IT News

Thanks to the vast rollout of COVID-19 vaccines to millions of people in the US and Europe, some of us are finally seeing some semblance of a return to normalcy. And organizations, who have experienced first-hand the struggle to stay afloat during months of struggle, are expecting to transition back to how things were.

For some, a life back to normal means employees commuting back to workplaces. Empty cubicles will slowly start filling up again. And face-to-face meetings, either a big group in a conference room or a small one in a coffee shop, will be A Thing once again.

But what about those employees who prefer to work from home, or at least to have the option? And what of businesses happy to be liberated from the constraints of physical workspaces? It seems there are many of both.

The normal we knew of may no longer fit the kind of normal organizations have adjusted for. Remote working during the pandemic has made leadership roles in organizations understand that connectivity—making company data and resources available for all employees who need them, no matter where they are, while keeping that data as secure as possible—is what they and every business really need.

The Cloud, in other words.

Cloud adoption

“Cloud” is a term used to describe a vast network of remote servers located around the world linked together to form a contiguous platform for computer services that can be subdivided and scaled with ease. It has been around for nearly two decades, and organizations adapting a Cloud strategy have been on the uptick, pre-pandemic. And the lockdowns and (some imposed) mandatory work from home (WFH) measures during the pandemic have only accelerated Cloud adoption even further.

It is noted that enterprises are the big spenders on Cloud computing. Yet, many have yet to embrace the Cloud—particularly those in the SMB sector. According to the Small & Medium Business Trend Report from Salesforce, “digital forward SMBs”—or SMBs that have invested in technology, including the cloud, to drive customer interaction and growth—were better equipped to handle the pandemic.

If you’re still on the fence about whether you should move your data and operations to the Cloud, or you’re locked in the “on-premise versus Cloud” debate on which one is better, we have identified below the three main reasons why organizations, regardless of size, are migrating to the Cloud.

1. Cost efficiency

Setting up servers and making sure that they are physically secure, have uninterrupted power and air conditioning, and are loaded with properly licensed, patched and updated software is no small task. There are high, upfront fees, a multitude of things can go wrong, and it is hard to scale. And the lifetime costs aren’t small either: From electricity bills and maintenance, to that dreaded “end of life” for both hardware and software. When it comes to this kind of computing infrastructure, economies of scale matter, and almost no business can compete with the scale of Cloud providers like Google, Microsoft and Amazon.

Suffice to say, many organizations are opting not to worry about servers and server rooms at all, and instead choosing to pay for what they use by using Cloud infrastructure like AWS, or Cloud services, like Office 365.

2. Security and compliance

Cloud service providers, especially the big-named ones like Amazon and Microsoft, boast of having excellent and powerful security in place by default. And Cloud service providers have made it a point to make their security as robust as possible, relieving businesses of many of the basics they struggle with, such as backups, single sign-on, encryption, firewall configuration, and consistent security updates—you name it. The Cloud doesn’t mean you can forget about security, but it can make it much easier to do the right thing.

The same robustness can be said about the physical security of their servers. It would be extremely hard for intruders to physically break into servers that house an organization’s precious data. Cloud providers keep data safe from physical destruction by keeping it in multiple places, and keep it safe from theft by investing in layers of physical security, like fences, guards, surveillance cameras, and biometric access systems.

Security in the Cloud also reduces the attack surface for insider threats because employees and contractors cannot go in and out of rooms they’re not supposed to go to.

When it comes to disasters—and by this, we mean natural and local ones—locations of on-premise servers are expected to withstand whatever nature can throw at it, may these be floods, earthquakes, tornadoes, and even your random lava spill. However, many on-premise operators don’t have the redundancies they need, seeing them as not cost efficient. On the other hand, redundancy is built into a Cloud or hybrid configuration.

Lastly, we’d like to mention that many Cloud providers comply with various security, privacy, and data protection regulations. In the US, we have the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and Federal Information Security Management Act (FISMA) among others. Other countries have their own standards that a Cloud provider complies to as well.

The security advantage of Cloud services was graphically illustrated in March this year, after Microsoft released patches for four zero-days being exploited by a group dubbed Hafnium. The patches were quickly reverse engineered by multiple criminal groups and automated attacks began soon after. The attacks turned unpatched Exchange servers into backdoors that could be used to steal data or launch ransomware inside company networks. IT teams dropped everything to find and patch their vulnerable servers, Microsoft released a flurry of tools to help, and the FBI even took the highly unusual step of remotely cleaning up some of the compromised servers.

What was notable about the incident is that it affected on-premise servers with Exchange, but not not the Cloud version. The “patch gap”, the often months-long gap between a patch being made available and it being used—the gap that criminals were so ruthlessly exploiting—simply didn’t exist in the Cloud.

3. Flexibility

The Cloud allows enormous flexibility, whether you’re adapting quickly to good news or bad. Famously, the Cloud allows services to scale up extremely quickly, avoiding many of the technical problems that can come from growing too fast or becoming suddenly popular.

