IT News

Journalists at the Dutch newspaper “De Volkskrant” have reported that the country’s intelligence service, AIVD, discovered in 2017 that Russian hackers had broken into Dutch police systems. The De Volkskrant report is based on knowledge from anonymous sources. The reason behind this act of espionage is thought to be the ongoing MH17 investigation.

MH17

A little background: on July 17, 2014, Malaysia Airlines Flight 17 (MH17) was shot from the sky on its way from Amsterdam to Kuala Lumpur above the Ukraine. The plane was hit by a surface-to-air missile, and as a result, all 298 people on board were killed, the majority of them Dutch.

At that time, there was a revolt of pro-Russian militants against the Ukrainian government which is thought to have been backed by Russia. Russian denied any direct involvement at the time but later admitted to having military intelligence officers in the country. Both the Ukrainian military and the separatists denied responsibility for the MH17 incident.

A large disinformation campaign was launched to obscure who was responsible.

The discovery

The Dutch police only became aware it had been breached after a tip off from AIVD, and the discovery caused a major panic, according to the newspaper. Whether and which data was stolen, is not clear, insiders told the Volkskrant. Understandably, the police network is a huge one and spread out across the country. Apparently the point of first entry was a server of the Police Academy. After discovery, the decision was made that putting a stop to the intrusion as quickly as possible was more important than figuring out what the intruders were after.

So, at this point it is unsure what the exact information was the intruders were after and even whether they were successful in finding that information. According to the Volkskrant, due to a lack of monitoring and logging, the AIVD and Dutch Police have very little knowledge of what the hackers did inside the police network. “There were a lot of question marks,” the newspaper’s source said. “How long had they been inside? Was this the first time? Had they already siphoned off data? That wasn’t clear.”

Dutch police

The Dutch police took the lead in the investigation of the MH17 incident. The Joint Investigation Team (JIT), a special team set up to investigate the MH17 incident, comprises officials from the Dutch Public Prosecution Service and the Dutch police, along with police and criminal justice authorities from Australia, Belgium, Malaysia and Ukraine. On July 5, 2017 the JIT countries decided that the prosecution of those responsible for downing flight MH17 would be conducted in the Netherlands.

The timing of the attack against the police could be coincidental, but it is notable that the attack took place in that same month.

Information feeds disinformation

One possible motive for the attack is disinformation. The best lies are based on truth after all. Reportedly, the Dutch justice department and the Dutch police were targeted with phishing emails and cars filled with listening equipment were found in the vicinity of the “Landelijk Parket”, which is the part of the justice department that deals with both national and international organized crimes. Knowing which facts were already known could be instrumental in building believable lies without revealing new facts.

Disinformation

We have reported before about the Russian disinformation campaigns regarding this incident. More recently, in November of 2020, Bellingcat, which has been instrumental in retrieving information about the attack on flight MH17, published evidence that Bonanza Media, a self-styled independent investigative platform, is in fact a special disinformation project working in coordination with Russia’s military intelligence. The open-source intelligence outfit asserts that:

While we have not yet established conclusively whether the Russia’s military intelligence agency, best known as the GRU, was behind the initial launch and funding of the Bonanza Media project, we have established that shortly after it was launched, senior members of the GRU entered into direct and regular communication with the project leader

It is no coincidence that one of the main forces behind Bonanza is Dutch as well. Together with former Russia Today journalist Yana Yerlashova, Bonanza was set up by blogger and journalist Max van der Werff.

Eliot Higgins, the founder and executive director of Bellingcat has called out what he says are Russian lies, and the interplay between the official Russian position and the disinformation propagated by so-called MH17 “Truthers”, in his recent tweets about the on-going MH17 court hearings.

Cozy Bear

Top suspect of the attack on the Dutch police is APT29 (Cozy Bear), a well-known hacking group that the White House linked earlier this year to the Russian Foreign Intelligence Service, also known as the SVR. They are also suspected to be behind the SolarWinds attack and other international espionage cases.

Aftermath

Both the Dutch police and the AIVD did not provide comments on the publication by the Volkskrant, but we do know that the AIVD is closely monitoring a reorganization to improve the security of the Dutch police’s networks.

The international court in The Hague is in the middle of the MH17 trials and Russia’s interference is unlikely to do their case any good, but of course they will deny every involvement.

The post Russia accused of hacking Dutch police during MH17 investigation appeared first on Malwarebytes Labs.

Until the information age, cookies were only known as a tasty but unhealthy snack that some people enjoyed, and others avoided. HTTP cookies, also known as computer, browser, or Internet cookies, are similarly divisive. Although some people like the more personalized browsing experience created by cookies, others have privacy concerns.

Cookies are small pieces of information that websites can store in your browser. A website can check that information each time you interact with it, and that allows it to tell you apart from everyone else. Without cookies you would never be able to log in to a website or store items in a shopping cart.

