Tuesday, January 21, 2025
Home Blog Page 39

Analysis of BlackGuard – a new info stealer malware being sold in a Russian hacking forum

By
Steven Black (n0tst3)
-
0
malware

Introduction:

Hacking forums often double up as underground marketplaces where cybercriminals buy, rent, and sell all kinds of malicious illegal products, including software, trojans, stealers, exploits, and leaked credentials. Malware-as-a-service has contributed substantially to the growth of ransomware and phishing attacks (among other attack types) in the past year, as they lower the technical barrier to entry for criminals to carry out attacks.

While recently perusing one of these hacking forums during regular research activities, the Zscaler ThreatLabz team came across BlackGuard, a sophisticated stealer, advertised for sale. Blackguard is currently being sold as malware-as-a-service with a lifetime price of $700 and a monthly price of $200.

BlackGuard has the capability to steal all types of information related to Crypto wallets, VPN, Messengers, FTP credentials, saved browser credentials, and email clients.

In this blog, we share analysis and screenshots of the techniques this stealer uses to steal information and evade detection using obfuscation, as well as techniques used for anti-debugging.

Fig 1. Forum thread promoting the BlackGuard stealer

Technical Analysis:

BlackGuard is a .NET stealer packed with a crypto packer. Currently, it is in active development and has the following capabilities:

Anti-Detection:

Once executed, it checks and kills the processes related to antivirus and sandbox as shown in the figure below.

Fig 2. BlackGuard detects antivirus processes

String Obfuscation:

The stealer contains a hardcoded array of bytes which is decoded in runtime to ASCII strings followed by base64 decoding. This allows it to bypass antivirus and string-based detection.

Fig 3. String decryption technique

Anti-CIS:

BlackGuard checks for the infected device country by sending a request to “http://ipwhois.app/xml/” and exits itself if the device is located in the Commonwealth of Independent States (CIS).

Fig 4. Whitelist CIS

Anti-Debug:

BlackGuard uses user32!BlockInput() which can block all mouse and keyboard events in order to disrupt attempts at debugging.

Fig 5. Anti-debugging technique

Stealing Function:

After all the checks are completed, the stealer function gets called which collects information from various browsers, software, and hardcoded directories, as shown in the screenshot below.

Fig 6. Stealer code

Fig 7. Features Posted on forum

Browsers:

BlackGuard steals credentials from Chrome- and Gecko-based browsers using the static path. It has the capability to steal history, passwords, autofill information, and downloads.

Fig 8. Browser stealing function

Cryptocurrency Wallets:

BlackGuard also supports the stealing of wallets and other sensitive files related to crypto wallet applications. It targets sensitive data in files such as wallet.dat that contain the address, the private key to access this address, and other data. The stealer checks for the default wallet file location in AppData and copies it to the working folder.

Fig 9. Crypto wallet stealing function

Crypto Extensions:

This stealer also targets crypto wallet extensions installed in Chrome and Edge with hardcoded extension IDs as shown in the figure below.

Fig 10. Crypto extensions stealing function

C2 Exfiltration:

After collecting the information, BlackGuard creates a .zip of all the files and sends it to the C2 server through a POST request along with the system information like Hardware ID and country as shown in the figure below.

Fig 11. C2 Exfiltration code snippet

Fig 12. Traffic capture of exfiltration

Fig 13. Panel screenshot

Targeted Applications:

Browsers:

Chrome, Opera, Firefox, MapleStudio, Iridium, 7Star, CentBrowser, Chedot, Vivaldi, Kometa, Elements Browser, Epic Privacy Browser, uCozMedia, Coowon, liebao, QIP Surf, Orbitum, Comodo, Amigo, Torch, Comodo, 360Browser, Maxthon3, K-Melon, Sputnik, Nichrome, CocCoc, Uran, Chromodo, Edge, BraveSoftware.

Crypto Wallets:

AtomicWallet, BitcoinCore, DashCore, Electrum, Ethereum, Exodus, LitecoinCore, Monero, Jaxx, Zcash, Solar, Zap, AtomicDEX, Binance, Frame, TokenPocket, Wassabi.