It can also help when businesses are faced with a sudden, unexpected and challenging situation, as many were in April 2020 as COVID spread around the world. Dyer Brown, a Boston-based architectural firm, is an SMB that adopted the Cloud prior to 2020 and was able to successfully and fully shift their entire workforce to remote work. Employees were able to access important files wherever they were, thus, productivity and collaboration weren’t sacrificed. This flexibility afforded by the Cloud not only made it possible for their 50 employees to work offsite but also take care of sick family members, home school kids, and focus on their health more.

It has also been made apparent that flexibility with work schedule due to working remotely has become a make-or-break factor for employees on whether they should stick with their current company or move to a new one. Some even welcome pay cuts in exchange for working from home.

This is something organizational leaders will need to consider seriously.

The post Cloud vs on premise: 3 reasons the Cloud is winning appeared first on Malwarebytes Labs.

Back in November, gaming giant Capcom suffered a ransomware attack. In its press notification, it mentioned the various types of data potentially grabbed by their attackers. Things took an ominous turn when they refused to pay the ransom, and the group behind the attack said that was the wrong move. Capcom had the chance to “save data from leakage”; they did not take it. Sure enough, a whole collection of files were leaked soon after.

The threat of data drops from scorned ransomware groups is now a common extortion tactic. What we couldn’t have predicted here, is one of the ramifications of said drop. Time to wind things forward to June 2021 and a date with a lawsuit. The twist? The lawsuit isn’t aimed at the ransomware authors, but the compromised company.

Of data drops and research collections

I used to work in and around game / movie development a long time ago. We were incredibly low budget, and did very low budget things. An invaluable source of help at the time were resource guides and collections. Essentially: Big books filled with work compiled by visual artists, composers, designers, whoever. If you were lucky, the book came with a CD loaded with material from the book. Even luckier? You could use the contents for your own work for free. If the project was commercial, you’d typically pay a license fee of some kind.

There were also companies which curated content from multiple artists, and made sure all the licensing behind the scenes was watertight. Where this often went wrong was if the disc went walkabout away from the book.

Organisations would end up with discs lying around in desks, with nobody sure of the source / who had paid for licensing. If someone ripped disc contents, you’d then end up with self-burnt CDs lying around the place which appeared to be in-house creations. You have to be incredibly careful where resource materials are concerned.

If you’re wondering how this ties into the ransomware attack, I’m about to fill in the blanks.

The unintended consequence of a data leak

An artist in this case is seeking $12m in damages from Capcom, claiming Capcom used their imagery from a resource book / CD in a number of its video game titles. This has all come about off the back of the data leak from the ransomware hack. At least one of the images from the stolen and leaked files shares the same file name as what appears to be an identical image from the book’s CD-ROM.

The Juracek Vs Capcom document can be seen here, along with multiple examples of images potentially making their way into games. Sadly, it doesn’t go into detail on the most fascinating part…whether or not the artist became aware as a result of the data breach and subsequent leak. Most reports simply say the artist is using the breach as part of their evidence. There’s also the question of how they became aware of the images in the dump in the first place.

If I had to guess, incredibly knowledgeable fans saw the high resolution images, wondered where they came from, and perhaps got in touch with the creator. This isn’t an unusual thing to happen. Back in the mid 90s I tracked down the music composer for a AAA game series on Japanese language message boards, in order to tell them how cool their music is. It’s a lot easier to do things like this these days which may be a blessing or a curse, or perhaps a bit of both.

However you stack it up, it promises to be a fascinating day in court. This story raises some other issues, too.

Turning a negative into a positive

Some ransomware groups have tried to mix it up a bit in the realm of PR. They present themselves as Robin Hood style renegades, robbing the rich to give to the poor…or, more specifically, giving to charities. An interesting tactic, except charities face all sorts of problems if they’re gifted ill-gotten gains. As mentioned elsewhere, there’s every possibility the “we’re being helpful, honest” approach is merely a ruse to keep up the pretence of respectability. Here, though, we run into a bit of a problem.

The artist in question has made what they feel to be a valid complaint, and are having their day in court as a result. Being able to tie specific file names from their CD-ROM to named files in Capcom folders off the back of the hack? That probably strengthens their case quite a bit.

Put simply, these ransomware authors…and anyone else, for that matter…can now point to this story as evidence that they did in fact “help” someone in indirect fashion.

New frontiers in the ransomware world

The fallout from the attack could prompt a new ransomware tactic. It’s not a stretch to think breachers will go looking for copyright / related violations. After all, some ransomware groups have already shown an interest in how they can weaponize the data they’ve stolen, beyond simply leaking it.

With so many ways to tie found materials to the original source online, they may view this as an easy PR win. On top of all the other issues with ransomware, we probably don’t need its authors yelling “Look! We’re helping!” every time a new leak hits. When a creator is potentially $12 million out of pocket, it becomes increasingly tricky to argue against it.