However, that ability to tell you apart from everyone else is also what makes cookies extremely useful for cross-site tracking and advertising. Thankfully, privacy-conscious users can disrupt that tracking easily, because blocking or clearing cookies is easy. Although there are plenty of tools that can help manage your cookies, if you need to, you can easily clear the decks directly in your browser. Here’s how:

Clearing cookies on a desktop computer

The following instructions will guide you through clearing cookies on the most popular desktop and mobile browsers (as of June 2021).

How to clear cookies in Chrome on Windows

1. Start Google Chrome.
2. Click the vertical three-dots icon on the top right-hand corner and then select History—alternatively, press Ctrl+H in Chrome. 
3. Click Clear browsing data.
4. Select Cookies and other site data.
5. Select All time in the Time range dropdown menu.
6. Click Clear data to clear cookies in Google Chrome.
7. Click Block all cookies in Cookies and other site data to turn off cookies permanently.

How to clear cookies in Firefox on Windows

1. Start Firefox.
2. Click the three-lined icon (hamburger menu) on the top right-hand corner and select Options next to the gear icon.
3. Click Privacy & Security and then Cookies and Site Data.
4. Select Cookies and Site Data.
5. Select Cached Web Content.
6. Hit Clear to clear cookies in Firefox.
7. You can also click Strict in Privacy & Security to Block most cookies, but this may cause websites to malfunction in Firefox.

How to clear cookies in Edge on Windows

1. Start Microsoft Edge
2. Click the horizontal three-dots icon on the top right-hand corner and select Settings next to the gear icon.
3. Click Privacy, search, and services.
4. Click Choose what to clear under Clear browsing data.
5. Select Browsing history, Download history, Cookies and other site data, and Cached images and files.
6. Hit Clear now to clear cookies in Microsoft Edge.
7. Click Block third-party cookies in Cookies and site preferences to block third-party cookies permanently.

How to clear cookies in Opera on Windows

1. Start Opera.
2. Click Settings on the top left-hand corner.
3. Click Advanced and then Privacy & Security.
4. Click Clear browsing data. Alternatively, please Ctrl+Shift+Del to open your Clear browsing data options faster.
5. Select Cookies and site data.
6. Hit Clear data to clear cookies in Opera.
7. Click Cookies and site data under Site Settings to find options to block all third-party cookies permanently.

How to clear cookies in Safari on macOS

1. Start Safari on your Mac.
2. Select Preferences and then click on Privacy.
3. Find Cookies and website data and hit Manage Website Data.
4. Press Remove All and Done to clear cookies in Safari.
5. Click Block all cookies under Manage Website Data and tick Prevent cross-site tracking to turn off cookies permanently.

Clearing cookies on a mobile device

How to clear cookies in Chrome for Android

1. Start the Chrome app.
2. Click the vertical three-dots icon on the top right-hand corner and then select History.
3. Click Clear browsing data…
4. Select All time in the Time range drop-down menu.
5. Click clear data to clear cookies in Chrome on an Android device.

How to clear cookies in Firefox for Android

1. Start the Firefox app.
2. Click the three-dot icon in the corner and hit Privacy.
3. Click Delete browsing data.  
4. Select Cookies and click Clear Data.
5. Alternatively, click Clear private data on exit to clear cookies in Firefox on an Android device
6. Click Disabled in Cookies to turn off cookies permanently.

How to clear cookies in Safari for iOS

1. Click Settings on your iOS device.
2. Find Safari.
3. Click Clear History and Website Data to clear your cookies and history in iOS.
4. Alternatively, click Settings, Safari, Advanced, Website Data, and then hit Remove All Website Data to clear cookies in iOS but keep your history.
5. Click Block All Cookies in Safari to turn off cookies permanently.

How to clear cookies in Firefox for iOS

1. Start the Firefox app.
2. Click the three-lined icon (hamburger menu) on the lower-right corner.
3. Hit Settings.
4. Select Data Management.
5. Click Clear Private Data to clear cookies in Firefox on iOS.
6. Click Cookies in Data Management to turn off cookies permanently.

The post How to clear cookies appeared first on Malwarebytes Labs.

This patch Tuesday harvest was another big one. The Windows updates alone included seven zero-day vulnerability updates, two of them are actively being used in the wild by a group called PuzzleMaker, four others that have also been seen in the wild, plus one other zero-day vulnerability not known to have been actively exploited. Add to that 45 vulnerabilities that were labelled important, and security updates for Android, Adobe, SAP, and Cisco. You can practically see the IT staff scrambling to figure out what to do first and what needs to be checked before applying the patches.

