Aug 31 2020

Hackers are backdooring QNAP NAS devices with 3-year old RCE bug

Category: Hacking,Malware — DISC @ 3:58 pm

Hackers are scanning for vulnerable network-attached storage (NAS) devices running multiple QNAP firmware versions, trying to exploit a remote code execution (RCE) vulnerability addressed by QNAP in a previous release.

Source: Hackers are backdooring QNAP NAS devices with 3-year old RCE bug


CISA says 62,000 QNAP NAS devices have been infected with the QSnatch malwareQSnatch malware, first spotted in late 2019, has grown from 7,000 bots to more than 62,000, according to a joint US CISA and UK NCSC security alert.


QSnatch And How To Protect Your QNAP NAS From Online Intruders

QNAP urges users to update Malware Remover after QSnatch alert

Tags: Backdoor, backdooring

Aug 10 2020

Hacked government, college sites push malware via fake hacking tools

Category: Hacking,Malware — DISC @ 5:44 pm

A large scale hacking campaign is targeting governments and university websites to host articles on hacking social network accounts that lead to malware and scams.

Some of the sites targeted in this campaign belong to government sites for San Diego, Colorado, Minnesota, as well as sites for UNESCO, the National Institutes of Health (nih.gov), National Cancer Institute (cancer.gov), Rutgers, University of Washington, Arizona State University, Rochester Institute of Technology, University of Iowa, Maryland University, and University of Michigan,

From the samples observed by BleepingComputer, the threat actors exploit vulnerabilities in CMS platforms to insert their own hosted articles. One of the common methods we saw was to exploit Drupal’s Webform component to upload PDFs with links to the fake hacking tools.

Source: Hacked government, college sites push malware via fake hacking tools

 

Download a Security Risk Assessment Steps paper!

DISC InfoSec 🔒 securing the business 🔒 via latest InfoSec titles

Subscribe to DISC InfoSec blog by Email

 

Jun 24 2020

Maersk, me & notPetya – gvnshtn

Category: Malware,Ransomware — DISC @ 12:31 pm

Maersk is the world’s largest integrated shipping and container logistics company. I was massively privileged (no pun intended) to be their Identity & Access Management (IAM) Subject Matter Expert (SME), and later IAM Service Owner. Along with tens (if not hundreds) of others, I played a role in the recovery and cybersecurity response to the events of the well-publicised notPetya malware attack in 2017.

Source: Maersk, me & notPetya – gvnshtn

Petya/NotPetya Ransomware Spreading via LAN
httpv://www.youtube.com/watch?v=Vor9sWpJQHw

Global Ransomware Attack | Petya/NotPetya
httpv://www.youtube.com/watch?v=KdgCwCuBUp4

Download a Security Risk Assessment steps paper!

Download a vCISO template

Subscribe to DISC InfoSec blog by Email

Take an awareness quiz to test your basic cybersecurity knowledge

May 26 2020

Russian cyberspies use Gmail to control updated ComRAT malware

Category: Malware — DISC @ 11:02 am

ESET security researchers have discovered a new version of the ComRAT backdoor controlled using the Gmail web interface and used by the state-backed Russian hacker group Turla for harvesting and stealing in attacks against governmental institutions.

Source: Russian cyberspies use Gmail to control updated ComRAT malware



US, UK, and Holland fighting back against Russia’s cyber attacks
httpv://www.youtube.com/watch?v=4MQ59QRTJSY

Russia cyber attacks: “a new stage in an espionage war, going beyond traditional espionage”
httpv://www.youtube.com/watch?v=C3C848sz4AQ






Download a CyberAware cheat sheet

Tags: russian, Russian cyber attack, Russian espionage, russian hacker

Jun 27 2019

Western intelligence hacked Russia’s Google Yandex to spy on accounts

Category: Cyber Espionage,Malware — DISC @ 2:15 pm

Exclusive: Western intelligence hacked ‘Russia’s Google’ Yandex to spy on accounts – sources

Source: Western intelligence hacked ‘Russia’s Google’ Yandex to spy on accounts


Enter your email address:

Delivered by FeedBurner

Tags: cyber espionage, cyber spy

Jun 25 2019

New Silex malware is bricking IoT devices, has scary plans | ZDNet

Category: Malware — DISC @ 10:07 pm

Over 2,000 devices have been bricked in the span of a few hours. Attacks still ongoing.