Crypto Wallet Extensions:

Binance, coin98, Phantom, Mobox, XinPay, Math10, Metamask, BitApp, Guildwallet, iconx, Sollet, Slope Wallet, Starcoin, Swash, Finnie, KEPLR, Crocobit, OXYGEN, Nifty, Liquality, Auvitas wallet, Math wallet, MTV wallet, Rabet wallet, Ronin wallet, Yoroi wallet, ZilPay wallet, Exodus, Terra Station, Jaxx.

Email Clients:

Outlook

Other Applications:

NordVPN, OpenVPN, ProtonVpn, Totalcomander, Filezilla, WinSCP, Steam

Messengers:

Telegram, Signal, Tox, Element, Pidgin, Discord

Conclusion:

While applications of BlackGuard are not as broad as other stealers, BlackGuard is a growing threat as it continues to be improved and is developing a strong reputation in the underground community.

To combat against BlackGuard and similar credential theft malware, we recommend that security teams inspect all traffic and use malware prevention tools that include both antivirus (for known threats) and sandboxing capabilities (for unknown threats). We also recommend training end users on the following:

Don’t use the same passwords for all the services and replace them on a regular cadence.
Use multi-factor authentication where applicable.
Avoid visiting unknown sites.
Avoid opening suspicious unknown files.

IOCs:

Hashes:

4d66b5a09f4e500e7df0794552829c925a5728ad0acd9e68ec020e138abe80ac

c98e24c174130bba4836e08d24170866aa7128d62d3e2b25f3bc8562fdc74a66

7f2542ed2768a8bd5f6054eaf3c5f75cb4f77c0c8e887e58b613cb43d9dd9c13

f2d25cb96d3411e4696f8f5401cb8f1af0d83bf3c6b69f511f1a694b1a86b74d

bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece

f47db48129530cf19f3c42f0c9f38ce1915f403469483661999dc2b19e12650b

ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14

1ee88a8f680ffd175943e465bf85e003e1ae7d90a0b677b785c7be8ded481392

71edf6e4460d3eaf5f385610004cfd68d1a08b753d3991c6a64ca61beb4c673a

e08d69b8256bcea27032d1faf574f47d5412b6da6565dbe52c968ccecea1cd5d

Domains:

win.mirtonewbacker.com

umpulumpu.ru

greenblguard.shop

onetwostep.at

Zscaler coverage:

We have ensured coverage for the payloads seen in these attacks via advanced threat signatures as well as our advanced cloud sandbox.

Advanced Threat Protection:

Win32.PWS.Blackguard

Advanced Cloud Sandbox:

Fig 14. Zscaler sandbox detection

source

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

Anonymous Claims Data Leak to Force Nestlé Out of Russia

By
Steven Black (n0tst3)
-
0
databreach

Multinational companies around the world voluntarily pulled their business out of Russia after president Vladimir Putin launched an unprovoked invasion of Ukraine, but the hacker group Anonymous is determined to give any stragglers a nudge. The hacktivist group recently leaked data, emails and passwords of food giant Nestlé’s customers and warned other companies that continued doing business in Russia that they would be next.

“We call on all companies that continue to operate in Russia by paying taxes to the budget of the Kremlin’s criminal regime: Pull out of Russia!” the group tweeted. “We give you 48 hours to reflect and withdraw from Russia or else you will be under our target!”

The group announced that Nestlé had become its first target. “The #Anonymous collective has leaked the database of the largest food company in the world, Nestlé. Leaked 10GB data of emails, passwords, Nestlé business costumers, etc.,” Anonymous tweeted.

And the collective explained that “Only a sample of data has been published with more than 50K Nestlé business customers. Leak: https://gofile.io/d/kyFj0A (No Virus detected) Currently the weight is 10GB in SQL Format.”

As Putin stepped up the assault on Ukraine, hackers and hacktivists jumped into the fray.

“When we look at external forces, which are many, that can impact an organization, often we do not think about such formidable forces, like hacktivist groups, in the equation. But knowing that hacktivist group(s) have been vocal and actively involved in the conflict in eastern Europe, organizations operating in that part of the world need to include such risk scenarios in their radar screen,” said Nasser Fattah, North America committee chair at Shared Assessments. “Primarily because a risk like this can quickly materialize and become an unexpected issue for an organization to manage. Note this risk scenario is comparable for organizations that might not directly operate in Russia but that have critical suppliers working in Russia—those critical suppliers are now the target.”