PuzzleMaker

Security researchers have discovered a new threat actor dubbed PuzzleMaker, that was found using a chain of Google Chrome and Windows 10 zero-day exploits in highly targeted attacks against multiple companies worldwide. Unfortunately the researchers were unable to conclusively identify the Chrome vulnerability that was used (but they do have a suspect). The good news is that the two Windows vulnerabilities in the attack chain were included in the Windows 10 KB5003637 & KB5003635 cumulative updates. These vulnerabilities are listed as CVE-2021-31955, a Windows kernel information disclosure vulnerability, and CVE-2021-31956, a Windows NTFS elevation of privilege vulnerability.

Other critical issues

The other critical patches made available by Microsoft this June include these actively exploited vulnerabilities:

• CVE-2021-33739, a Microsoft DWM Core Library Elevation of Privilege Vulnerability.
• CVE-2021-33742 Windows MSHTML Platform Remote Code Execution Vulnerability.
• CVE-2021-31199 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability.
• CVE-2021-31201 another Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability.

Not (yet) actively exploited zero day vulnerability:

• CVE-2021-31968 Windows Remote Desktop Services Denial of Service Vulnerability.

Other critical updates:

• CVE-2021-31963 Microsoft SharePoint Server Remote Code Execution Vulnerability.
• CVE-2021-31959 Scripting Engine Memory Corruption Vulnerability.
• CVE-2021-31967 VP9 Video Extensions Remote Code Execution Vulnerability.
• CVE-2021-31985 Microsoft Defender Remote Code Execution Vulnerability.
• CVE-2021-33742 Windows MSHTML Platform Remote Code Execution Vulnerability.

Android

The Android Security Bulletin of June 7 mentions a critical security vulnerability in the System component that “could enable a remote attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process”, which is as bad as it sounds. That vulnerability, listed as CVE-2021-0507, could allow an attacker to take control of a targeted Android device unless it’s patched.

Cisco

Cisco has issued a patch for a vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software, that could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. An attacker could exploit this vulnerability by sending a crafted SSL/TLS message through an affected device. SSL/TLS messages sent to an affected device do not trigger this vulnerability. Cisco informs us that there is no workaround for this issue. Patching is the only solution.

SAP

In the SAP advisory for Security Patch Day – June 2021 we can find two issues that are labelled as “Hot News”:

• CVE-2021-27602 SAP Commerce, versions – 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.
• CVE-2021-27610 Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform.

Adobe

To top things off, Adobe has released a giant Patch Tuesday security update release that fixes vulnerabilities in ten applications, including Adobe Acrobat (of course), Reader, and Photoshop. Notably five vulnerabilities in Adobe Acrobat and Reader were fixed that address multiple critical vulnerabilities. Acrobat’s determination to cement its place as the new Flash shows no sign of dimming.

Successful exploitation could lead to arbitrary code execution in the context of the current user on both Windows and macOS. The same is true for two critical vulnerabilities in Photoshop that could lead to arbitrary code execution in the context of the current user.

CVE

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) database. Its goal is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services). Which is why we try and link you to the Mitre list of CVE’s where possible. It allows interested parties to find and compare vulnerabilities.

Happy patching, everyone!

The post Microsoft fixes seven zero-days, including two PuzzleMaker targets, Google fixes serious Android flaw appeared first on Malwarebytes Labs.

Back in 2016, we saw the emergence of a botnet mainstay called TrickBot. Initially observed by our Labs team spreading via malvertising campaigns, it quickly became a major problem for businesses everywhere. Whether spread by malvertising or email spam, the end result was the same. Data exfiltration and the threat of constant reinfection were the order of the day.

Over time, it evolved. Tampering with web sessions depending on mobile carrier is pretty smart. Other features such as disabling real-time monitoring from Windows Defender were also added. In fact, wherever you look, there’s the possibility of stumbling upon a TrickBot reference when digging into other attacks.

The tricky problem of “sophisticated” attacks

The word “sophisticated” is used a lot in security research. Sometimes, it’s used even if an attack being discussed is a basic phish, or maybe some very generic malware.

However, TrickBot is a pretty formidable opponent. As is often the case, the “sophisticated” part isn’t necessarily just about the files themselves. There’s also the organisation behind the scenes to contend with. We’re talking people, infrastructure, small groups of individuals all working to make some code, and keep it ticking over. To grab the exfiltrated data and make something of it. Wherever you look where TrickBot is concerned, there’s probably another cluster of specialised people up to no good. This isn’t a good thing when tackling malware developments.

“How bad is it, really?”

Have you ever stopped to consider “what, exactly, are we up against” when dealing with malware? This week’s events are a very good, and rather alarming, illustration.