Source: New Silex malware is bricking IoT devices, has scary plans | ZDNet

How dangerous are IOT devices? | Yuval Elovici | TEDxBGU


Enter your email address:

Delivered by FeedBurner

Jun 17 2019

U.S. Govt Achieves BlueKeep Remote Code Execution, Issues Alert

Category: Malware,Security Incident — DISC @ 8:57 am

The Cybersecurity and Infrastructure Security Agency (CISA) published an alert for Windows users to patch the critical severity Remote Desktop Services (RDS) RCE security flaw dubbed BlueKeep.

Source: U.S. Govt Achieves BlueKeep Remote Code Execution, Issues Alert

 
How to check if a target is vulnerable to the new RDP vulnerability (BlueKeep).


Enter your email address:

Delivered by FeedBurner

Tags: BlueKeep, RDP vulnerability, Remote Code Execution

Jun 01 2019

A dive into Turla PowerShell usage | WeLiveSecurity

Category: Malware — DISC @ 3:37 pm

ESET researchers show how, in a bid to evade detection, the Turla group leverages PowerShell scripts to inject malware directly into memory.

Source: A dive into Turla PowerShell usage | WeLiveSecurity








 Subscribe in a reader

Apr 21 2019

Stuxnet Malware Analysis

Category: Malware — DISC @ 6:15 pm

Stuxnet Malware Analysis By Amr Thabet


 Subscribe in a reader

Tags: advanced malware, Advanced persistent threat, Stuxnet

Apr 19 2019

Malware Analysis

Category: Malware — DISC @ 12:17 pm

Malware Analysis

 

 
Introduction to Malware Analysis | SANS Lenny Zeltser

 
Five Awesome Tools to perform Behavioural Analysis of Malware


 Subscribe in a reader

Tags: complex malware, Malware, malware 2.0

Apr 09 2019

LimeRAT spreads in the wild

Category: Malware — DISC @ 3:58 pm

Cybaze-Yoroi ZLab team spotted an interesting infection chain leveraging several techniques able to defeat traditional security defences and spread LimeRAT.

Source: LimeRAT spreads in the wild

  • 2019 State of Malware | MalwareByte Labs


    • Enter your email address:

    Delivered by FeedBurner

    Apr 05 2019

    How to avoid document-based malware attacks

    Category: Antivirus,Malware — DISC @ 9:39 am

    Some 59% of all malicious files detected in the first quarter of 2019 were documents, according to a Barracuda Networks report. Here’s how to protect yourself against this growing threat.

    Source: How to avoid document-based malware attacks


    Jan 21 2019

    New Rocke Group Malware Turns off Your Cloud Security Tools

    Category: Malware — DISC @ 11:09 pm

    A new Rocke Group malware sample “captured” and analysed by Palo Alto Networks Unit 42 has adopted code to uninstall five cloud security protection products

    Source: New Rocke Group Malware Turns off Your Cloud Security Tools

    🔒 securing the business 🔒

    DISC InfoSec

     


    Jan 29 2017

    Top 5 excellent Antivirus Protection of 2017

    Category: Antivirus,cyber security,Malware,Mobile Security,Network security,next generation firewall — DISC @ 6:01 pm

    Excellence is achievable but perfection is not. Find an excellent anti-virus product based on your requirements.

     

    Malware are evolving faster than ever, so it’s encourging to discover that the latest generation of antivirus (AV) are better equipped to handle this evolving pace of change. Information security best practice recommends that every PC should run at least antivirus (antimalware), antispyware, and a firewall, and you keep it up to date. So if you’re not running an anti-virus, or may feel your anti-virus could do a bit more, take a look at the list below  and find an anti virus solution which fulfill your current needs based on the modern day threats.

     

    All five antivirus solutions below includes On-Demand Malware Scan, On-Access Malware Scan, Website Rating, Malicious URL Blocking, Phishing Protection and Behavior-Based Detection.