But Nestlé took issue with Anonymous’s claims, arguing that the leak was the result of its own actions and that the data was accidentally published in February. “It related to a case from February this year, when some randomized and predominantly publicly available test data…was made accessible unintentionally online for a short period of time,” Fortune cited Nestlé as saying. “We quickly investigated, and no further action was deemed necessary.”

Nevertheless, it appeared Nestlé felt the heat to cut ties with Russia, announcing that it was ending capital investment in the country and would pare back the consumer products it offers there, selling only “essential products.”

Still, the hacktivist group’s claim is a cautionary tale, some cybersecurity pros say.
“This [A]nonymous threat to Nestlé is a clear example of how we cannot let hacker groups set international policy on what is proper or improper conduct. It’s the worst kind of kangaroo court for social justice imaginable,” said Garret Grajek, CEO at YouAttest. “It is imperative that enterprises, especially the ones listed as critical infrastructure by the Biden administration, place a high priority on cybersecurity—especially principles like zero-trust and identity governance that proactively stop the spread of intrusions and alert the enterprise of malfeasance.”

Suggest a change to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.

Bookmark
Please login to bookmarkClose

U.S. Charges 4 Russian Gov Employees Over Hacking Critical Infrastructure Worldwide

By
Steven Black (n0tst3)
-
0

The U.S. government on Thursday released a cybersecurity advisory outlining multiple intrusion campaigns conducted by state-sponsored Russian cyber actors from 2011 to 2018 that targeted the energy sector in the U.S. and beyond.

“The [Federal Security Service] conducted a multi-stage campaign in which they gained remote access to U.S. and international Energy Sector networks, deployed ICS-focused malware, and collected and exfiltrated enterprise and ICS-related data,” the U.S. government said, attributing the attacks to an APT actor known as Energetic Bear.

In addition, the Justice Department charged four Russian government employees, including three officers of the Russian Federal Security Service and a computer programmer at the Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM), for their roles in carrying out the attacks on oil refineries, nuclear facilities, and energy companies.

The four Russian nationals are Pavel Aleksandrovich Akulov(36), Mikhail Mikhailovich Gavrilov (42), and Marat Valeryevich Tyukov (39), and Evgeny Viktorovich Gladkikh (36).

The seven-year-long global energy sector campaign is said to have taken advantage of spear-phishing emails, trojanized software updates, and redirects to rogue websites (aka watering holes) to gain initial access, using it to deploy remote access trojans like Havex on compromised systems.

Also detailed by the security agencies is a 2017 campaign engineered by cyber actors with ties to TsNIIKhM with the goal of manipulating the industrial control systems of an unnamed oil refinery located in the Middle East by leveraging a piece of malware called TRITON.

“TRITON was designed to specifically target Schneider Electric’s Triconex Tricon safety systems and is capable of disrupting those systems,” the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Energy (DOE) said.

Collectively, the hacking campaigns are alleged to have singled out thousands of computers, at hundreds of companies and organizations, in approximately 135 countries, the FBI said.

“The potential of cyberattacks to disrupt, if not paralyze, the delivery of critical energy services to hospitals, homes, businesses and other locations essential to sustaining our communities is a reality in today’s world,” said U.S. Attorney Duston Slinkard for the District of Kansas. “We must acknowledge there are individuals actively seeking to wreak havoc on our nation’s vital infrastructure system, and we must remain vigilant in our effort to thwart such attacks.”

Suggest a change to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.

Bookmark
Please login to bookmarkClose

Google Chrome Zero-Day Bugs Exploited Weeks Ahead of Patch

By
Steven Black (n0tst3)
-
0

Two separate campaigns from different threat actors targeted users with the same exploit kit for more than a month before the company fixed an RCE flaw found in February.

North Korean threat actors exploited a remote code execution (RCE) zero-day vulnerability in Google’s Chrome web browser weeks before the bug was discovered and patched, according to researchers.

Google Threat Analysis Group (TAG) discovered the flaw, tracked as CVE-2022-0609, on Feb. 10, reporting and patching it four days later as part of an update. Researchers said at the time that an exploit for the flaw–a use-after-free vulnerability in Chrome’s animation component–already existed in the wild.

