Archive for author: makoadmin

A number of threat actors continue to take advantage of the ongoing coronavirus pandemic through phishing scams and other campaigns distributing malware.

In this blog, we look at 3 different phishing waves targeting applicants for Covid-19 relief loans. The phishing emails impersonate the US Small Business Administration (SBA), and are aimed at delivering malware, stealing user credentials or committing financial fraud.

In each of these campaigns, criminals are spoofing the sender’s email so that it looks like the official SBA’s. This technique is very common and unfortunately often misunderstood, resulting in many successful scams.

GuLoader malware

In April, we saw the first wave of SBA attacks using COVID-19 as a lure to distribute malware. The emails contained attachments with names such as ‘SBA_Disaster_Application_Confirmation_Documents_COVID_Relief.img’.

The malware was the popular GuLoader, a stealthy downloader used by criminals to load the payload of their choice and bypass antivirus detection.

Traditional phishing attempt

The second wave we saw involved a more traditional phishing approach where the goal was to collect credentials from victims in order to scam them later on.

A URL, especially if it has nothing to do with the sender, is a big giveaway that the email may be fraudulent. But things get a little more complicated when attackers are using attachments that look seemingly legitimate.

Advanced phishing attempt

This is what we saw in a pretty clever and daring scheme that tricks people into completing a full form containing highly personal information, including bank account details. These could be used to directly drain accounts or in an additional layer of social engineering, which tricks users into paying in advanced fees that don’t exist as part of the real SBA program.

This latest campaign started in early August and is convincing enough to fool even seasoned security experts. Here’s a closer look at some red flags we encountered as we analyzed it.

Most people aren’t aware of email spoofing and believe that if the sender’s email matches that of a legitimate organization, it must be real. Unfortunately, that is not the case, and there are additional checks that need to be performed to confirm the authenticity of a sender.

There are various technologies for confirming the true sender email address, but we will instead focus on the emails headers, a sort of blue print that is available to anyone. Depending on the email client, there are different ways to view such headers. In Outlook, you can click File and then Properties to display them:

One of the items to look at is the “Received” field. In this case, it shows a hostname (park-mx.above[.]com) that looks suspicious. In fact, we can see it has already been mentioned in another scam campaign.

If we go back to this email, we see that it contains an attachment, a loan application with the 3245-0406 reference number. A look at the PDF metadata can sometimes reveal interesting information.

Here we note the file was created on July 31 with Skia, a graphics library for Chrome. This tells us that the fraudsters created that form shortly before sending the spam emails.

For comparison, if we look at the application downloaded from the official SBA website, we see some different metadata:

This legitimate application form was created used Acrobat PDFMaker for Word on March 27 which coincides with the pandemic timeline.

The loan application would typically be printed out and then mailed to a physical address at one of the government offices. If we go back to the original email, it asks to send the completed form as a reply via email instead:

This is where things get interesting. Even though the sender’s email is disastercustomerservice@sba.gov, when you hit the reply button, it shows a different email address at: disastercustomerservice@gov-sba[.]us. While sba.gov is the official and legitimate government website, gov-sba[.]us is not.

That domain name (gov-sba[.]us) was registered just days before the email campaign began and clearly does not belong to the US government.

However, we should note that this campaign is quite elaborate and that it would be easy to fall for it. Sadly, the last thing you would want when applying for a loan is to be out of even more money.

If you reply to this email with the completed form containing private information that includes your bank account details, this is is exactly what would happen.

Tips on how to protect yourself

There is no question that people should be extremely cautious whenever they are asked to fill out information online—especially in an email. Fraudsters are lurking at every corner and ready to pounce on the next opportunity.

Both the Department of Justice and the Small Business Administration have been warning of scams pertaining to SBA loans. Their respective sites provide various tips on how to steer clear of various malicious schemes.

Perhaps the biggest takeaway, especially when it comes to phishing emails, is that the sender’s address can easily be spoofed and is in no way a solid guarantee of legitimacy, even if it looks exactly the same.

Because we can’t expect everyone to be checking for email headers and metadata, at least we can suggest double checking the legitimacy of any communication with a friend or by phoning the government organization. For the latter we always recommend to never dial the number found in an email or left on a voicemail, as it could be fake. Google the organization for its correct contact number.

Malwarebytes also protects against phishing attacks and malware by blocking offending infrastructure used by scammers.

The post SBA phishing scams: from malware to advanced social engineering appeared first on Malwarebytes Labs.

As we continue to track web threats and credit card skimming in particular, we often rediscover techniques we’ve encountered elsewhere before.

In this post, we share a recent find that involves what is known as an homoglyph attack. This technique has been exploited for some time already, especially in phishing scams with IDN homograph attacks.

The idea is simple and consists of using characters that look the same in order to dupe users. Sometimes the characters are from a different language set or simply capitalizing the letter ‘i’ to make it appear like a lower case ‘l’.

A threat actor is using this technique on several domain names to load the popular Inter skimming kit inside of a favicon file. It may not be their first rodeo either as some ties point to an existing Magecart group.