What happened this week, you ask? That would be a potentially major blow to the TrickBot crew. A Latvian woman has been charged for their alleged role in a transnational cybercrime organisation. That organisation, as you’ll have guessed, is all about TrickBot shenanigans. What’s particularly interesting here, is how it illuminates just how much work goes into development. It isn’t one person sitting in their bedroom. It’s an actual criminal enterprise, run as a business, with lots of different divisions and moving parts.

There are malware managers in hiring roles, hiring developers to produce the files. This is done on Russian language job websites, and made to look as if it’s for “regular” coding jobs. 

There’s folks looking after finances, and testing malware against CAV services. Money mules and spear phishing are thrown into the mix alongside social engineering and international theft of money, personal, and confidential information.

Peeling back the TrickBot onion

This is just skimming the surface of what was happening under the hood. An entire infrastructure was created, with servers, VPNs, and VPS providers combined by the TrickBot crew to create the perfect malware deployment environment. That’s before you get to the crypters, hired to help evade detection from security software. Or how about those responsible for the spamming tools? The folks monitoring bank website flows to figure out how to defeat multi-factor encryption? There’s even someone creating coding tests, to ensure potential malware author hires know what they’re doing in terms of injections.

Make no mistake, the groups infecting millions of computers worldwide and making huge amounts of money aren’t doing it by accident. What cases like United States of America v. Alla Witte show us is that it’s efficient, structured, and very organised indeed.

The basic plan? Infect computers with TrickBot, spread across networks, grab banking details, and then steal funds. Said funds would then be laundered across a variety of bank accounts “controlled by the defendant and others”. Ransomware would also be deployed, for that final splash of cash.

As touched on above, the group hired experts in a variety of cybercrime fields. This was a perfect accompaniment to the modular, ever-evolving TrickBot. This itself was built upon the framework of the older Dyre malware, with all the years of experience and field expertise you’d expect coming along for the ride.

Evading the long arm of the law

Certain elements of the team helped evade detection by making use of multiple tricks to keep out of law enforcement’s reach. Stolen credit cards and fake identities paid for behind the scenes tech like servers and domains. Multiple proxies were used for communications purposes. Emails and attachments were encrypted, and chat in a private messaging server was also locked down. Multiple VPN services made use of around the world are the final anonymous splashes of icing on a very large cake.

Big scams, big numbers

The full arrest warrant document [PDF] is roughly 60 pages long, and contains an incredible amount of information. It breaks everything down by category, explaining how the malware and its injections worked. How the multi-stage laundering took place, including dates / transaction amounts. The wire transfers listed range from $44,900 to $230,400 across most of 2017 to 2018. There’s even an incredible attempted approximate wire transfer of $691,570,000 between the 19 and 20 October, 2017.

It’s possible time has now been called on this TrickBot crew. No matter what happens, you can be sure other groups are out there right now doing much the same things. A few of them will be just as big, just as well organised, and firing even bigger plundered sums of cash around banking infrastructure.

Next time you read about a piece of malware in the news, consider the sobering thought that it is the tip of a very long spear. An in-depth process lies under the surface keeping said malware in operation. How bad is it really? What, exactly, are we up against?

The answer is: all of the above, and more.

The post TrickBot indictment reveals the scale and complexity of organized cybercrime appeared first on Malwarebytes Labs.

The US Department of Justice announced Monday that it recovered much of the ransomware payment that Colonial Pipeline paid to free itself from the attack that derailed the oil and gas supplier’s operations for several days last month.

The seizure of 63.7 of the initial 75 paid bitcoins represented the first success of the Justice Department’s Ransomware and Digital Extortion Task Force, a team formalized just months ago, according to reporting from The Wall Street Journal. The value of the recovered bitcoins stands at roughly $2.3 million.

Some commentators have speculated that the discrepancy between what was paid and what was recovered may be accounted for by the fact that Darkside ransomware is sold under the Ransomware-as-a-Service (RaaS) model. The missing money (about 15% of the total) may be the fee the attackers paid the Darkside creators for using their malware.

In statements prepared Monday, US Deputy Attorney General Lisa Monaco characterized the operation as a victory and a representation of the Justice Department’s full powers.

“Following the money remains one of the most basic, yet powerful tools we have,” Monaco said. “Ransom payments are the fuel that propels the digital extortion engine, and today’s announcement demonstrates that the United States will use all available tools to make these attacks more costly and less profitable for criminal enterprises. We will continue to target the entire ransomware ecosystem to disrupt and deter these attacks.”

Monaco added that the Department of Justice’s actions showcased the “value of early notification to law enforcement”—a clear signal that the federal government is now operating in lockstep to curb the threat of ransomware. In mid-May, the White House emphasized the importance of cyberattack notification when President Joe Biden signed an Executive Order that requires such warnings from technology companies that sell their products to the federal government, and weeks later, the Transportation Security Administration (TSA) rolled out a new cybersecurity directive for all US pipeline companies that will require pipelines to notify the government of any cyberattacks.

