limit (think social media posts). Alas, thats not all there is to it. The creators of short links may be pursuing their own goals, not necessarily driven by concern for users. Lets talk about them. Short links and user tracking Have you ever wondered why many internet links are so long and unsightly? Its usually because links encode all kinds of parameters for tracking click-throughs, so-called UTM tags. Usually, these tags are deployed to determine where the user clicked on the link, and thus to evaluate the effectiveness of ad campaigns, placement on blogger pages, and so on. This is not done in the name of user convenience, of course, but for digital marketing. In most cases, this is a fairly harmless form of tracking that doesnt necessarily collect data from link clickers: often marketers are just interested in the source of traffic. But since this additional packaging doesnt look very aesthetic, and often makes the URL insanely long, shortener services are often brought into play. Whats more unpleasant from a privacy point of view is that URL shorteners dont limit themselves to redirecting users to the destination address. They also tend to harvest a host of statistics about the link clickers — so your data ends up in the hands not only of the creator of the short link through embedded UTM tags, but also of the owners of the URL shortener. Of course, this is the internet, and everyone collects some kind of statistics, but using a short link introduces another intermediary that holds data on you. Disguised malicious links Besides violating your privacy, short links can threaten the security of your devices and data. As we never tire of repeating: always carefully check links before clicking on them. But with short links, a problem arises: you never know for sure where it is youll be taken. If cybercriminals use short links, the advice to check them becomes meaningless: you can only find out where a link points after clicking. And by then it may be too late — if the attackers exploit a zero-click vulnerability in the browser, the infection can occur as soon as you land on the malicious site. Short links and dynamic redirects Cybercriminals can also use link-shortening tools to change the target address as the need arises. Suppose that some attackers bought a database of millions of email addresses and used it to send out phishing messages with some kind of link. But heres the problem (for the attackers): the phishing site they created was quickly discovered and blocked. Rehosting it at a different address is not an issue, but then they would have to resend all the phishing mailshots. The solution (again, for the attackers) is to use a shimming service, which makes it possible to quickly change the URL users will visit. And the role of shims here can be played by URL shorteners, including ones originally created with dubious intentions in mind. With this approach, a link to the shimming service is added to the phishing email, which redirects victims to the phishers site at their currently active address. Often, multiple redirects are used to further muddy the trail. And if the destination phishing site gets blocked, the cybercriminals simply host it at a new address, change the link in the shim, and the attack continues. Man-in-the-middle attacks Some link-shortening tools, such as Sniply, offer users more than just shorter links. They allow tracking the actions of link clickers on the actual destination site, which is effectively a man-in-the-middle attack: traffic passes through an intermediate service node that monitors all data exchanged between the user and the destination site. Thus, the URL shortener can intercept anything it wants: entered credentials, social network messages, and so on. Personal spying In most cases, short links intended for mass use are placed in social network posts or on web pages. But additional risks arise if one was sent to you personally — in a messenger or an email to your personal or work address. Using such links, an attacker who already has some information about you can redirect you to a phishing site where your personal data is pre-filled. For example, to a copy of a banking site with a valid username and a request to enter your password, or to the payment gateway of some service with your bank card number pre-filled, asking you to enter a security code. Whats more, such links can be used for doxing and other types of tracking, especially if the URL shortener service offers advanced functionality. For instance, our recent post about protecting privacy in Twitch looked in detail at ways to de-anonymize streamers and how to counter them. How to stay protected What to do about it? We could advise never to click on short links, but, in the vast majority of cases, URL shorteners are used for legitimate purposes, and short links have become so common that total avoidance isnt really an option. That said, we do recommend that you pay special attention to short links sent to you in direct messages and emails. You can inspect such links before clicking by copying and pasting them into a tool for checking short links, such as GetLinkInfo or UnshortenIt. However, there is a simpler method: a high-quality security solution with an integrated approach that takes care of security and privacy at the same time. For example, our Kaspersky Premium has a Private Browsing component that blocks most known online trackers and thus prevents your online activities from being monitored. Our products also offer protection against online fraud and phishing, so rest assured that Kaspersky Premium will warn you in good time before landing on a dangerous site — even if the link was shortened. And, of course, the antivirus will guard against any attempts to infect your devices — including ones exploiting as-yet-unknown vulnerabilities.