Discovery

We collect information about web threats in various ways: from live crawling websites to finding them or with other tools such as VirusTotal.

While writing rules for hunting is a continuous and time-consuming process, identifying relevant threats within large data sets is also a difficult exercise.

One of our YARA rules triggered a detection for the Inter skimming kit on a file uploaded to VirusTotal. Considering that Inter is a popular framework, we actually get dozens and dozens of alerts each day.

This one looked different though because because the detected file was not typical HTML or JavaScript, but an .ico file instead.

One downside of finding files via VT hunting, especially when it comes to web threats, is that we don’t quite know where they come from. Thankfully, this one gave a little bit of a clue when we inspected the file and saw a “gate” (data exfiltration server):

Homoglyph attack

At first glance, we read that domain as ‘cigarpage’ when in fact it is ‘cigarpaqe’. A quick lookup confirmed that the correct website is indeed cigarpage.com and cigarpaqe[.]com is the imposter.

The legitimate site was hacked and injected with an innocuous piece of code referencing an icon file:

It plays an important role in loading a copycat favicon from the fake site, using the same URI path in order to keep it as authentic as possible. This is actually not the first time that we see skimming attacks abusing the favicon file.

The reason why the attackers are loading this favicon from a different location becomes obvious as we examine it more closely. While the legitimate file is small and typical, the one loaded from the homoglyph domain contains a large piece of JavaScript.

Skimmer

This JavaScript is the one that originally triggered a detection for our Inter skimming kit YARA rule. The screenshot below shows the form fields on a payment page that are being monitored and their corresponding data.

The gate used for exfiltration has the same domain that was used to host the malicious favicon file.

Homoglyph attacks with a historic tie to Magecart Group 8

The threat actor did not only target that one website, but several more belonging to the same victim.

Looking at the malicious infrastructure (51.83.209.11), we can see several domains were registered recently with the same homoglyph technique.

Here are the original domain names on the left, and their homoglyph version on the right:

cigarpage.com:cigarpaqe.com
fieldsupply.com:fleldsupply.com
wingsupply.com:winqsupply.com

A fourth domain stands out from the rest: zoplm.com. This is also an homoglyph for zopim.com, but that domain has a history. It was previously associated with Magecart Group 8 (RiskIQ)/CoffeMokko (Group-IB) and was recently registered again after several months of inactivity.

The skimming code sometimes referred to as CoffeMokko is quite different from the one involved here. However, according to Group-IB, this threat actor may have reused skimming code from others, in particular Group 1 (RiskIQ) in a skimmer also known as Grelos and seen in several attacks.

In addition, Group 8 was documented in high-profile breaches, including one that is relevant here: the MyPillow compromise. This involved injecting a malicious third-party JavaScript hosted on mypiltow.com (note the homoglyph on mypillow.com).

While homoglyph attacks are not restricted to one threat actor, especially when it comes to spoofing legitimate web properties, it is still interesting to note in correlation with infrastructure reuse.

Combining techniques

Threat actors love to take advantage of any technique that will provide them with a layer of evasion, no matter how small that is.

Code re-use poses a problem for defenders as it blurs the lines between the different attacks we see and makes any kind of attribution harder.

One thing we know from experience is that previously used infrastructure has a tendency to come back up again, either from the same threat actor or different ones. It may sound counter productive to leverage already known (and likely blacklisted) domains or IPs, but it has its advantages, too—in particular, when a number of compromised (and never cleaned up) sites still load third party scripts from those.

We contacted the victim site but also noticed that the malicious code had already been removed. Malwarebytes users are protected against this homoglyph attack.

Indicators of Compromise

Homoglyph domains/IP

cigarpaqe[.]com
fleldsupply[.]com
winqsupply[.]com
zoplm[.]com
51.83.209[.]11

The post Inter skimming kit used in homoglyph attacks appeared first on Malwarebytes Labs.

In the United States, data privacy is hard work—particularly for the American people. But one US Senator believes it shouldn’t have to be.

In June, Democratic Senator Sherrod Brown of Ohio released a discussion draft of a new data privacy bill to improve Americans’ data privacy rights and their relationship with the countless companies that collect, store, and share their personal data. While the proposed federal bill includes data rights for the public and data restrictions for organizations that align with many previous data privacy bills, its primary thrust is somewhat novel: Consent is unmanageable at today’s scale.

Instead of having to click “Yes” to innumerable, unknown data collection practices, Sen. Brown said, Americans should be able to trust that their online privacy remains intact, no clicking necessary.

As the Senator wrote in his opinion piece published in Wired: “Privacy isn’t a right you can click away.”

The Data Accountability and Transparency Act

In mid-June, Sen. Brown introduced the discussion draft of the Data Accountability and Transparency Act (which does not appear to have an official acronym, and which bears a perhaps confusing similarity in title to the 2014 law, the Digital Accountability and Transparency Act).