     

    1) McAfee Antivirus plus

    [mks_col]

    [mks_one_half]Unlimited protection for Windows, Android, macOS, and iOS devices. New behavior-centric antivirus engine. Essential antivirus protection for PCs, Macs, smartphones, and tablets. [/mks_one_half]

    [mks_one_half] [/mks_one_half]

    [/mks_col]

     

     

    2) Webroot Secure Anywhere Antivirus

    [mks_col]

    [mks_one_half]For Cloud Security it will analyze files, phishing sites, malicious web pages, IP addresses, and mobile apps providing a real time view of current threats and enabling protection from zero day attacks.Can recover files encrypted by ransomware. Uses tiny amount of disk space. Very fast scan. Handles unknown malware. Includes firewall.[/mks_one_half]

    [mks_one_half][/mks_one_half]

    [/mks_col]

     

     

    3) Bitdefender Antivirus Plus

    [mks_col]

    [mks_one_half]Effective ransomware protection. Many bonus features including password manager, secure browser, and file shredder. Wi-Fi Security Advisor. Always secure on the go.

    [/mks_one_half]

    [mks_one_half][/mks_one_half]

    [/mks_col]

     

    4) Symantec Norton Antivirus Basic

    [mks_col]

    [mks_one_half]Protection is always up-to-date to defend against spyware, malware, and unsafe websites, while safeguarding your identity and online transactions. Powerful intrusion prevention. Norton Power Eraser blasts persistent malware. Password management.[/mks_one_half]

    [mks_one_half][/mks_one_half]

    [/mks_col]

     

    5) Kaspersky Antivirus

    [mks_col]

    [mks_one_half]Kaspersky Anti-Virus helps protect against viruses, spyware & more. Great for antiphishing and speedy full-system scan.[/mks_one_half]

    [mks_one_half][/mks_one_half]

    [/mks_col]

     

    Our recommendation is based on The best Antivirus protection of 2017

    Top Rated Antivirus Protection

    Tags: Antivirus software, bitdefender, kaspersky, McAfee, Symantec, webroot

    Feb 24 2016

    How should an organization deal with #ransomware?

    Category: Information Security,Malware — DISC @ 2:31 pm

    ransomware-image

    by Stephen Northcutt

    A question came up on the GIAC Advisory Board: “How should an organization deal with ransomware?”

    One of the members, Alan Waggoner, gave a good answer. All posts to that mailing list are private, so this is reposted with his permission.

    1. Get reliable, tested backups of everything that is important.
    2. Talk to the managers about their risk acceptance. They probably don’t realize what the potential damage and loss productivity, data, and revenue they are facing. Point out downtime and cost to recover.
    3. White-listing applications like Bit9/Carbon Black won’t be effective in an environment where any user can install any software they want.
    4. Limited administrative access on local computers is excellent for most malware, but ransom-ware tends to run as the local user and doesn’t require elevated privileges.
    5. Centralize management of your endpoint AV so you would get real time notification of malware detection. However, don’t count on it because it would be signature based and relatively easy to bypass.
    6. Segment the network and data as much as possible. Focus of accounting and payroll. Those departments should not have a need for local admin rights or installing random software.
    7. End user security awareness training should be mandatory, with periodic phishing tests.

    8. Set up gateway based email filtering (block dangerous extensions) and web content/malware filtering.

    There is a lot more to do, but the above list should be enough to keep you busy for the foreseeable future and put you and your company on a better path than they are on now.


    Jan 04 2013

    Controls against industrial Malware

    Category: Malware — DISC @ 11:43 pm

    Malicious software is called a malware and malware may include viruses, worms and trojans. A virus is a piece of code which is capable of replicating itself and mainly it depends on a host file (a document) to reach its target. However worm does not rely on the host file to reach the target but it does replicate. Main property of Trojan is concealment of code and ultimately used to get control of target system.

