News: Security & Privacy News

Hackers earn $1,132,500 for 29 zero-days at Pwn2Own Vancouver

Fri, 22 Mar 2024 07:50:40 +0000

Pwn2Own Vancouver 2024 has ended with security researchers collecting $1,132,500 after demoing 29 zero-days (and some bug collisions).

Throughout the event, they targeted software and products in the web browser, cloud-native/container, virtualization, enterprise applications, server, local escalation of privilege (EoP), enterprise communications, and automotive categories, all up-to-date and in their default configuration.

The total prize pool was over $1,300,000 in cash prizes and a Tesla Model 3, which Team Synacktiv won on the first day.

Competitors successfully gained code execution and escalated privileges on fully patched systems after hacking Windows 11, Ubuntu Desktop, VMware Workstation, Oracle VirtualBox, three web browsers (Apple Safari, Google Chrome, and Microsoft Edge), and the Tesla Model 3.

Vendors have 90 days to release security fixes for zero-day vulnerabilities reported during Pwn2Own contests before TrendMicro's Zero Day Initiative discloses them publicly.

Pwn2Own Vancouver 2024 leaderboard (ZDI)

Manfred Paul won this year's edition of Pwn2Own Vancouver with 25 Master of Pwn points and $202,500 earned throughout the two-day competition after hacking the Apple Safari, Google Chrome, and Microsoft Edge web browsers.

On the first day of Pwn2Own, he gained remote code execution (RCE) in Safari via an integer underflow bug and a PAC bypass zero-day combo. He then used a double-tap RCE exploit targeting an Improper Validation of Specified Quantity in Input weakness to take down Chrome and Edge.

Synacktiv also made Pwn2Own Vancouver 2024's Day 1 highlight reel after winning a Tesla Model 3 car and $200,000 after hacking the Tesla ECU with Vehicle (VEH) CAN BUS Control in under 30 seconds using an integer overflow exploit.

On the second day, Manfred Paul also exploited an out-of-bounds (OOB) write zero-day vulnerability to gain RCE and escaped Mozilla Firefox's sandbox using an exposed dangerous function weakness.

Other successful attempts (and bug collisions) on the last day include:

Windows 11 privilege escalation exploits from HackInside, IBM X-Force's Valentina Palmiotti, Marcin Wiązowski, and Gabriel Kirkpatrick,
STAR Labs SG's VMware Workstation RCE and Ubuntu Linux privilege escalation exploits and a Docker escape,
Palo Alto's team hacking Chrome and Edge after defeating V8 hardening,
ColdEye's Oracle VirtualBox guest-to-host escape exploit,
KAIST Hacking Lab's Seunghyun Lee double-tap Chrome and Edge RCE exploit,
Theori with a privilege escalation on Ubuntu Linux.

ZDI has awarded $3,494,750 during the last three Pwn2Ownco hacking contests (Toronto, Tokyo Automotive, and Vancouver).

Also, at Pwn2Own Vancouver 2023, hackers collected another $1,035,000 in awards and a Tesla car (won by Synaktiv) for 27 zero-days in Windows 11, Microsoft Teams, Microsoft SharePoint, macOS, Ubuntu Desktop, VMware Workstation, Oracle VirtualBox, and Tesla's Model 3.

Source

Unpatchable vulnerability in Apple chip leaks secret encryption keys

Thu, 21 Mar 2024 17:12:09 +0000

Fixing newly discovered side channel will likely take a major toll on performance.

A newly discovered vulnerability baked into Apple’s M-series of chips allows attackers to extract secret keys from Macs when they perform widely used cryptographic operations, academic researchers have revealed in a paper published Thursday.

The flaw—a side channel allowing end-to-end key extractions when Apple chips run implementations of widely used cryptographic protocols—can’t be patched directly because it stems from the microarchitectural design of the silicon itself. Instead, it can only be mitigated by building defenses into third-party cryptographic software that could drastically degrade M-series performance when executing cryptographic operations, particularly on the earlier M1 and M2 generations. The vulnerability can be exploited when the targeted cryptographic operation and the malicious application with normal user system privileges run on the same CPU cluster.

Beware of hardware optimizations

The threat resides in the chips’ data memory-dependent prefetcher, a hardware optimization that predicts the memory addresses of data that running code is likely to access in the near future. By loading the contents into the CPU cache before it’s actually needed, the DMP, as the feature is abbreviated, reduces latency between the main memory and the CPU, a common bottleneck in modern computing. DMPs are a relatively new phenomenon found only in M-series chips and Intel's 13th-generation Raptor Lake microarchitecture, although older forms of prefetchers have been common for years.

Security experts have long known that classical prefetchers open a side channel that malicious processes can probe to obtain secret key material from cryptographic operations. This vulnerability is the result of the prefetchers making predictions based on previous access patterns, which can create changes in state that attackers can exploit to leak information. In response, cryptographic engineers have devised constant-time programming, an approach that ensures that all operations take the same amount of time to complete, regardless of their operands. It does this by keeping code free of secret-dependent memory accesses or structures.

The breakthrough of the new research is that it exposes a previously overlooked behavior of DMPs in Apple silicon: Sometimes they confuse memory content, such as key material, with the pointer value that is used to load other data. As a result, the DMP often reads the data and attempts to treat it as an address to perform memory access. This “dereferencing” of “pointers”—meaning the reading of data and leaking it through a side channel—is a flagrant violation of the constant-time paradigm.

The team of researchers consists of:

Boru Chen, University of Illinois Urbana-Champaign
Yingchen Wang, University of Texas at Austin
Pradyumna Shome, Georgia Institute of Technology
Christopher W. Fletcher, University of California, Berkeley
David Kohlbrenner, University of Washington
Riccardo Paccagnella, Carnegie Mellon University
Daniel Genkin, Georgia Institute of Technology

In an email, they explained:

Prefetchers usually look at addresses of accessed data (ignoring values of accessed data) and try to guess future addresses that might be useful. The DMP is different in this sense as in addition to addresses it also uses the data values in order to make predictions (predict addresses to go to and prefetch). In particular, if a data value “looks like” a pointer, it will be treated as an “address” (where in fact it's actually not!) and the data from this “address” will be brought to the cache. The arrival of this address into the cache is visible, leaking over cache side channels.

Our attack exploits this fact. We cannot leak encryption keys directly, but what we can do is manipulate intermediate data inside the encryption algorithm to look like a pointer via a chosen input attack. The DMP then sees that the data value “looks like” an address, and brings the data from this “address” into the cache, which leaks the “address.” We don’t care about the data value being prefetched, but the fact that the intermediate data looked like an address is visible via a cache channel and is sufficient to reveal the secret key over time.

In Thursday’s paper, the team explained it slightly differently:

Our key insight is that while the DMP only dereferences pointers, an attacker can craft program inputs so that when those inputs mix with cryptographic secrets, the resulting intermediate state can be engineered to look like a pointer if and only if the secret satisfies an attacker-chosen predicate. For example, imagine that a program has secret s, takes x as input, and computes and then stores y = s ⊕ x to its program memory. The attacker can craft different x and infer partial (or even complete) information about s by observing whether the DMP is able to dereference y. We first use this observation to break the guarantees of a standard constant-time swap primitive recommended for use in cryptographic implementations. We then show how to break complete cryptographic implementations designed to be secure against chosen-input attacks.

Enter GoFetch

The attack, which the researchers have named GoFetch, uses an application that doesn’t require root access, only the same user privileges needed by most third-party applications installed on a macOS system. M-series chips are divided into what are known as clusters. The M1, for example, has two clusters: one containing four efficiency cores and the other four performance cores. As long as the GoFetch app and the targeted cryptography app are running on the same performance cluster—even when on separate cores within that cluster—GoFetch can mine enough secrets to leak a secret key.

The attack works against both classical encryption algorithms and a newer generation of encryption that has been hardened to withstand anticipated attacks from quantum computers. The GoFetch app requires less than an hour to extract a 2048-bit RSA key and a little over two hours to extract a 2048-bit Diffie-Hellman key. The attack takes 54 minutes to extract the material required to assemble a Kyber-512 key and about 10 hours for a Dilithium-2 key, not counting offline time needed to process the raw data.

The RSA and Diffie-Hellman keys were processed on implementations from Go and OpenSSL and the Kyber and Dilithium from CRYSTALS-Kyber and CRYSTALS-Dilithium. All four implementations employ constant-time programming, proving that the DMPs in Apple silicon defeat the widely deployed defense.

Experimental results of four cryptographic attack PoCs. This show the mean of three runs of each PoC. Online time refers to the required time for a co-located attacker process, which includes (1) standard eviction sets generation; (2) compound eviction set finding; and (3) DMP leakage. Offline time is the post-processing (e.g. lattice reduction) time to complete secret key recovery. The time for the offline signature collection phase of Dilithium-2 is not included.

Chen et al.

GoFetch isn’t the first time researchers have identified threats lurking in Apple DMPs. The optimization was first documented in 2022 research that discovered a previously unknown “pointer-chasing DMP” in both the M1 and Apple’s A14 Bionic chip for iPhones. The research, from a different assemblage of academics, gave rise to Augury, an attack that identified and exploited a memory side channel that leaked pointers. Ultimately, Augury was unable to mix data and addresses when constant-time practices were used, a shortcoming that may have given the impression the DMP didn’t pose much of a threat.

“GoFetch shows that the DMP is significantly more aggressive than previously thought and thus poses a much greater security risk,” the GoFetch authors wrote on their website. “Specifically, we find that any value loaded from memory is a candidate for being dereferenced (literally!). This allows us to sidestep many of Augury's limitations and demonstrate end-to-end attacks on real constant-time code.”

Penalizing performance

Like other microarchitectural CPU side channels, the one that makes GoFetch possible can’t be patched in the silicon. Instead, responsibility for mitigating the harmful effects of the vulnerability falls on the people developing code for Apple hardware. For developers of cryptographic software running on M1 and M2 processors, this means that in addition to constant-time programming, they will have to employ other defenses, almost all of which come with significant performance penalties.

One of the most effective mitigations, known as ciphertext blinding, is a good example. Blinding works by adding/removing masks to sensitive values before/after being stored to/loaded from memory. This effectively randomizes the internal state of the cryptographic algorithm, preventing the attacker from controlling it and thus neutralizing GoFetch attacks. Unfortunately, the researchers said, this defense is both algorithm-specific and often costly, potentially even doubling the computing resources needed in some cases, such as for Diffie-Hellman key exchanges.

One other defense is to run cryptographic processes on the previously mentioned efficiency cores, also known as Icestorm cores, which don't have DMP. One approach is to run all cryptographic code on these cores. This defense, too, is hardly ideal. Not only is it possible for unannounced changes to add DMP functionality to efficiency cores, running cryptographic processes here will also likely increase the time required to complete operations by a nontrivial margin. The researchers mention several ad-hoc defenses, but they are equally problematic.

The DMP on the M3, Apple’s latest chip, has a special bit that developers can invoke to disable the feature. The researchers don’t yet know what kind of penalty will occur when this performance optimization is turned off. (The researchers noted that the DMP found in Intel’s Raptor Lake processors doesn’t leak the same sorts of cryptographic secrets. What’s more, setting a special DOIT bit also effectively turns off the DMP.)

Readers should remember that whatever penalties result will only be felt when affected software is performing specific cryptographic operations. For browsers and many other types of apps, the performance cost may not be noticeable.

“Longer term, we view the right solution to be to broaden the hardware-software contract to account for the DMP,” the researchers wrote. “At a minimum, hardware should expose to software a way to selectively disable the DMP when running security-critical applications. This already has nascent industry precedent. For example, Intel’s DOIT extensions specifically mention disabling their DMP through an ISA extension. Longer term, one would ideally like finer-grain control, e.g., to constrain the DMP to only prefetch from specific buffers or designated non-sensitive memory regions.”

Apple representatives declined to comment on the record about the GoFetch research.

End users who are concerned should check for GoFetch mitigation updates that become available for macOS software that implements any of the four encryption protocols known to be vulnerable. Out of an abundance of caution, it’s probably also wise to assume, at least for now, that other cryptographic protocols are likely also susceptible.

“Unfortunately, to assess if an implementation is vulnerable, cryptanalysis and code inspection are required to understand when and how intermediate values can be made to look like pointers in a way that leaks secrets,” the researchers advised. “This process is manual and slow and does not rule out other attack approaches.”

Source

Proton Pass gets passkey support for both free and paid users

Thu, 21 Mar 2024 17:10:02 +0000

Proton, a company well-known for its privacy-focused services and apps, has announced passkey support for its Proton Pass password manager. The ability to replace traditional and less secure passwords with a more reliable authentication method is now rolling out to free and paid customers of Proton Pass on all platforms.

Proton touts several benefits of its passkey support:

Open source security: Consistent with the open, transparent nature of the passkey protocol, Proton’s passkey implementation, and the Proton Pass applications are fully open source. This approach allows for community review, contributing to a more secure and trustworthy passkey experience for everyone.

Passkey sharing and interoperability: In Proton Pass, passkeys and passwords receive equal priority, ensuring both can be shared directly and exported to another service. This flexibility is part of our commitment to maintaining convenience and interoperability, ensuring passkeys are as user-friendly as traditional passwords.

Innovative UX/UI design: Proton Pass displays passkeys in a straightforward way, hiding the complex cryptography behind a simple interface. This makes using passkeys as easy as using passwords, ensuring all users can securely log in without confusion.

Rust-based robust implementation: Proton Pass leverages Rust for its development across all platforms. This choice ensures consistent behavior and top-notch security and performance across all user devices, mitigating risks of passkey corruption.

Customers who are not ready to switch to passkeys can continue using traditional passwords. Proton understands that it may take a while before passkeys become a universal standard across platforms and websites. For that reason, Proton Pass will continue improving the traditional password experience and related features, such as email aliases, 2FA authentication, etc.

However, Proton says adopting passkeys will improve security and simplify the online experience. Passkeys also provide additional security against phishing and data breaches for business customers.

You can learn more about passkeys in a post on the official Proton blog.

Source

Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds

Thu, 21 Mar 2024 17:06:40 +0000

The company behind the Saflok-brand door locks is offering a fix, but it may take months or years to reach some hotels.

When thousands of security researchers descend on Las Vegas every August for what's come to be known as “hacker summer camp,” the back-to-back Black Hat and Defcon hacker conferences, it's a given that some of them will experiment with hacking the infrastructure of Vegas itself, the city's elaborate array of casino and hospitality technology. But at one private event in 2022, a select group of researchers were actually invited to hack a Vegas hotel room, competing in a suite crowded with their laptops and cans of Red Bull to find digital vulnerabilities in every one of the room's gadgets, from its TV to its bedside VoIP phone.

One team of hackers spent those days focused on the lock on the room's door, perhaps its most sensitive piece of technology of all. Now, more than a year and a half later, they're finally bringing to light the results of that work: a technique they discovered that would allow an intruder to open any of millions of hotel rooms worldwide in seconds, with just two taps.

Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries.