Broadly, the bill attempts to wrangle better data privacy protections in three ways. First, it grants now-commonly proposed data privacy rights to Americans, including the rights of data access, portability, transparency, deletion, and accuracy and correction. Second, it places new restrictions on how companies and organizations can collect, store, share, and sell Americans’ personal data. The bill’s restrictions are tighter than many other bills, and they include strict rules on how long a company can keep a person’s data. Finally, the bill would create a new data privacy agency that would enforce the rules of the bill and manage consumer complaints.

Buried deeper into the bill though are two proposals that are less common. The bill proposes an outright ban on facial recognition technology, and it extends what is called a “private right of action” to the American public, meaning that, if a company were to violate the data privacy rights of an everyday consumer, that consumer could, on their own, bring legal action against the company.

Frustratingly, that is not how it works today. Instead, Americans must often rely on government agencies or their own state Attorney General to get any legal recourse in the case of, for example, a harmful data breach.

If Americans don’t like the end results of the government’s enforcement attempts? Tough luck. Many Americans faced this unfortunate truth last year, when the US Federal Trade Commission reached a settlement agreement with Equifax, following the credit reporting agency’s enormous data breach which affected 147 million Americans.

Announced with some premature fanfare online, the FTC secured a way for Americans affected by the data breach to apply for up to $125 each. The problem? If every affected American actually opted for a cash repayment, the real money they’d see would be 21 cents. Cents.

That’s what happens for one of the largest data breaches in recent history. But what about for smaller data breaches that don’t get national or statewide attention? That’s where a private right of action might come into play.

As we wrote last year, some privacy experts see a private right of action as the cornerstone to an effective, meaningful data privacy bill. In speaking then with Malwarebytes Labs, Purism founder and chief executive Todd Weaver said:

“If you can’t sue or do anything to go after these companies that are committing these atrocities, where does that leave us?” 

For many Americans, it could leave them with a couple of dimes in their pocket.

Casting away consent management in the Data Accountability and Transparency Act

Today, the bargain that most Americans agree to when using various online platforms is tilted against their favor. First, they are told that, to use a certain platform, they must create an account, and in creating that account, they must agree to having their data used in ways that only a lawyer can understand, described to them in a paragraph buried deep in a thousand-page-long end-user license agreement. If a consumer disagrees with the way their data will be used, they are often told they cannot access the platform itself. Better luck next time.

But under the Data Accountability and Transparency Act, there would be no opportunity for a consumer’s data to be used in ways they do not anticipate, because the bill would prohibit many uses of personal data that are not necessary for the basic operation of a company. And the bill’s broad applicability affects many companies today.

Sen. Brown’s bill targets what it calls “data aggregators,” a term that includes any individual, government entity, company, corporation, or organization that collects personal data in a non-insignificant way. Individual people who collect, use, and share personal data for personal reasons, however, are exempt from the bill’s provisions.

The bill’s wide net thus includes all of today’s most popular tech companies, from Facebook to Google to Airbnb to Lyft to Pinterest. It also includes the countless data brokers who help power today’s data economy, packaging Americans’ personal data and online behavior and selling it to the highest bidders.

The restrictions on these companies are concise and firm.

According to the bill, data aggregators “shall not collect, use, or share, or cause to be collected, used, or shared any personal data,” except for “strictly necessary” purposes. Those purposes are laid out in the bill, and they include providing a good, service, or specific feature requested by an individual in an intentional interaction,” engaging in journalism, conducting scientific research, employing workers and paying them, and complying with laws and with legal inquiries. In some cases, the bill allows for delivering advertisements, too.

The purpose of these restrictions, Sen. Brown explained, is to prevent the aftershock of worrying data practices that impact Americans every day. Because invariably, Sen. Brown said, when an American consumer agrees to have their data used in one obvious way, their data actually gets used in an unseen multitude of other ways.

Under the Data Accountability and Transparency Act, that wouldn’t happen, Sen. Brown said.

“For example, signing up for a credit card online won’t give the bank the right to use your data for anything else—not marketing, and certainly not to use that data to sign you up for five more accounts you didn’t ask for (we’re looking at you, Wells Fargo),” Sen. Brown said in Wired. “It’s not only the specific companies you sign away your data to that profit off it—they sell it to other companies you’ve never heard of, without your knowledge.”

Thus, Sen. Brown’s bill proposes a different data ecosystem: Perhaps data, at its outset, should be restricted.

Are data restrictions enough?

Doing away with consent in tomorrow’s data privacy regime is not a unique idea—the Center for Democracy and Technology released its own draft data privacy bill in 2018 that extended a set of digital civil rights that cannot be signed away.

But what if consent were not something to be replaced, but rather something to be built on?

That’s the theory proposed by Electronic Frontier Foundation, said Adam Schwartz, a senior staff attorney for the digital rights nonprofit.

Schwartz said that Sen. Sherrod’s bill follows on a “kind of philosophical view that we see in some corners of the privacy discourse, which is that consent is just too hard—that consumers are being overwhelmed by screens that say ‘Do you consent?’”