Sure, this is still potentially another way for people who don’t actually care about helping people to act as if they do. But if the end result is the same and someone does benefit, it doesn’t really matter a whole lot. As far as the ransomware authors are concerned, they’ll have a collection of individuals telling everyone how cool they are.

It’s to be hoped we don’t end up fighting a PR war on top of the technical battle already raging across networks everywhere. I’m not sure I agree that “any publicity is good publicity”, but good publicity certainly is. So in case anyone is tempted to offer ransomware operators the benefit of the doubt, let’s not forget they’re same organised crime gangs that think little of attacking hospitals.

The post How a Resident Evil image leaked in a ransomware attack ended up in the middle of $12m copyright claim appeared first on Malwarebytes Labs.

Journalists at the Dutch newspaper “De Volkskrant” have reported that the country’s intelligence service, AIVD, discovered in 2017 that Russian hackers had broken into Dutch police systems. The De Volkskrant report is based on knowledge from anonymous sources. The reason behind this act of espionage is thought to be the ongoing MH17 investigation.

MH17

A little background: on July 17, 2014, Malaysia Airlines Flight 17 (MH17) was shot from the sky on its way from Amsterdam to Kuala Lumpur above the Ukraine. The plane was hit by a surface-to-air missile, and as a result, all 298 people on board were killed, the majority of them Dutch.

At that time, there was a revolt of pro-Russian militants against the Ukrainian government which is thought to have been backed by Russia. Russian denied any direct involvement at the time but later admitted to having military intelligence officers in the country. Both the Ukrainian military and the separatists denied responsibility for the MH17 incident.

A large disinformation campaign was launched to obscure who was responsible.

The discovery

The Dutch police only became aware it had been breached after a tip off from AIVD, and the discovery caused a major panic, according to the newspaper. Whether and which data was stolen, is not clear, insiders told the Volkskrant. Understandably, the police network is a huge one and spread out across the country. Apparently the point of first entry was a server of the Police Academy. After discovery, the decision was made that putting a stop to the intrusion as quickly as possible was more important than figuring out what the intruders were after.

So, at this point it is unsure what the exact information was the intruders were after and even whether they were successful in finding that information. According to the Volkskrant, due to a lack of monitoring and logging, the AIVD and Dutch Police have very little knowledge of what the hackers did inside the police network. “There were a lot of question marks,” the newspaper’s source said. “How long had they been inside? Was this the first time? Had they already siphoned off data? That wasn’t clear.”

Dutch police

The Dutch police took the lead in the investigation of the MH17 incident. The Joint Investigation Team (JIT), a special team set up to investigate the MH17 incident, comprises officials from the Dutch Public Prosecution Service and the Dutch police, along with police and criminal justice authorities from Australia, Belgium, Malaysia and Ukraine. On July 5, 2017 the JIT countries decided that the prosecution of those responsible for downing flight MH17 would be conducted in the Netherlands.

The timing of the attack against the police could be coincidental, but it is notable that the attack took place in that same month.

Information feeds disinformation

One possible motive for the attack is disinformation. The best lies are based on truth after all. Reportedly, the Dutch justice department and the Dutch police were targeted with phishing emails and cars filled with listening equipment were found in the vicinity of the “Landelijk Parket”, which is the part of the justice department that deals with both national and international organized crimes. Knowing which facts were already known could be instrumental in building believable lies without revealing new facts.

Disinformation

We have reported before about the Russian disinformation campaigns regarding this incident. More recently, in November of 2020, Bellingcat, which has been instrumental in retrieving information about the attack on flight MH17, published evidence that Bonanza Media, a self-styled independent investigative platform, is in fact a special disinformation project working in coordination with Russia’s military intelligence. The open-source intelligence outfit asserts that:

While we have not yet established conclusively whether the Russia’s military intelligence agency, best known as the GRU, was behind the initial launch and funding of the Bonanza Media project, we have established that shortly after it was launched, senior members of the GRU entered into direct and regular communication with the project leader

It is no coincidence that one of the main forces behind Bonanza is Dutch as well. Together with former Russia Today journalist Yana Yerlashova, Bonanza was set up by blogger and journalist Max van der Werff.

Eliot Higgins, the founder and executive director of Bellingcat has called out what he says are Russian lies, and the interplay between the official Russian position and the disinformation propagated by so-called MH17 “Truthers”, in his recent tweets about the on-going MH17 court hearings.

Cozy Bear

Top suspect of the attack on the Dutch police is APT29 (Cozy Bear), a well-known hacking group that the White House linked earlier this year to the Russian Foreign Intelligence Service, also known as the SVR. They are also suspected to be behind the SolarWinds attack and other international espionage cases.

Aftermath

Both the Dutch police and the AIVD did not provide comments on the publication by the Volkskrant, but we do know that the AIVD is closely monitoring a reorganization to improve the security of the Dutch police’s networks.

The international court in The Hague is in the middle of the MH17 trials and Russia’s interference is unlikely to do their case any good, but of course they will deny every involvement.