By exploiting weaknesses in both Dormakaba's encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel—say, by booking a room there or grabbing a keycard out of a box of used ones—then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock's data, and the second opens it.

“Two quick taps and we open the door,” says Wouters, a researcher in the Computer Security and Industrial Cryptography group at the KU Leuven University in Belgium. “And that works on every door in the hotel.”

A video of the researchers demonstrating their lock-hacking technique.

(The pattern of lights shown on the lock is redacted at one point at the researchers’ request to avoid revealing a

detail oftheir technique they agreed with Dormakaba not to make public.) Video: Ian Carroll

Wouters and Carroll, an independent security researcher and founder of travel website Seats.aero, shared the full technical details of their hacking technique with Dormakaba in November 2022. Dormakaba says that it's been working since early last year to make hotels that use Saflok aware of their security flaws and to help them fix or replace the vulnerable locks. For many of the Saflok systems sold in the last eight years, there's no hardware replacement necessary for each individual lock. Instead, hotels will only need to update or replace the front desk management system and have a technician carry out a relatively quick reprogramming of each lock, door by door.

Wouters and Carroll say they were nonetheless told by Dormakaba that, as of this month, only 36 percent of installed Safloks have been updated. Given that the locks aren't connected to the internet and some older locks will still need a hardware upgrade, they say the full fix will still likely take months longer to roll out, at the very least. Some older installations may take years.

“We have worked closely with our partners to identify and implement an immediate mitigation for this vulnerability, along with a longer-term solution,” Dormakaba wrote to WIRED in a statement, though it declined to detail what that “immediate mitigation” might be. “Our customers and partners all take security very seriously, and we are confident all reasonable steps will be taken to address this matter in a responsible way.”

The technique to hack Dormakaba's locks that Wouters and Carroll's research group discovered involves two distinct kinds of vulnerabilities: One that allows them to write to its keycards, and one that allows them to know what data to write to the cards to successfully trick a Saflok lock into opening. When they analyzed Saflok keycards, they saw that they use the MIFARE Classic RFID system, which has been known for more than a decade to have vulnerabilities that allow hackers to write to keycards, though the brute-force process can take as long as 20 seconds. They then cracked a part of Dormakaba's own encryption system, its so-called key derivation function, which allowed them to write to its cards far faster. With either of those tricks, the researchers could then copy a Saflok keycard at will, but still not generate one for a different room.

The researchers' more crucial step required them to obtain one of the lock programming devices that Dormakaba distributes to hotels, as well as a copy of its front desk software for managing keycards. By reverse engineering that software, they were able to understand all the data stored on the cards, pulling out a hotel property code as well as a code for each individual room, then create their own values and encrypt them just as Dormakaba's system would, allowing them to spoof a working master key that opens any room on the property. “You can make a card that really looks as if it was created by the software from Dormakaba, essentially,” says Wouters.

And how did Carroll and Wouters obtain Dormakaba's front desk software? “We nicely asked a few people,” Wouters says. “Manufacturers assume that no one will sell their equipment on eBay, and that no one will make a copy of their software, and those assumptions, I think everyone knows, are not really valid.”

Once they'd managed all that reverse engineering work, the final version of their attack could be pulled off with little more than a $300 Proxmark RFID read-write device and a couple of blank RFID cards, an Android phone, or a Flipper Zero radio hacking tool.

A Saflok branded lock.

Photograph: Dormakaba

The biggest caveat to the hackers' Unsaflok technique is that it still requires that they have a keycard—even an expired one—for a room somewhere in the same hotel as the room they're targeting. That's because each card has a property-specific code they need to read and then duplicate on their spoofed card, as well as a room-specific one.

Once they have that property code, the technique also requires using an RFID read-write device to write two cards—one card that reprograms a target lock as well as the second spoofed card that unlocks it. (An Android phone or a Flipper Zero could also be used to emit one signal after another instead of the two cards, the researchers say.) The researchers hint that the first card allows them to open a target room without guessing its unique identifier in the hotel's system, but declined to say exactly what that first card does. They're holding that element of the technique in confidence to avoid giving too clear a set of instructions to would-be intruders or thieves.

By contrast, one security researcher presented a similar hotel keycard hack that opened locks sold by the firm Onity at the Black Hat conference in 2012 with no such obfuscation, and allowed any hacker to build a device that opened any of Onity's 10 million locks worldwide. When Onity refused to pay for the hardware upgrades necessary to solve the problem and instead put the onus on its customers, the issue remained unfixed in many hotels—and eventually was exploited in at least one hacker's cross-country burglary spree.

Carroll and Wouters say that they're trying to avoid that scenario by taking a more cautious approach, while still warning the public about their technique, given that hundreds of properties will likely remain vulnerable to it even now that Dormakaba has offered its fix. “We're trying to find the middle ground of helping Dormakaba to fix it quickly, but also telling the guests about it," says Carroll. “If someone else reverse engineers this today and starts exploiting it before people are aware, that might be an even bigger problem.”

To that end, Carroll and Wouters point out that hotel guests can recognize the vulnerable locks most often—but not always—by their distinct design: a round RFID reader with a wavy line cutting through it. They suggest that if hotel guests do have a Saflok on their door, they can determine if it's been updated by checking their keycard with the NFC Taginfo app by NXP, available for iOS or Android. If the lock is manufactured by Dormakaba, and that app shows that the keycard is still a MIFARE Classic card, it's likely still vulnerable.

If that's the case, the two researchers say, there's not much to do other than avoid leaving valuables in the room and, when you're inside, bolt the chain on the door. They warn that the deadbolt on the room is also controlled by the keycard lock, so it doesn't provide an extra safeguard. “If someone locks the deadbolt, they’re still not protected,” says Carroll.

Even without a perfect or fully implemented fix, Wouters and Carroll argue, it's better for hotel guests to know the risks than to have a false sense of security. After all, they point out, the Saflok brand has been sold for more than three decades, and may have been vulnerable for much or all of those years. Though Dormakaba says it's not aware of any past use of Wouters and Carroll's technique, the researchers point out that doesn't mean it never happened in secret.

“We think the vulnerability has been there for a long time,” says Wouters. “It's unlikely that we are the first to find this.”

Source

Windows 11, Tesla, and Ubuntu Linux hacked at Pwn2Own Vancouver

Thu, 21 Mar 2024 07:43:11 +0000

On the first day of Pwn2Own Vancouver 2024, contestants demoed Windows 11, Tesla, and Ubuntu Linux zero-day vulnerabilities and exploit chains to win $732,500 and a Tesla Model 3 car.

The competition started with Haboob SA's Abdul Aziz Hariri using an Adobe Reader exploit that combined an API restriction bypass and a command injection bug to gain code execution on macOS to earn $50,000.

Synacktiv won the Tesla Model 3 and $200,000 after hacking the Tesla ECU with Vehicle (VEH) CAN BUS Control in under 30 seconds using an integer overflow.

Theori security researchers Gwangun Jung and Junoh Lee earned $130,000 after escaping a VMware Workstation VM to gain code execution as SYSTEM on the host Windows OS using a chain targeting an uninitialized variable bug, a UAF weakness, and a heap-based buffer overflow.

Reverse Tactics' Bruno PUJOS and Corentin BAYET collected $90,000 by exploiting two Oracle VirtualBox bugs and a Windows UAF to escape the VM and elevate privileges to SYSTEM.

The first day of the contest ended with Manfred Paul hacking the Apple Safari, Google Chrome, and Microsoft Edge web browsers, exploiting three zero-day vulnerabilities and winning $102,500.

Other attempts from the first day of Pwn2Own include:

DEVCORE Research Team earned a $30,000 award after escalating privileges to SYSTEM on a fully patched Windows 11 system using an exploit that targeted two bugs, including a TOCTAU race condition. They were also awarded $10,000 for demoing an already-known Ubuntu Linux local privilege escalation (LPE) exploit.
The KAIST Hacking Lab's Seunghyun Lee hacked the Google Chrome web browser using a Use-After-Free (UAF) vulnerability to collect $60,000.
Kyle Zeng from ASU SEFCOM demoed another LPE exploit targeting Ubuntu Linux via a race condition to earn $20,000.
Cody Gallagher also won $20,000 for an Oracle VirtualBox out-of-bounds (OOB) write zero-day vulnerability.
Viettel Cyber Security's Dungdm also hacked Oracle's VirtualBox using a two-bug exploit chain for $20,000.

After the zero-days are demoed at Pwn2Own, vendors have 90 days to create and release security patches for all reported flaws before Trend Micro's Zero Day Initiative discloses them publicly.

Pwn2Own Vancouver 2024 leaderboard (ZDI)

Throughout Pwn2Own Vancouver 2024, security researchers will target fully patched products in the web browser, cloud-native/container, virtualization, enterprise applications, server, local escalation of privilege (EoP), enterprise communications, and automotive categories.

On the second day, Pwn2Own competitors will attempt to exploit zero-day bugs in Windows 11, VMware Workstation, Oracle VirtualBox, Mozilla Firefox, Ubuntu Desktop, Google Chrome, Docker Desktop, and Microsoft Edge.

After the two days of the hacking competition, the hackers can earn over $1,300,000, including a Tesla Model 3 car. The top award for hacking a Tesla is now $150,000, and the car itself.

Competitors can win a maximum award of $500,000 and a Tesla Model 3 car for an exploit that gives complete remote control with unconfined root when targeting the Tesla Autopilot.

Using a Windows kernel vulnerability, they can also get a $300,000 award for a successful Hyper-V Client guest-to-host escape and a privilege escalation on the host OS.

During last year's Vancouver Pwn2Own, won by Team Synacktiv, hackers earned $1,035,000 and a Tesla car for 27 zero-days (and several bug collisions) in Windows 11, Microsoft Teams, Microsoft SharePoint, macOS, Ubuntu Desktop, VMware Workstation, Oracle VirtualBox, and Tesla's Model 3.

Synacktiv also hacked the Tesla Modem and Infotainment System during the first edition of Pwn2Own Automotive in January, getting root permissions on a Tesla Modem by chaining three zero-days and demoing an Infotainment System sandbox escape via a two zero-day exploit chain.

Source

Users ditch Glassdoor, stunned by site adding real names without consent

Wed, 20 Mar 2024 03:28:06 +0000

Anonymous review site Glassdoor now consults public sources to identify users.

Glassdoor, where employees go to leave anonymous reviews of employers, has recently begun adding real names to user profiles without users' consent, a Glassdoor user named Monica was shocked to discover last week.

"Time to delete your Glassdoor account and data," Monica, a Midwest-based software professional, warned other Glassdoor users in a blog. (Ars will only refer to Monica by her first name so that she can speak freely about her experience using Glassdoor to review employers.)

Monica joined Glassdoor about 10 years ago, she said, leaving a few reviews for her employers, taking advantage of other employees' reviews when considering new opportunities, and hoping to help others survey their job options. This month, though, she abruptly deleted her account after she contacted Glassdoor support to request help removing information from her account. She never expected that instead of removing information, Glassdoor's support team would take the real name that she provided in her support email and add it to her Glassdoor profile—despite Monica repeatedly and explicitly not consenting to Glassdoor storing her real name.

Although it's common for many online users to link services at sign-up to Facebook or Gmail accounts to verify identity and streamline logins, for years, Glassdoor has notably allowed users to sign up for its service anonymously. But in 2021, Glassdoor acquired Fishbowl, a professional networking app that integrated with Glassdoor last July. This acquisition meant that every Glassdoor user was automatically signed up for a Fishbowl account. And because Fishbowl requires users to verify their identities, Glassdoor's terms of service changed to require all users to be verified.

While users can remain anonymous, this change raises some potential concerns about data privacy and anonymity, Aaron Mackey, a lawyer for the Electronic Frontier Foundation (EFF), told Ars.

The EFF regularly defends Glassdoor users from being unmasked by retaliating employers. Particularly for employees who fear retaliation for reviews, Mackey said that Glassdoor users could historically choose never to share their real names, and the company now storing names for all users makes it much more likely that users could be linked to their reviews should Glassdoor's data ever be subpoenaed or leaked. That's what had Monica so concerned, too.

"Glassdoor now requires your real name and will add it to older accounts without your consent if they learn it, and your only option is to delete your account," Monica's blog warned. "They do not care that this puts people at risk with their employers. They do not care that this seems to run counter to their own data-privacy policies."

Monica soon discovered that deleting her Glassdoor account would not prevent them from storing her name, instead only deactivating her account. She decided to go through with a data erasure request, which Glassdoor estimated could take up to 30 days. In the meantime, her name remained on her profile, where it wasn't publicly available to employers but it could be used to link her to job reviews if Glassdoor introduced a bug in an update or data was ever breached, she feared.

"Since we require all users to have their names on their profiles, we will need to update your profile to reflect this," one Glassdoor employee wrote while reassuring her that "your anonymity will still be protected."

"No one has the ability to see your user profile and the contents within it, meaning no one, including your employer, will be able to see your details," Glassdoor's employee wrote.

"I do not consent," Monica responded. "I would delete my account before allowing that."

In a privacy policy, Glassdoor says, "if we have collected and processed your personal information with your consent, then you can withdraw your consent at any time," but Monica said Glassdoor did not give her the option and stored her name and recommended that she delete her account if she wanted her name removed. This would delete her reviews as well, employees confirmed. In response, Monica continued protesting the data storage, escalating her complaint to a Glassdoor manager who did not prove to be any more sympathetic than subordinates.

"I stand behind the decision that your name has to be placed on your profile and it cannot be reverted back to just your initials or nullified/anonymized from the platform," Glassdoor's manager wrote, confirming that Monica's case was now considered closed. "I am sorry that we disagree on this issue. We treat all users equally when it comes to what is eligible to be placed on the profile and what is not, but we know that there are times our users, such as yourself, may not always agree with us."

"You heard it from the manager of Glassdoor's community team: they treat all users equally badly," Monica's blog warned. "Soon my account will be gone. If you have one, you might consider doing the same."

Glassdoor defends populating user info

Glassdoor's spokesperson told Ars that Glassdoor does not comment on specific user accounts, only sharing a statement that does not seem to apply to Monica's situation.

"When a user provides information, either during the sign-up process or by uploading a resume, that information will automatically cross-populate between all Glassdoor services, including our community app Fishbowl," Glassdoor's spokesperson said. "When using Glassdoor and Fishbowl, there is always the option to remain anonymous. Users can choose to be fully anonymous or reveal elements of their identity, like company name or job title, while using our community service."

Monica told Ars that she never uploaded a resume or provided her name to Glassdoor. In her blog, she said that she would never share personally identifying information (PII) with the job review site because Glassdoor "storing my name along with that data puts me at risk."

"I pointed out that we've seen ample evidence that anybody with a juicy online database can be hacked, and the mere presence of that involuntary data was a problem," Monica's blog said.

"Data breaches are not uncommon these days, and anybody who works in tech knows that it's easy to introduce bugs when making software changes—and software is always undergoing change," Monica told Ars. "Even though reviews are supposed to be anonymous, having my name on the profile means that association is one JOIN away. That's a danger whether the threat is programming accidents or malicious attacks. And, frankly, a company with a policy of adding [personally identifiable information] without consent and over user objections is deeply concerning."