Therefore, Schwartz said, for a bill like the Data Accountability and Transparency Act, “in lieu of consent, you see data minimization,”—a term used to describe the set of practices that require companies to only collect what they need, store what is necessary, and share as little as possible when giving the consumer what they asked for.

But instead of ascribing only to data minimization, Schwartz said, EFF takes what he called a “belt-and-suspenders” approach that includes consent. In other words, the more support systems for consumers, the better.

“We concede there are problems with consent—confusing click-throughs, yes—but think that if you do consent plus two other things, it can become meaningful.”

To make a consent model more meaningful, Schwartz said consumers should receive two other protections. First, any screens or agreements that ask for a user’s consent should not include the use of any “dark patterns.” The term describes user-experience design techniques that could push a consumer into a decision that does not benefit themselves. For example, a company could ask for a user’s consent to use their data in myriad, imperceptible ways, and then present the options to the user in two ways: one, with a bright, bold green button, and the other in pale gray, small text.

The practice is popular—and despised—enough to warrant a sort of watchdog Twitter account.

Second, Schwartz said, a consent model should require a ban on “pay for privacy” schemes, in which organizations and companies could retaliate against a consumer who opts into protecting their own privacy. That could mean consumers pay a literal price to exercise their privacy rights, or it could mean withholding a discount or feature that is offered to those who waive their privacy rights.

Sen. Brown’s bill does prohibit “pay for privacy” schemes—a move that we are glad to see, as we have reported on the potential dangers of these frameworks in the past.

What’s next?

Because Congress is attempting—and failing—to properly address the likely immediate homelessness crisis that will kick off this month due to the cratering American economy colliding with the evaporation of eviction protections across the country, an issue like data privacy is probably not top of mind.

That said, the introduction of more data privacy bills over the past two years has pushed the legislative discussion into a more substantial realm. Just a little more than two years ago, data privacy bills took more piece-meal approaches, focusing on the “clarity” of end-user license agreements, for example.

Today, the conversation has advanced to the point that a bill like the Data Accountability and Transparency Act does not seek “clarity,” it seeks to do away with the entire consent infrastructure built around us.  

It’s not a bad start.

The post Data Accountability and Transparency Act of 2020 looks beyond consent appeared first on Malwarebytes Labs.

The evergreen peril of business email compromise (BEC) finds itself in the news once more. This time, major English Premier League football teams almost fell victim to their trickery, to the tune of £1 million.

First half: fraudsters on the offensive

Somebody compromised a Managing Director’s email after they logged into a phishing portal via bogus email. Fake accounts set up during the transfer window to buy and sell players provided the required opening. They inserted themselves into the conversations with ease. Both clubs were conversing with fakes, as the fraudsters changed banking details for payment. No money reached the scammers, as the bank recognised the fraudulent bank account.

As with so many BEC attacks, the weak point was unsecured email with no additional measures in place. Some 2FA would have helped immeasurably here, along with additional precautions. We’ve talked about this previously, where organisations may have to accept some slowdown in their activities behind the scenes for the extra protection afforded. Does the CEO need to confirm wires over the phone with someone in another timezone? Will it slow things down a little?

That is, for some, the cost of (scammers) doing business. The trick is trying to come up with solutions that work best for you, in a way which doesn’t meet with objections from both the board and the people making use of these processes daily.

The sporting sector is under attack digitally on all fronts at the moment. You can read about some of the other attacks, and a few more BEC-related shenanigans, in the NCSC report.

Second half: BEC keeps the pressure up

BEC scams have gained a lot of visibility these past few weeks.

Big financial losses sit alongside the embarrassment of going public of compromise. We almost certainly don’t know the true extent of the damage. Ransomware and similar blackmail threats cause similar problems when trying to estimate impact.

BEC isn’t just some sort of amateur hour, either. The pros are absolutely doing what they can in this realm to further enhance their profits.

Extra time: the long arm of the law

Organisations and people often realise too late that sending wires means the cash is gone forever. The attack replies on stealth and making away with the money without anybody noticing until it’s too late.

On the other hand, busts do happen. Turns out being massively visible with some 2.4 million Instagram followers might not be the best way to remain Guy Incognito. After a little under 1 million dollars was swiped from a victim in the US, the FBI found evidence of communications between a popular social media star and the alleged co-conspirators of the fraud. The FBI filed a criminal complaint in June which alleges all the social media star’s wealth is gained illegally.

Interestingly, there’s mention of yet another attempt on an English premier league football club. This time, however, the money up for grabs is significantly larger:  £100 million, versus £1 million.

Ouch.

Penalties: one final multi-pronged attack

It’s not just the standard BEC we need to be concerned about. There’s a lot of divergent routes into your business originating from roughly the same starting position. Vendor email compromise is something gaining prominence since its more well-known sibling came to light, so add that to the growing list of things to defend against. The successful attack on a major European cinema chain for $21 million is starting to seem like small potatoes at this point, though most definitely not for anyone caught in the fallout.

