Jan 27 2021

Europol-led op knocks 700 servers offline

Category: Botnet — DISC @ 10:54 am

Command ‘n’ control botnet of notorious Emotet Windows ransomware shut down in multinational police raid

EU police agency Europol has boasted of taking down the main botnet powering the Emotet trojan-cum-malware dropper, as part of a multinational police operation that included raids on the alleged operators’ homes in the Ukraine.

“To severely disrupt the EMOTET infrastructure, law enforcement teamed up together to create an effective operational strategy. It resulted in this week’s action whereby law enforcement and judicial authorities gained control of the infrastructure and took it down from the inside,” said Europol in a jubilant statement this afternoon.

Police forces from the Netherlands, Germany, the United States, the United Kingdom, France, Lithuania, Canada and Ukraine all took part in the takedown.

“Analysis of accounts used by the group behind Emotet showed $10.5m being moved over a two-year period on just one Virtual Currency platform,” said Britain’s National Crime Agency, which added: “NCA investigators were able to identify that almost $500,000 had been spent by the group over the same period to maintain its criminal infrastructure.”

Source: Command ‘n’ control botnet of notorious Emotet Windows ransomware shut down in multinational police raid

Jan 27 2021

Maritime port cybersecurity

Category: cyber security — DISC @ 10:47 am
Maritime port cybersecurity

MARITIME CYBER SECURITY

Although acknowledging previous relevant cases, the chosen starting point will be June, 16th 2017, when the International Maritime Organization (IMO) formally adopts the recommendations included in the three declarations of principles in the Resolution MSC.428 (98) entitled Cyber Risk Management in Safety Management System.

In this sense, the cyber security risk assessment becomes integral part of the objective (Art.1.2) included in the ISM Code; according to which the management of the cyber security risk must be included in the general objective, for this reason shipping companies must “…ensure safety at sea, prevention of human injury or loss of life, and avoidance of damage to the environment, in particular to the marine environment and to property“. In particular, these objectives are identified in the pursue of the following obligations:

1.         provide for safe practices in ship operation and a safe working environment;

2.         assess all identified risks to its ships, personnel and the environment and establish appropriate safeguards; and

3.         continuously improve safety management skills of personnel ashore and aboard ships, including preparing for emergencies related both to safety and environmental protection.

In the declarations related to the MSC.428 (98), the IMO introduces for the first time the date of Jan., 1st 2021, stating that: “…Administrations (are encouraged) to ensure that cyber risks are appropriately addressed in safety management system no later than the first annual verification of the company’s Document of Compliance after 1 January 2021“.

The second date to remember is Jul. 5th 2017, when the IMO, through the Maritime Safety Committee released the Guidelines on Maritime Cyber Risk Management included in the MSC-FAL.1/Circ.3. These guidelines suggest recommendations identified as “high level“ for the management of cyber risk in the maritime sector, with special reference to shipping. The pursued aim is to promote the mitigation of cyber risks, through the adjustment of the safety management system, included in the ISM Code framework.

Jan 26 2021

SANS Faculty Free Tools

Category: Information Security,Security Tools — DISC @ 4:44 pm

SANS Faculty free tools download

Jan 26 2021

Cyber Espionage Report

Category: Cyber Espionage — DISC @ 4:16 pm

Jan 26 2021

Open source tool was incorrectly labeled as a threat by Chrome’s Safe Browsing

Category: Web Security — DISC @ 4:12 pm
https://www.facebook.com/DISCInfoSec/posts/4020863801258067

Jan 26 2021

Ghost hack – criminals use deceased employee’s account to wreak havoc

Category: Cybercrime,Information Security — DISC @ 12:00 pm
Ghost hack – criminals use deceased employee’s account to wreak havoc

Many, if not most, organisations will tell you that they have processes and procedures that they follow when employees leave.

In particular, most companies have a slick and quick procedure for removing ex-staff from the payroll.

Firstly, it doesn’t make economic sense to pay someone who is no longer entitled to the money; secondly, many countries require employers to withold payroll taxes automatically, to pay them in promptly, and to account for them accurately.

Why get into trouble with the tax office over former employees when you can have a simple “staff leaving” checklist that will help to keep you compliant and solvent at the same time?

Unfortunately, we’re not always quite so switched on (or, to be more precise, not quite so good at switching things off) when it comes to ex-staff and cybersecurity.

History is full of stories of havoc wreaked by ex-employees who maintained both their grudges and their paswords or access tokens after being fired or laid off.

Some of these revenge attacks have acquired legendary status, like the man from the splendidly named town of Maroochydore in Maroochy Shire in Queensland, Australia, who used insider information and a purloined computer to “hack” the council’s waste management system.