Google TAG now revealed it believes two threat groups—the activity of which has been publicly tracked as Operation Dream Job and Operation AppleJeus, respectively—exploited the flaw as early as Jan. 4 in “campaigns targeting U.S. based organizations spanning news media, IT, cryptocurrency and fintech industries,” according to a blog post published Thursday by Google TAG’s Adam Weidemann. Other organizations and countries also may have been targeted, he said.

“One of the campaigns has direct infrastructure overlap with a campaign targeting security researchers which we reported on last year,” he wrote. In that campaign, hackers linked to North Korea used an elaborate social-engineering campaign to set up trusted relationships with security researchers with the ultimate goal of infecting their organizations’ systems with custom backdoor malware.

The two groups, though separate, used the same exploit kit in their campaigns, which signals that they may work for the same entity with a shared supply chain. However, “each operate with a different mission set and deploy different techniques,” Weidemann said. It’s also possible that other North Korean government-backed attackers have access to the same kit, he added.

Two Campaigns, One Exploit

Researchers revealed specific details about both Operation Dream Job and Operation AppleJeus in the post. The former targeted more than 250 individuals working for 10 different news media, domain registrars, web hosting providers and software vendors.

“The targets received emails claiming to come from recruiters at Disney, Google and Oracle with fake potential job opportunities,” Weidemann explained. “The emails contained links spoofing legitimate job-hunting websites like Indeed and ZipRecruiter.”

If victims clicked on the link, they would be served a hidden browser iframe that would trigger the exploit kit, he wrote. Fake job domains owned by attackers that were used in the campaign included: disneycareers[.]net, find-dreamjob[.]com, indeedus[.]org, varietyjob[.]com, and ziprecruiters[.]org.

Exploitation URLs associated with Operation Dream Job used in the campaign included: https[:]//colasprint[.]com/about/about.asp, a legitimate but compromised website; and https[:]//varietyjob[.]com/sitemap/sitemap.asp.

Operation AppleJeus, the work of a separate North Korean threat group, targeted more than 85 users in cryptocurrency and fintech industries leveraging the same exploit kit.

Attackers compromised at least two legitimate fintech company websites to host hidden iframes that served the exploit kit to visitors to the site, researchers revealed. Google TAG also observed fake websites–already set up to distribute trojanized cryptocurrency applications—that hosted malicious iframes pointing their visitors to the exploit kit, Weidemann wrote.

Attacker-owned websites observed in Operation AppleJeus included one dozen sites including: blockchainnews[.]vip, financialtimes365[.]com and giantblock[.]org, according to the post.

Exploit Kit Revealed (Partially)

Researchers managed to recover key aspects of the functionality of the exploit kit used in both campaigns, which employed multiple stages and components to target users. Links to the exploit were placed in hidden iframes on websites that attackers either owned or had previously compromised, Weidemann wrote.

“The kit initially serves some heavily obfuscated javascript used to fingerprint the target system,” he explained. “This script collected all available client information such as the user-agent, resolution, etc. and then sent it back to the exploitation server.”

If the data sent to the server met a set of unknown requirements, the client would be served a Chrome RCE exploit and some additional javascript. If the RCE was successful, the javascript would request the next stage referenced within the script as “SBX,” which is a common acronym for Sandbox Escape.

Researchers were unable to recover the stages of exploit that followed the initial RCE because attackers took care to protect their exploits, deploying various safeguards, Weidemann said.

Those tactics included only serving the iframe at specific times–presumably when attackers knew an intended target would be visiting the site, he said. In some email campaigns, attackers also sent targets links with unique IDs that potentially were used to enforce a one-time-click policy for each link. This would allow the exploit kit to only be served once, Weidemann said.

Attackers also used Advanced Encryption Standard (AES) encryption for each stage, including the clients’ responses using a session-specific key. Finally, additional stages of the exploit were only served if the previous one was successful; if not, the next stage was not served, researchers found.

Suggest a change to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

Google Explains Surge in Chrome Zero-Day Exploitation

By
Steven Black (n0tst3)
-
0

The number of Chrome vulnerabilities exploited in malicious attacks has been increasing over the past years and Google believes several factors have contributed to this trend

14 Chrome Zero-Day Vulnerabilities Exploited in Attacks in 2021.

The number of Chrome vulnerabilities exploited in the wild reached 14 in 2021, up from eight in 2020 and two in 2019. Chrome is targeted far more often than Firefox, Safari and Internet Explorer, according to data from Google’s Project Zero research unit, which tracks exploitation of zero-days.