Some scammers roll with malware. For others, it’s a case of burning a horribly expensive exploit. The hope is that it’ll make several times the amount paid for it initially. The rest lurking in the shadows? Big money from malvertising, or gaming social media with a splash of viral spread and a lot of stolen clicks.

Meanwhile, over there, we have a group of people piecing together the inner workings of your organisation from information freely available online. At this very moment, they’re considering sending some innocent missive, just to see if the mail address is live and if the person responsible for it replies.

You won’t hear from them again…but you almost certainly will see a mail from something claiming to be your system administrator urging you to reset your login details.

Where both you and your organisation’s cash reserves end up after that, is entirely down to whatever planning was made beforehand.

How ready will you be when the business email compromisers come calling?

The post Business email compromise: gunning for goal appeared first on Malwarebytes Labs.

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Chuck Brooks, cybersecurity evangelist and adjunct professor for Georgetown University’s Applied Intelligence Program and graduate Cybersecurity Programs, about identity and access management technology.

This set of technologies and policies controls who accesses what resources inside a system—from company files being locked away for only some employees, to even your online banking account being accessible only to you.

But with more individuals using more accounts to access more resources than ever before, threats have similarly emerged.

Tune in to hear about the uses of identity and access management technology, how the tech will be influenced by other technologies in the future, and more, on the latest episode of Lock and Code, with host David Ruiz.

You can also find us on the Apple iTunes store, Google Play Music, and Spotify, plus whatever preferred podcast platform you use.

We cover our own research on: 

• What’s been going on with TikTok.
• We explained some of the issues surrounding Cloud workload security.
• A malspam campaign dabbles in GuLoader. 
• What to look out for in a prevalent PayPal phishing scam.

Other cybersecurity news

• Masking identities: How well do facial recognition systems cope with facemasks? (Source: Help Net Security)
• 5G security brawl causes fallout: China and UK at potential loggerheads over a decision to remove Huwei products from 5G mobile networks (Source: The Register)
• Mobile malware gunning for Android: BlackRock targets hundreds of applications in a bid for confidential information (Source: AsianAge)
• Emotet at it again: Stolen attachments are added into the mix in efforts to fool potential victims (Source: TechRadar)
• Steer clear of tax cut scam mails: Reports abound of fake council tax reduction mails for UK residents (Source: Infosecurity Magazine)

Stay safe, everyone!

The post Lock and Code S1Ep12: Pinpointing identity and access management’s future with Chuck Brooks appeared first on Malwarebytes Labs.

For the last few weeks, there’s been a solid stream of fake PayPal emails in circulation, twisting FOMO (fear of missing out) into DO THIS OR BAD THINGS WILL HAPPEN. It’s one of the most common tools in the scammer’s arsenal, and a little pressure applied in the right way often brings results for them.

Claim people are going to lose something, or incur charges, or miss out on a valuable service, and they’ll come running. Below is an outline of who these emails claim to be from, what they look like, and the kind of panic-clicking that they’re pushing. These are just a few examples; there are many, many others.

Common factors

Most of the mails we’ve seen claim to be sent from

Secure(AT)intl-limited(DOT)com

Or variations thereof, although the actual email being used is frequently just a mishmash of random letters / words / numbers. They also mostly make claims that your account is limited, or restricted in some way, or there’s been some unusual activity on your account and now you must  prove you were the one making (non-existent) transactions.

It’s very similar to this batch of missives from 2015, where scammers were after credit card / payment  details. Here’s some of the mails, to give you an idea of what to look out for. They are typically awash with typos, and we’ve not corrected any of their mistakes.

Scam mails

Re: [Important] – Your account was temporary limited

We would like to inform you of certain modifications to our user contracts which concern you.

No action is required on your part. However, if you would like to know more, we invite you to consult our Policy Updates page where you will find the details of these modifications, in which cases they apply and how to refuse them, if applicable.

After a recent review of your account activity. we’ve determined you are in violation of PayPal’s Acceptable Use Policy. Your account has been limited until we hear from you. While your account is limited, some options in your account won’t be available.

Re: [Renewal of the Order Receipt] Sign Up for Bank Statement Updates use Google Chrome from Marshall Islands

Dear Customer Service

Your paypal account has been limited because we’ve noticed significanyt changes in your account activity. As your payment ptocessor, we need to understand these changes better. This account limitation will affectr your ability to:

Send or receive money

Withdraw money from your account

Add or remove a card & bank account

Dispute a transaction

Close your account

What to do next?

Please logi in to your paypal account and proviude the requested information thought {SIC} the resolution center

Re: Submitted : Statement update login with Google Chrome From Taiwan, Province of China

Your PayPal account has been limited

Dear Customer,

Our service is improving the security system for all PayPal account. The reason, many accounts have been hacked by someone to order an item using a credit / debit / bank card in account associated.

For the convenience and security of PayPal, we have limited all accounts registered.

PayPal is the safer, faster way to pay. To recovery your account, you can click the link button below and proceed with identity verification to prove that it is your account.