The post Russia accused of hacking Dutch police during MH17 investigation appeared first on Malwarebytes Labs.

Until the information age, cookies were only known as a tasty but unhealthy snack that some people enjoyed, and others avoided. HTTP cookies, also known as computer, browser, or Internet cookies, are similarly divisive. Although some people like the more personalized browsing experience created by cookies, others have privacy concerns.

Cookies are small pieces of information that websites can store in your browser. A website can check that information each time you interact with it, and that allows it to tell you apart from everyone else. Without cookies you would never be able to log in to a website or store items in a shopping cart.

However, that ability to tell you apart from everyone else is also what makes cookies extremely useful for cross-site tracking and advertising. Thankfully, privacy-conscious users can disrupt that tracking easily, because blocking or clearing cookies is easy. Although there are plenty of tools that can help manage your cookies, if you need to, you can easily clear the decks directly in your browser. Here’s how:

Clearing cookies on a desktop computer

The following instructions will guide you through clearing cookies on the most popular desktop and mobile browsers (as of June 2021).

How to clear cookies in Chrome on Windows

1. Start Google Chrome.
2. Click the vertical three-dots icon on the top right-hand corner and then select History—alternatively, press Ctrl+H in Chrome. 
3. Click Clear browsing data.
4. Select Cookies and other site data.
5. Select All time in the Time range dropdown menu.
6. Click Clear data to clear cookies in Google Chrome.
7. Click Block all cookies in Cookies and other site data to turn off cookies permanently.

How to clear cookies in Firefox on Windows

1. Start Firefox.
2. Click the three-lined icon (hamburger menu) on the top right-hand corner and select Options next to the gear icon.
3. Click Privacy & Security and then Cookies and Site Data.
4. Select Cookies and Site Data.
5. Select Cached Web Content.
6. Hit Clear to clear cookies in Firefox.
7. You can also click Strict in Privacy & Security to Block most cookies, but this may cause websites to malfunction in Firefox.

How to clear cookies in Edge on Windows

1. Start Microsoft Edge
2. Click the horizontal three-dots icon on the top right-hand corner and select Settings next to the gear icon.
3. Click Privacy, search, and services.
4. Click Choose what to clear under Clear browsing data.
5. Select Browsing history, Download history, Cookies and other site data, and Cached images and files.
6. Hit Clear now to clear cookies in Microsoft Edge.
7. Click Block third-party cookies in Cookies and site preferences to block third-party cookies permanently.

How to clear cookies in Opera on Windows

1. Start Opera.
2. Click Settings on the top left-hand corner.
3. Click Advanced and then Privacy & Security.
4. Click Clear browsing data. Alternatively, please Ctrl+Shift+Del to open your Clear browsing data options faster.
5. Select Cookies and site data.
6. Hit Clear data to clear cookies in Opera.
7. Click Cookies and site data under Site Settings to find options to block all third-party cookies permanently.

How to clear cookies in Safari on macOS

1. Start Safari on your Mac.
2. Select Preferences and then click on Privacy.
3. Find Cookies and website data and hit Manage Website Data.
4. Press Remove All and Done to clear cookies in Safari.
5. Click Block all cookies under Manage Website Data and tick Prevent cross-site tracking to turn off cookies permanently.

Clearing cookies on a mobile device

How to clear cookies in Chrome for Android

1. Start the Chrome app.
2. Click the vertical three-dots icon on the top right-hand corner and then select History.
3. Click Clear browsing data…
4. Select All time in the Time range drop-down menu.
5. Click clear data to clear cookies in Chrome on an Android device.

How to clear cookies in Firefox for Android

1. Start the Firefox app.
2. Click the three-dot icon in the corner and hit Privacy.
3. Click Delete browsing data.  
4. Select Cookies and click Clear Data.
5. Alternatively, click Clear private data on exit to clear cookies in Firefox on an Android device
6. Click Disabled in Cookies to turn off cookies permanently.

How to clear cookies in Safari for iOS

1. Click Settings on your iOS device.
2. Find Safari.
3. Click Clear History and Website Data to clear your cookies and history in iOS.
4. Alternatively, click Settings, Safari, Advanced, Website Data, and then hit Remove All Website Data to clear cookies in iOS but keep your history.
5. Click Block All Cookies in Safari to turn off cookies permanently.

How to clear cookies in Firefox for iOS

1. Start the Firefox app.
2. Click the three-lined icon (hamburger menu) on the lower-right corner.
3. Hit Settings.
4. Select Data Management.
5. Click Clear Private Data to clear cookies in Firefox on iOS.
6. Click Cookies in Data Management to turn off cookies permanently.

The post How to clear cookies appeared first on Malwarebytes Labs.

This patch Tuesday harvest was another big one. The Windows updates alone included seven zero-day vulnerability updates, two of them are actively being used in the wild by a group called PuzzleMaker, four others that have also been seen in the wild, plus one other zero-day vulnerability not known to have been actively exploited. Add to that 45 vulnerabilities that were labelled important, and security updates for Android, Adobe, SAP, and Cisco. You can practically see the IT staff scrambling to figure out what to do first and what needs to be checked before applying the patches.