One reason for the increasing number of zero-day attacks targeting Chrome is related to transparency — browser security teams and research groups are increasingly informing the public about in-the-wild exploitation of vulnerabilities. For example, Project Zero’s exploit tracker does not show any Chrome vulnerabilities being leveraged by hackers before 2019, but the internet giant admits that it “doesn’t mean exploitation didn’t happen.”

Another reason for Chrome being increasingly targeted is related to the deprecation of Flash, as well as the web browser’s popularity. Specifically, threat actors often exploited Adobe Flash vulnerabilities in web attacks before the software was killed off, and now they are focusing more on the browser itself. In addition, since the Chromium rendering engine is now also used by Microsoft for its Edge browser, finding a Chromium vulnerability allows attackers to target more systems.

Google has also attributed the rise in the number of exploited Chrome vulnerabilities to the need to chain multiple bugs for a single exploit. Seven years ago, a single vulnerability could be very valuable to attackers, but the security improvements in modern browsers have resulted in a single flaw almost never being enough for an attacker to achieve their goal.

In addition, the company has blamed this trend on the increasing complexity of the browser, which now includes many of the functions of an operating system. This complexity, while beneficial in terms of functionality, also means more bugs.

“Ultimately, we believe data is an important part of the story, but the absolute number of exploited bugs isn’t a sufficient measure of security risk,” Google argued. “Since some security bugs are inevitable, how a software vendor architects their software (so that the impact of any single bug is limited) and responds to critical security bugs is often much more important than the specifics of any single bug.”

The company says it has been taking steps to prevent Chrome from being abused by malicious actors. These steps include faster patching of vulnerabilities and mechanisms designed to make exploitation of entire classes of vulnerabilities more difficult.

Google said recently that it paid out nearly $9 million in bug bounties last year, including roughly $3.1 million for Chrome vulnerabilities.

Only one Chrome vulnerability appears to have been exploited in the wild until now in 2022.

Suggest a change to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.

Bookmark
Please login to bookmarkClose

Over 500,000 Patients Hit by Data Breaches at Healthcare Firms in Alabama, Colorado

By
Steven Black (n0tst3)
-
0
databreach

The information of more than half a million individuals was likely compromised after three healthcare services providers in Alabama and Colorado suffered cybersecurity breaches.

Patients Hit by Data Breaches

The most recent cyberattack – and most impactful – targeted South Denver Cardiology Associates and resulted in the data of more than 287,000 patients being exfiltrated.

The Colorado firm identified the attack on January 4 and later discovered that an unknown party had access to certain systems in its network between January 2 and January 5, 2022.

Potentially compromised data may have included names, birth dates, drivers’ license numbers, Social Security numbers, and various other patient data. Patient medical records, however, were not compromised, the company says.

The healthcare firm says it started notifying impacted individuals last week, but made no mention whether ransomware was used in the attack.

Another healthcare services provider that recently started notifying patients of a data breach is the Birmingham, Alabama-based Norwood Clinic.

The firm told the Maine Attorney General’s office that over 228,000 individuals were likely impacted by a data breach that started on September 20, 2021, and was discovered a month later, on October 22.

During that time, the attackers were able to access protected patient information, including names, birth dates, contact data, Social Security numbers, and various types of health information.

“However, the investigation was unable to confirm the specific information that may have been accessed. Therefore, out of an abundance of caution, Norwood is providing notice to all of its patients, regardless of whether their information was in fact subject to unauthorized access or acquisition,” the firm said in the notification letter.

Montrose Regional Health, which is also based in Colorado, is the third healthcare services provider to have disclosed a data breach over the past couple of weeks.

The firm notified the U.S. Department of Health and Human Services that over 52,000 individuals were impacted by unauthorized access to the email accounts of certain employees, between August 2 and October 26, 2021.

Potentially impacted information includes names, patient account numbers, treatment dates and costs, and additional health information, Montrose Regional Health says in a data breach notification.

The company has reset account passwords and has also started notifying impacted individuals about the incident.