Re: Reminder: [Daily Report] [Update News] [System known] Update-informatie zie factuur van – Statement Update New Login

Your paypal account is temporarily limited

Hello client,

We noticed that you’ve been using your Paypal account in a questionable manner. To understand this better, we just need more information from you.

To ensure that your account remains secure, we need you to take action on your account. We’ve also temporarily limited certain features in your account

Currently, You won’t be able to:

• Send Payments

• Withdraw Funds

What should you do?

Log in to your Paypal account follow the steps and perform the required tasks.

RE: Reminder: [Daily Report] [Statement Agreement] We have sent notifications. Automatic updates 

Your account has been limited.

Hello, Customer

We’ve limited your account

After a recent review of your account activity, we’ve determined you are in violation of PayPal’s Acceptable Use Policy. Please log in to confirm your identity and review all your recent activity

You can find the complete PayPal Acceptable Use Policy by clicking Legal at the bottom of any PayPal page.

Help and advice for avoiding scams

PayPal has expanded its security resources in recent years. They now have a portal for multiple forms of suspicious activity, a section for reporting phish scams, and protection for buyers and sellers.

You can also check out part 1 of our 3-part Phishing 101 guide.

These emails won’t be drying up anytime soon, so please be on your guard and, as always, visit the PayPal website directly from your browser should you receive any messages claiming you’ve been limited or locked out. If it’s genuine, then customer service will be able to assist. If it isn’t, help both PayPal and everyone else by reporting the phish. It’s a win-win scenario.

The post Avoid these PayPal phishing emails appeared first on Malwarebytes Labs.

They say any publicity is good publicity. But perhaps this isn’t true for CloudEye, an Italian firm that claims to provide “the next generation of Windows executables’ protection”.

First described by Proofpoint security researchers in March 2020, GuLoader is a downloader used by threat actors to distribute malware on a large scale. In June, CloudEye was exposed by CheckPoint as the entity behind GuLoader.

Following the spotlight from several security firms and news outlets, GuLoader activity dropped in late June. But around the second week of July, we started seeing the downloader in malspam campaigns again.

Protection and evasion attract criminal element

While the concept of downloaders is certainly not new, GuLoader itself found its origins in DarkEye Protector, a crypter sold in various forums circa 2011, which later evolved into CloudEye.

Designed as a product to prevent reverse engineering and protect against other forms of code theft, CloudEye is a Visual Basic 6 downloader that leverages cloud services to store and retrieve the final piece of software (in the form of heavily obfuscated shellcode) a customer wants to install.

GuLoader/CloudEye has proved to be very effective at bypassing sandboxes and security products including network-based detection.

This is exactly the kind of feature criminals may want to distribute their malware. Unsurprisingly, this is exactly what happened and at one point GuLoader became the most popular malicious attachment in our spam honeypot.

Back in business

On July 11, CloudEye announced it was resuming its business after about a month of interruption during which time sales stopped and accounts used by malicious actors were banned.

What prompted us to visit the company’s website and see this announcement was seeing GuLoader in the wild back again. We noted malspam activity using the classic DHL delivery lure pushing GuLoader again:

GuLoader and stealers

The attachment is an ISO file type which Windows 10 can open by mounting it as a drive. Inside, it contains the GuLoader executable written in Visual Basic. Usiung a decompiler, you can reveal one of its forms, which is very typical of GuLoader:

When you execute it, it will attempt to connect to a remote server to download its payload. By the time we checked this sample, that website no longer responded. However, a PCAP file was available on VirusTotal and allowed us to ‘trick’ the malware so it would proceed to load it as normal.

We used PE-Sieve to reconstruct the encrypted payload as a standalone PE file. This allows us to dump the shellcode from memory into a file on disk.

It turned out to be the FormBook stealer, which is consistent with the type of payloads we see associated with GuLoader.

Popular tool already cracked?

We believe one particular threat group is engaged in malspam campaigns with and without GuLoader, and instead using RAR attachments to spread other stealers.

Once a tool has proved to be popular and effective for criminal purposes (whether it was built for legitimate reasons or not), it will continue to fuel malware campaigns.

It’s quite possible that of the many builders of GuLoader in circulation some have been cracked and are now being used by threat actors on their own accord.

We track the GuLoader malspam campaigns and continue to protect our customers against this threat.

Thanks to S!Ri for the heads up on the return of GuLoader.

Indicators of Compromise

GuLoader

DHL_AWB_INV_9882900_99862788_998.exe
8a13de21c0cb1d10e4ee93394794e0714f4a58994be543ac94592b6f8abc53dc

Shellcode loaded by GuLoader

fbdoskitryupanel.webredirect[.]org/uploud/5bab0b1d864615bab0b1d864b3/bin_koLHz220.bin
45.76.45[.]167

Decoded shellcode into binary

7b4d3b6eb50a072d36f6233aeb56352735c59dd54ba54d6e6fbca6b23a1739d5

The post Malspam campaign caught using GuLoader after service relaunch appeared first on Malwarebytes Labs.