Mackey told Ars that there may be other risks to Glassdoor users. Employers could leverage real names or information used on Fishbowl to "potentially narrow and/or identify" Glassdoor reviewers. And the Fishbowl and Glassdoor data being combined means that information linking accounts could be subjected to legal requests, such as an employer subpoena or a law enforcement request for data.

Where before users "could take steps to make sure that no identifying information was in either of those things," that's "not the case now," Mackey said.

"I feel like what they're doing is sort of at cross purposes with the promises and goals of the Glassdoor review website," Mackey said. "If Glassdoor's purpose is really to empower employees to speak candidly about a variety of things that might occur in their work—whether that's the compensation, whether it's the working conditions, whether it's harassment or other workplace abuse—having the potential for your name to be associated with it, and having no choice but to provide Glassdoor with a real name is a problem. And it seems sort of counter to the whole values and animating purposes of Glassdoor's website."

Glassdoor sometimes adds inaccurate information

Today, when a legacy user returns to the Glassdoor site or a new user signs up, Glassdoor prompts users to input Fishbowl information, explaining why the information is being collected.

Ever since Glassdoor's integration with Fishbowl, Glassdoor's terms say that Glassdoor "may update your Profile with information we obtain from third parties. We may also use personal data you provide to us via your resume(s) or our other services." This effort to gather information on Fishbowl users includes Glassdoor staff consulting publicly available sources to verify information that is then used to update Glassdoor users' accounts.

Basically, if Glassdoor discovers an inaccuracy in a user's profile, such as a typo or misspelling, it will update users' profiles without notifying the user. Glassdoor views this verification as necessary so that Fishbowl users can be confident that the people they meet on the professional network are who they say they are.

As Monica's blog spread widely online, another Glassdoor user, Josh Simmons, commented to confirm that Glassdoor had "already auto-populated details" on his account, too. But instead of correcting Simmons' information, Glassdoor seemed to be adding in mistakes to his profile.

Simmons, who requested to use his real name and share his employer information, is a managing director of Matrix.org Foundation. He discovered that Glassdoor had not only messed up his employer's name but also claimed that he was based in London, while he is actually located in California.

"It was bizarre, because I had never provided that information, and it was a somewhat incoherent mix of details," Simmons told Ars.

Like Monica, Simmons requested that Glassdoor delete his data rather than remain on a site that might update his profile without notifying him of potentially inaccurate changes.

Monica told Ars that Glassdoor deleted her data in a few days, much faster than the 30-day estimate. The process to request data erasure was "a little unclear but not too hard," Monica said. But the process of deleting her Fishbowl account was less clear.

Glassdoor's support team told Monica that the only way to delete information from her Fishbowl account was to "download the Fishbowl app and log in with either a social connection, your work email, or phone number to gain access to your account."

Because Monica did not want to give Glassdoor more information just to delete information, she opted not to log into that account. Instead, she said in her blog that she found a "workaround" by submitting a form to delete her personal data, which Glassdoor confirmed would also delete the account.

"I received a (robo) message from Glassdoor saying my data deletion has been processed, and I was logged out in my browser where I'd been signed in," Monica told Ars in an email. "I'm a little leery of trying to log back in to confirm it's gone (don't want them recreating/restoring anything). As far as I can tell, my account is gone now, which should mean the profile is gone."

Glassdoor vows to defend users’ anonymity

The EFF's Mackey previously represented a Glassdoor user after their employer, a cryptocurrency exchange, attempted to unmask them after leaving an unfavorable review. In this case and other cases, including as recently as last week, Glassdoor has joined the EFF in fighting back against these requests, shielding reviewers from potential retaliation.

"Glassdoor has been second to none, for more than a decade in defending its users anonymity and privacy," Mackey told Ars. "They regularly would try to get kicked out legal claims for their users' speech when they believe that the user had a First Amendment right to speak about their employer. And they have done incredible work."

That's why Mackey said it was "disappointing to see that Glassdoor" is seemingly taking its business in a "different direction" with Fishbowl.

"The fact that there's no clear separation between the data and users on Fishbowl and Glassdoor just seems problematic," Mackey told Ars.

Glassdoor's spokesperson told Ars that "Glassdoor is committed to providing a platform for people to share their opinions and experiences about their jobs and companies, anonymously—without fear of intimidation or retaliation."

"We vigorously defend our users’ right to anonymous free speech and will appear in court to oppose and defeat requests for user information," Glassdoor's spokesperson said. "In fact, courts have almost always ruled in favor of Glassdoor and its users when we’ve fought to protect their anonymity. With the addition of Fishbowl’s community features to Glassdoor, our commitment to user privacy remains ironclad, and we will continue to defend our users from employers who seek to unmask their identity."

But Mackey suggested that the Fishbowl side of Glassdoor "is potentially" making it riskier to contribute to the legacy confidential review side.

"It's just concerning that they would sort of change this business model and potentially... put some of their users in a difficult position of either being identified via a government subpoena" or "a data breach or some other data security problem," Mackey said.

Source

Microsoft finally killing 1024-bit TLS so Windows stops loading old outdated shady web apps

Sat, 16 Mar 2024 17:24:13 +0000

Microsoft, over the last few years, has been making multiple announcements related to TLS (Transport Layer Security) updates and changes. Much of it is focused on making Windows a more secure OS.

The most recent changes were related to the deprecation of TLS 1.0 and 1.1 on upcoming Windows which the company announced in August last year, and earlier this year, the end of TLS 1.0, and 1.1 support for Azure Storage Accounts was also declared. Microsoft also issued a reminder later for the former as it is a major shift.

Following those, Microsoft has now announced that it will soon be ending support for RSA keys with lengths shorter than 2048 bits such that TLS server authentications will potentially be much more secure as future Windows versions should block old, outdated and potentially malicious websites and other web-based apps.

This update was long overdue as current modern standards and security-based best practices recommend at least a 2048-bit RSA (Rivest–Shamir–Adleman) or a 256-bit ECDSA (Elliptic Curve Digital Signature Algorithm) cryptographic key.

Compared to a 1024-bit RSA key, which provides 80 bits of security strength, a 2048-bit key provides 112-bit strength, and more in this case, means better.

On its website, Microsoft explains the update:

Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013, recommending specifically that RSA keys should have a key length of 2048 bits or longer.

This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows.

TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.

TLS and RSA-related updates aren't the only security changes Microsoft has had plans for. The company recently announced that it is updating its Windows 8-era Secure Boot keys. And in the recent past, the tech giant suggested more TPM-like security chip might be introduced, perhaps something like Pluton. Meanwhile, the Windows kernel is also getting a Rust-y makeover for better memory security.

Source

StopCrypt: Most widely distributed ransomware now evades detection

Fri, 15 Mar 2024 02:36:24 +0000

A new variant of StopCrypt ransomware (aka STOP) was spotted in the wild, employing a multi-stage execution process that involves shellcodes to evade security tools.

StopCrypt, also known as STOP Djvu, is the most widely distributed ransomware in existence that you rarely hear about.

While you constantly hear how big some ransomware operations are, such as LockBit, BlackCat, and Clop, you rarely hear security researchers discussing STOP.

That is because this ransomware operation does not typically target businesses but rather consumers, hoping to generate tens of thousands small $400 to $1,000 ransom payments instead of one large multi-million-dollar demand.

The ransomware is commonly distributed via malvertising and shady sites distributing adware bundles disguised as free software, game cheats and software cracks.

However, when these programs are installed, the users become infected with a variety of malware, including password stealing trojans and STOP ransomware.

This leads infected users to desperately reach out to security researchers, ransomware experts, and our 807-page STOP ransomware forum topic to try and receive help.

Since its original release in 2018, the ransomware encryptor has not changed much, with new versions mostly released to fix critical problems.

For this reason, when a new STOP version is released, it bears watching due to the large number of people who will be affected by it.

New multi-staged execution

SonicWall's threat research team has uncovered a new variant of the STOP ransomware (they call it StopCrypt) in the wild that now utilizes a multi-stage execution mechanism.

Initially, the malware loads a seemingly unrelated DLL file (msim32.dll), possibly as a diversion. It also implements a series of long time-delaying loops that may help bypass time-related security measures.

Next, it uses dynamically constructed API calls on the stack to allocate the necessary memory space for read/write and execution permissions, making detection harder.

StopCrypt uses API calls for various operations, including taking snapshots of running processes to understand the environment in which it's operating.

The next stage involves process hollowing, where StopCrypt hijacks legitimate processes and injects its payload for discreet execution in memory. This is done through a series of carefully orchestrated API calls that manipulate process memory and control flow.

Once the final payload is executed, a series of actions takes place to secure persistence for the ransomware, modify access control lists (ACLs) to deny users permission to delete important malware files and directories, and a scheduled task is created to execute the payload every five minutes.

StopCrypt's scheduled task (SonicWall)

Files are encrypted and a ".msjd" extension is appended to their new names. However, it should be noted that there are hundreds of extensions related to the STOP ransomware as they change them often.

Finally, a ransom note named "_readme.txt" is created in every impacted folder, giving victims instructions on paying the ransom for data retrieval.

Sample of a ransom note (Sonic Wall)

The evolution of StopCrypt into a more stealthy and powerful threat underscores a troubling trend in cybercrime.

Though StopCrypt's monetary demands aren't high and its operators do not perform data theft, the damage it can cause to many people could be significant.

Source

Tor launches WebTunnel Bridge as another way to bypass censorship

Thu, 14 Mar 2024 11:49:44 +0000

The Tor Project announced the immediate release of WebTunnel Bridge, a new way for Tor users to bypass censorship. Not all Tor users may fire up the official client to connect to the network and access content on the Internet that would otherwise be blocked.

Depending on the environment, default Tor browser and network connections may not work. This is a problem that so-called bridges attempt to solve. Think of a bridge as a way to access Tor indirectly. There are several options available, and the latest one is WebTunnel Bridge.

The main idea behind WebTunnel Bridge is to obfuscate anything that has to do with Tor. It is designed to look like regular encrypted web traffic using HTTPS. In other words, automated systems that monitor network connections for certain traits or patterns cannot link WebTunnel Bridge traffic to Tor.

Another positive feature of WebTunnel Bridge is that it can be configured to be on the same network endpoint as websites. Anyone checking the connection manually, by loading the address in a web browser or other tool, will notice that the website is being loaded. There is no indication that the same connection may also be used to fuel Tor.

The Tor Project says that this new way of circumventing censorship is ideal for environments that use protocol allow-lists and "a deny-by-default network environment".

Using WebTunnel Bridge

Using the WebTunnel Bridge is slightly more complicated than using Tor directly. Here are the required steps:

Visit this special Tor Project website. It is the Get Bridges page on the website, which allows you to gain access to bridges.
Select webtunnel from the menu on the page.
Activate the "Get Bridges" button.
Solve the captcha that is displayed.
Copy the bridge line.

Now switch to the Tor Browser application on the system. If you do not have Tor Browser installed, you may download it from the official download page.

It is available for desktop systems and for Android. Open the connection preferences with a click on "configure connection". There you need to activate the "add a Bridge manually" button and paste the bridge line into the form field. Select connect to start the connection process. The process is similar on Android.

Closing Words

The Tor Project is constantly looking for bridge operators. A support page is available that provides technical information on creating webtunnel bridges.

The new webtunnel option should help Tor users from around the world, especially in restrictive environments that block regular Tor use.

Source

The EU AI Act passed — here’s what comes next

Wed, 13 Mar 2024 16:16:40 +0000

The EU’s sweeping AI regulations have (almost) passed their final hurdle.

European Union lawmakers have officially approved the bloc’s landmark AI regulation, paving the way for the EU to prohibit certain uses of the technology and demand transparency from providers. In a majority vote on Wednesday, 523 European Parliament members elected to formally adopt the Artificial Intelligence Act (AI Act), and will now work towards its enforcement and implementation.

The AI Act has been hotly debated since it was first proposed in 2021, with some of its strictest regulations — such as a proposed total ban on biometric systems for mass public surveillance — being softened by last-minute compromises. While Wednesday’s announcement means the law has almost passed its final hurdle, it will still take years for some rules to be enforced.

The legal language of the text is still awaiting final approval, either via a separate announcement or a plenary session vote on April 10th/11th, with the AI Act then officially coming into force 20 days after it’s published in the Official Journal — which is anticipated to happen in May or June this year. Provisions will then take effect in stages: countries will have six months to ban prohibited AI systems, 12 months to enforce rules against “general-purpose AI systems” like chatbots, and up to 36 months for AI systems the law has designated as “high risk.”

Prohibited systems include things like social scoring, emotion recognition at work or schools, or systems that are designed to influence behavior or exploit user vulnerabilities. Examples of “high-risk” AI systems include those applied to critical infrastructure, education, and vocational training, certain law enforcement systems, and those that can be used to influence democratic processes like elections.

“In the very short run, the compromise on the EU AI Act won’t have much direct effect on established AI designers based in the US, because, by its terms, it probably won’t take effect until 2025,” said Paul Barrett back, deputy director of the NYU Stern Center for Business and Human Rights, back in December 2023 when the EU provisionally agreed on the landmark AI regulation. So for now, Barrett says major AI players like OpenAI, Microsoft, Google, and Meta will likely continue to fight for dominance, particularly as they navigate regulatory uncertainty in the US.

The AI Act got its start before the explosion in general-purpose AI (GPAI) tools like OpenAI’s GPT-4 large language model, and regulating them became a remarkably complicated sticking point in last-minute discussions. The act divides its rules on the level of risk an AI system has on society, or as the EU said in a statement, “the higher the risk, the stricter the rules.”

But some member states grew concerned that this strictness could make the EU an unattractive market for AI. France, Germany, and Italy all lobbied to water down restrictions on GPAI during negotiations. They won compromises, including limiting what can be considered “high-risk” systems, which would then be subject to some of the strictest rules. Instead of classifying all GPAI as high-risk, there will be a two-tier system and law enforcement exceptions for outright prohibited uses of AI like remote biometric identification.

That still hasn’t satisfied all critics. French President Emmanuel Macron attacked the rules, saying the AI Act creates a tough regulatory environment that hampers innovation. Barrett said some new European AI companies could find it challenging to raise capital with the current rules, which gives an advantage to American companies. Companies outside of Europe may even choose to avoid setting up shop in the region or block access to platforms so they don’t get fined for breaking the rules — a potential risk Europe has faced in the non-AI tech industry as well, following regulations like the Digital Markets Act and Digital Services Act.

But the rules also sidestep some of the most controversial issues around generative AI

AI models trained on publicly available — but sensitive and potentially copyrighted — data have become a big point of contention for organizations, for instance. The approved rules, however, do not create new laws around data collection. While the EU pioneered data protection laws through GDPR, its AI rules do not prohibit companies from gathering information, beyond requiring that it follow GDPR guidelines.

