Archive for NEWS

LinkedIn scams are a “significant threat”, warns FBI

Digital currency fraud is a growing issue on social media, and LinkedIn is no different. In fact, according to according to Sean Ragan, the FBI’s special agent in charge of the San Francisco and Sacramento, California, field offices, cryptocurrency scams are big business on LinkedIn.

“It’s a significant threat. This type of fraudulent activity is significant, and there are many potential victims, and there are many past and current victims.”

How cryptocurrency scams work on LinkedIn

Aspects of LinkedIn cryptocurrency scams share similar traits with fraud attempts on other platforms:

  • Someone messages you out of the blue. They begin with small talk, and eventually work their way up to cryptocurrency conversation. They claim that, yes, they can help you make big money from certain investments.
  • LinkedIn is generally seen as a trusted platform, reinforced by people’s perception as the go-to place for business related dealings. This is one advantage it has over less formal sites.
  • Victims are directed to genuine cryptocurrency investment portals. Though no further details are provided in the article, this can go one of two ways. Either the victim invests with their own cash, or the scammer sends them some funds to get started.
  • Weeks or months down the line, the scammer has the victim transfer funds to a site controlled by the scammer. At this point, funds are drained and the cash disappears along with the con-artist.

Scammers take the well-worn path to riches

The FBI notes that this type of fraud is on the rise, and draws a parallel with romance scams. In both cases, the end result is the same: loss of funds. However, this style of cryptocurrency fraud has its origins elsewhere and the connection to romance fraud is quite relevant.

This style of attack is called the “pig butcher” scam. It involves a so-called “fattening up” of the pig (target) with messages of affection. Eventually, the same jump-off into cryptocurrency investment takes place. The money, as always, vanishes. One of the key features of this attack is the pretence of accidental communication. Golf is popular, as are messages about luggage and airports.

The tactics used on LinkedIn almost certainly match up in various ways. If they can just get you to the investment site and have you deposit some funds: they’ve got you.

Linkedin take fraudsters to task

The team at LinkedIn point out that 96% of detected fake accounts and 99.1% of spam and scams are caught and removed by automated defences. That’s somewhere in the region of 70 million scam messages removed between July to December in 2021. For comparison, LinkedIn removed around 60 million between January and June of 2019. It also hit a peak of removals between July to December of 2020, with a massive 91 million scams given a time out.

Additionally, 11.9 million fake accounts were stopped at registration between July and December of 2021. Around 4.4 million were restricted proactively, and 127k further accounts were restricted once members reported them.

How to spot a scam on LinkedIn

With regard to cryptocurrency scams themselves, LinkedIn offers the following advice. Be wary of:

  • People asking for money who you don’t know in person. This may include sending cash directly, cryptocurrency, gift cards, prizes, and other winnings.
  • Job postings which sound too good to be true. Mystery shoppers, personal assistants, company impersonators are all potential red flags. Steer clear of anything which demands money from you up front.
  • Romantic gestures on a business-centric platform. This is especially dubious if tied to a brand new account with few or no connections. Keep in mind that established accounts can also be compromised, and used for any of the scam attempts listed above.

Should you experience LinkedIn content you’re not sure about, don’t worry. You can report it directly to LinkedIn to investigate. Stay safe out there!

The post LinkedIn scams are a “significant threat”, warns FBI appeared first on Malwarebytes Labs.

Posted in: NEWS

Leave a Comment (0) →

DDoS-for-hire service provider jailed

Matthew Gatrel, a 33-year-old man from St. Charles, Illinois, has been sentenced to two years in prison for running websites that provide powerful distributed denial-of-service (DDoS) attacks against internet users and websites. This sentencing resulted in the seizure of his websites, making the internet a little safer from DDoS attacks.

Gatrel was the administrator and owner of DownThem.org and AmpNode.com, two DDoS-for-hire websites with thousands of clients which launched attacks against more than 200,000 targets. He was convicted of three charges, including conspiracy to commit unauthorized impairment of a protected computer, conspiracy to commit wire fraud, and unauthorized impairment of a protected computer.

“Gatrel ran a criminal enterprise designed around launching hundreds of thousands of cyberattacks on behalf of hundreds of customers,” prosecutors wrote in a sentencing memorandum. More from that memorandum:

“He also provided infrastructure and resources for other cybercriminals to run their own businesses launching these same kinds of attacks. These attacks victimized wide swaths of American society and compromised computers around the world.”

Prosecutors said that DownThem.org was a subscription-based service that allowed paying customers to launch DDoS attacks at targets of their choice.