    Modern day malware Stuxnet can manipulate Programmable Logic Controllers (PLCs) of critical infrastructure. Industrial Control System (ICS), SCADA, and manufactruing insdutry infrastructure is controled by the PLCs. Another malware, named Duqu, Flame by its discoverers, is similar to Stuxnet in many respects. Like modern trojans Duqu communicates with a command and control server in encrypted form which gives you an idea of sophistication to develop this malware. In the past year the discovery of the Stuxnet malware – and subsequently of the Flame, Duqu and most recently Gauss malware – has brought the issue of state-sponsored cyberwarfare into sharp focus in security community which are simply known as modern day (WMD) weapon of mass destruction.

    The discovery of these modern day malware caused an uproar among the security community when it was found that these malware had been specifically designed as a highly targeted industrial espionage tool. Perhaps this create a frenzy out there to deveop these kind of tools but that bring out some questions which I’m unable to answer. Is it legal for a state to develop these tools? Is it legal for a state to use these tools in offense? do we have any international charter on the legality of these tools, otherwise Stuxnet, Duqu and Flame may set a wrong legal precedence of what’s good for the goose is good for the gander.

    Main sources of malware infection may be USB drive, CD Rom, internet and unaware users but basically malware can install itself on your computer by simply visiting an infected/implanted website (pirated software, web sites with illegal content)

    An organization should perform a comprehensive risk assessment on their malware policy to determine if they will accept the risk of adobe attachment and other executable files to pass through their perimeter gateway. Organization may need to consider all the possible sources of malware threats in their risk assessment which may include but not limited to spyware.

    Malware Controls:
    • High level formal malware policy and procedure. There should be a formal policy and procedure for USB drives if risk assessment determines that USB drive risk is not acceptable to business. Then there is a need to implement a control (policy, procedure, technical or training) or multiple of these controls to mitigate this risk to acceptable level.
    • Anti-Virus policy which makes it mandatory to install, and signature file updates should take place on a regular interval (daily)
    • Patch policy for all the latest patches, fixes and service packs that are published by the vendors
    • Regular audit or review of anti-malware software and data file on the system
    • All email attachment, software downloads should be checked for malware at the perimeter and adobe attachment and executable treated based on the risk assessment (drop, pass)
    • User awareness training to possible infected email, spyware and infected website
    • There should be a business continuity plan to recover from a possible malware attack

    Related Books

    Malware Titles from DISC InfoSec Store
    Anti-Malware Software from DISC Infosec store
    Anti-Virus software from DISC InfoSec Store
    Anti-Malware Titles from eBay

    Free Online Virus Scan

    Norton Virus Scan | McAfee Virus Scan | Analyze suspicious files

    Tags: anti virus, Malicious Software, Malware, Security, Spyware and Adware, trojan, Trojan Horses, Viruses

    Oct 23 2012

    The Rise of Malicious Traffic on Networks and how it Infect

    Category: Malware — DISC @ 4:12 pm

     

    Malware logo Crystal 128.

    Malware logo Crystal 128. (Photo credit: Wikipedia)

    Sophisticated malicious attacks can go largely undetected by most antivirus software.  Defense in depth approach requires organizations to monitor for malicious activity, malware (bot traffic) at various levels of the network, perimeter layer, application level and subsequently at critical data level.

    How an end user might become infected, the obvious scenario being possibly our less educated users who could potentially be clicking in links in email messages from senders they might not be aware of or people visiting some high-risk sites such as those offering free downloads. The second scenario which is less obvious is where a user may click a link from a known good site which may contain a link to a bad site. The most common situation here is where advertising may have been purchased and site owners may not have been able to perform the due diligence to make sure a reputable company has purchased the ad space. Finally we’ve got our third and scarier scenario where a trusted site has actually been compromised and infected with some kind of malware.

    According to Symantec‘s most recent Internet Security Threat Report, Global networks faced more than 286 million cyberthreats in 2010, as attackers employed more sophisticated methods that make malware harder to detect and more difficult to remove. Furthermore, the number of Web-based attacks increased 93% in 2010, and malware writers have been turning their attention to social-networking sites such as Twitter and Facebook, where it’s estimated that 17% of links are connected to malware.

    So the malicious activity is on the rise based on the Symantec report, which emphasis the point to monitor and evaluate the harmful traffic into your network.  Malicious activity monitoring also requires an effective incident handling procedures to analyze, evaluate and taking appropriate actions with malicious events at hand.  An incident handling procedures also differentiate the event from incident meaning when an event turn into an incident.