Kroll Employee SIM-Swapped for Crypto Investor Data

krebsonsecurity Aug 25, 2023 A Little Sunshine

Security consulting giant Kroll disclosed today that a SIM-swapping attack against one of its employees led to the theft of user information for multiple cryptocurrency platforms that are relying on Kroll services in their ongoing bankruptcy proceedings. And there are indications that fraudsters may already be show more ...

exploiting the stolen data in phishing attacks. Cryptocurrency lender BlockFi and the now-collapsed crypto trading platform FTX each disclosed data breaches this week thanks to a recent SIM-swapping attack targeting an employee of Kroll — the company handling both firms’ bankruptcy restructuring. In a statement released today, New York City-based Kroll said it was informed that on Aug. 19, 2023, someone targeted a T-Mobile phone number belonging to a Kroll employee “in a highly sophisticated ‘SIM swapping’ attack.” “Specifically, T-Mobile, without any authority from or contact with Kroll or its employees, transferred that employee’s phone number to the threat actor’s phone at their request,” the statement continues. “As a result, it appears the threat actor gained access to certain files containing personal information of bankruptcy claimants in the matters of BlockFi, FTX and Genesis.” T-Mobile has not yet responded to requests for comment. Countless websites and online services use SMS text messages for both password resets and multi-factor authentication. This means that stealing someone’s phone number often can let cybercriminals hijack the target’s entire digital life in short order — including access to any financial, email and social media accounts tied to that phone number. SIM-swapping groups will typically call employees on their mobile devices, pretend to be someone from the company’s IT department, and then try to get the person on the other end of the line to visit a phishing website that mimics the company’s employee login page. Multiple SIM-swapping gangs have had great success targeting T-Mobile employees for the purposes of reselling a cybercrime service that can be hired to divert any T-Mobile user’s text messages and phone calls to another device. In February 2023, KrebsOnSecurity chronicled SIM-swapping attacks claimed by these groups against T-Mobile employees in more than 100 separate incidents in the second half of 2022. The average cost to SIM swap any T-Mobile phone number was approximately $1,500. The unfortunate result of the SIM-swap against the Kroll employee is that people who had financial ties to BlockFi, FTX, or Genesis now face increased risk of becoming targets of SIM-swapping and phishing attacks themselves. And there is some indication this is already happening. Multiple readers who said they got breach notices from Kroll today also shared phishing emails they received this morning that spoofed FTX and claimed, “You have been identified as an eligible client to begin withdrawing digital assets from your FTX account.” A phishing message targeting FTX users that went out en masse today. A major portion of Kroll’s business comes from helping organizations manage cyber risk. Kroll is often called in to investigate data breaches, and it also sells identity protection services to companies that recently experienced a breach and are grasping at ways to demonstrate that they doing something to protect their customers from further harm. Kroll did not respond to questions. But it’s a good bet that BlockFi, FTX and Genesis customers will soon enjoy yet another offering of free credit monitoring as a result of the T-Mobile SIM swap. Kroll’s website says it employs “elite cyber risk leaders uniquely positioned to deliver end-to-end cyber security services worldwide.” Apparently, these elite cyber risk leaders did not consider the increased attack surface presented by their employees using T-Mobile for wireless service. The SIM-swapping attack against Kroll is a timely reminder that you should do whatever you can to minimize your reliance on mobile phone companies for your security. For example, many online services require you to provide a phone number upon registering an account, but that number can often be removed from your profile afterwards. Why do I suggest this? Many online services allow users to reset their passwords just by clicking a link sent via SMS, and this unfortunately widespread practice has turned mobile phone numbers into de facto identity documents. Which means losing control over your phone number thanks to an unauthorized SIM swap or mobile number port-out, divorce, job termination or financial crisis can be devastating. If you haven’t done so lately, take a moment to inventory your most important online accounts, and see how many of them can still have their password reset by receiving an SMS at the phone number on file. This may require stepping through the website’s account recovery or lost password flow. If the account that stores your mobile phone number does not allow you to delete your number, check to see whether there is an option to disallow SMS or phone calls for authentication and account recovery. If more secure options are available, such as a security key or a one-time code from a mobile authentication app, please take advantage of those instead. The website 2fa.directory is a good starting point for this analysis. Now, you might think that the mobile providers would share some culpability when a customer suffers a financial loss because a mobile store employee got tricked into transferring that customer’s phone number to criminals. But earlier this year, a California judge dismissed a lawsuit against AT&T that stemmed from a 2017 SIM-swapping attack which netted the thieves more than $24 million in cryptocurrency.

NIST Publishes First Draft Standards for Post-Quantum Cryptography

darkreading Aug 25, 2023 Feed

Publication of the first draft PQC standards opens a 90-day period for public comment and paves the way for interoperability testing.

China Unleashes Flax Typhoon APT to Live Off the Land, Microsoft Warns

darkreading Aug 25, 2023 Feed

The cyber-espionage group has created a stealthy, hard-to-mitigate network of persistent access across a range of organizations, but the endgame is unclear.

'Whiffy Recon' Malware Transmits Device Location Every 60 Seconds

darkreading Aug 25, 2023 Feed

Deployed by the infamous SmokeLoader botnet, the location-tracking malware could be used for a host of follow-on cyberattacks or even physical targeting.

Luna Grabber Malware Targets Roblox Gaming Devs

darkreading Aug 25, 2023 Feed

Roblox gaming developers are lured in by a package that claims to create useful scripts to interact with the Roblox website, for example by “promot(ing) users, shout events, and so on, or to create Discord utiltiies (sic) to manage their community.”