“Under the rules, companies may have to provide a transparency summary or data nutrition labels,” Susan Ariel Aaronson, director of the Digital Trade and Data Governance Hub and a research professor of international affairs at George Washington University said when the EU provisionally approved the rules. “But it’s not really going to change the behavior of companies around data.”

Aaronson points out that the AI Act still hasn’t clarified how companies should treat copyrighted material that’s part of model training data, beyond stating that developers should follow existing copyright laws (which leave lots of gray areas around AI). So it offers no incentive for AI model developers to avoid using copyrighted data.

The AI Act also won’t apply its potentially stiff fines to open-source developers, researchers, and smaller companies working further down the value chain — a decision that’s been lauded by open-source developers in the field. GitHub chief legal officer Shelley McKinley said it is “a positive development for open innovation and developers working to help solve some of society’s most pressing problems.” (GitHub, a popular open-source development hub, is a subsidiary of Microsoft.)

Observers think the most concrete impact could be pressuring other political figures, particularly American policymakers, to move faster. It’s not the first major regulatory framework for AI — in July, China passed guidelines for businesses that want to sell AI services to the public. But the EU’s relatively transparent and heavily debated development process has given the AI industry a sense of what to expect. Aaronson said the provisional text (which has since been approved) at least shows that the EU has listened and responded to public concerns around the technology.

Lothar Determann, data privacy and information technology partner at law firm Baker McKenzie, says the fact that it builds on existing data rules could also encourage governments to take stock of what regulations they have in place. And Blake Brannon, chief strategy officer at data privacy platform OneTrust, said more mature AI companies set up privacy protection guidelines in compliance with laws like GDPR and in anticipation of stricter policies. He said that depending on the company, the AI Act is “an additional sprinkle” to strategies already in place.

The US, by contrast, has largely failed to get AI regulation off the ground — despite being home to major players like Meta, Amazon, Adobe, Google, Nvidia, and OpenAI. Its biggest move so far has been a Biden administration executive order directing government agencies to develop safety standards and build on voluntary, non-binding agreements signed by large AI players. The few bills introduced in the Senate have mostly revolved around deepfakes and watermarking, and the closed-door AI forums held by Sen. Chuck Schumer (D-NY) have offered little clarity on the government’s direction in governing the technology.

Now, policymakers may look at the EU’s approach and take lessons from it

This doesn’t mean the US will take the same risk-based approach, but it may look to expand data transparency rules or allow GPAI models a little more leniency.

Navrina Singh, founder of Credo AI and a national AI advisory committee member, believes that while the AI Act is a huge moment for AI governance, things will not change rapidly, and there’s still a ton of work ahead.

“The focus for regulators on both sides of the Atlantic should be on assisting organizations of all sizes in the safe design, development, and deployment of AI that are both transparent and accountable,” Singh told The Verge in December. She adds there’s still a lack of standards and benchmarking processes, particularly around transparency.

The act does not retroactively regulate existing models or apps, but future versions of OpenAI’s GPT, Meta’s Llama, or Google’s Gemini will need to take into account the transparency requirements set by the EU. It may not produce dramatic changes overnight — but it demonstrates where the EU stands on AI.

Update March 12th, 8:30ET AM: Updated the original article following the EU Act being officially adopted.

Source

Five reasons antivirus has gotten worse

Tue, 12 Mar 2024 18:58:26 +0000

Third-party antivirus has slowly fallen out of favour with users. But what happened to make this software lose users' trust?

KEY TAKEAWAYS

Removing viruses is harder now due to their complexity and the need for isolating and reinstalling operating systems.
Windows Defender has greatly improved over the years and can now compete with third-party antivirus programs effectively.
Antivirus software has become bloated with unnecessary services like VPNs, while slowing down PCs and undermining its own effectiveness.

Antivirus used to be a mainstay of any home desktop. Software like McAfee was basically essential, and weekly virus scans were a feature of lots of people's early experience of 2000's home computers. But in the last decade, third-party antivirus has all but disappeared as a requirement for a new PC, and it seems less effective than ever at stopping legitimate threats to your PC, all while getting slower, more bloated and increasingly expensive. But what happened to antivirus? How did a once commonplace bit of software end up in relative obscurity? Here are five reasons why we think antivirus has gotten worse.

1. Viruses are more complex

Simply removing a virus isn't as easy as it used to be

One key reason why antivirus software isn't as popular as it used to be is that it's fundamentally become far less effective. In the past, antivirus software had a decent chance at identifying a malicious binary or a bit of software once it was running, isolating the process, and removing any associated files it had opened. This was often enough to isolate and remove a relatively simple bit of malware, though it was always far from foolproof. However, as the potential for profitable exploitation has exploded (the rise of internet banking hasn't helped), the complexity of malware has also ballooned, making it far more difficult to remove malware once it's active on a machine.

Modern malware can use any number of exploits, techniques, and tricks to not only obfuscate its function, but to lodge itself into an operating system in a way that's extremely difficult to detect or remove. This is why, in recent years, it's become commonplace advice to physically isolate any infected PC from your network and reinstall your operating system entirely. In the case of rootkits, it may even be needed to entirely dispose of an affected PC.

This has been standard in corporate circles for a while — any affected devices would likely be nuked (or disposed of and replaced) and a full digital-forensic investigation launched to isolate any other devices that may have had contact with an affected device.

In recent years, it's become commonplace advice to physically isolate any infected PC from your network and reinstall your operating system entirely

2. Windows Defender has gotten better

First-party antivirus will always have an advantage

Source: Microsoft

Microsoft introduced Security Essentials in 2009, designed as a lightweight replacement for the aging Windows Defender which shipped with Windows XP. While praised for being lightweight and easy to use, Security Essentials was often deficient at detecting malware. Windows 8 then essentially rebranded version of Security Essentials, once again named as Windows Defender (confusing, right?), which has slowly become the total 'Windows Security' package we have on Windows today.

However, despite significant failings in the early 2010's (Security Essentials was often considered effectively moot at actually detecting malware), Windows Defender has slowly improved over the last few years, and as of December 2023 has received a similar outstanding score in all categories from av-test.org's continuous antivirus analysis tests. This is in comparison to the same site's tests in December 2012, which gave Microsoft Security Essentials a mere 1.5/6 for protection.

While Windows Defender might not be the best antivirus on the market, it's easily good enough in comparison to its competition that, for most people, the extra hassle and cost of installing a third-party product was simply no longer worth it.

3. Rising number of threats

More malware means more work to counter it.

Source: AV-Atlas

Another problem facing antivirus companies has been a rising number of threats. As the internet has been used more and more as the backbone of many of our social and financial lives, the profitability and range of targets for exploitation has exploded. Zero-day vulnerabilities are now worth millions in common software, as their potential is huge. In comparison, while being affected by a virus in the 2000s might cost you some family photos, it was unlikely to lead to extensive financial fraud or your credit card details being leaked online.

This larger target has grown the number of malicious actors attempting to exploit machines constantly, and while most big companies (and some governments) have bug-bounty programs to counter this, there are still new exploits, zero-day attacks and forms of malware being developed all the time. Keeping on top of the detection, fingerprinting, and signature analysis of these programs required for a lot of antivirus has become an increasingly difficult job for any antivirus company. Dynamic analysis tools based on machine learning and intelligent threat detection have helped this, but they're far from foolproof.

4. Antivirus software is bloated

Development is expensive; it's much easier to upsell a VPN

As the effectiveness of antivirus software has declined, along with the number of people installing it, antivirus companies have looked for other ways to improve profitability. This has often involved bundling their products with other services not related to malware, like web filtering, VPNs, parental controls and online identity protection. These services can be useful, but are often bundled as part of bloated subscriptions and desktop applications. While this bloat may seem like a good idea, over time it's helped garner a reputation for antivirus software as effectively bloatware, not significantly better than your operating system's default antivirus and often pre-installed on lower-end laptops to help keep the store price low. These applications also gained reputations for being difficult to uninstall, with multiple steps required and plenty of "are you really sure?" prompts designed to scare users into keeping the software on their PC.

This hasn't been helped by some more nefarious practices, including free antivirus products quietly selling your browsing data, or even crypto-mining in the background on your PC. While there are good antiviruses out there, this reputational damage to the category as a whole has had an impact. There was also the push for antivirus on phones, which seems to have largely died out now.

5. Antivirus software slows your PC down

Antivirus has a bad reputation for slow scans

Source: Tom's Guide

It is impossible for antivirus to avoid having a performance hit on your PC (running just about anything will), but this issue is a combination of a bad reputation and the inevitability of some form of performance hit. Tom's Guide have previously investigated the performance impact of antivirus, with their results showing that even the best antivirus can slow your PC down by a single-digit percentage passively. While scans have become much more efficient (helped by the much faster random-access storage available on many laptops and PCs now), they can still have a significant performance impact. Antivirus has gotten smarter and is often now aware enough to start-stop scans when you're using your PC or not, and identify opportune moments to scan files, but this isn't foolproof.

None of this is again helped by the reputation of bloatware-antivirus from the 2000/2010's, which could grind most budget laptops to a halt for hours trawling through your OS install directories.

Antivirus products lost their way, but it's still kicking

There's still space in the market for third-party antivirus, and while we don't recommend it as a necessity for new PCs (provided you have your Windows security features enabled), it is still nice to have an added layer of protection. But antivirus got muddled somewhere, becoming pre-bundled scareware that could force your PC to a halt with horrible desktop applications and performance-choking scans. But there remains plenty of great antivirus software out there though. Just be careful to do your research and only pay for features that are actually keeping you safe.

Source

Never-before-seen Linux malware gets installed using 1-day exploits

Tue, 12 Mar 2024 07:38:19 +0000

Discovery means that NerbianRAT is cross-platform used by for-profit threat group.

Researchers have unearthed Linux malware that circulated in the wild for at least two years before being identified as a credential stealer that’s installed by the exploitation of recently patched vulnerabilities.

The newly identified malware is a Linux variant of NerbianRAT, a remote access Trojan first described in 2022 by researchers at security firm Proofpoint. Last Friday, Checkpoint Research revealed that the Linux version has existed since at least the same year, when it was uploaded to the VirusTotal malware identification site. Checkpoint went on to conclude that Magnet Goblin—the name the security firm uses to track the financially motivated threat actor using the malware—has installed it by exploiting “1-days,” which are recently patched vulnerabilities. Attackers in this scenario reverse engineer security updates, or copy associated proof-of-concept exploits, for use against devices that have yet to install the patches.

Checkpoint also identified MiniNerbian, a smaller version of NerbianRAT for Linux that’s used to backdoor servers running the Magento ecommerce server, primarily for use as command and control servers that devices infected by NerbianRAT connect to. Researchers elsewhere have reported encountering servers that appear to have been compromised with MiniNerbian, but Checkpoint Research appears to have been the first to identify the underlying binary.

“Magnet Goblin, whose campaigns appear to be financially motivated, has been quick to adopt 1-day vulnerabilities to deliver their custom Linux malware, NerbianRAT and MiniNerbian,” Checkpoint researchers wrote. “Those tools have operated under the radar as they mostly reside on edge-devices. This is part of an ongoing trend for threat actors to target areas which until now have been left unprotected.”

Checkpoint discovered the Linux malware while researching recent attacks that exploit critical vulnerabilities in Ivanti Secure Connect, which have been under mass exploitation since early January. In the past, Magnet Goblin has installed the malware by exploiting one-day vulnerabilities in Magento, Qlink Sense, and possibly Apache ActiveMQ.

In the course of its investigation into the Ivanti exploitation, Checkpoint found the Linux version of NerbianRAT on compromised servers that were under the control of Magnet Goblin. URLs included:

http://94.156.71[.]115/lxrt
http://91.92.240[.]113/aparche2
http://45.9.149[.]215/aparche2

The Linux variants connect back to the attacker-controlled IP 172.86.66[.]165.

Besides deploying NerbianRAT, Magnet Goblin also installed a custom variant of malware tracked as WarpWire, a piece of stealer malware recently reported by security firm Mandiant. The variant Checkpoint encountered stole VPN credentials and sent them to a server at the domain miltonhouse[.]nl.

Checkpoint Research

NerbianRAT Windows featured robust code that took pains to hide itself and to prevent reverse engineering by rivals or researchers.

“Unlike its Windows equivalent, the Linux version barely has any protective measures,” Checkpoint said. “It is sloppily compiled with DWARF debugging information, which allows researchers to view, among other things, function names and global variable names.”

The report continued:

Upon its initial execution, the backdoor goes through a duplicate process check, which is carried out by allocating shared memory segments. If it succeeds, it forks itself, which is the only anti-debugging/anti-analysis trick embedded within the malware. Following this check, NerbianRAT begins the main initialization process.

Figure 6 – NerbianRAT main function.

Checkpoint Research

Initialization

In its initialization, the malware follows several steps:

Collects basic information, including the current time, username, and machine name.

Generates a bot ID using a combination of the value of the file /etc/machine-id and the current process ID.

Loads a hardcoded IP address (172.86.66.165) into two global variables, the primary and secondary host.

Decrypts the global working directory variable and sets it as %TEMP%.

Searches for the file rgs_c.txt, reads its contents and tries to parse it as the following arguments: -pP port -h host

Loads a public RSA key that is later used to encrypt the network communication.

Configuration

Following its initialization, Nerbian continues to load its configuration from the file tmp/debconf.socket. It is encrypted in AES using a hard-coded key and 16 null bytes as the IV. The configuration itself contains a broad set of values, which demonstrates the threat actor’s efforts to customize the backdoor.

Figure 7 – NerbianRAT configuration variables.

Checkpoint Research

The NerbianRAT Linux variant configuration is similar to the Windows version. Much of the configuration is dedicated to the malware C2 mechanisms, determining the backdoors hours of activity, how often it reaches out to its C2 server, and similar functions. For example, the parameters start_worktime and end_worktime are used to determine the hours in which NerbianRAT attempts to connect to its C2 server.

After loading the config file, the working directory is enforced to /tmp/ and the global variable primary host is set based on the b_use_secondary_host config field type. It then proceeds to communicate with its C2.

Command and Control

Unlike the Windows variant, the Linux NerbianRAT utilizes raw TCP sockets, sending data blobs represented by structs back and forth in a custom protocol. This means that the C2 server logic is also rewritten so it can communicate with this version of the backdoor. AES encryption is used as the main encryption when communicating with the C2, although depending on the data transmitted, RSA can also be leveraged.

The bot runs in two possible states:

If the time is not during the working hours stated in the config, but the b_use_alive_signal field on the config is set, it continuously sends a ping to the C2 server containing the data collected earlier and some of the config fields.

If the time is during the working hours (calculated by converting the current time to UTC and then checking the hour field and comparing it to the config fields), it sends the C2 the same data mentioned above. If the server approves of that data, it sends a valid action for the backdoor to execute.

There are the conditions which must be met for the buffer received from the C2 server to be valid:

It should start with the magic 4r3f0 and then the AES encrypted buffer.