Suggest a change to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

Brave Browser Goes The Extra Mile to Block Third Party Cookies

By
Steven Black (n0tst3)
-
0

Brave is testing a new feature to stop bounce tracking, a sneaky method that websites use to load third-party tracking cookies so they can gather more information about who is visiting their site.

The Brave browser

Brave is a Chromium-based browser that blocks unwanted content by default and does not need much tinkering to keep you safe and private. Brave is available for Windows, macOs, Linux, iOS, and Android.

Brave Nightly is the version of Brave that is used for testing and development. The releases are updated every night, hence the name, and may contain bugs. Nightly automatically sends out crash reports when things go wrong. Nightly is now used to test a feature that’s designed to prevent what’s known as bounce tracking.

Why third party cookies are out of fashion

Many browsers and, especially, ad-blockers will refuse to load third-party cookies, which are cookies that do not originate from the site that you are currently visiting. From a website administrator’s point of view, third-party cookies are tracking codes that are placed on a web visitor’s computer after being generated by another website other than their own. When a web visitor visits their site and others, the third-party cookie tracks this information and sends it to the third-party who created the cookie. The most common third-parties are advertisers, marketers, and social media platforms.

Google has long since changed its ways and adopted other methods of tracking users. But not everyone is a tech giant with the necessary resources to pull that off, so some have resorted to bounce tracking.

Bounce tracking

Tracking protection has become a mainstream feature in many browsers these days, including Apple’s Safari, Mozilla’s Firefox, and Microsoft’s Edge. So the targeted ad industry felt it had to find a way to circumvent those measures. Enter Bounce tracking, also known as redirect tracking. Another, even more invasive method is fingerprinting, which identifies users based on their computers’ unique attributes.

Bounce tracking abuses the fact that browsers’ anti-tracking tools generally allow sites to store their own cookies so they can remember repeat visitors. To limit their tracking to first-party cookies, a site that wants to track you can load an intermediary site—or tracking site—first before transferring you to the intended destination. The intermediary site sets a first-party cookie along the way, and each time you cross through it, it gathers more information about where you’ve been and where you’re going.

But there are other methods of bounce tracking like link decoration, which means a website can add a unique identifier to the links you click on, serving as a flag to the next site you visit. The destination site can then store the identifier in a first-party cookie on the original site’s behalf, letting it track your activity. The more this happens on additional sites, the more the original site can track you without ever using third-party cookies. Facebook adverts use this method in the fbclid parameter which allows the destination site to recognize you as a specific Facebook user.

Stopping bounce tracking

Some browsers have some methods to detect and stop bounce tracking but it is not always easy, since the browser doesn’t know beforehand that it will be directed through a tracking site.

In a privacy update, Brave explained how it plans to improve the existing methods. It is calling the new feature Unlinkable Bouncing. The browser will notice when you’re about to visit a privacy harming (or otherwise suspect) website, and route that visit through a new, temporary browser storage. This prevents the site from identifying you by tying your footprint to that of previous visits, but allows the site to otherwise function as normal because your visit will look like a unique, first-time visit. The temporary storage is then deleted when you browse away from the suspect site, preventing the site from re-identifying you on future visits.

The Unlinkable Bouncing feature is now enabled in Brave Nightly, and will be in Brave’s full release on version 1.37.

A possible weak point in the Unlinkale Bouncing feature is that it relies on consulting filter lists, but you can think of it as an extra layer on top of the existing features designed to stop bounce tracking, like the query parameter stripping, debouncing, and bounce-tracking interstitial features.

article sourced from MB blog

Suggest a change to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

CISA list of 95 new known exploited vulnerabilities raises questions

By
Steven Black (n0tst3)
-
0

On Friday March 3, the Cybersecurity and Infrastructure Security Agency (CISA) added a whopping number of 95 new known exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog.

This catalog provides Federal Civilian Executive Branch (FCEB) agencies with a list of vulnerabilities that are known to be exploited in the wild and gives the agencies a due date by when the vulnerability needs to be patched in their organization.

But even if your organization isn’t a FCEB agency that needs to follow the Binding Operation Directive 22-01, the CISA list can act as a good guide for your patch management strategy.

95 new ones?