    Real time malicious activity monitoring at perimeter will work nicely with ISO 27001 (ISMS) process. It will not only satisfy the auditor need for monitoring and maintaining of certain controls in the standard  but also new threats to the organization will serve as a feed to required risk assessment process which can be evaluated against relevant vulnerabilities.

    Below are some of the famous malicious attacks which can be used to breach network:

    SQL injection—By analysing the URL syntax of targeted websites, hackers are able to embed instructions to upload malware that gives them remote access to the target servers.

    Exploiting system vulnerabilities in another method—In many cases, laptops, desktops, and servers do not have the latest security patches deployed, which creates a gap in the security posture. Gaps or system vulnerabilities can also be created by improper computer or security configurations. Cyber-criminals search for and exploit these weaknesses to gain access to the corporate network and confidential information.

    Targeted malware—Cybercriminals use spam, email, and instant message communications often disguised to come from known entities to direct users to websites that are compromised with malware. This section includes several different approaches that cybercriminals leverage to infect systems with malicious code.

    Related articles

    Tags: anti virus, facebook, Internet security, Malware, Security, Symantec

    Oct 24 2011

    New Stuxnet-Like Worm Discovered

    Category: Malware — DISC @ 12:42 pm

    By Jeff James : Twitter at @jeffjames3
    In June 2010, security experts, analysts, and software providers were warning IT managers about Stuxnet, a new computer worm that was spreading rapidly over the internet. Stuxnet was distributed by Windows machines, and the intent of the worm wasn’t immediately clear. After a few months it was revealed that the vast majority of Stuxnet infections were in Iran, and Stuxnet seemed to have been specifically targeting the Siemens industrial control equipment used in the Iranian nuclear program.

    German security expert Ralph Langner was interviewed by NPR reporter Tom Gjelten earlier this year about Stuxnet, and Gjelten reported that Langner told him that the worm was so complex and sophisticated that it was “almost alien in design” and believed that only the United States had the resources required to create Stuxnet and orchestrate the attack. As more details emerged, it became clear that Stuxnet was likely developed by either Israeli or American intelligence agencies in an attempt to impede Iran’s nuclear program.

    Both Israeli and American security officials have sidestepped questions about their involvement, but Gary Samore, White House Coordinator for Arms Control and Weapons of Mass Destruction, stated at a December 2010 conference on Iran that “we’re glad they [the Iranians] are having trouble with their centrifuge machine and that we – the US and its allies – are doing everything we can to make sure that we complicate matters for them.” [Source: NPR’s Need to Know]

    Now security researchers from Symantec have revealed that they’ve discovered a new Stuxnet-like worm called W32.Duqu that shares much of the same code with Stuxnet. Symantec’s Security Research blog posted details about Duqu yesterday:

    “Duqu shares a great deal of code with Stuxnet; however, the payload is completely different. Instead of a payload designed to sabotage an industrial control system, the payload has been replaced with general remote access capabilities. The creators of Duqu had access to the source code of Stuxnet, not just the Stuxnet binaries. The attackers intend to use this capability to gather intelligence from a private entity to aid future attacks on a third party. While suspected, no similar precursor files have been recovered that predate the Stuxnet attacks.
    According to Symantec, Duqu also functions as a keylogger designed to “capture information such as keystrokes and system information” but lacks the specific code related to “industrial control systems, exploits, or self-replication.” Symantec’s research team believes that Duqu is collecting information for a possible future attack, and seem to point the finger at the original creators of Stuxnet, since the creators of Duqu seem to have direct access to Stuxnet source code:

    The creators of Duqu had access to the source code of Stuxnet, not just the Stuxnet binaries. The attackers intend to use this capability to gather intelligence from a private entity to aid future attacks on a third party. While suspected, no similar precursor files have been recovered that predate the Stuxnet attacks.
    The arrival of Stuxnet signaled that cyberattacks have entered a new phase, with nation states and professional, highly-skilled programmers helping elevate cyberwarfare to a new, more sophisticated (and dangerous) level. Microsoft Technical Fellow Mark Russinovich offers up a fictional account of what can happen when terrorist groups turn to cyberwarfare in his novel Zero Day, and it’s a chilling preview of what the future of warfare could look like.