This crook quite literally, if you will pardon the expression, showered the shire with… well, with 1,000,000 litres of raw sewage, by operating all the right pumps in all the wrong ways.

As amusing as this crime sounds with 20 years of hindsight – it happened in the year 2000 – the disgruntled former contractor caused an environmental hazard, including polluting a tidal canal, that took days to clean up.

He was caught, tried and convicted of 27 counts of unauthorised computer access, and one count of wilfully and unlawfully causing serious environmental harm:

“Marine life died, the creek water turned black and the stench was unbearable for residents,” said Janelle Bryant, investigations manager for the Australian Environmental Protection Agency.

Then there was the US sysadmin who was fired in 2009 and decided to get his own back by planting keyloggers on his former employee’s network, harvesting passwords until he had access to the accounts of senior staff, and then remotely hacking into a presentation by the CEO to the board of directors.

Source: Ghost hack

Jan 26 2021

Dance like nobody’s watching, browse the web like everyone is

Category: Information Security — DISC @ 12:58 am
https://www.facebook.com/DISCInfoSec/posts/4018091268201987

Jan 26 2021

Cyber Security Spend To Jump 10% to $60 Billion in 2021

Category: Information Security — DISC @ 12:48 am
Cyber Security Spend To Jump 10% to $60 Billion in 2021

Jan 25 2021

New campaign targeting security researchers

Category: Information Security,Information Warfare — DISC @ 6:10 pm

Over the past several months, the Threat Analysis Group has identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations. The actors behind this campaign, which we attribute to a government-backed entity based in North Korea, have employed a number of means to target researchers which we will outline below. We hope this post will remind those in the security research community that they are targets to government-backed attackers and should remain vigilant when engaging with individuals they have not previously interacted with.

In order to build credibility and connect with security researchers, the actors established a research blog and multiple Twitter profiles to interact with potential targets. They’ve used these Twitter profiles for posting links to their blog, posting videos of their claimed exploits and for amplifying and retweeting posts from other accounts that they control.

Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers.

A screenshot from the actors' blog of an analysis done by the actor about a publicly disclosed vulnerability.
Example of an analysis done by the actor about a publicly disclosed vulnerability.

While we are unable to verify the authenticity or the working status of all of the exploits that they have posted videos of, in at least one case, the actors have faked the success of their claimed working exploit. On Jan 14, 2021, the actors shared via Twitter a YouTube video they uploaded that proclaimed to exploit CVE-2021-1647, a recently patched Windows Defender vulnerability. In the video, they purported to show a successful working exploit that spawns a cmd.exe shell, but a careful review of the video shows the exploit is fake. Multiple comments on YouTube identified that the video was faked and that there was not a working exploit demonstrated. After these comments were made, the actors used a second Twitter account (that they control) to retweet the original post and claim that it was “not a fake video.”

Source: New campaign targeting security researchers

Jan 25 2021

Insider Attack on Home Surveillance Systems

Category: Cyber surveillance,Insider Threat — DISC @ 11:23 am
Insider Attack on Home Surveillance Systems

Jan 25 2021

VisualDoor: SonicWall SSL-VPN Exploit

Category: Information Security,VPN — DISC @ 12:28 am

TL;DR: SonicWall “Virtual Office” SSL-VPN Products ship an ancient version of Bash vulnerable to ShellShock, and are therefore vulnerable to unauthenticated remote code execution (as a “nobody” user) via the /cgi-bin/jarrewrite.sh URL.

The exploit is incredibly trivial. We simply spaff a shellshock payload containing a bash /dev/tcp backconnect at it, and we get a shell. Now, the environment on these things is incredibly limited – its stripped down Linux. But we have bash, openssl, and FTP. So you could always download your own toolkit for further exploitation.

Anyway, here is the public exploit. It is incredibly trivial and recycles the telnetlib handler for reverse shells from exploits released by Stephen Seeley. https://github.com/darrenmartyn/visualdoor.

Source: VisualDoor: SonicWall SSL-VPN Exploit

Jan 24 2021

The Prescription Coffee Mug

Category: cyber security,Information Security — DISC @ 3:13 pm
https://www.facebook.com/DISCInfoSec/posts/4014648401879607

Jan 24 2021

Hacker leaks data of 2.28M users of dating site MeetMindful

Category: Data Breach,Hacking — DISC @ 12:13 pm
Hacker leaks data of 2.28M users of dating site MeetMindful

Jan 23 2021

New Attack Could Let Hackers Clone Your Google Titan 2FA Security Keys via The Hacker News

Category: 2FA,Hacking — DISC @ 11:13 pm
cloning google titan security keys

Hardware security keys—such as those from Google and Yubico—are considered the most secure means to protect accounts from phishing and takeover attacks.