CISA normally sends out a mail every few days in which it details a few important vulnerabilities it’s added to the Catalog. However, on March 3 it didn’t even enumerate the list. Instead, it just emailed a link to the Catalog and included instructions on how to find the most recently added vulnerabilities. If you’re looking yourself, you need to click on the arrow on the of the “Date Added to Catalog” column, which will sort by descending dates.

Not so new

The first thing that jumped out at me is that these vulnerabilities were not all very new at all. The oldest vulnerability on that list is CVE-2002-0367, an almost 20 year old vulnerability in Windows NT and Windows 2000. In fact, only 5 vulnerabilities were patched in 2022. All these applied to Cisco’s Small Business RV160, RV260, RV340, and RV345 series routers by the way.

This brings me to the next thing that is remarkable. 38 of the 95 added vulnerabilities are for Cisco products. Other products include those by Microsoft (27), Adobe (16), and Oracle(7).

Of the Adobe vulnerabilities, nine were found in Flash Player. Adobe Flash Player reached End of Life (EOL)  on December 31, 2020, after being first announced in 2017. Since Adobe no longer supports Flash Player, on January 12, 2021,  the company started blocking Flash content from running. In fact, Adobe strongly recommends all users immediately uninstall Flash Player to help protect their systems.

Possible reasons

Pondering the reason for CISA to suddenly add 95 vulnerabilities to their list, I came up with the following options:

  • It suddenly became aware of several old vulnerabilities that were nonetheless still being exploited.
  • It suddenly decided to list vulnerabilities in software that has long reached EOL but could still be used a lot.
  • The nature of actively exploited vulnerabilities has changed.

Some examples

Personally, I suspect that the nature of the actively exploited vulnerabilities has changed. Last year, you would typically see exploited vulnerabilities that would allow an attacker to breach a network or compromise a system to gain a foothold. This allows attackers to exfiltrate data, plant ransomware, and other criminal activities that could lead to financial gain.

However, looking at some of the vulnerabilities that were included in this list of 95, I noticed that many could lead to Denial-of-Service (DoS) attacks.

Examples:

  • A vulnerability in Siemens SIMATIC CP 1543-1 versions before 2.0.28 allows remotely authenticated users to cause a denial of service by modifying SNMP variables.
  • Multiple Cisco vulnerabilities on this list which could result in a DoS condition or cause an affected system to reload.

Other vulnerabilities could allow attackers to run arbitrary code or cause a denial of service. For example, a PowerPoint vulnerability that has been around since 2015 and was found to be used by the Russian state-sponsored team APT28 (aka Fancy Bear) in 2018.

Some Flash Player vulnerabilities were found to be used in targeted attacks. The suspect in this case was APT37, also known as the North Korean “Lazarus” group.

A vulnerability in older Windows versions (Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1) would allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document. The use of this exploit was attributed to the Russian “SANDWORM” operation.

I also found an Elevation of Privilege (EoP) vulnerability in a Windows Installer on the CISA list that would allow an attacker to delete targeted files on a system. However, they would NOT gain privileges to view or modify file contents.

Other interesting items on the list are some IoT vulnerabilities that got some fame in 2020 under the name Ripple20.  Successful exploitation of these vulnerabilities could result in denial of service, information disclosure or remote code execution.

So, is it just me or is there a trend here that shows vulnerabilities that were previously hard to exploit for financial gain, but are perfectly usable to disrupt operations? Could it be that, no surprise, the war in Ukraine has changed the nature of the actively exploited vulnerabilities?

According to Adam Kujawa, Security Evangelist and Director of Malwarebytes’ Threat Intel team:

“In 2007, we observed Russian sympathizers online utilizing hacking tools to launch disruption attacks against Georgian news networks and government networks, to prevent information from flowing to the public while Russia had troops roll in. Similar events have happened in Estonia, and Russian sponsored hackers are known to utilize Ukrainian networks as a kind of “playground” for their attacks, shutting off power grids and other critical infrastructure, launching massive supply chain attacks against them (as in the case of NotPetya). And those are just some of the attacks we know about.

With that in mind, I believe that while many of these vulnerabilities are useless against actual intrusion and espionage, the exploits developed from them will be used to disrupt and degrade rather than collect.

I am not sure how many of these have been used in the wild, and while it is great to see CISA be proactive in spreading this information, I must wonder how much of the information will get to those protecting networks in Ukraine?  Could it be that CISA may have just handed over the knowledge about various disruptive exploits that will work on unpatched systems, to be used against those who don’t have endpoint patching as their top priority?”