According to a sworn affidavit in support of a “seizure warrant” that was revealed Monday, Monaco’s statement about “following the money” was surprisingly literal. According to the affidavit, law enforcement tracked Colonial Pipeline’s payment across the public Bitcoin ledger until much of the payment landed in one specific Bitcoin address, which the outlet The Record identified here. After the funds arrived at the Bitcoin address—which law enforcement referred to as the “Subject Address”—they were not touched for days.

Then, a bit of mystery happened.

According to the affidavit, the Justice Department was able to retrieve funds from the Subject Address because the FBI obtained that address’s related “private key.”

Private keys are somewhat like passwords, in that they not to be shared, but they are also more complex than that. Private keys are randomized strings of letters and numbers that are cryptographically related to the Bitcoin address that they access. Reverse engineering a private key is technically infeasible, which means that somehow, the FBI obtained an example of possibly the most closely guarded secret for any cryptocurrency user today.

Some users keep their private keys on exchanges (websites for trading bitcoins). If the Colonial Pipeline attackers kept their key on a US-based exchange it would be an easy matter for the FBI to seize it. However, security-conscious Bitcoin users tend to keep their keys where they can see and secure them, on computers they own.

How the FBI managed managed to get the key is unclear, but a week after the Colonial Pipeline attack, Darkside said it lost control of some of its servers. In the same announcement, the threat actors also said they lost some ransom payments.

Whether the US government removed Darkside’s server access is not known, but the FBI’s ability to obtain a Bitcoin address private key still reveals a new attitude in America’s fight against cybercrime—a fierce, antagonistic approach that potentially crosses ethical lines.

In April, the Department of Justice revealed that the FBI had obtained the somewhat extraordinary authority to access servers it did not own or control so that it could remove web shells placed by cybercriminals who exploited zero-day vulnerabilities in on-premises versions of Microsoft Exchange Server software. These web shell removals were performed with no notification to the servers’ owners.

Similarly, in January, after the international law enforcement agency Europol announced that it had taken control of the Emotet botnet, cybersecurity researchers spotted something hidden. The law enforcement agencies responsible for the takedown had already planned to deploy an update to remove Emotet from infected machines, and law enforcement agencies themselves wrote the code for the deployment.

In speaking on our podcast Lock and Code, Malwarebytes Security Evangelist Adam Kujawa said this was a new tactic from government authorities.

“I’ve seen people maybe misuse or abuse or modify how a particular malware Command & Control infrastructure would work, but I’ve never seen law enforcement deploy brand new code, and that’s kind of worrying a lot of folks,” Kujawa said. “A lot of people might consider it illegal.”

The post DOJ recovers pipeline ransom, signals more aggressive approach to cybercrime appeared first on Malwarebytes Labs.

An international operation that monitored an encrypted device company under control of the Federal Bureau of Investigation (FBI) and the Australian Federal Police (AFP) has led to a massive, coordinated string by law enforcement in several countries.

The setup

Law enforcement agencies around the world have long campaigned for encryption backdoors, so they can see what criminals are saying to each other. Unable to break the encryption of existing messaging apps, the FBI and the AFP came up with an ingenious plan to get criminals to use a device for encrypted communication that they could eavesdrop on.

The FBI created an app called AN0M, to fill the void left behind by dismantling several encrypted platforms used by criminals. Custom cellphones with the FBI-controlled platform installed were sold on underground markets and grew in popularity. Of course, not all the users interested in these devices were necessarily criminals, but the phones turned out to be very popular among criminals of all kinds, including outlawed motor gangs, Italian organized crime, Asian crime syndicates, and international drug traffickers.

As a result, law enforcement officials have been monitoring what they had to say for nearly three years.

The operation

The name of the operation was different depending on who you ask. The AFP refers to it as Special Operation Ironside, Europol ran an Operational Task Force to support the sting and called it Greenlight, and the FBI (and many others) call it Operation Trojan Shield. Which is very fitting as it pretended to offer the criminals a shield to hide their messages, but that shield was in fact a Trojan horse.

The goal of the new platform was to target global organized crime, drug trafficking, and money laundering organizations, regardless of where they operated, with an encrypted device that had features that would appeal to organized crime networks, such as remote wipe and duress passwords, to persuade criminal networks to pivot to the device.

The service is said to have provided over 12,000 encrypted devices to over 300 criminal syndicates operating in more than 100 countries.

The cooperation

The FBI had the lead in the investigation aided by the AFP which provided the systems needed to decrypt the messages. Europol supported the  operation by coordinating the international law enforcement community that was involved, by enriching the information picture and bringing the criminal intelligence into ongoing operations to target organized crime and drug trafficking organizations. The following countries participated in the international coalition: Australia, Austria, Canada, Denmark, Estonia, Finland, Germany, Hungary, Lithuania, New Zealand, the Netherlands, Norway, Sweden, the United Kingdom, and the United States.