Due to the increasing use of the cloud, organizations find themselves dealing with hybrid environments and nebulous workloads to secure. Containerization and cloud-stored data have provided the industry with a new challenge. And while you can try to make the provider of cloud data storage responsible for the security of the data, you will have a hard time trying to convince the provider that they are responsible for your cloud workload security.

What are you talking about?

Let us explain some of the less common terms for those that are unfamiliar with them.

The goal of containerization is to allow applications to run in an efficient and bug-free way across different computing environments, whether that is a desktop or virtual machine or Windows or Linux operating system. The demand for applications to run consistently among different systems and infrastructures has moved development of this technology along at a rapid pace. The use of different platforms within business organizations and the move to the cloud are undoubtedly huge contributors to this demand. Containerization is almost always conducted in a cloud environment, which contributes to its scalability.

While there are many providers of cloud data storage, providers that offer containerization services for the moment are almost exclusively the big players, like Amazon Web Services, Oracle, and Microsoft Azure.

Static, or even constantly changing, data are easier to protect than active processes. And a cloud workload can range from simple web applications to complex organization-specific workflow management systems.

Cloud workload security

From a security standpoint, the isolation between containers is a good thing. If one container is compromised, it is almost impossible for any malware to cross over to another container, as the top layer operating system has separate namespaces for each of the containers. But as you can imagine, this separation also makes it harder to devise a security solution for the whole complex of containers that are in use.

Traditionally, security software was designed to keep your IT environment protected from the outside world. Nowadays cutting the environment off from the outside world would mean cloud resources to become unavailable and remote workers to be disconnected from the company network. Because security was one of the major concerns holding organizations back from moving their data and workload to the cloud, a lot of attention has been given to cloud workload security.

The first step to expand your security perimeter to include the cloud workload is to make the cloud environment secure-by-design. Which means that attention has been given to security implications during every step of the design.

Your IT department and cloud resources

One common mistake is that organizations or teams within the organization start using cloud resources without involving their in-house IT/security department. While this may seem trivial or they may not even be thinking of the new “app” as a cloud resource, it does have an impact on the security perimeter and the responsible team should be aware of the change.

Organization of cloud security

The way cloud security is organized depends very much on where the responsibility for the security of the cloud resources lie. They vary from a completely in-house model to a fully external model where the cloud security provider takes full responsibility for all the resources and provides the necessary security layers.

Application layer

Web applications are secured in the application layer. This layer generally consists of a few elements designed to protect the applications from outside threats. The main element can be a customized firewall combined with end-to- end encryption. This will shield the applications from threats and protect the data-stream from being intercepted and read.

Hypervisor layer

Another important layer for cloud workload security is the hypervisor layer. The security setup in this layer will be designed to keep the cloud server’s virtualization environment safe. In this environment you will find the guest operating systems and virtual networks. This layers’ security will also take care of the containers that are running in virtual machines. The main component for the security in this layer will be application hardening. In-house apps need to be coded with security in mind and third-party software needs to be updated and patched in a timely manner.

Security orchestration

In such a layered and complex environment another important element is the security orchestration. Orchestration in this context implies:

• Solutions working together without interrupting each other.
• Streamlining workflow processes so that each component does what it does best.
• Unification so that data is exported in a user-friendly and organized manner.

Security orchestration is ideally possible even when security software comes from different vendors. However, it often needs to be modified to get the most out of what the solutions have to offer, without one interfering with the effectivity of another.

In general, it’s easier to effectively orchestrate specialized applications from different vendors than it is to orchestrate overlapping applications from different vendors. The overlap between rivalling applications tends to be the field where the accidents happen. Either because features are disabled so they do not cause interference, or because one application is expected to catch something and the other doesn’t need to watch that area.

Rise in importance

As cloud applications continue to grow in absolute numbers and relative size for your organization it is imperative to look at the structure and organization of your security perimeter and into the way you want to secure that perimeter. Some points of attention as your organization grows in this direction:

• Stay on top of the awareness of the security and IT teams of all cloud applications.
• Scout the possibilities of security applications from different vendors and how you can best manage and orchestrate them.
• Inform yourself about the different types of cloud-based applications you are using and whether they need a specific security approach.
• Do not rely on your cloud provider to have security automatically arranged for you. If you do decide to rely on the cloud services provider for security arrangement as well, make sure you and your IT staff are aware of the boundaries and limitations of their coverage.

Stay safe everyone!

The post Cloud workload security: Should you worry about it? appeared first on Malwarebytes Labs.

In recent news retail giant Amazon sent a memo to employees telling them to delete the popular social media app TikTok from their phones. In the memo it stated that the app would pose a security risk without going into details. Later the memo was withdrawn without an explanation except that it was sent in error. Are we curious yet, my dear Watson?

What is TikTok

For those of us that can’t tell one social media app from another, TikTok is one of the most popular ones and it was especially designed to allow users to upload short video’s for others to like and share. Functionality has grown from a basic lip-sync app to host a wide variety of short video clips. It is predominantly popular among a younger audience. Most of the users are between 13 and 24 years old. In the first quarter of 2019, TikTok was the most downloaded app in the App Store, with over 33 million installs. TikTok is owned by a Chinese tech company called ByteDance.