AmpNode.com was a “bulletproof” server hosting service provider “with an emphasis on ‘spoofing’ servers that could be pre-configured with DDoS attack scripts and lists of vulnerable ‘attack amplifiers’ used to launch simultaneous cyberattacks on victims”.

Gatrel’s services helped launch attacks against targets worldwide, including homes, schools, universities, financial institutions, and local government websites. Many clients of AmpNode also operated DDoS-for-hire services.

This website seizure splash screen appears when you visit DownThem.

Prosecutors also said that Gatrel offered expert advice and guidance to clients of both services, ranging from different methods to “down” different types of computers to bypassing DDoS protection services. To get potential clients to buy in, he used DownThem to launch a DDoS attack against these clients’ intended victims and provide proof that their internet connection had been severed.

Juan “Severon” Martinez from Pasadena, California, Gatrel’s co-defendant and criminal partner, pleaded guilty to the unauthorized impairment of a protected computer. He was sentenced to five years’ probation.

The post DDoS-for-hire service provider jailed appeared first on Malwarebytes Labs.

Posted in: NEWS

Leave a Comment (0) →

Internet Safety Month: 7 tips for staying safe online while on vacation

Going on vacation has never been more talked about and anticipated. I mean—for many of us, it’s been a while.

But before you get lost in dreamy thoughts of sun, sea, and sand, you might want to set aside some time to plan on how to keep your devices, and your data, safe while you are relaxing

Your devices need some prepping, too

Before anything else, know which devices you’ll bring and which ones you’ll leave at home. Then make backups of the files in them.

This is also the perfect time to look deeper into what’s on your devices, especially if you haven’t done any spring cleaning due to busyness. So update those apps that need updating and uninstall those that waste space; scan your devices with a trusty malware scanner, and change any duplicate passwords. Then follow these tips:

7 security and privacy tips that fit in your pocket

Ensure your devices have the “Find My Device” feature enabled. This feature isn’t just limited to Apple products, and can really help if you lose your device. You can remotely wipe a device if you lose it or even put a message on the screen with contact details in case it is found.

Be mindful of seasonal scams. Such scams may arrive via email, SMS, or social media. If a service offers rates that are too good to be true, asks for an upfront fee, or demands payments to be wired, avoid it.

Use 2FA. Make sure you lock your accounts behind two-factor authentication (2FA). This additional security measure makes them harder to compromise should someone get hold of your login details.

Turn off Bluetooth connectivity. Many people forget Bluetooth is there. As a rule of thumb, remove it if you don’t use it. But if you can’t, disable it when it’s not in use.

Leave your device in the hotel’s safe. Hotel safes are there to keep anything of value safe. This includes your devices. When you’re not using a device, keep it in the safe—and remember the pin code!

Refrain from posting on social media about your vacation. This is good practice before you leave as well. You don’t want people knowing that your home will be empty, so save posting about your getaway until you are back home.

Feel free to use a VPN. Hotel and airport Wi-Fi is safer now than years ago, thanks to HTTPS everywhere. But if you still can’t shake the feeling of being “exposed,” use a VPN you trust. Malwarebytes has one.

The post Internet Safety Month: 7 tips for staying safe online while on vacation appeared first on Malwarebytes Labs.

Posted in: NEWS

Leave a Comment (0) →

Securing the software supply chain, with Kim Lewandowski: Lock and Code S03E13

At the start of the global coronavirus pandemic, nearly everyone was forced to learn about the “supply chain.” Immediate stockpiling by an alarmed (and from a smaller share, opportunistic) public led to an almost overnight disappearance of hand sanitizer, bottled water, toilet paper, and face masks.

In time, those items returned to stores. But then a big ship got stuck in the Suez, and once again, we learned even more about the vulnerability of supply chains. They can handle little stress. They can be derailed with one major accident. They spread farther than we know.

While the calamity in the canal involved many lessons, there was another story in late 2020 that required careful study in cyberspace—an attack on the digital supply chain.

That year, attackers breached a network management tool called Orion, which is developed by the Texas-based company SolarWinds. Months before the attack was caught, the attackers swapped malicious code into a legitimately produced security update from SolarWinds. This malicious code gave the attackers a backdoor into every Orion customer who both downloaded and deployed the update and who had their servers connected online. Though the initial number of customers who downloaded the update was about 18,000 companies, the number of customers infected with the attackers’ malware was far lower, somewhere around 100 companies and about a dozen government agencies.