Is it legal?

Of course it was you would say, since it was run by law enforcement. But listening in on the conversations of people that you have no evidence against is not allowed in many countries. The AFP’s prominent role may be related to Australia’s Telecommunications and other Legislation Amendment (TOLA), passed in 2018. The TOLA provides Australian law enforcement with the ability to make technical assistance requests (TARs) that oblige companies providing technical services in Australia to help them decrypt messages with technical assistance or new capabilities.

Providing a service after taking down the real enablers

It is ironic in a way that the need for a encrypted device company has arisen after the EncroChat system had been compromised so that law enforcement could eavesdrop, and the Sky ECC communication service was unlocked. After these events ANOM was welcomed in criminal circles and passed on by word-of-mouth advertising. Australian Federal Police Commissioner Reece Kershaw:

“Essentially, they have handcuffed each other by endorsing and trusting AN0M and openly communicating on it — not knowing we were watching the entire time.”

You had to know a criminal to get hold of one of these customized phones and you could only communicate with someone on the same platform. This probably helped to limit the number of customers to the “target audience” of the agencies that ran the sting operation.

The results

To say that the operation was a success would be an understatement. Law enforcement agencies report that around 800 suspects have been arrested. Searches of more than 700 houses have resulted in the seizure of over eight tons of cocaine, 22 tons of cannabis and cannabis resin, two tons of synthetic drugs, six tons of synthetic drugs precursors, 250 firearms, 55 luxury vehicles and over $48 million in cash and cryptocurrencies.

Why stop now?

Given the operation was so successful, questions have been raised about why its use wasn’t continued. The decision to stop the operation was reportedly made jointly by all the international partners. But commissioner Kershaw is reported to have hinted of “a legal time frame on this operation” about which more details might be revealed later on. We’ll keep you posted.

The post 800 arrests after police dupe crime groups into using backdoored phones appeared first on Malwarebytes Labs.

This week on Lock and Code, we’re presenting you something a little different. We’re telling you a story—with no guest interview included—that involves the use of VPNs.

In 2016, a mid-20s man began an intense, prolonged harassment campaign against his new roommate. He emailed her from spoofed email accounts. He texted her and referenced sensitive information that was only stored in a private, online journal. He created new Instagram accounts, he repeatedly made friend requests through Facebook to her friends and family, he even started making bomb threats. And though he tried to sometimes mask his online activity, two of the VPNs he used while registering a fake account eventually gave his information to the FBI.

This record-keeping practice, known as VPN logging, is frowned upon in the industry. And yet, it helped lead to the capture of a dangerous criminal.

Can two VPN “wrongs” make a right? Find out today on Lock and Code, with host David Ruiz.

https://feed.podbean.com/lockandcode/feed.xml

You can also find us on Apple Podcasts, Spotify, and Google Podcasts, plus whatever preferred podcast platform you use.

The post Can two VPN “wrongs” make a right? Lock and Code S02E10 appeared first on Malwarebytes Labs.

Last week on Malwarebytes Labs, we looked at an interesting trend in facial recognition technology—hint: it’s a slow fade, the latest ransomware attacks on JBS and Steamship Authority, Cobalt Strike, a Coronavirus phishing campaign, WhatsApp’s decision to not limit app functionalities for non-compliant users after all, and a cyber threat report compiled by the National Crime Agency (NCA) in the UK.

We also analyzed Kimsuky, the APT that continues to attack the South Korean government, and the NSIS crypter along with its evolution.

Lastly, we recognized the cybersecurity challenges in SMBs and were in awe after the US Attorney’s office decided to investigate ransomware attacks the same way as terrorist attacks.

Other cybersecurity news

• A phishing campaign launched off of the back of the recent ransomware attack against Colonial Pipeline weeks ago. The email, purporting to originate from a company’s “Help Desk”, is encouraging recipients to download a “ransomware system update” that’d prevent the company from getting attacked by ransomware. (Source: Inky)
• Organizers of the Tokyo Olympics found themselves on the receiving end of a data breach. (Source: The Japan Times)
• Fujifilm fell victim to a ransomware attack. (Source: InfoSecurity Magazine)
• Those returning to the office were welcomed by—drumroll, please—phishing emails! (Source: Avanan)
• According to researchers, a new ransomware variant called Epsilon Red is said to be hunting for unpatched Microsoft Exchange servers to exploit. (Source: Computing)
• The UK government faced a backlash and legal challenge over its plan to share health service data with a third-party as part of its digitization effort. (Source: Computing)
• A threat report from Thales revealed that, although the pandemic has transformed how we do work, cybersecurity is sadly not keeping up. (Source: TechRepublic)
• Mustang Panda, a Chinese espionage campaign, is gaining access to official Southeast Asian government websites via a novel Windows backdoor. (Source: The Record)
• JBS, the world’s largest meat supplier, is back to normal operations after a ransomware attack. (Source: Bleeping Computer)

Stay safe, everyone!