After decryption, the first 4 bytes of the buffer should contain the null-terminated string cmd.
If all of those conditions are met, the data is parsed and will result in one of the following actions:

Action ID Action description

1 Continue requesting more actions.

4 Run a Linux command in a separate thread.

5 Send the last command result and clean up the result file. ** If a command is running it is stopped.

6 Run a Linux command immediately.

7 Do nothing / Idle command.

8 Change the connection interval global variable.

9 Update the start and end worktimes, then save the config file.

14 Send back the idle status timings string / the configuration / results of the last run Linux command.

15 Set a config variable, based on the name of the field and a value.

16 Update the gl_command_buffer global variable, used when executing commands from the C2.

Action ID	Action description
1	Continue requesting more actions.
4	Run a Linux command in a separate thread.
5	Send the last command result and clean up the result file. ** If a command is running it is stopped.
6	Run a Linux command immediately.
7	Do nothing / Idle command.
8	Change the connection interval global variable.
9	Update the start and end worktimes, then save the config file.
14	Send back the idle status timings string / the configuration / results of the last run Linux command.
15	Set a config variable, based on the name of the field and a value.
16	Update the gl_command_buffer global variable, used when executing commands from the C2.

Meanwhile, MiniNerbian is a simplified version of NerbianRAT that uses much of the same source code. At the same time, it’s a distinct piece of malware rather than a copy of NerbianRAT with certain parts excised.

“One of the main differences is the MiniNerbian communication method, which uses HTTP and passes data by sending POST requests to /dashboard/ endpoint. In contrast, NerbianRAT sends data over raw sockets,” Checkpoint said. MiniNerbian supports only three actions, as described in these functions:

system_cmd – A request command by the C2 is executed and returned to the server.
time_flag_change – The malware updates its internal time flag, with two possible returns to the C2 depending on the flag state:
- Time flag has changed, Now it works for whole day..
- Time flag has changed, Now it works only certain times everyday.... Similar to the Nerbian backdoor, this “mini” version also only is active at certain hours.
core_config_set – This allows the MiniNerbian backdoor config to be updated.

The report provides indicators of compromise that people can use to determine if they’ve been targeted in the campaign.

Source

KeePassXC adds support for Passkeys, improves database import from Bitwarden and 1Password

Mon, 11 Mar 2024 08:21:52 +0000

KeePassXC has been updated to 2.7.7. The latest version of the open source password manager adds support for Passkeys, and has gained the ability to import your vault data from Bitwarden.

Passkeys in KeePassXC

Several password managers have added support for Passkeys over the past year, including Bitwarden, 1Password, Dashlane, Google Password Manager, Apple iCloud Keychain, even Windows 11 supports it. KeePassXC is the latest to join the party to support the phishing-resistant protocol created by FIDO.

An important thing to note here is that this is not a standalone feature, it requires you to install the KeePassXC browser extension, which works in tandem with the desktop program. Download the KeePassXC browser extension for Firefox, Chrome or Edge.

In order to use it, you will also need to "Enable Passkeys" in the extension's settings. To access the Passkeys stored in the application, head to the Database > Passkeys. Go to a website that supports Passkeys, for example, Google. Choose the "create a passkey" option, and select "Use another device". You should see a pop-up from the KeePassXC browser extension that asks you to save the passkey, click on "Register".

This will save the digital security key to your vault, you can find it saved as a new entry in your database, it has the word "Passkey" in the name. In the test scenario, it was saved as KeePassXC-Browser Passwords / Google (Passkey).

The password manager app also allows you to import existing Passkeys stored on your computer (.Passkey files). Once you have saved a Passkey in KeePassXC, you will be able to log in to websites without using a password.

This works across browsers, so if you created a Passkey using the KeePassXC add-on for Firefox, it will be available in Chrome or Edge, as long as you have the extension for the browsers and have connected them to the vault. Refer to the official documentation for more details about the feature.

Import passwords from Bitwarden

KeePassXC now allows you to import your database from Bitwarden. The option to add the JSON format is available under a new Import Wizard that you can access from the Database > Import menu.

KeePassXC has allowed users to migrate from 1Password for a long time, but the older versions of the password manager used the OPVault format to import the data. The latest version of KeePassXC adds support for 1Password's export format, 1PUX. You may choose to import the data to an existing database, or create a new one. Other options that are available in the import wizard include support for CSV and KDB formats.

Easier database unlock for hardware keys

The announcement for KeePassXC 2.7.7 says that the program has improved the database unlock experience for hardware security keys such as YubiKey, OnlyKey. You no longer need to choose the hardware key or key file after entering your master password, in fact, the fields for both options have been removed from the login pop-up. The program now detects the devices automatically, all you need to do is plug in your hardware key into your computer. The feature also supports NFC readers and key files, though you will need to use the "select file" option to unlock the vault.

Download KeePassXC 2.7.7 for Windows, macOS and Linux from GitHub. You can also get it from the Microsoft Store.

Do you use a password manager for Passkeys?

Source

The Week in Ransomware - March 8th 2024 - Waiting for the BlackCat rebrand

Sat, 09 Mar 2024 06:36:58 +0000

We saw another ransomware operation shut down this week after first getting breached by law enforcement and then targeting critical infrastructure, putting them further in the spotlight of the US government.

What makes this strange is that this seems to be a common routine for the DarkSide, I mean BlackCat/ALPHV, ransomware operation which tends to hit critical infrastructure, and then realize it was a big mistake.

As it was, they were already being targeted by an international law enforcement operation, allowing the FBI to hack the gang's servers for months while collecting data, decryptors, and ultimately, seizing the domain of the data leak site.

While the Tor onion domain seizure was a game of tug of war between the FBI and BlackCat, instead of shutting down, the ransomware gang decided to continue operating and vowed to target US critical infrastructure in revenge.

Approximately two months later, one of their affiliates attacked UnitedHealth Group's Change Healthcare, a technology solutions company used by many pharmacies, doctor's offices, and hospitals for billing claims for healthcare and prescriptions.

This attack led to severe disruption in the US healthcare system, preventing pharmacies from accepting insurance and discount cards and, in some cases, causing patients to pay full price for medicine.

Similar to their attack on Colonial Pipeline as DarkSide, which led to them to shut down, their rebrand as BlackCat/ALPHV has now shut down after the Change Healthcare attack.

According to an affiliate, Optum, Change Healthcare's parent company and a subsidiary of UnitedHealth, paid a $22 million ransom to the ransomware operation to prevent the leaking of stolen data and to receive a file decryptor.

However, this affiliate says that BlackCat stole the ransom and did not transfer over a share of the payment, stating it was seized by the "feds."

In reality, BlackCat performed an exit scam where they stole the ransom, blamed law enforcement, and shut down, stating that they do not want to be in court again.

Unfortunately, it is only a matter of time before we see the ransomware operation rebrand under a new name to repeat this cycle.

In other news, the Stormous ransomware gang attacked the Duvel Belgian beer maker, which many consider critical infrastructure.

Finally, the Swiss government also warned that 65,000 of its documents were leaked as part of a Play ransomware attack on Xplain.

Contributors and those who provided new ransomware information and stories this week include @demonslay335, @Seifreed, @fwosar, @malwrhunterteam, @billtoulas, @BleepinComputer, @LawrenceAbrams, @serghei, @Ionut_Ilascu, @ddd1ms, @uuallan, @AShukuhi, @BrettCallow, @BushidoToken, @JBurnsKoven, @Jon__DiMaggio, @ValeryMarchive, @UK_Daniel_Card, @AlexMartin, @TalosSecurity, @CarlyPage_, and @pcrisk.

March 4th 2024

BlackCat ransomware turns off servers amid claim they stole $22 million ransom

The ALPHV/BlackCat ransomware gang has shut down its servers amid claims that they scammed the affiliate responsible for the attack on Optum, the operator of the Change Healthcare platform, of $22 million.

Should we ban ransom payments?

As cybercriminals continue to reap the financial rewards of their attacks, talk of a federal ban on ransom payments is getting louder.

New STOP ransomware variants

PCrisk found new STOP ransomware variants that append the .wisz and .wiaw extensions.

New SkyNet ransomware variant

PCrisk found a SkyNet variant that appends the .payuranson extension and drops a ransom note named SkynetData.txt.

March 5th 2024

BlackCat ransomware shuts down in exit scam, blames the "feds"

The BlackCat ransomware gang is pulling an exit scam, trying to shut down and run off with affiliates’ money by pretending the FBI seized their site and infrastructure.

GhostSec’s joint ransomware operation and evolution of their arsenal

Talos observed the GhostSec and Stormous ransomware groups operating together to conduct several double extortion attacks using the GhostLocker and StormousX ransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessment of the disclosure messages posted by the group in their Telegram channels and Stormous ransomware data leak site.

New Makop ransomware variant

PCrisk found a Makop variant that appends the .reload extension and drops a ransom note named +README-WARNING+.txt.

March 6th 2024

Duvel says it has "more than enough" beer after ransomware attack

Duvel Moortgat Brewery was hit by a ransomware attack late last night, bringing to a halt the beer production in the company's bottling facilities.

Capita, company providing UK’s nuclear submarine training, confirms ‘cyber incident’

Capita, the United Kingdom’s largest outsourcing company, confirmed Monday that an IT outage which left staff locked out of their accounts on Friday was caused by “a cyber incident.”

New MedusaLocker ransomware variants

PCrisk found new MedusaLocker variants that append the .genesis15 and .duralock05 extensions and drop a ransom note named HOW_TO_BACK_FILES.html.

March 7th 2024

FBI: U.S. lost record $12.5 billion to online crime in 2023

FBI's Internet Crime Complaint Center (IC3) has released its 2023 Internet Crime Report, which recorded a 22% increase in reported losses compared to 2022, amounting to a record of $12.5 billion.

Switzerland: Play ransomware leaked 65,000 government documents

The National Cyber Security Centre (NCSC) of Switzerland has released a report on its analysis of a data breach following a ransomware attack on Xplain, disclosing that the incident impacted thousands of sensitive Federal government files.

LockBit: How the franchise is trying to stage a comeback

Since the Cronos legal operation, the LockBit 3.0 mafia franchise has endeavored to convince that business continues as if nothing had happened. Examination of his claims shows a very different reality.

March 8th 2024

UnitedHealth brings some Change Healthcare pharmacy services back online

Optum's Change Healthcare has started to bring systems back online after suffering a crippling BlackCat ransomware attack last month that led to widespread disruption to the US healthcare system.

That's it for this week! Hope everyone has a nice weekend!

Contributors and those who provided new ransomware information and stories this week include: @demonslay335, @Seifreed, @fwosar, @malwrhunterteam, @billtoulas, @BleepinComputer, @LawrenceAbrams, @serghei, @Ionut_Ilascu, @ddd1ms, @uuallan, @AShukuhi, @BrettCallow, @BushidoToken, @JBurnsKoven, @Jon__DiMaggio, @ValeryMarchive, @UK_Daniel_Card, @AlexMartin, @TalosSecurity, @CarlyPage_, and @pcrisk

March 4th 2024

BlackCat ransomware turns off servers amid claim they stole $22 million ransom

Should we ban ransom payments?

As cybercriminals continue to reap the financial rewards of their attacks, talk of a federal ban on ransom payments is getting louder.

New STOP ransomware variants

PCrisk found new STOP ransomware variants that append the .wisz and .wiaw extensions.

New SkyNet ransomware variant

PCrisk found a SkyNet variant that appends the .payuranson extension and drops a ransom note named SkynetData.txt.

March 5th 2024

BlackCat ransomware shuts down in exit scam, blames the "feds"

The BlackCat ransomware gang is pulling an exit scam, trying to shut down and run off with affiliates’ money by pretending the FBI seized their site and infrastructure.

GhostSec’s joint ransomware operation and evolution of their arsenal

New Makop ransomware variant

PCrisk found a Makop variant that appends the .reload extension and drops a ransom note named +README-WARNING+.txt.

March 6th 2024

Duvel says it has "more than enough" beer after ransomware attack

Duvel Moortgat Brewery was hit by a ransomware attack late last night, bringing to a halt the beer production in the company's bottling facilities.

Capita, company providing UK’s nuclear submarine training, confirms ‘cyber incident’

Capita, the United Kingdom’s largest outsourcing company, confirmed Monday that an IT outage which left staff locked out of their accounts on Friday was caused by “a cyber incident.”

New MedusaLocker ransomware variants

PCrisk found new MedusaLocker variants that append the .genesis15 and .duralock05 extensions and drop a ransom note named HOW_TO_BACK_FILES.html.

March 7th 2024

FBI: U.S. lost record $12.5 billion to online crime in 2023

FBI's Internet Crime Complaint Center (IC3) has released its 2023 Internet Crime Report, which recorded a 22% increase in reported losses compared to 2022, amounting to a record of $12.5 billion.

Switzerland: Play ransomware leaked 65,000 government documents

LockBit: How the franchise is trying to stage a comeback

March 8th 2024

UnitedHealth brings some Change Healthcare pharmacy services back online

Optum's Change Healthcare has started to bring systems back online after suffering a crippling BlackCat ransomware attack last month that led to widespread disruption to the US healthcare system.

That's it for this week! Hope everyone has a nice weekend!

Source

Microsoft says it's struggling to fight off Russian cyberspies who stole company secrets

Fri, 08 Mar 2024 21:59:02 +0000

Microsoft is heavily relied upon by the U.S. government and is conducting high-level AI research

Microsoft is still struggling to keep out the Russian cyberspies that gained high-level access to the company late last year, the company announced Friday.

Those hackers have in recent weeks gained access to some key company secrets, including digital vaults where the company keeps source code for some of its programs, the company said in a blog post.

Microsoft said the hackers are members of a group that the cybersecurity industry and U.S. and U.K. government agencies widely associated with Russia’s SVR intelligence agency, which is roughly analogous with the U.S. National Security Agency. The U.S. has said the SVR was responsible for the SolarWinds hacking campaign of 2020, one of the most expansive and successful cyberespionage campaigns against the U.S. government discovered to date.

A spokesperson for Russia’s Ministry of Foreign Affairs didn’t immediately respond to a request for comment.

The extent of valuable information that the hackers took is unclear, and a Microsoft spokesperson declined to share more information.

But the ongoing hacking campaign is particularly noteworthy because Microsoft plays a crucial role in the U.S. Federal government systems and the company’s artificial intelligence research is some of the most advanced in the world.

Adam Meyers, the senior vice president for counteradversary operations at the cybersecurity company Crowdstrike, said that the type of valuable government information that Microsoft holds could be ripe for Russian influence operations aimed at destabilizing the country’s targets.

“What is significant here is that Microsoft has a tremendous amount of data of the United States government and other governments,” Meyers said.

“If you think about the Russia angle, their goal is to try to drive a wedge in NATO, members of the European Union, in the United States to try and cause dissension and chaos and confusion,” he said.

Microsoft announced in January that it had discovered an ongoing hacking campaign that began in November. To gain access, the hackers relied on a crude technique, known as password spraying, of repeatedly trying username and password combinations in order to break into an account that had significant administrative authority.