PuzzleMaker

Security researchers have discovered a new threat actor dubbed PuzzleMaker, that was found using a chain of Google Chrome and Windows 10 zero-day exploits in highly targeted attacks against multiple companies worldwide. Unfortunately the researchers were unable to conclusively identify the Chrome vulnerability that was used (but they do have a suspect). The good news is that the two Windows vulnerabilities in the attack chain were included in the Windows 10 KB5003637 & KB5003635 cumulative updates. These vulnerabilities are listed as CVE-2021-31955, a Windows kernel information disclosure vulnerability, and CVE-2021-31956, a Windows NTFS elevation of privilege vulnerability.

Other critical issues

The other critical patches made available by Microsoft this June include these actively exploited vulnerabilities:

• CVE-2021-33739, a Microsoft DWM Core Library Elevation of Privilege Vulnerability.
• CVE-2021-33742 Windows MSHTML Platform Remote Code Execution Vulnerability.
• CVE-2021-31199 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability.
• CVE-2021-31201 another Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability.

Not (yet) actively exploited zero day vulnerability:

• CVE-2021-31968 Windows Remote Desktop Services Denial of Service Vulnerability.

Other critical updates:

• CVE-2021-31963 Microsoft SharePoint Server Remote Code Execution Vulnerability.
• CVE-2021-31959 Scripting Engine Memory Corruption Vulnerability.
• CVE-2021-31967 VP9 Video Extensions Remote Code Execution Vulnerability.
• CVE-2021-31985 Microsoft Defender Remote Code Execution Vulnerability.
• CVE-2021-33742 Windows MSHTML Platform Remote Code Execution Vulnerability.

Android

The Android Security Bulletin of June 7 mentions a critical security vulnerability in the System component that “could enable a remote attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process”, which is as bad as it sounds. That vulnerability, listed as CVE-2021-0507, could allow an attacker to take control of a targeted Android device unless it’s patched.

Cisco

Cisco has issued a patch for a vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software, that could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. An attacker could exploit this vulnerability by sending a crafted SSL/TLS message through an affected device. SSL/TLS messages sent to an affected device do not trigger this vulnerability. Cisco informs us that there is no workaround for this issue. Patching is the only solution.

SAP

In the SAP advisory for Security Patch Day – June 2021 we can find two issues that are labelled as “Hot News”:

• CVE-2021-27602 SAP Commerce, versions – 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.
• CVE-2021-27610 Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform.

Adobe

To top things off, Adobe has released a giant Patch Tuesday security update release that fixes vulnerabilities in ten applications, including Adobe Acrobat (of course), Reader, and Photoshop. Notably five vulnerabilities in Adobe Acrobat and Reader were fixed that address multiple critical vulnerabilities. Acrobat’s determination to cement its place as the new Flash shows no sign of dimming.

Successful exploitation could lead to arbitrary code execution in the context of the current user on both Windows and macOS. The same is true for two critical vulnerabilities in Photoshop that could lead to arbitrary code execution in the context of the current user.

CVE

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) database. Its goal is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services). Which is why we try and link you to the Mitre list of CVE’s where possible. It allows interested parties to find and compare vulnerabilities.

Happy patching, everyone!

The post Microsoft fixes seven zero-days, including two PuzzleMaker targets, Google fixes serious Android flaw appeared first on Malwarebytes Labs.

Back in 2016, we saw the emergence of a botnet mainstay called TrickBot. Initially observed by our Labs team spreading via malvertising campaigns, it quickly became a major problem for businesses everywhere. Whether spread by malvertising or email spam, the end result was the same. Data exfiltration and the threat of constant reinfection were the order of the day.

Over time, it evolved. Tampering with web sessions depending on mobile carrier is pretty smart. Other features such as disabling real-time monitoring from Windows Defender were also added. In fact, wherever you look, there’s the possibility of stumbling upon a TrickBot reference when digging into other attacks.

The tricky problem of “sophisticated” attacks

The word “sophisticated” is used a lot in security research. Sometimes, it’s used even if an attack being discussed is a basic phish, or maybe some very generic malware.

However, TrickBot is a pretty formidable opponent. As is often the case, the “sophisticated” part isn’t necessarily just about the files themselves. There’s also the organisation behind the scenes to contend with. We’re talking people, infrastructure, small groups of individuals all working to make some code, and keep it ticking over. To grab the exfiltrated data and make something of it. Wherever you look where TrickBot is concerned, there’s probably another cluster of specialised people up to no good. This isn’t a good thing when tackling malware developments.

“How bad is it, really?”

Have you ever stopped to consider “what, exactly, are we up against” when dealing with malware? This week’s events are a very good, and rather alarming, illustration.