Mitigation

Given the varied nature of the list, the most actionable advice is to keep an eye on the known exploited vulnerabilities catalog. To make things easier, you can subscribe to receive the updates. Besides the usual security advice, now seems to be a good time to invest in clever patch management, and ditch that software which has reached EOL and no longer receives security updates.

Stay safe, everyone!

article sourced from malwarebytes blog

Suggest a change to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

New Linux Bug in Netfilter Firewall Module Lets Attackers Gain Root Access

By
Steven Black (n0tst3)
-
0

A newly disclosed security flaw in the Linux kernel could be leveraged by a local adversary to gain elevated privileges on vulnerable systems to execute arbitrary code, escape containers, or induce a kernel panic.

Linux Bug in Netfilter Leads To Root

Tracked as CVE-2022-25636 (CVSS score: 7.8), the vulnerability impacts Linux kernel versions 5.4 through 5.6.10 and is a result of a heap out-of-bounds write in the netfilter subcomponent in the kernel. The issue was discovered by Nick Gregory, a research scientist at Capsule8.

“This flaw allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a privilege escalation threat,” Red Hat said in an advisory published on February 22, 2022. Similar alerts have been released by Debian, Oracle Linux, SUSE, and Ubuntu.

Netfilter is a framework provided by the Linux kernel that enables various networking-related operations, including packet filtering, network address translation, and port translation.

Specifically, CVE-2022-25636 relates to an issue with incorrect handling of the framework’s hardware offload feature that could be weaponized by a local attacker to cause a denial-of-service (DoS) or possibly execute arbitrary code.

“Despite being in code dealing with hardware offload, this is reachable when targeting network devices that don’t have offload functionality (e.g. lo) as the bug is triggered before the rule creation fails.” Gregory said. “Additionally, while nftables requires CAP_NET_ADMIN, we can unshare into a new network namespace to get this as a (normally) unprivileged user.”

“This can be turned into kernel [return-oriented programming]/local privilege escalation without too much difficulty, as one of the values that is written out of bounds is conveniently a pointer to a net_device structure,” Gregory added.

Suggest a change to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

Ukraine Accuses Russia of using Phosphorus Bombs – Ombudsman

By
Steven Black (n0tst3)
-
0

Ukraine accuses Russia of using phosphorus bombs – ombudsman

Article influenced from the original post by The Mirror

Ukraine’s human rights ombudswoman accused Russia on Sunday of using banned phosphorus munitions in an overnight attack on the town of Popasna in Ukraine’s eastern Luhansk region. Reuters had reported they were not immediately able to verify her statement.

The ombudswoman, Liudmila Denisova, shared a photograph purporting to show the alleged attack, but did not say if Ukraine had concrete evidence.

“The bombing of a civilian city by the Russian attackers with these weapons is a war crime and a crime against humanity according to the Rome convention,” she said in an online statement.

This follows allegations made by Ukrainian law enforcement officials, who posted images and videos to social media of what they claimed to be white phosphorus:

Credit: Олексій Білошицький
Credit: Олексій Білошицький

The fighting in Ukraine

Fighting continues on the 18th day of Russia’s invasion of Ukraine, with civilian areas in the Kharkiv and Mariupol areas reportedly coming under fire by Russian forces.

The Ukrainian military accused Russian forces of continuing to use civilian infrastructure for the purposes of their ongoing invasion, which includes disguising themselves as Ukrainian civilians or soldiers. 

UK intel: Russian forces are attempting to push further into the country, advancing from Kharkiv in the North and Mariupol in the South with the goal of enveloping Ukrainian forces in the East.

The Ukrainian military also accused Russian forces of targeting civilians and seizing their personal belongings.

Suggest a change to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose
1...383940...79Page 39 of 79

Editor Picks

Featured

Cyber Academy

ABOUT US

RiSec represents an autonomous, non-profit alliance comprising of individuals dedicated to enhancing cybersecurity awareness and education. Read more

Contact us: security@realinfosec.net

Social

Subscribe for weekly updates

Copyright © RiSec 2023 All rights reserved.
All trademarks, logos, images and brand names are the property of their respective owners.