The hackers were able to quickly gain access to the email accounts of some key Microsoft employees, including senior corporate leadership, legal teams and those who researched foreign cyberspies like the SVR, the company said at the time.

Since then, the problem has only grown more severe, the company said. Password spraying increased by tenfold from February to March, Microsoft said, and it appears that the hackers have been able to use what they initially learned to discover other weaknesses in the company’s systems.

In an emailed statement, a senior official at the U.S. Cybersecurity and Infrastructure Security Agency, Eric Goldstein, said the agency “remains closely engaged with Microsoft to understand this intrusion campaign and provide all necessary assistance to impacted organizations, including Microsoft customers.”

Source

Hacked WordPress sites use visitors' browsers to hack other sites

Thu, 07 Mar 2024 03:03:29 +0000

Hackers are conducting widescale attacks on WordPress sites to inject scripts that force visitors' browsers to bruteforce passwords for other sites.

The campaign was first spotted by website cybersecurity firm Sucuri, which has been tracking a threat actor known for breaching sites to inject crypto wallet drainer scripts.

Crypto wallet drainers are malicious scripts that steal all cryptocurrency and assets when someone connects their wallet.

When people visit these compromised sites, the scripts display misleading messages to convince users to connect their wallets to the site. However, once they do so, the scripts steal all the contained assets.

These scripts have become very common over the past year, with threat actors creating fake Web3 sites with wallet drainers. They then hack X accounts, create YouTube videos, or take out Google and X advertisements to promote the sites and steal visitor's cryptocurrency.

Sucuri researchers reported that the threat actors were breaching compromised WordPress sites to inject the AngelDrainer wallet drainer in multiple waves from multiple URLs, the last being 'dynamiclink[.]lol/cachingjs/turboturbo.js.'

In late February, the threat actor switched from wallet draining to hijacking visitors' browsers to bruteforce other WordPress sites. using a malicious script from a newly registered domain 'dynamic-linx[.]com/chx.js'.

Building a bruteforce army

According to a new report from Sucuri, the threat actor is using compromised WordPress sites to load scripts that force visitors' browsers to conduct bruteforce attacks for account credentials on other websites.

A bruteforce attack is when a threat actor attempts to log in to an account using different passwords to guess the correct one. With the credentials, the threat actor can steal data, inject malicious scripts, or encrypt files on the site.

As part of this hacking campaign, the threat actors compromise a WordPress site to inject malicious code into the HTML templates. When visitors access the website, the scripts are loaded in their browser from https://dynamic-linx[.]com/chx.js.

These scripts will cause the browser to quietly contact the threat actors' server at 'https://dynamic-linx[.]com/getTask.php' to receive a password bruteforcing task.

This task comes in the form of a JSON file containing the parameters for the bruteforce attack: an ID, the website URL, account name, a number denoting the current batch of passwords to go through, and one hundred passwords to try.

Example bruteforce JSON task

Source: BleepingComputer

Once the task is received, the script will cause the visitor's browser to quietly upload a file using the WordPress site's XMLRPC interface using the account name and passwords in the JSON data.

If a password is accurate, the script will notify the threat actor's server that a password was found for the site. The hacker can then connect to the site to retrieve the uploaded file containing the base64 encoded username and password pair.

Script causing browser to bruteforce a website's credentials

Source: BleepingComputer

As long as the page remains open, the malicious script will cause the web browser to repeatedly connect back to the attacker's server and retrieve a new task to execute.

According to the HTML source code search engine PublicHTML, there are currently over 1,700 sites hacked with these scripts or their loaders, providing a massive pool of users who will be unwittingly conscripted into this distributed bruteforce army.

CronUp researcher Germán Fernández found that the website of Ecuador's Association of Private Banks was compromised in this campaign, acting as a watering hole for unsuspecting visitors.

It is unclear why the threat actors switched from injecting crypto wallet drainers to bruteforcing other sites. However, Sucuri believes it is to build a more extensive portfolio of sites from which to launch further attacks at a larger scale, such as crypto-draining attacks.

"Most likely, they realized that at their scale of infection (~1000 compromised sites) the crypto drainers are not very profitable yet," concluded Sucuri researcher Denis Sinegubko.

"Moreover, they draw too much attention and their domains get blocked pretty quickly. So, it appears reasonable to switch the payload with something stealthier, that at the same time can help increase their portfolio of compromised sites for future waves of infections that they will be able to monetize in one way or another."

Source

Spain tells Sam Altman, Worldcoin to shut down its eyeball-scanning orbs

Wed, 06 Mar 2024 16:53:12 +0000

Cryptocurrency launched by OpenAI's Altman is drawing scrutiny from regulators.

Worldcoin's "Orb," a device that scans your eyeballs to verify that you're a real human.

Spain has moved to block Sam Altman’s cryptocurrency project Worldcoin, the latest blow to a venture that has raised controversy in multiple countries by collecting customers’ personal data using an eyeball-scanning “orb.”

The AEPD, Spain’s data protection regulator, has demanded that Worldcoin immediately ceases collecting personal information in the country via the scans and that it stops using data it has already gathered.

The regulator announced on Wednesday that it had taken the “precautionary measure” at the start of the week and had given Worldcoin 72 hours to demonstrate its compliance with the order.

Mar España Martí, AEPD director, said Spain was the first European country to move against Worldcoin and that it was impelled by special concern that the company was collecting information about minors.

“What we have done is raise the alarm in Europe. But this is an issue that affects... citizens in all the countries of the European Union,” she said. “That means there has to be coordinated action.”

Worldcoin, co-founded by Altman in 2019, has been offering tokens of its own cryptocurrency to people around the world, in return for their consent to have their eyes scanned by an orb.

The scans are used as a form of identification as it seeks to create a reliable mechanism to distinguish between humans and machines as artificial intelligence becomes more advanced.

Worldcoin was not immediately available for comment.

The Spanish regulator’s decision is the latest blow to the aspirations of the OpenAI boss and his Worldcoin co-founders Max Novendstern and Alex Blania following a series of setbacks elsewhere in the world.

At the point of its rollout last summer, the San Francisco and Berlin headquartered start-up avoided launching its crypto tokens in the US on account of the country’s harsh crackdown on the digital assets sector.

The Worldcoin token is also not available in major global markets such as China and India, while watchdogs in Kenya last year ordered the project to shut down operations. The UK’s Information Commissioner’s Office has previously said it would be making inquiries into Worldcoin.

While some jurisdictions have raised concerns about the viability of a Worldcoin cryptocurrency token, Spain’s latest crackdown targets the start-up’s primary efforts to establish a method to prove customers’ “personhood”—work that Altman characterizes as essential in a world where sophisticated AI is harder to distinguish from humans.

In the face of growing scrutiny, Altman told the Financial Times he could imagine a world where his start-up could exist without its in-house cryptocurrency.

Worldcoin has registered 4 million users, according to a person with knowledge of the matter. Investors poured roughly $250 million into the company, including venture capital groups Andreessen Horowitz and Khosla Ventures, internet entrepreneur Reid Hoffman and, prior to the collapse of his FTX empire, Sam Bankman-Fried.

The project attracted media attention and prompted a handful of consumer complaints in Spain as queues began to grow at the stands in shopping centers where Worldcoin is offering cryptocurrency in exchange for eyeball scans.

In January, the data protection watchdog in the Basque country, one of Spain’s autonomous regions, issued a warning about the eye-scanning technology Worldcoin was using in a Bilbao mall. The watchdog, the AVPD, said it fell under biometric data protection rules and that a risk assessment was needed.

España Martí said the Spanish agency was acting on concerns that the Worldcoin initiative did not comply with biometric data laws, which demand that users be given adequate information about how their data will be used and that they have the right to erase it.

Sharing such biometric data, she said, opened people up to a variety of risks ranging from identity fraud to breaches of health privacy and discrimination.

“I want to send a message to young people. I understand that it can be very tempting to get €70 or €80 that sorts you out for the weekend,” España Martí said, but “giving away personal data in exchange for these derisory amounts of money is a short, medium and long-term risk.”

Source

Meta Abandons Hacking Victims, Draining Law Enforcement Resources, Officials Say

Wed, 06 Mar 2024 16:50:26 +0000

A coalition of 41 state attorneys general says Meta is failing to assist Facebook and Instagram users whose accounts have been hacked—and they want the company to take “immediate action.”

Forty-one state attorneys general penned a letter to Meta’s top attorney on Wednesday saying complaints are skyrocketing across the United States about Facebook and Instagram user accounts being stolen, and declaring “immediate action” necessary to mitigate the rolling threat.

The coalition of top law enforcement officials, spearheaded by New York attorney general Letitia James, says the “dramatic and persistent spike” in complaints concerning account takeovers amounts to a “substantial drain” on governmental resources, as many stolen accounts are also tied to financial crimes—some of which allegedly profits Meta directly.

“We have received a number of complaints of threat actors fraudulently charging thousands of dollars to stored credit cards,” says the letter addressed to Meta’s chief legal officer, Jennifer Newstead. “Furthermore, we have received reports of threat actors buying advertisements to run on Meta.”

“We refuse to operate as the customer service representatives of your company,” the officials add. “Proper investment in response and mitigation is mandatory.”

In addition to New York, the letter is signed by attorneys general from Alabama, Alaska, Arizona, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Illinois, Iowa, Kentucky, Louisiana, Maryland, Massachusetts, Michigan, Minnesota, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming, and the District of Columbia.

Meta did not immediately respond to WIRED's request for comment on the letter.

Account takeovers can occur as a result of phishing as well as other more sophisticated and targeted techniques. Once an attacker gains access to an account, the owner can be easily locked out by changing passwords and contact information. Private messages and personal information are left up for grabs for a variety of nefarious purposes, from impersonation and fraud to pushing misinformation.

“It's basically a case of identity theft and Facebook is doing nothing about it,” said one user whose complaint was cited in the letter to Meta's Newstead.

The state officials said the accounts that were stolen to run ads on Facebook often run afoul of its rules while doing so, leading them to be permanently suspended, punishing the victims—often small business owners—twice over.

“Having your social media account taken over by a scammer can feel like having someone sneak into your home and change all of the locks,” New York's James said in a statement. “Social media is how millions of Americans connect with family, friends, and people throughout their communities and the world. To have Meta fail to properly protect users from scammers trying to hijack accounts and lock rightful owners out is unacceptable.”

Other complaints forwarded to Newstead show hacking victims expressing frustration over Meta’s lack of response. In many cases, users report no action being taken by the company. Some say the company encourages users to report such problems but never responds, leaving them unable to salvage their accounts or the businesses they built around them.

After being hacked and defrauded of $500, one user complained that their ability to communicate with their own customer base had been “completely disrupted,” and that Meta had never responded to the report they filed, though the user had followed the instructions the company provided them to obtain help.

“I can't get any help from Meta. There is no one to talk to and meanwhile all my personal pictures are being used. My contacts are receiving false information from the hacker,” one user wrote.

Wrote another: “This is my business account, which is important to me and my life. I have invested my life, time, money and soul in this account. All attempts to contact and get a response from the Meta company, including Instagram and Facebook, were crowned with complete failure, since the company categorically does not respond to letters.”

Figures provided by James’ office in New York show a tenfold increase in complaints between 2019 and 2023—from 73 complaints to more than 780 last year. In January alone, more than 128 complaints were received, James’ office says. Other states saw similar spikes in complaints during that period, according to the letter, with Pennsylvania recording a 270 percent increase, a 330 percent jump in North Carolina, and a 740 percent surge in Vermont.

The letter notes that, while the officials cannot be “certain of any connection,” the drastic increase in complaints occurred “around the same time” as layoffs at Meta affecting roughly 11,000 employees in November 2022, around 13 percent of its staff at the time.

Source

Hackers target Docker, Hadoop, Redis, Confluence with new Golang malware

Wed, 06 Mar 2024 16:48:25 +0000

Hackers are targeting misconfigured servers running Apache Hadoop YARN, Docker, Confluence, or Redis with new Golang-based malware that automates the discovery and compromise of the hosts.

The malicious tools used in the campaign take advantage of the configuration weaknesses and exploit an old vulnerability in Atlassian Confluence to execute code on the machine.

Researchers at cloud forensics and incident response company Cado Security discovered the campaign and analyzed the payloads used in attacks, bash scripts, and Golang ELF binaries.

The researchers note that the intrusion set is similar to previously reported cloud attacks, some of them attributed to threat actors like TeamTNT, WatchDog, and Kiss-a-Dog.

They started investigating the attack after getting an initial access alert on a Docker Engine API honeypot, with a new container based on Alpine Linux being spawned on the server.

For the next steps, the threat actor relies on multiple shell scripts and common Linux attack techniques to install a cryptocurrency miner, establish persistence, and set up a reverse shell.

New Golang malware for target discovery

According to the researchers, the hackers deploy a set of four novel Golang payloads that are responsible for identifying and exploiting hosts running services for Hadoop YARN (h.sh), Docker (d.sh), Confluence (w.sh), and Redis (c.sh).

The names of the payloads are likely a poor attempt at disguising them as bash scripts. However, they are 64-bit Golang ELF binaries.

“Interestingly, the malware developer neglected to strip the binaries, leaving DWARF debug information intact. There has been no effort made to obfuscate strings or other sensitive data within the binaries either, making them trivial to reverse engineer” - Cado Security

The hackers use the Golang tools to scan a network segment for open ports 2375, 8088, 8090, or 6379, which are the default ones for the targets of this campaign.

In the case of “w.sh,” after discovering an IP address for a Confluence server, it fetches an exploit for CVE-2022-26134, a critical vulnerability that allows remote attackers to execute code without the need to authenticate.

Another Golang payload discovered is called “fkoths” and its task is to remove traces of the initial access by deleting Docker images from the Ubuntu or Alpine repositories.

Cado Security found that the attacker used a larger shell script called “ar.sh” to further their compromise, prevent forensic activity on the host, and fetch additional payloads, including the popular XMRig mining application for Monero cryptocurrency.

The script also adds an SSH key that lets the attacker maintain access to the infected system, retrieves the Golang-based reverse shell Platypus, and looks for SSH keys and related IP addresses.

While most of the payloads in the campaign are widely flagged as malicious by antivirus engines on the Virus Total scanning platform, the four Golang binaries for discovering target services are virtually undetected.

Two of the payloads, w.sh and c.sh, are detected by less than 10 antivirus engines on the platform and the earliest submission date is December 11, 2023, which may hint at the start of the campaign. The other two are undetected on the platform.

Cado Security shared a technical analysis for all the payloads discovered in the campaign as well as the associated indicators of compromise.

Source

BlackCat ransomware shuts down in exit scam, blames the "feds"

Tue, 05 Mar 2024 18:01:10 +0000

The BlackCat ransomware gang is pulling an exit scam, trying to shut down and run off with affiliates’ money by pretending the FBI seized their site and infrastructure.

The gang announced they are now selling the source code for the malware for the hefty price of $5 million.

On a hacker forum, ALPHV said that they decided "to close the project" because of "the feds," without providing additional details or a clarification.