What happened this week, you ask? That would be a potentially major blow to the TrickBot crew. A Latvian woman has been charged for their alleged role in a transnational cybercrime organisation. That organisation, as you’ll have guessed, is all about TrickBot shenanigans. What’s particularly interesting here, is how it illuminates just how much work goes into development. It isn’t one person sitting in their bedroom. It’s an actual criminal enterprise, run as a business, with lots of different divisions and moving parts.

There are malware managers in hiring roles, hiring developers to produce the files. This is done on Russian language job websites, and made to look as if it’s for “regular” coding jobs. 

There’s folks looking after finances, and testing malware against CAV services. Money mules and spear phishing are thrown into the mix alongside social engineering and international theft of money, personal, and confidential information.

Peeling back the TrickBot onion

This is just skimming the surface of what was happening under the hood. An entire infrastructure was created, with servers, VPNs, and VPS providers combined by the TrickBot crew to create the perfect malware deployment environment. That’s before you get to the crypters, hired to help evade detection from security software. Or how about those responsible for the spamming tools? The folks monitoring bank website flows to figure out how to defeat multi-factor encryption? There’s even someone creating coding tests, to ensure potential malware author hires know what they’re doing in terms of injections.

Make no mistake, the groups infecting millions of computers worldwide and making huge amounts of money aren’t doing it by accident. What cases like United States of America v. Alla Witte show us is that it’s efficient, structured, and very organised indeed.

The basic plan? Infect computers with TrickBot, spread across networks, grab banking details, and then steal funds. Said funds would then be laundered across a variety of bank accounts “controlled by the defendant and others”. Ransomware would also be deployed, for that final splash of cash.

As touched on above, the group hired experts in a variety of cybercrime fields. This was a perfect accompaniment to the modular, ever-evolving TrickBot. This itself was built upon the framework of the older Dyre malware, with all the years of experience and field expertise you’d expect coming along for the ride.

Evading the long arm of the law

Certain elements of the team helped evade detection by making use of multiple tricks to keep out of law enforcement’s reach. Stolen credit cards and fake identities paid for behind the scenes tech like servers and domains. Multiple proxies were used for communications purposes. Emails and attachments were encrypted, and chat in a private messaging server was also locked down. Multiple VPN services made use of around the world are the final anonymous splashes of icing on a very large cake.

Big scams, big numbers

The full arrest warrant document [PDF] is roughly 60 pages long, and contains an incredible amount of information. It breaks everything down by category, explaining how the malware and its injections worked. How the multi-stage laundering took place, including dates / transaction amounts. The wire transfers listed range from $44,900 to $230,400 across most of 2017 to 2018. There’s even an incredible attempted approximate wire transfer of $691,570,000 between the 19 and 20 October, 2017.

It’s possible time has now been called on this TrickBot crew. No matter what happens, you can be sure other groups are out there right now doing much the same things. A few of them will be just as big, just as well organised, and firing even bigger plundered sums of cash around banking infrastructure.

Next time you read about a piece of malware in the news, consider the sobering thought that it is the tip of a very long spear. An in-depth process lies under the surface keeping said malware in operation. How bad is it really? What, exactly, are we up against?

The answer is: all of the above, and more.

The post TrickBot indictment reveals the scale and complexity of organized cybercrime appeared first on Malwarebytes Labs.

The US Department of Justice announced Monday that it recovered much of the ransomware payment that Colonial Pipeline paid to free itself from the attack that derailed the oil and gas supplier’s operations for several days last month.

The seizure of 63.7 of the initial 75 paid bitcoins represented the first success of the Justice Department’s Ransomware and Digital Extortion Task Force, a team formalized just months ago, according to reporting from The Wall Street Journal. The value of the recovered bitcoins stands at roughly $2.3 million.

Some commentators have speculated that the discrepancy between what was paid and what was recovered may be accounted for by the fact that Darkside ransomware is sold under the Ransomware-as-a-Service (RaaS) model. The missing money (about 15% of the total) may be the fee the attackers paid the Darkside creators for using their malware.

In statements prepared Monday, US Deputy Attorney General Lisa Monaco characterized the operation as a victory and a representation of the Justice Department’s full powers.

“Following the money remains one of the most basic, yet powerful tools we have,” Monaco said. “Ransom payments are the fuel that propels the digital extortion engine, and today’s announcement demonstrates that the United States will use all available tools to make these attacks more costly and less profitable for criminal enterprises. We will continue to target the entire ransomware ecosystem to disrupt and deter these attacks.”

Monaco added that the Department of Justice’s actions showcased the “value of early notification to law enforcement”—a clear signal that the federal government is now operating in lockstep to curb the threat of ransomware. In mid-May, the White House emphasized the importance of cyberattack notification when President Joe Biden signed an Executive Order that requires such warnings from technology companies that sell their products to the federal government, and weeks later, the Transportation Security Administration (TSA) rolled out a new cybersecurity directive for all US pipeline companies that will require pipelines to notify the government of any cyberattacks.