But a new research published on Thursday demonstrates how an adversary in possession of such a two-factor authentication (2FA) device can clone it by exploiting an electromagnetic side-channel in the chip embedded in it.

The vulnerability (tracked as CVE-2021-3011) allows the bad actor to extract the encryption key or the ECDSA private key linked to a victim’s account from a FIDO Universal 2nd Factor (U2F) device like Google Titan Key or YubiKey, thus completely undermining the 2FA protections.

“The adversary can sign in to the victim’s application account without the U2F device, and without the victim noticing,” NinjaLab researchers Victor Lomne and Thomas Roche said in a 60-page analysis.

“In other words, the adversary created a clone of the U2F device for the victim’s application account. This clone will give access to the application account as long as the legitimate user does not revoke its second factor authentication credentials.”

Source: New Attack Could Let Hackers Clone Your Google Titan 2FA Security Keys

Jan 23 2021

Hacker blunder leaves stolen passwords exposed via Google search

Category: Information Security,Password Security — DISC @ 2:18 pm

Source: Hacker blunder leaves stolen passwords exposed via Google search

Hackers hitting thousands of organizations worldwide in a massive phishing campaign forgot to protect their loot and let Google the stolen passwords for public searches.

The phishing campaign has been running for more than half a year and uses dozens of domains that host the phishing pages. It received constant updates to make the fraudulent Microsoft Office 365 login requests look more realistic.

Creds in plain sight

Despite relying on simple techniques, the campaign has been successful in bypassing email protection filters and collected at least 1,000 login credentials for corporate Office 365 accounts.

Researchers at cybersecurity companies Check Point and Otorio analyzing this campaign discovered that the hackers exposed the stolen credentials to the public internet.

In a report published today, they explain that the attackers exfiltrated the information to domains they had registered specifically for the task. Their mistake was that they put the data in a publicly visible file that Google indexed.

As a result, Google could show results for queries of a stolen email address or password, as seen in the screenshot above:

Jan 23 2021

SANS Virtual Summits Will Be FREE for the Community in 2021

Category: Information Privacy,Information Security,Security Awareness — DISC @ 1:52 pm

Jan 22 2021

US administration adds “subliminal” ad to White House website

Category: InfoSec jobs — DISC @ 11:44 pm
US administration adds “subliminal” ad to White House website

Well, it turns out that the new 2021 White House website added a job ad, too, presumably hoping to get some publicity and to attract job applicants to the US Digital Service (USDS).

The USDS describes itself as a part of the public service that aims to use “design and technology to deliver better services to the American people”, and its goal is to attract at least some of those technophiles that might otherwise be lured to join the fast-paced, dollar-sign world of commercial cloud-based products and services.

After all, today’s technology business juggernauts are in a position to offer eye-watering starting salaries and the promise of fast-paced, ever-changing coding challenges based on the very latest hardware platforms and programming languages.

Jan 22 2021

Key 2021 Insights: Proactive Security Needed for Ransomware, Phishing

Category: Information Security,Phishing,Ransomware — DISC @ 12:03 pm

Healthcare leaders will need to shift into a proactive security approach into 2021, if they hope to defend against the onslaught of ransomware and phishing threats.

The ransomware surge during the last few months has already continued into 2021. And though the malware will remain a key trend into this year, healthcare industry stakeholders will need adopt a proactive security approach and secure key entry points, including phishing threats and vulnerable endpoints.

Listen to the full podcast to learn more about Xtelligent Healthcare Media’s predictions for 2021. And don’t forget to subscribe on iTunes, Spotify, or Google Podcasts.

Xtelligent Healthcare Media Editors recently compiled predictions for the healthcare sector in the year ahead on a Healthcare Strategies podcast episode. In the healthcare security space, leaders can expect continued email-based attacks and other schemes that prey on COVID-19 fears.

Source: Proactive Security Needed for Ransomware, Phishing

Jan 22 2021

SVR Attacks on Microsoft 365

Category: Cyber Attack — DISC @ 12:27 am
SVR Attacks on Microsoft 365

Jan 22 2021

70% of Financial Service Firms Hit by COVID Cyber Attacks

Category: Information Security — DISC @ 12:23 am
70% of Financial Service Firms Hit by COVID Cyber Attacks

A new report has emerged detailing that 70% of financial service firms have been hit by  COVID-related cyber attacks in the past twelve months that were more damaging due to the unusual circumstances of the COVID-19 virus. 

The numbers come from Keeper Security, who took responses from more than 370 information technology leaders in the UK while compiling a global report into financial service firms being targeted by cyber attacks. 

Authors of the report state that 70% of financial service firms were hit by cyber attacks, with the majority of IT leaders saying that COVID-19 working conditions made the attacks more severe. 

« Previous Page — Next Page »