However, a national law enforcement agency listed on the seizure banner confirmed to BleepingComputer that they were not involved in any recent disruption of ALPHV infrastructure.

'The feds screwed us over'

The ransomware gang started the exit-scam operation on Friday, when they took their Tor data leak blog offline. On Monday, they further shut down the negotiation servers, saying that they decided to turn everything off, amid complaints from an affiliate that the operators stole a $20 million Change Healthcare ransom from them."

Yesterday, the gang's status on Tox changed to 'GG' ('good game') - hinting at the end of the operation, and later to "selling source code 5kk," indicating that they wanted $5 million for their malware.

BlackCat ransomware status on Tox messaging platform

source: BleepingComputer

In a message on a hacker forum shared by Recorded Future's Dmitry Smilyanets, the administrators of the operation said that they "decided to completely close the project" and "we can officially declare that the feds screwed us over.

While Europol and the FBI have not responded to our emails, the NCA told BleepingComputer that they are not involved in any recent disruption to ALPHV's infrastructure, even though they are listed on the fake seizure message.

At the time of writing, the ALPHV leak site shows a fake banner announcing that the Federal Bureau of Investigation (FBI) seized the server in a “coordinated law enforcement action taken against ALPHV Blackcat Ransomware.

Fake FBI banner on ALPHV ransomware data leak site

source: BleepingComputer

BleepingComputer noticed that the seizure banner image is hosted under a folder named "/THIS WEBSITE HAS BEEN SEIZED_files/," which clearly indicates that the banner was extracted from an archive.

Banner added on ALPHV site

source: BleepingComputer

Ransomware expert Fabian Wosar told BleepingComputer that the ransomware gang simply setup a Python SimpleHTTPServer to serve the fake banner.

"So they simply saved the takedown notice from the old leak site and spun up a Python HTTP server to serve it under their new leak site. Lazy," Fabian Wosar told BleepingComputer.

Additionally, Wosar says that his contacts at Europol an the NCA "declined any sort of involvement" in seizing the ALPHV ransomware site.

Despite NCA's statement and evidence that the banner on the leak site is not the result of law enforcement activity, ALPHV told BleepingComputer that their infrastructure was seized.

Rumors of a possible exit scam from ALPHV started when a longtime ALPHV partner, a so-called "Notchy," claimed that the gang had closed their account and robbed them of a $22 million payment from the ransom allegedly paid by Optum for the Change Healthcare attack.

As proof of their claim, the affiliate shared a cryptocurrency payment address that recorded only one incoming transfer of 350 bitcoins (about $23 million) from a wallet that appears to have been used specifically for this transaction on March 2nd.

After getting the funds, the recipient address that allegedly belongs to ALPHV operators distributed the bitcoins to various wallets in equal transactions of about $3.3 million.

It is worth noting that while the recipient address is now empty, it shows that it received and sent close to $94 million.

With claims from affiliates not getting paid, a sudden shut down of the infrastructure, cutting ties with multiple affiliates, the "GG" message on Tox, announcing that they're selling the malware source code, and especially pretending that the FBI took control of their websites, all this is a cleart indication that ALPHV/BlackCat ransomware administrators are exit scamming.

Who is BlackCat/ALPHV ransomware

The operators of BlackCat have been involved in ransomware since at least 2020, first launching as DarkSide in August 2020 as a ransomware-as-a-service (RaaS) operation.

A RaaS is when core operators develop a ransomware encryptor and negotiation sites and recruit affiliates to use their tools to conduct ransomware attacks and steal data.

After a ransom is paid, the operators split the ransom payment, with affiliates and their teams usually receiving 70-80% of the payment and the operation receiving the rest.

After their widely publicized attack on Colonial Pipeline, the threat actors shut down the DarkSide operation in May 2021 under intense pressure from global law enforcement.

While ransomware gangs were already under scrutiny by law enforcement, the attack on Colonial Pipeline was a tipping point for governments worldwide who began prioritizing targeting these cybercrime operations.

Instead of staying away, the operators launched a new ransomware operation called BlackMatter on July 31st, 2021. However, the cybercriminals quickly shut down again in November 2021 after Emsisoft exploited a weakness to create a decryptor, and servers were seized.

Instead of learning from their mistakes, the ransomware operators returned in November 2021, this time under the name BlackCat or ALPHV.

While the gang's official name is ALPHV, it was not known at the time, so researchers called it BlackCat based on the small icon of a black cat used on every victim's negotiation site.

Since then, the ransomware gang has continuously evolved its extortion tactics, taking the unusual approach of partnering with English-speaking affiliates.

However, last year, the threat actors grew increasingly toxic, working with affiliates who threatened physical harm, posting nude photos from stolen data, and aggressively calling out victims.

With this new extortion strategy, the ransomware gang was firmly planted in the crosshairs of law enforcement.

In December 2023, an international law enforcement operation seized the ransomware gang's Tor negotiation and data leak sites.

The FBI also announced that they had hacked BlackCat's servers and quietly collected information on the cybercriminals while obtaining decryptors to allow victims to recover their files for free.

Instead of shutting down, the ransomware gang continued their activities, vowing to retaliate against the US government by attacking critical infrastructure.

Never learning from their past mistakes, the ransomware gang once again conducted an attack that went too far, putting the full scrutiny of global law enforcement on their operation.

First, it was Colonial Pipeline in 2020, and now it's the attack on UnitedHealth Group's Change Healthcare. The Change Healthcare attack has significantly impacted the US healthcare system after systems used by pharmacies and doctors to file claims with insurance companies were disrupted.

This disruption has led to real-world consequences for US patients who can no longer use discount cards or receive medications under their normal insurance plans, forcing them to temporarily pay full price for critical medications.

The threat actors also claimed to have stolen 6 TB of data from Change Healthcare, containing the healthcare information for millions of US citizens.

After receiving an alleged $22 million ransom payment from Change Healthcare to not leak data and receive the decryptor, an affiliate claimed the BlackCat operators stole their money.

However, instead of being disrupted by law enforcement, the operation has once again shut down, pulling an exit scam.

At this point, it is unclear if the ransomware gang will return under a new name. However, one thing is sure: their reputation has been significantly tarnished, making it doubtful affiliates would want to work with them in the future.

Source

Windows Kernel bug fixed last month exploited as zero-day since August

Sun, 03 Mar 2024 02:11:24 +0000

Microsoft patched a high-severity Windows Kernel privilege escalation vulnerability in February, six months after being informed that the flaw was being exploited as a zero-day.

Tracked as CVE-2024-21338, the security flaw was found by Avast Senior Malware Researcher Jan Vojtěšek in the appid.sys Windows AppLocker driver and reported to Microsoft last August as an actively exploited zero-day.

The vulnerability impacts systems running multiple versions of Windows 10 and Windows 11 (including the latest releases), as well as Windows Server 2019 and 2022.

Microsoft explains that successful exploitation enables local attackers to gain SYSTEM privileges in low-complexity attacks that don't require user interaction.

"To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system," Redmond says.

The company patched the vulnerability on February 13 and updated the advisory on Wednesday, February 28, to confirm that CVE-2024-21338 had been exploited in the wild, but it didn't disclose any details regarding the attacks.

Patched six months after initial report

However, Avast told BleepingComputer that the North Korean Lazarus state hackers have been exploiting the flaw in attacks as a zero-day since at least August 2023 to gain kernel-level access and turn off security tools, allowing them to avoid using easier-to-detect BYOVD (Bring Your Own Vulnerable Driver) techniques

"From the attacker's perspective, crossing from admin to kernel opens a whole new realm of possibilities. With kernel-level access, an attacker might disrupt security software, conceal indicators of infection (including files, network activity, processes, etc.), disable kernel-mode telemetry, turn off mitigations, and more," Avast explained.

"Additionally, as the security of PPL (Protected Process Light) relies on the admin-to-kernel boundary, our hypothetical attacker also gains the ability to tamper with protected processes or add protection to an arbitrary process. This can be especially powerful if lsass is protected with RunAsPPL as bypassing PPL could enable the attacker to dump otherwise unreachable credentials."

Lazarus exploited the flaw to establish a kernel read/write primitive, enabling an updated FudModule rootkit version to perform direct kernel object manipulation.

This new FudModule version comes with significant stealth and functionality improvements, including new and updated rootkit techniques for evading detection and turning off AhnLab V3 Endpoint Security, Windows Defender, CrowdStrike Falcon, and the HitmanPro security protections.

While analyzing the attacks, Avast also discovered a previously unknown remote access trojan (RAT) malware used by Lazarus, which will be the focus of a BlackHat Asia presentation in April.

"With their admin-to-kernel zero-day now burned, Lazarus is confronted with a significant challenge. They can either discover a new zero-day exploit or revert to their old BYOVD techniques," Avast said.

Windows users are advised to install the February 2024 Patch Tuesday updates as soon as possible to block Lazarus' CVE-2024-21338 attacks.

Source

Microsoft's GitHub is under siege as security experts claim over 100,000 Github repositories are infected

Sat, 02 Mar 2024 07:39:43 +0000

GitHub has a cybersecurity issue, and it seems the team at GitHub is having difficulty solving the problem.

What you need to know

Apiiro, a cybersecurity firm, reported that GitHub has suffered a massive attack that could impact thousands of people.
This attack involves cloning safe and clean repositories, adding malicious, obfuscated code, and reuploading them.
GitHub is trying to delete the malicious repositories but can't seem to track them all.

In a recent report by Apiiror, security research and data science teams discovered a very large attack. Apiiro is calling it a malicious repository confusion campaign. The Apiiro teams estimate that over 100,000 GitHub repositories are affected, possibly even millions. Unfortunately, this isn't the first time we have had to report on GitHub being used by malicious actors. A few months ago, we discussed how GitHub is being used to facilitate ransomware and even create command and control channels for ransomware attacks.

These attacks are not overly complicated nor are they hard to stop, the issue is that the attacks are happening at such an alarming pace GitHub seems to be having trouble keeping up.

What are repository confusion attacks?

The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain.

Apiiro

A GitHub repository is a place where a GitHub user can upload their code so it can be shared with the rest of the world. There are very popular repositories that are often searched for and downloaded by many people. In a watering hole attack, attackers download popular good repositories, add malicious code, "7 layer" "eep" ac"ord"ng" to Api"ro, and reupload them to GitHub with the same name. They then spread the fake version of the repository through social media, Discord, and other means to a targeted audience. These features indicate a watering hole attack that is very common in CyberSecurity.

A watering hole attack involves cyber attackers targeting groups of users by infecting websites they frequently visit. The attackers patiently wait for users to navigate to these compromised websites and then redirect them to a malicious site to infect their computers, granting access to the organization's network.

Once these attackers reupload their malicious repositories, they use automation to fork them thousands of times. This tactic is pretty commonly used. A few years ago, I recalled a trendy music album by a renowned artist, and many people tried to download the album via Torrent. The file being circulated was malicious, though, and caused a lot of people to lose their data.

How do the GitHub malicious repositories infect your PC?

Apiiro and other cybersecurity firms are calling this a supply chain attack, and while that could technically be true, I think GitHub barely qualifies as a supply chain.

A supply chain attack is a cyberattack targeting a trusted third-party vendor or supplier. "It involves injecting malicious code into software or compromising hardware components to gain unauthorized access to a company's network or data," per Crowdstrike.

Usually, a supply chain would need to come from a third-party vendor or supplier with access to your infrastructure and not a website that hosts code that might be used in a company's environment.

These attacks obfuscate the code, and Python is mainly used to carry out the attacks. Once delivery of the payload has occurred and the vulnerability has been exploited, the code uses BlackCap Grabber to perform actions on target and send the stolen information to a command and control server. If you download a malicious GitHub repository, these things could be stolen or done on your PC.

Browser passwords, cookies, and browsing history
System information
Login credentials from apps and tools such as Steam, MetaMask, and Exodus
It will also attempt to bypass TokenProtector
Hijacking the Windows clipboard to alter cryptocurrency addresses, replacing its content with the attacker's wallet address (among other functionalities)

What can Microsoft do to make GitHub safe?

According to the report, "GitHub was notified, and most of the malicious repos were deleted, but the campaign continues, and attacks that attempt to inject malicious code into the supply chain are becoming increasingly prevalent."

This attack started in May of 2023 but has grown exponentially. This attack seems to be a whack-a-mole situation where GitHub will have to try to detect this code after it is uploaded and possibly once it's too late. As these attacks continue, more and more users could be infected.

You probably can't rely on Microsoft and GitHub to keep you safe if you are a heavy GitHub user. Suppose you want to check if your PC is infected. Apiiro provided a VirusTotal graph with some of the malicious files discovered. If you want to check your PC for these files, that would be highly time-consuming.

Look for Python patterns in your PC environment that match these code strings:

exec(Fernet
exec(requests
exec(_ _import
exec(bytes
exec(“””\nimport
exec(compile
_ _import_ _(“builtins”).exec(

The best practice is to run code in a sandbox to protect your primary PC. Look for any code communicating with social media platforms or crypto wallets. Be careful when downloading any code from GitHub until Microsoft can handle this issue.

GitHub isn't the only cybersecurity issue Microsoft is facing.

Microsoft tries to be a global leader in security but has a lot of in-house issues it needs to address. (Image credit: Daniel Rubino)

In the era of pervasive AI integration, Microsoft has a prime opportunity to prioritize internal security measures before expanding outward. Despite the advancements in AI, the indispensability of human analysts and engineers in frontline defense against cyber threats remains evident. As the cybersecurity landscape evolves, individuals interested in entering the field may find guidance valuable, such as our cybersecurity starter guide.

Microsoft has recently launched Security Copilot, a tool purported to enhance the performance of cybersecurity defenders. However, its effectiveness largely hinges on customer engagement, reflecting Microsoft's hands-off approach, a characteristic often associated with the company, notorious for its minimal investment in customer service. This ethos seems to extend to cybersecurity, where Microsoft's efforts appear mostly reactive despite regular maintenance and updates, such as Patch Tuesday.

GitHub, a subsidiary of Microsoft, has been exploited effectively by hackers, raising questions about the company's ability to leverage AI for defensive purposes. Nevertheless, if Microsoft can fortify its systems, including its OS, servers, and subsidiaries like GitHub, it can significantly reduce global breach incidents, benefitting all stakeholders.

Source

The Week in Ransomware - March 1st 2024 - Healthcare under siege

Sat, 02 Mar 2024 07:36:04 +0000

Ransomware attacks on healthcare over the last few months have been relentless, with numerous ransomware operations targeting hospitals and medical services, causing disruption to patient care and access to prescription drugs in the USA.

The most impactful attack of 2024 so far is the attack on UnitedHealth Group's subsidiary Change Healthcare, which has had significant consequences for the US healthcare system. This attack was later linked to the BlackCat ransomware operation, with UnitedHealth also confirming the group was behind the attack.

Change Healthcare is an electronic payment exchange service used by doctors, pharmacists, and hospitals to submit billing claims in the US healthcare system.

The attack has caused significant disruptions in Change Healthcare's services, significantly impacting pharmacies that cannot bill customers picking up prescription medicines.