According to a sworn affidavit in support of a “seizure warrant” that was revealed Monday, Monaco’s statement about “following the money” was surprisingly literal. According to the affidavit, law enforcement tracked Colonial Pipeline’s payment across the public Bitcoin ledger until much of the payment landed in one specific Bitcoin address, which the outlet The Record identified here. After the funds arrived at the Bitcoin address—which law enforcement referred to as the “Subject Address”—they were not touched for days.

Then, a bit of mystery happened.

According to the affidavit, the Justice Department was able to retrieve funds from the Subject Address because the FBI obtained that address’s related “private key.”

Private keys are somewhat like passwords, in that they not to be shared, but they are also more complex than that. Private keys are randomized strings of letters and numbers that are cryptographically related to the Bitcoin address that they access. Reverse engineering a private key is technically infeasible, which means that somehow, the FBI obtained an example of possibly the most closely guarded secret for any cryptocurrency user today.

Some users keep their private keys on exchanges (websites for trading bitcoins). If the Colonial Pipeline attackers kept their key on a US-based exchange it would be an easy matter for the FBI to seize it. However, security-conscious Bitcoin users tend to keep their keys where they can see and secure them, on computers they own.

How the FBI managed managed to get the key is unclear, but a week after the Colonial Pipeline attack, Darkside said it lost control of some of its servers. In the same announcement, the threat actors also said they lost some ransom payments.

Whether the US government removed Darkside’s server access is not known, but the FBI’s ability to obtain a Bitcoin address private key still reveals a new attitude in America’s fight against cybercrime—a fierce, antagonistic approach that potentially crosses ethical lines.

In April, the Department of Justice revealed that the FBI had obtained the somewhat extraordinary authority to access servers it did not own or control so that it could remove web shells placed by cybercriminals who exploited zero-day vulnerabilities in on-premises versions of Microsoft Exchange Server software. These web shell removals were performed with no notification to the servers’ owners.

Similarly, in January, after the international law enforcement agency Europol announced that it had taken control of the Emotet botnet, cybersecurity researchers spotted something hidden. The law enforcement agencies responsible for the takedown had already planned to deploy an update to remove Emotet from infected machines, and law enforcement agencies themselves wrote the code for the deployment.

In speaking on our podcast Lock and Code, Malwarebytes Security Evangelist Adam Kujawa said this was a new tactic from government authorities.

“I’ve seen people maybe misuse or abuse or modify how a particular malware Command & Control infrastructure would work, but I’ve never seen law enforcement deploy brand new code, and that’s kind of worrying a lot of folks,” Kujawa said. “A lot of people might consider it illegal.”

The post DOJ recovers pipeline ransom, signals more aggressive approach to cybercrime appeared first on Malwarebytes Labs.

An international operation that monitored an encrypted device company under control of the Federal Bureau of Investigation (FBI) and the Australian Federal Police (AFP) has led to a massive, coordinated string by law enforcement in several countries.

The setup

Law enforcement agencies around the world have long campaigned for encryption backdoors, so they can see what criminals are saying to each other. Unable to break the encryption of existing messaging apps, the FBI and the AFP came up with an ingenious plan to get criminals to use a device for encrypted communication that they could eavesdrop on.

The FBI created an app called AN0M, to fill the void left behind by dismantling several encrypted platforms used by criminals. Custom cellphones with the FBI-controlled platform installed were sold on underground markets and grew in popularity. Of course, not all the users interested in these devices were necessarily criminals, but the phones turned out to be very popular among criminals of all kinds, including outlawed motor gangs, Italian organized crime, Asian crime syndicates, and international drug traffickers.

As a result, law enforcement officials have been monitoring what they had to say for nearly three years.

The operation

The name of the operation was different depending on who you ask. The AFP refers to it as Special Operation Ironside, Europol ran an Operational Task Force to support the sting and called it Greenlight, and the FBI (and many others) call it Operation Trojan Shield. Which is very fitting as it pretended to offer the criminals a shield to hide their messages, but that shield was in fact a Trojan horse.

The goal of the new platform was to target global organized crime, drug trafficking, and money laundering organizations, regardless of where they operated, with an encrypted device that had features that would appeal to organized crime networks, such as remote wipe and duress passwords, to persuade criminal networks to pivot to the device.

The service is said to have provided over 12,000 encrypted devices to over 300 criminal syndicates operating in more than 100 countries.

The cooperation

The FBI had the lead in the investigation aided by the AFP which provided the systems needed to decrypt the messages. Europol supported the  operation by coordinating the international law enforcement community that was involved, by enriching the information picture and bringing the criminal intelligence into ongoing operations to target organized crime and drug trafficking organizations. The following countries participated in the international coalition: Australia, Austria, Canada, Denmark, Estonia, Finland, Germany, Hungary, Lithuania, New Zealand, the Netherlands, Norway, Sweden, the United Kingdom, and the United States.

Is it legal?