Nation states’ attention

This wasn’t the first time TikTok faced removal from a number of devices. India already banned TikTok. And the USA and Australia are also considering blocking the app. In fact, In December, the US Army banned TikTok from its phones, and in March, US senators proposed a bill that would block TikTok from all government devices.

Is TikTok safe?

For starters, TikTok being a Chinese product does not help. A number of Chinese apps and software packages have been under investigation and were found to be “calling home”. Now this does not automatically they are spying on you, but when you start your investigation with a negative expectation, you are inclined to see it as such. And gathering information about a client without their consent is wrong.

The fact that TikTok is different in China itself, where it goes under the name Douyin, is another factor. But this could be explained away as well as China has a reputation of spying on its population. So maybe the foreign version is less intrusive then the domestic one. And some governments have their own reasons not to trust anything from Chinese origin or another agenda to boycott products originating from China.

Adding to the suspicion a Reddit user by the handle of bangorlol posted comments about the data found to be sent home when he reverse-engineered the app. The same user has started a thread on reddit where he wishes to cooperate with other reverse-engineers on newer versions of the app. One type of behavior that was confirmed by another source is that the app copies information from the clipboard. Which certainly is something that goes above and beyond what other social media apps do.

TikTok’s defense

TikTok’s main defense consists of the fact that most of their senior staff are outside of China. On their blog they also specified where their data are stored and that the data are not subject to Chinese law.

“TikTok is led by an American CEO, with hundreds of employees and key leaders across safety, security, product, and public policy here in the US. We have never provided user data to the Chinese government, nor would we do so if asked.”

Options to ban TikTok completely

Besides organizations like Wells Fargo and some branches of the US military asking their employees to refrain using the app on devices that also contain data about the organization, we have also seen countries advocating a total ban of the app. But this is not an easy goal to achieve and could also prove to be ineffective.

For a total ban of an app you would have to get it removed from the official playstores. This is harder to achieve for some countries than for others. India banned TikTok along with 58 other Chinese apps. The US government would have to find a legally sound reason to request that Apple and Google pull TikTok from their app stores and would probably meet with a lot of resistance.

Besides if people want to install a popular app like TikTok there are many other sources. Downloads are not limited to the official playstores, so a determined user will be able to find the app elsewhere. And it does not stop the millions of active users from continuing to use the app.

Another option is to give TikTok the same treatment as was handed to Huawei. Put them on the Commerce Departments’ entity list which would deny them access to US technology. Given the circumstances that doesn’t accomplish much more than denying them access to the playstores with the same consequences as we discussed above.

Social media and privacy

We have warned many times against posting privacy sensitive information on social media and guiding you and your children to use social media in a safe way. We even posted a guide for those that wanted to remove themselves from the major social media.

But when the social media app itself is determined to mine your data it becomes a whole different story. We have seen no conclusive proof that this is true for TikTok, but some of the allegations are very serious and seem to be supported by facts and authoritative research.

Other analysts discarded the researchers’ findings as jumping to conclusions. On thing is for sure: a full analysis without the help of the developers will take a lot of effort and time and even then, the results may still be disputable. At this point we can not be sure whether the TikTok app is spying on its users in a way that goes deeper than we might expect from an ordinary social media app.

All we can do at this point is to inform our users about the ongoing discussion and maybe explain some of the points that are being brought up. We also feel the need to repeat our warnings about the difficult relationship between social media and privacy. Obviously if any concrete facts should surface we will keep you posted.

Stay safe everyone!

The post TikTok is being discouraged and the app may be banned appeared first on Malwarebytes Labs.

Last week on Malwarebytes Labs, our Lock and Code podcast delved into Bluetooth and beacon technology. We also dug into APT groups targeting India and Hong Kong, covered a law enforcement bust, and tried to figure out when, exactly, a Deepfake is a Deepfake.

Other cybersecurity news

• Insecure email addresses resulted in big-bucks sporting targets (Source: Silicon)
• What do you do when a lack of backups meets a ransomware attack? (Source: Help Net Security)
• Time to go underground: A study of what makes two leaked carding forums tick (Source: Sage Journals – access may be required)
• Twitter provided an update on the latest compromise-related happenings (Source: Twitter)
• Insurer “wins” the worst prize imaginable, in the form of the first charge under new cybersecurity rule violations (Source: The Register)
• Google cloud services were misused by phishers (Source: IT Pro Portal)
• An Apple co-founder was not impressed at how his image was being used on YouTube videos to push scams (Source: BBC)
• FullFact provided a roundup of scams which exist, and scams which do exist, but not quite in the way you might think (Source: Full Fact)
• Thieves in Europe found a new way to empty out ATM cash machines. (Source: Wired)
• BlackRock, a new Android malware, was found stealing critical information, from bank accounts and other login credentials. (Source: Jagran Josh)

Stay safe!

The post A week in security (July 20 – 26) appeared first on Malwarebytes Labs.