This disruption has trickled down to patients, who, in some cases, are forced to pay full price for their medications until the issue is resolved. However, some medicines can cost thousands of dollars, making it difficult for many to afford the payments.

To make matters worse, the BlackCat ransomware operation, aka ALPHV, claims to have stolen 6TB of data from Change Healthcare during the attack, containing the personal information of millions of people.

The attack has led the FBI, CISA, and the HHS to issue a joint advisory warning of BlackCat attacks on hospitals.

"The cyberattack against Change Healthcare that began on Feb. 21 is the most serious incident of its kind leveled against a U.S. health care organization," warned Rick Pollack, President and CEO, American Hospital Association (AHA).

"We will continue discussions with UnitedHealth Group and the federal government about these efforts as a prolonged disruption of Change Healthcare’s systems could mean that some hospitals and health systems may be unable to pay salaries for clinicians and other members of the care team, acquire necessary medicines and supplies, and pay for mission critical contract work in areas such as physical security, dietary and environmental services." - AHA's Rick Pollack.

Another ransomware operation known as Rhysida, also known for its attacks on healthcare, has sunk to a new low by trying to sell the stolen patient data from Lurie Children's Hospital in Chicago.

Another ransomware known for targeting healthcare is Lockbit, which was hit with a law enforcement operation last week called Operation Cronos that allowed law enforcement to seize servers, data, and decryptors.

However, LockBit has returned with new infrastructure and servers, promising to increase security and prevent such a massive takedown again.

Unfortunately, BleepingComputer has already seen signs that some affiliates are actively conducting attacks, but it appears to be at a diminished capacity compared to before the law enforcement operation.

Even still, many believe LockBit will shut down soon after having its reputation tarnished and losing trust in the cybercrime community.

In other news, an extortion group called Mogilevich claims to have breached Epic Games and stolen 189 GB of data, including source code. Epic Games, though, told BleepingComputer that there is "zero evidence" that they were breached in an attack.

Finally, more ransomware gangs have jumped on the ScreenConnect RCE vulnerability exploitation train, including Black Basta and the Bl00dy ransomware gang.

Contributors and those who provided new ransomware information and stories this week include: @demonslay335, @Ionut_Ilascu, @Seifreed, @serghei, @fwosar, @BleepinComputer, @malwrhunterteam,@billtoulas, @LawrenceAbrams, @Threatlabz, @DarkWebInformer, @CISAgov, @TrendMicro, @Shadowserver, @a_greenberg, @BrettCallow, @Jon__DiMaggio, @CrowdStrike, @H4ckManac, @RobWright22, @ValeryMarchive, and @pcrisk

February 25th 2024

LockBit ransomware returns, restores servers after police disruption

The LockBit gang is relaunching its ransomware operation on a new infrastructure less than a week after law enforcement hacked their servers, and is threatening to focus more of their attacks on the government sector.

February 26th 2024

UnitedHealth subsidiary Optum hack linked to BlackCat ransomware

A cyberattack on UnitedHealth Group subsidiary Optum that led to an ongoing outage impacting the Change Healthcare payment exchange platform was linked to the BlackCat ransomware group by sources familiar with the investigation.

Ransomware Roundup – Abyss Locker

This edition of the Ransomware Roundup covers the Abyss Locker (AbyssLocker) ransomware.

February 27th 2024

FBI, CISA warn US hospitals of targeted BlackCat ransomware attacks

Today, the FBI, CISA, and the Department of Health and Human Services (HHS) warned U.S. healthcare organizations of targeted ALPHV/Blackcat ransomware attacks.

Black Basta, Bl00dy ransomware gangs join ScreenConnect attacks

The Black Basta and Bl00dy ransomware gangs have joined widespread attacks targeting ScreenConnect servers unpatched against a maximum severity authentication bypass vulnerability.

Hessen Consumer Center says systems encrypted by ransomware

The Hessen Consumer Center in Germany has been hit with a ransomware attack, causing IT systems to shut down and temporarily disrupting its availability.

New Mallox ransomware variant

PCrisk found a new Mallox ransomware variant that appends the .ma1x0 extension and drops a ransom note named HOW TO RESTORE FILES.txt.

February 28th 2024

Epic Games: "Zero evidence" we were hacked by Mogilevich gang

Epic Games said they found zero evidence of a cyberattack or data theft after the Mogilevich extortion group claimed to have breached the company's servers.

LockBit ransomware returns to attacks with new encryptors, servers

The LockBit ransomware gang is once again conducting attacks, using updated encryptors with ransom notes linking to new servers after last week's law enforcement disruption.

Ransomware gang claims they stole 6TB of Change Healthcare data

The BlackCat/ALPHV ransomware gang has officially claimed responsibility for a cyberattack on Optum, a subsidiary of UnitedHealth Group (UHG), which led to an ongoing outage affecting the Change Healthcare platform.

Rhysida ransomware wants $3.6 million for children’s stolen data

The Rhysida ransomware gang has claimed the cyberattack on Lurie Children's Hospital in Chicago at the start of the month.

February 29th 2024

StopRansomware: Phobos Ransomware

The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint CSA, to disseminate known TTPs and IOCs associated with the Phobos ransomware variants observed as recently as February 2024, according to open source reporting. Phobos is structured as a ransomware-as-a-service (RaaS) model. Since May 2019, Phobos ransomware incidents impacting state, local, tribal, and territorial (SLTT) governments have been regularly reported to the MS-ISAC. These incidents targeted municipal and county governments, emergency services, education, public healthcare, and other critical infrastructure entities to successfully ransom several million U.S. dollars

The Mysterious Case of the Missing Trump Trial Ransomware Leak

This week, the notorious ransomware gang known as LockBit threatened a kind of disruption that would have been a first even for a criminal industry that has crippled hospitals and triggered the shutdown of a gas pipeline: leaking documents from the criminal prosecution of a former president and presidential candidate.

Then, without explanation, that threat evaporated, leaving plenty of unanswered questions behind.

New Frea Ransomware

PCrisk found a new ransomware that appends the .frea extension and drops a ransom note named oku.txt.

March 1st 2024

The Anatomy of an ALPHA SPIDER Ransomware Attack

Alphv ransomware-as-a-service, which first emerged in December 2021, is notable for being the first written in the Rust programming language. The Alphv RaaS offers a number of features designed to attract sophisticated affiliates, including ransomware variants targeting multiple operating systems; a highly customizable variant that rebuilds itself every hour to evade antivirus tooling; a searchable database on a clear web domain and the adversary’s dedicated leak site (DLS), which enables visitors to search for leaked data; and a Bitcoin mixer integrated to affiliate panels.

Unisys: source code “exfiltrated” during a cyberattack in 2022

For less than an hour, in early August 2022, Alphv/BlackCat claimed to have stolen source code from Unisys, during a cyberattack. The incident actually occurred, reveals the examination of the regulatory declarations of the person concerned.

New Xorist variants

PCrisk found new Xorist ransomware variants that append the .WoXoTo or .RSA-4096 extensions and drops a ransom note named HOW TO DECRYPT FILES.txt.

That's it for this week! Hope everyone has a nice weekend!

Source

Here Come the AI Worms

Fri, 01 Mar 2024 16:16:13 +0000

Security researchers created an AI worm in a test environment that can automatically spread between generative AI agents—potentially stealing data and sending spam emails along the way.

As generative AI systems like OpenAI's ChatGPT and Google's Gemini become more advanced, they are increasingly being put to work. Startups and tech companies are building AI agents and ecosystems on top of the systems that can complete boring chores for you: think automatically making calendar bookings and potentially buying products. But as the tools are given more freedom, it also increases the potential ways they can be attacked.

Now, in a demonstration of the risks of connected, autonomous AI ecosystems, a group of researchers have created one of what they claim are the first generative AI worms—which can spread from one system to another, potentially stealing data or deploying malware in the process. “It basically means that now you have the ability to conduct or to perform a new kind of cyberattack that hasn't been seen before,” says Ben Nassi, a Cornell Tech researcher behind the research.

Nassi, along with fellow researchers Stav Cohen and Ron Bitton, created the worm, dubbed Morris II, as a nod to the original Morris computer worm that caused chaos across the internet in 1988. In a research paper and website shared exclusively with WIRED, the researchers show how the AI worm can attack a generative AI email assistant to steal data from emails and send spam messages—breaking some security protections in ChatGPT and Gemini in the process.

The research, which was undertaken in test environments and not against a publicly available email assistant, comes as large language models (LLMs) are increasingly becoming multimodal, being able to generate images and video as well as text. While generative AI worms haven’t been spotted in the wild yet, multiple researchers say they are a security risk that startups, developers, and tech companies should be concerned about.

Most generative AI systems work by being fed prompts—text instructions that tell the tools to answer a question or create an image. However, these prompts can also be weaponized against the system. Jailbreaks can make a system disregard its safety rules and spew out toxic or hateful content, while prompt injection attacks can give a chatbot secret instructions. For example, an attacker may hide text on a webpage telling an LLM to act as a scammer and ask for your bank details.

To create the generative AI worm, the researchers turned to a so-called “adversarial self-replicating prompt.” This is a prompt that triggers the generative AI model to output, in its response, another prompt, the researchers say. In short, the AI system is told to produce a set of further instructions in its replies. This is broadly similar to traditional SQL injection and buffer overflow attacks, the researchers say.

To show how the worm can work, the researchers created an email system that could send and receive messages using generative AI, plugging into ChatGPT, Gemini, and open source LLM, LLaVA. They then found two ways to exploit the system—by using a text-based self-replicating prompt and by embedding a self-replicating prompt within an image file.

In one instance, the researchers, acting as attackers, wrote an email including the adversarial text prompt, which “poisons” the database of an email assistant using retrieval-augmented generation (RAG), a way for LLMs to pull in extra data from outside its system. When the email is retrieved by the RAG, in response to a user query, and is sent to GPT-4 or Gemini Pro to create an answer, it “jailbreaks the GenAI service” and ultimately steals data from the emails, Nassi says. “The generated response containing the sensitive user data later infects new hosts when it is used to reply to an email sent to a new client and then stored in the database of the new client,” Nassi says.

In the second method, the researchers say, an image with a malicious prompt embedded makes the email assistant forward the message on to others. “By encoding the self-replicating prompt into the image, any kind of image containing spam, abuse material, or even propaganda can be forwarded further to new clients after the initial email has been sent,” Nassi says.

In a video demonstrating the research, the email system can be seen forwarding a message multiple times. The researchers also say they could extract data from emails. “It can be names, it can be telephone numbers, credit card numbers, SSN, anything that is considered confidential,” Nassi says.

Although the research breaks some of the safety measures of ChatGPT and Gemini, the researchers say the work is a warning about “bad architecture design” within the wider AI ecosystem. Nevertheless, they reported their findings to Google and OpenAI. “They appear to have found a way to exploit prompt-injection type vulnerabilities by relying on user input that hasn't been checked or filtered,” a spokesperson for OpenAI says, adding that the company is working to make its systems “more resilient” and saying developers should “use methods that ensure they are not working with harmful input.” Google declined to comment on the research. Messages Nassi shared with WIRED show the company’s researchers requested a meeting to talk about the subject.

While the demonstration of the worm takes place in a largely controlled environment, multiple security experts who reviewed the research say that the future risk of generative AI worms is one that developers should take seriously. This particularly applies when AI applications are given permission to take actions on someone’s behalf—such as sending emails or booking appointments—and when they may be linked up to other AI agents to complete these tasks. In other recent research, security researchers from Singapore and China have shown how they could jailbreak 1 million LLM agents in under five minutes.

Sahar Abdelnabi, a researcher at the CISPA Helmholtz Center for Information Security in Germany, who worked on some of the first demonstrations of prompt injections against LLMs in May 2023 and highlighted that worms may be possible, says that when AI models take in data from external sources or the AI agents can work autonomously, there is the chance of worms spreading. “I think the idea of spreading injections is very plausible,” Abdelnabi says. “It all depends on what kind of applications these models are used in.” Abdelnabi says that while this kind of attack is simulated at the moment, it may not be theoretical for long.

In a paper covering their findings, Nassi and the other researchers say they anticipate seeing generative AI worms in the wild in the next two to three years. “GenAI ecosystems are under massive development by many companies in the industry that integrate GenAI capabilities into their cars, smartphones, and operating systems,” the research paper says.

Despite this, there are ways people creating generative AI systems can defend against potential worms, including using traditional security approaches. “With a lot of these issues, this is something that proper secure application design and monitoring could address parts of,” says Adam Swanda, a threat researcher at AI enterprise security firm Robust Intelligence. “You typically don't want to be trusting LLM output anywhere in your application.”

Swanda also says that keeping humans in the loop—ensuring AI agents aren’t allowed to take actions without approval—is a crucial mitigation that can be put in place. “You don't want an LLM that is reading your email to be able to turn around and send an email. There should be a boundary there.” For Google and OpenAI, Swanda says that if a prompt is being repeated within its systems thousands of times, that will create a lot of “noise” and may be easy to detect.

Nassi and the research reiterate many of the same approaches to mitigations. Ultimately, Nassi says, people creating AI assistants need to be aware of the risks. “This is something that you need to understand and see whether the development of the ecosystem, of the applications, that you have in your company basically follows one of these approaches,” he says. “Because if they do, this needs to be taken into account.”

Source

The Proton Pass for Windows app finally launches with the addition of an offline mode

Thu, 29 Feb 2024 15:45:51 +0000

Proton, the online privacy and security company best known for its Proton Mail application, has previously released its Proton Pass password manager for iOS and Android, along with web extensions for Edge, Chrome, Firefox, and Brave web browsers, and its own web-based app. Today, users of Windows can finally download the long-awaited dedicated Proton Pass desktop app.

In an emailed press release, Proton says the Windows version of the Proton Pass app offers those users some advantages compared to the various web extensions and the web app. The biggest one is that the Windows app can be used even when your PC is offline.

The press release quotes Son Nguyen, the Product Lead for Proton Pass, as saying:

While Proton Pass has long been available as a browser extension on desktop, even in today's highly connected world offline support is still necessary . . . The Proton Pass desktop app for Windows lets you access all of your credentials without a browser or internet access, which has been requested by Proton Pass for Business customers.

The offline mode of the Proton Pass Windows app includes the Argon2 hashing algorithm. Proton says this will keep your passwords safe, even if your PC is not connected to the internet. That feature is available for people who pay for a Proton Pass Plus or Unlimited subscription plan. However, a paid subscription to Proton Pass Plus is pretty affordable at just $4.99 a month, or $23.88 for a year.

As with the other Proton Pass mobile apps and web browser extensions, the new Proton Pass for Windows offers end-to-end encryption for all online signup options. That includes not just passwords, but email addresses, and login user names. It can even encrypt data like credit card numbers, codes, and more. The service also generates random email addresses that people can use to sign into services where they would not like to use their own email address as a login.

Proton Pass for Windows should be available to download today on the company's website. The company says it will release Proton Pass apps for macOS and Linux sometime later in 2024.

Source