Of course it was you would say, since it was run by law enforcement. But listening in on the conversations of people that you have no evidence against is not allowed in many countries. The AFP’s prominent role may be related to Australia’s Telecommunications and other Legislation Amendment (TOLA), passed in 2018. The TOLA provides Australian law enforcement with the ability to make technical assistance requests (TARs) that oblige companies providing technical services in Australia to help them decrypt messages with technical assistance or new capabilities.

Providing a service after taking down the real enablers

It is ironic in a way that the need for a encrypted device company has arisen after the EncroChat system had been compromised so that law enforcement could eavesdrop, and the Sky ECC communication service was unlocked. After these events ANOM was welcomed in criminal circles and passed on by word-of-mouth advertising. Australian Federal Police Commissioner Reece Kershaw:

“Essentially, they have handcuffed each other by endorsing and trusting AN0M and openly communicating on it — not knowing we were watching the entire time.”

You had to know a criminal to get hold of one of these customized phones and you could only communicate with someone on the same platform. This probably helped to limit the number of customers to the “target audience” of the agencies that ran the sting operation.

The results

To say that the operation was a success would be an understatement. Law enforcement agencies report that around 800 suspects have been arrested. Searches of more than 700 houses have resulted in the seizure of over eight tons of cocaine, 22 tons of cannabis and cannabis resin, two tons of synthetic drugs, six tons of synthetic drugs precursors, 250 firearms, 55 luxury vehicles and over $48 million in cash and cryptocurrencies.

Why stop now?

Given the operation was so successful, questions have been raised about why its use wasn’t continued. The decision to stop the operation was reportedly made jointly by all the international partners. But commissioner Kershaw is reported to have hinted of “a legal time frame on this operation” about which more details might be revealed later on. We’ll keep you posted.

The post 800 arrests after police dupe crime groups into using backdoored phones appeared first on Malwarebytes Labs.

This week on Lock and Code, we’re presenting you something a little different. We’re telling you a story—with no guest interview included—that involves the use of VPNs.

In 2016, a mid-20s man began an intense, prolonged harassment campaign against his new roommate. He emailed her from spoofed email accounts. He texted her and referenced sensitive information that was only stored in a private, online journal. He created new Instagram accounts, he repeatedly made friend requests through Facebook to her friends and family, he even started making bomb threats. And though he tried to sometimes mask his online activity, two of the VPNs he used while registering a fake account eventually gave his information to the FBI.

This record-keeping practice, known as VPN logging, is frowned upon in the industry. And yet, it helped lead to the capture of a dangerous criminal.

Can two VPN “wrongs” make a right? Find out today on Lock and Code, with host David Ruiz.

https://feed.podbean.com/lockandcode/feed.xml

You can also find us on Apple Podcasts, Spotify, and Google Podcasts, plus whatever preferred podcast platform you use.

The post Can two VPN “wrongs” make a right? Lock and Code S02E10 appeared first on Malwarebytes Labs.

Last week on Malwarebytes Labs, we looked at an interesting trend in facial recognition technology—hint: it’s a slow fade, the latest ransomware attacks on JBS and Steamship Authority, Cobalt Strike, a Coronavirus phishing campaign, WhatsApp’s decision to not limit app functionalities for non-compliant users after all, and a cyber threat report compiled by the National Crime Agency (NCA) in the UK.

We also analyzed Kimsuky, the APT that continues to attack the South Korean government, and the NSIS crypter along with its evolution.

Lastly, we recognized the cybersecurity challenges in SMBs and were in awe after the US Attorney’s office decided to investigate ransomware attacks the same way as terrorist attacks.

Other cybersecurity news

• A phishing campaign launched off of the back of the recent ransomware attack against Colonial Pipeline weeks ago. The email, purporting to originate from a company’s “Help Desk”, is encouraging recipients to download a “ransomware system update” that’d prevent the company from getting attacked by ransomware. (Source: Inky)
• Organizers of the Tokyo Olympics found themselves on the receiving end of a data breach. (Source: The Japan Times)
• Fujifilm fell victim to a ransomware attack. (Source: InfoSecurity Magazine)
• Those returning to the office were welcomed by—drumroll, please—phishing emails! (Source: Avanan)
• According to researchers, a new ransomware variant called Epsilon Red is said to be hunting for unpatched Microsoft Exchange servers to exploit. (Source: Computing)
• The UK government faced a backlash and legal challenge over its plan to share health service data with a third-party as part of its digitization effort. (Source: Computing)
• A threat report from Thales revealed that, although the pandemic has transformed how we do work, cybersecurity is sadly not keeping up. (Source: TechRepublic)
• Mustang Panda, a Chinese espionage campaign, is gaining access to official Southeast Asian government websites via a novel Windows backdoor. (Source: The Record)
• JBS, the world’s largest meat supplier, is back to normal operations after a ransomware attack. (Source: Bleeping Computer)

Stay safe, everyone!

The post A week in security (May 31 – June 6) appeared first on Malwarebytes Labs.