The post A week in security (May 31 – June 6) appeared first on Malwarebytes Labs.

Amazon smart device owners only have until June 8 to opt out of a new program that will group their Echo speakers and Ring doorbells into a shared wireless network with their neighbors, a new feature that the shopping giant claims will provide better stability for smart devices during initial setup and through possible Internet connectivity problems.

The program is the latest example of yet another multibillion-dollar company rolling out significant changes without meaningfully notifying users beforehand, making it increasingly difficult for users to choose how their data is used, or how their products function. In March, Google changed how Google Chrome users would be tracked across the web, and in May, WhatsApp threatened to remove basic messaging functions from the apps of users who refused to share some of their data with parent company, Facebook.

With all these company decisions, user choice has diminished.

This week, Amazon announced that many of its smart devices would be incorporated into what it is calling “Amazon Sidewalk,” a shared network of devices within neighborhoods that will, according to the company, “help simplify new device setup, extend the low-bandwidth working range of devices to help find pets or valuables with Tile trackers, and help devices stay online even if they are outside the range of their home WiFi.”

Amazon Sidewalk will create a mesh network between smart devices that are located near one another in a neighborhood. Through the network, if, for instance, a home WiFi network shuts down, the Amazon smart devices connected to that home network will still be able to function, as they will be borrowing internet connectivity from neighboring products. Data transfer between homes will be capped, and the data communicated through Amazon Sidewalk will be encrypted.

Amazon smart device owners will automatically be enrolled into Amazon Sidewalk, but they can opt out before a June 8 deadline. That deadline has irked many cybersecurity and digital rights experts, as Amazon Sidewalk itself was not unveiled until June 1—just one week before a mass rollout.

Jon Callas, director of technology projects at Electronic Frontier Foundation, told the news outlet ThreatPost that he did not even know about Amazon’s white paper on the privacy and security protocols of Sidewalk until a reporter emailed him about it.

“They dropped this on us,” Callas said in speaking to ThreatPost. “They gave us seven days to opt out.”

Other experts have warned about the security and privacy implications of Amazon’s project, as Sidewalk will rely on an untested WiFi protocol to link together selected devices. Whitney Merrill, a privacy and information security attorney with Asana, said on Twitter: “Hello privacy nightmare.” 

Further, as reported by Ars Technica, the history of wireless connection technologies is littered with vulnerabilities. Researchers found flaws in the late-90s security algorithm Wired Equivalent Privacy (WEP)—after it had been widely used for years—and the technology that replaced it—WPA—is not without problems.

To its credit, Amazon’s white paper addresses how it plans to keep customers’ data secure and private when it travels through Sidewalk. According to that white paper, Amazon will limit the type and amount of metadata it receives, it will encrypt the contents of delivered packets so that the company cannot see what is inside, and customers themselves will also be prevented from seeing the content of packets sent to and from endpoints that they do not own.

Security and privacy aside, one issue still remains—weakened user choice.

The implementation of Amazon Sidewalk mirrors the more careless behavior showcased by Google earlier this year, when it decided to include millions of Google Chrome users in an experiment into how their web browsing behavior was tracked online. Google, like Amazon, did not individually notify users about the new program—called FLoC—and Google, like Amazon, automatically enrolled users into the program, forcing them to manually opt out.

Amazon’s approach to opt-out is clearer than Google’s, though. The company has developed a specific menu item in its Alexa and Ring apps that clearly denotes a new setting to enable or disable Sidewalk. Google, on the other hand, did not have a specific toggle to disable FLoC, and users were instead forced to turn off all third-party cookies if they wanted to opt out.

Certain aspects of Amazon’s rollout of Sidewalk also resemble decisions made this year by WhatsApp, the end-to-end encrypted messaging app owned by Facebook. Last month, the messaging app told users that if they did not agree to sharing some of their data with Facebook, they would see their apps become useless, unable to receive calls or messages. WhatsApp walked back this decision in late May.

Here, Amazon is implementing no such consequences for opting out—which is good—but it is still making a sweeping decision about how customers’ own products should function. And the company isn’t just changing the way already-purchased Amazon devices work, it’s also reaching beyond those devices to affect relationships that have nothing to do with Amazon, such as who gets to use your internet connection, how much of it they can use, and what you might be charged for that.