    While many fingers are pointing at U.S. and Israeli intelligence service for creating Stuxnet – and possibly Duqu — what happens when a hostile nation or well-organized terrorists develop the same level of cyberwarfare capability? Questions like these are undoubtedly keeping IT security professionals and experts at government security agencies awake at night.

    For more technical information on the Duqu worm, see Symantec’s W32.Duqu: The Precursor to the Next Stuxnet whitepaper [PDF] and a Symantec post that provides additional Duqu technical details.

    The New Face of War: How War Will Be Fought in the 21st Century

    Has Israel Begun A Cyber War On Iran With The Stuxnet ‘Missile’?: An article from: APS Diplomat News Service

    Sep 12 2011

    Mobile Malware

    Category: Malware,Smart Phone — DISC @ 8:07 pm

    Lookout Mobile Security

    By Mandira Srivastava

    Do you think it is safe to access sensitive data on mobile phone? Do you know that malware can steal valuable information from your phone? As smartphone sales are growing, the development of mobile malware, viruses that penetrate the security system of mobile devices, also increases.

    Mobile malware has been around for many years, it has been a problem for computers for a long time and now because of the evolution of the smart phone it has started to hit mobile handsets. Because the smart phones are becoming increasingly more sophisticated and their operating systems are becoming more similar to a computer, it is now possible for them to be infected with malware and it is important for all business owners to be aware of this.

    Just like computer malware, mobile malware is installed on your smartphone and will attempt to steal information and data stored on your phone. The information that can be stolen includes documents, passwords, email login details and even credit card details just like on a PC. Mobile malware has increased rapidly during the last year and there is more and more stealth malware appearing. Stealth malware is when the malware is running in the background on the phone without the user being aware of it.

    With wireless payment systems and mobile shopping apps becoming more popular it is also possible that the malware will be able to intercept credit card details. Also, text messaging that is sometimes used to send banking codes could be used by the criminals to get sensitive information. If you are considering using a mobile payment system for your business, make sure it is tested and secure.

    Malware has been found on all of the current phones and operating systems, including the iPhone and the Android phones.

    One of the main ways that the malware can access your phone is through the Wi-Fi networks and Bluetooth. Because the smartphone can easily be connected to wireless networks this can make it easier to download the malware. You can avoid this happening to your phone by only using secure and trusted Wi-Fi networks and by only accepting Bluetooth connections from people whom you know and keeping the Bluetooth switched off when you aren’t using it.

    Email has always been a popular target for the hackers and with text messaging being so popular, they have also used this to spread the malware as well as phishing scams to try to steal your identity. It is a good idea to apply the same precautions you use before opening a strange email before opening a suspicious text.

    Mobile security is becoming more and more important especially for businesses and it is a good idea to implement some security measures in order to avoid the malware spreading. You can, for example, always use a password for your phone so no one else can use it if it is stolen and only download apps from official sites and not third parties.

    Apr 19 2011

    About Microsoft Security Essentials

    Category: Malware — DISC @ 9:51 pm

    Microsoft Security Essentials can also be used by small businesses on up to 10 PCs!
    Microsoft Security Essentials provides real-time protection for your home or small business PC that guards against viruses, spyware, and other malicious software.

    Microsoft Security Essentials is a free* download from Microsoft that is simple to install, easy to use, and is automatically updated to protect your PC with the latest technology.

    Microsoft Security Essentials runs quietly and efficiently in the background so that you are free to use your Windows-based PC the way you want—without interruptions or long computer wait times.

    Before installing Microsoft Security Essentials, we recommend that you uninstall other antivirus software already running on your PC. Running more than one antivirus program at the same time can potentially cause conflicts that affect PC performance.

    Download it Free -> Microsoft Security Essentials

    The Myths of Security: What the Computer Security Industry Doesn’t Want You to Know

    This book tells you:

    Why anti-virus software doesn’t work well — and one simple way to fix it

    Tags: Free antivirus

    « Previous Page — Next Page »