Is Bias in AI Algorithms a Threat to Cloud Security?

darkreading Aug 25, 2023 Feed

Using AI for threat detection and response is essential — but it can't replace human intelligence, expertise, and intuition.

WinRAR Zero-Day Actively Exploited to Distribute Malware

cyware Aug 25, 2023 Malware and Vulnerabilities

A recently discovered zero-day vulnerability in WinRAR has been exploited in a malware distribution campaign that has been ongoing since April. The vulnerability, known as CVE-2023-3881, allows attackers to create malicious zip archives with spoofed file extensions, concealing them as harmless files. It is highly recommended that users upgrade to the latest version (6.23) of WinRAR.

Title Lender TMX Now Says Payment Card Data Stolen in Breach

cyware Aug 25, 2023 Breaches and Incidents

A revised data breach notification is being sent to victims stating that attackers may have also stolen their credit/debit card number, beyond the raft of personal information.

China-based 'Flax Typhoon' hackers targeting Taiwan govt: Microsoft

cyware Aug 25, 2023 Breaches and Incidents

The activities observed suggest the threat actor intends to perform espionage and maintain access to organizations across a broad range of industries for as long as possible.

Time keeps on slippin’ slippin’ slippin’: The 2023 Active Adversary Report for Tech Leaders

cyware Aug 25, 2023 Trends, Reports, Analysis

In H1 2023, compromised credentials accounted for 50% of root causes, whereas exploiting a bug came in at 23%. We can’t conclusively say that attackers are favoring compromised credentials over vulnerabilities, but it can’t be denied either.

New Luna Grabber Poses as Roblox Packages, Strikes NPM

cyware Aug 25, 2023 Malware and Vulnerabilities

Malicious actors are targeting Roblox developers with a new malware called Luna Grabber, distributed through npm packages that impersonate legitimate software. These fake packages, including noblox.js-vps, noblox.js-ssh, and noblox.js-secure, house malicious multi-stage payloads. This campaign underscores the recurring strategy of threat actors employing typosquatting as a tactic to deceive developers.

Researchers released PoC exploit for Ivanti Sentry flaw CVE-2023-38035

cyware Aug 25, 2023 Malware and Vulnerabilities

The vulnerability could be exploited to access sensitive API data and configurations, run system commands, or write files onto the system. The vulnerability CVE-2023-38035 impacts Sentry versions 9.18 and prior.

Rockwell ThinManager Vulnerabilities Could Expose Industrial HMIs to Attacks

cyware Aug 25, 2023 Malware and Vulnerabilities

Exploitation of the vulnerabilities can allow causing a denial-of-service (DoS) condition, deleting arbitrary files with system privileges, and uploading arbitrary files to any folder on the drive where ThinServer.exe is installed.

Ransomware With an Identity Crisis Targets Small Businesses, Individuals

cyware Aug 25, 2023 Malware and Vulnerabilities

A key reason it was so tricky for researchers to identify TZW as a spinoff of Adhubllka is because of the small ransom demands the group typically makes. At such a level, victims often pay attackers and the attackers continue to fly under the radar.

Nearly 1,000 Organizations, 60 Million Individuals Impacted by MOVEit Hack

cyware Aug 25, 2023 Breaches and Incidents

On August 14 and 15, the cybercriminals leaked nearly 1 Tb of information allegedly stolen from 16 of the victims, Resecurity said. These victims include UCLA, Siemens Energy, Cognizant, and cybersecurity firms Norton LifeLock and Netscout.

Sextortion Scams Surge 178% in a Year

cyware Aug 25, 2023 Identity Theft, Fraud, Scams

The good news is that the scam is an empty threat that aims to play on the victim’s fear of leaking data. By knowing this, they can then be confidently ignored. ESET traced one scam wherein an actor demanded £1000 ($1260) in BTC from the victim.

Cisco NX-OS Software TACACS+ or RADIUS Remote Authentication Directed Request Denial of Service Vulnerability

cyware Aug 25, 2023 Malware and Vulnerabilities

This vulnerability can only be exploited over Telnet, which is disabled by default, or over the console management connection. This vulnerability cannot be exploited over SSH connections to the device.

Bankrupt Crypto Platforms FTX and BlockFi Warn Customers of Data Breach

cyware Aug 25, 2023 Breaches and Incidents

FTX learned that Kroll, the claims agent in the bankruptcy, experienced a cybersecurity incident that compromised non-sensitive customer data of certain claimants in the pending bankruptcy case.

Smart Cities: Utopian Dream, Security Nightmare, Or Political Gimmick?

packetstormsecurity Aug 25, 2023 headline,hacker,government

EU Safety Laws Start To Bite For TikTok, Instagram, And Others

packetstormsecurity Aug 25, 2023 headline,government,privacy,data loss,fa

Biden Administration Reveals New Crypto Tax Reporting Rules

packetstormsecurity Aug 25, 2023 headline,government,usa,cryptography

Top 5 Most Abused Brands By Hackers

packetstormsecurity Aug 25, 2023 headline,hacker,microsoft,phish