Amazon Sidewalk will work with the following devices in the US, according to Amazon: Ring Floodlight Cam (2019), Ring Spotlight Cam Wired (2019), Ring Spotlight Cam Mount (2019), Echo (3rd gen and newer), Echo Dot (3rd gen and newer), Echo Dot for Kids (3rd gen and newer), Echo Dot with Clock (3rd gen and newer), Echo Plus (all generations), Echo Show (2nd gen), Echo Show 5, 8, 10 (all generations), Echo Spot, Echo Studio, Echo Input, Echo Flex.

For users who want to opt out, they can find the solution in their Alexa and Ring apps. In the Alexa app, users can go to “Settings,” and then navigate to “Account Settings,” where they can find “Amazon Sidewalk.” Users can also disable Sidewalk in the “Control Center” of the Ring app or Ring website.

The post Amazon Sidewalk starts sharing your WiFi tomorrow, thanks appeared first on Malwarebytes Labs.

When you think of the world of ethical hackers (white hat), malicious hackers (black hat), and hackers that flirt with both sides (grey hat), you may envision people in shiny trench coats and dark glasses, whose computer skills are only matched by their prowess in martial arts.

The truth is that hackers are pretty different from their depiction in The Matrix. For example, most hackers can’t slow time down and jump across tall buildings. At least, not that we know of. In reality, a hacker usually keeps a low profile and concentrates on their work.

What’s a hacker?

The answer to “what’s a hacker?” depends on who you ask. We’d guess that most people who work with computers will tell you the answer is something close to this Wikipedia description: “a computer expert who uses their technical knowledge to achieve a goal or overcome an obstacle, within a computerized system by non-standard means.” Much to the annoyance of many of those people, outside of computing, people often understand “hacker” to mean something different and more negative.

To many, a hacker is someone that employs their expertise to breach a computer, smartphone, tablet, or network, regardless of intent. Although it is often used to refer to illegal activity, even within this narrower definition not all hackers are deemed criminal. They are often classified into three main categories: Ethical hackers have traditionally been known as “white hat”, malicious hackers as “black hat”, and “grey hats” are somewhere in the middle.

Ethical hackers

Ethical hackers look for security flaws and vulnerabilities for the purpose of fixing them. Ethical hackers don’t break laws when hacking. An ethical hacker can be someone who tests their own computer’s network defenses to develop their knowledge of computer software and hardware or a professional hired to test and enhance system security.

Security careers related to ethical hacking are in-demand. Malware analysts are a good example. An in-demand ethical hacker who has worked hard to develop their skillset can have a lucrative career.

Ethical hackers are sometimes referred to as white hat hackers. White hat hacker is an outmoded term for an ethical hacker. It comes from 20^th century Western films in which the good guys wore white hats. Modern experts refer to them as ethical hackers.

Malicious hackers

Malicious hackers circumvent security measures and break into computers and networks without permission. Many people wonder what motivates hackers who have had intentions. While some do it for cyber-adventure, others hack into computers for spying, activism, or financial gain. Malicious hackers might use tools like computer viruses, spyware, ransomware, Trojan horses, and more to further their goals. While there may be financial incentives to hacking, the risks are high too: A malicious hacker can face a long time behind bars and massive fines for their illegal activity.

Just as “white hat” is an older term for ethical hackers, conversely “black hat” is an older term for malicious hackers, also based on the old Western film practice of which hats the “good guys” and “bad guys” wore. Today, malicious hacker is a more apt description.

Grey hat hackers

A grey hat hacker skirts the boundaries between ethical and unethical hacking by breaking laws or using unethical techniques in order to achieve an ethical outcome. Such hackers may use their talents to find security vulnerabilities in a network without permission to simply show off, hone their skills, or highlight a weakness.

Tips on how to become an ethical hacker

You may have what it takes to become a highly rated ethical hacker if you’re patient, clever, have an affinity for computers, have good communication skills, and enjoy solving puzzles.

A degree in computer science or information security and a background in military intelligence can be useful but isn’t necessary. Thanks to the wide availability of information and open source code, and incentives like bug bounties, there are many routes into ethical hacking outside of traditional education. For more advice on how to become an ethical hacker, take a look at our interview with bug bounty hunter Youssef Sammouda.

How do I protect myself from a hacker?

An unethical hacker can use many techniques and tools to breach your computer or device’s network security. Your first line of defense is to make life hard for hackers by ensuring you: Use strong, unique passwords; keep your systems patched with security updates; install advanced antivirus protection that defends your computer against malicious software; enable the firewalls on your Internet router and computers. For an extra layer of defense, you can protect your network traffic from snooping and tampering with a VPN.   

Lastly, be on guard for phishing and social engineering attacks that try to trick you into doing something that’s bad for you, like downloading malware or giving out sensitive information.

The post White hat, black hat, grey hat hackers: What’s the difference? appeared first on Malwarebytes Labs.