This attack, which did involve a breach of a company, had a broader focus—the many, many clients of that one company. This was an attack on the software supply chain, and since that major event, similar attacks have happened again and again.

Today, on the Lock and Code podcast with host David Ruiz, we speak with Kim Lewandowski, founder and head of product at Chainguard, about the software supply chain, its vulnerabilities, and how we can fix it.

“Our software supply chains are as brittle and sort of filled with weaknesses, similar to a physical supply chain. When you think about every step of the path from when a developer starts writing software all the way to where it’s pushed to production, or where end user is using it, there’s different attack vectors across that entire path.”

Kim Lewandowski, founder, head of product, Chainguard Inc.

Tune in to hear about why the software supply chain is so difficult to secure, what is at stake if we continue to ignore the problem, and what steps we can take today—and tomorrow—to ensure that future software builds are secure and trustworthy.

This video cannot be displayed because your Functional Cookies are currently disabled.

To enable them, please visit our privacy policy and search for the Cookies section. Select “Click Here” to open the Privacy Preference Center and select “Functional Cookies” in the menu. You can switch the tab back to “Active” or disable by moving the tab to “Inactive.” Click “Save Settings.”

You can find us on Apple PodcastsSpotify, and Google Podcasts, plus whatever preferred podcast platform you use.

Show notes, resources, and credits:

Kubernetes diagram:

https://user-images.githubusercontent.com/622577/170547400-ef9e2ef8-e35b-46df-adee-057cbce847d1.svg

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

The post Securing the software supply chain, with Kim Lewandowski: Lock and Code S03E13 appeared first on Malwarebytes Labs.

Posted in: NEWS

Leave a Comment (0) →

ALPHV squeezes victim with dedicated leak site for employees and customers

Eyebrows were raised this week when the ALPHV ransomware group created a leak site dedicated to just one of its victims. The site was aimed at the employees and guests of a hotelier that had been attacked, and allowed them to see if their personal details had been leaked. The new tactic seems to be designed to create further pressure on the victim to pay the ransom.

The ransomware-as-a-service (RaaS) group ALPHV, also known as BlackCat and Noberus, is currently one of the most active. In our recent May ransomware review, only BlackBasta and the prolific LockBit accounted for more known attacks in the last month.

ALPHV ransomware is used by affiliates who conduct individual attacks, beaching organizations using stolen credentials or, more recently by exploiting weaknesses in unpatched Microsoft Exchange servers. During the attacks data is stolen and encrypted, and the victim is asked to pay a ransom for both a decryption tool, and to prevent the stolen data being leaked.

Although affiliates perform the attacks, the ransom negotiations and data leaks are typically coordinated from a single ALPHV website, hosted on the dark web.

But in this case neither of those two things were true.

Instead of hosting the stolen data on a site that deals with all the gang’s victims, the victim had a website dedicated to them. Bolder still, the site wasn’t on the dark web where it’s impossible to locate and difficult to take down, but hard for many people to reach. Instead it was on the regular world wide web, where we (and law enforcement) could easily discover things like where it was located and what company was hosting it. It was even indexed by Google.

The ransomware leak site was indexed by Google

The aim seems to have been to make it as easy as possible for employees and guests to find their data, so that they would put pressure on the hotelier to pay up.

A message on the site makes it clear that this is about ramping up pressure:

Inaction endangers both your employees and your guests ... We strongly advise you to be proactive in your negotiations; you do not have much time. 

The 112GB of stolen data included personally identifiable information (PII) belonging to 1,500 employees and guests. The gang is reported to have created “data packs” for each employee, containing files related to their hotel employment.

ALPHV leak site for emloyees and guests
Employees and guests could check if their data was part of the leak

Ransomware groups use the dark web for their leak sitesm, rather than the regular web, because it makes it almost impossible for them to be taken down, or for their operators to be traced.

So, wouldn’t this make the site easy to take down, and leave the operators vulnerable?

Because this is unlike anything ALPHV has done before, it’s possible that this is being done by an affiliate, and it may turn out to be a mistake. However, it’s likely the accounts for the site’s name and hosting were created using stolen data. Equally, it may be that this was simply an experiment and that ALPHV were using the media to spread word of the site and weren’t expecting it to be around for very long.

Sure enough, the site disappeared from the web yesterday.

The post ALPHV squeezes victim with dedicated leak site for employees and customers appeared first on Malwarebytes Labs.

Posted in: NEWS

Leave a Comment (0) →
Page 5 of 252 «...34567...»