Modified Version Of WhatsApp For Android Spotted Installing Triada Trojan.

 

A modified version of the WhatsApp messaging app for Android has been trojanized to intercept text messages, serve malicious payloads, display full-screen ads, and sign up device owners for unwanted premium subscriptions without their knowledge.

"The Trojan Triada snuck into one of these modified versions of the messenger called FMWhatsApp 16.80.0 together with the advertising software development kit (SDK)," researchers from Russian cybersecurity firm Kaspersky said in a technical write-up published Tuesday. "This is similar to what happened with APKPure, where the only malicious code that was embedded in the app was a payload downloader."

Modified versions of legitimate Android apps — a practice called Modding — are designed to perform functions not originally conceived or intended by the app developers. FMWhatsApp, billed as a custom build of WhatsApp, allows users to refashion the app with different themes, personalize icons, and hide features like last seen, and even deactivate video calling features. The app is only available via third-party websites.

The tampered variant of the app detected by Kaspersky comes equipped with capabilities to gather unique device identifiers, which are sent to a remote server that responds back with a link to a payload that's subsequently downloaded, decrypted, and launched by the Triada trojan.

The payload, for its part, can be employed to carry out a wide range of malicious activities ranging from downloading additional modules and displaying full-screen ads to stealthily subscribing the victims to premium services and signing into WhatsApp accounts on the device. Even worse, the attackers can hijack and take control of the WhatsApp accounts to carry out social engineering attacks or distribute spam messages, thus propagating the malware to other devices.

"It's worth highlighting that FMWhatsapp users grant the app permission to read their SMS messages, which means that the Trojan and all the further malicious modules it loads also gain access to them," the researchers said. "This allows attackers to automatically sign the victim up for premium subscriptions, even if a confirmation code is required to complete the process."

 

 

Microsoft, Google To Invest $30 Billion In Cybersecurity Over Next 5 Years.

 Google and Microsoft said they are pledging to invest a total of $30 billion in cybersecurity advancements over the next five years, as the U.S. government partners with private sector companies to address threats facing the country in the wake of a string of sophisticated malicious cyber activity targeting critical infrastructure, laying bare the risks to data, organizations, and governments worldwide.

 The White House cybersecurity meeting, which brought together executives from the education, energy, finance, insurance, and tech sectors, included companies like ADP, Amazon, Apple, Bank of America, Code.org, Girls Who Code, Google, IBM, JP Morgan Chase, Microsoft, and Vantage Group, among others.

To that end, the U.S. government on Wednesday announced a collaboration between the National Institute of Standards and Technology (NIST) and industry partners to develop a new framework to improve the security and integrity of the technology supply chain, alongside plans to expand the Industrial Control Systems Cybersecurity Initiative to secure natural gas pipelines.

The big tech sector is also rallying behind with a roster of initiatives including —

• Microsoft will invest $20 billion over the next five years to deliver advanced security solutions, in addition to making available $150 million in technical services to help federal, state, and local governments with upgrading security protections.
• Google will invest over $10 billion to bolster cybersecurity, including expanding zero-trust programs, helping secure the software supply chain and enhancing open-source security. It's worth noting that the search giant, earlier this June, announced a framework called the Supply chain Levels for Software Artifacts (SLSA or "salsa") to safeguard the integrity of software supply chains.
• Apple will work with more than 9,000 of its suppliers to push for mass adoption of multi-factor authentications, vulnerability remediation, event logging, and security training.
• IBM will train 150,000 people in cybersecurity skills over the next three years, and will partner with 20 Historically Black Colleges & Universities to establish a more diverse cyber workforce.
• Amazon will make available to all Amazon Web Services account holders a multi-factor authentication device to protect against phishing and password theft at no extra cost.

 While it remains to be seen how these efforts will unfold in practice, the commitments demonstrate the urgency in prioritizing and elevating cybersecurity after a relentless stretch of high-profile cyber attacks targeting Solar Winds, Microsoft, Colonial Pipeline, IBS, and Kaseya in recent months. The incidents also prompted U.S. President Joe Biden to issue an executive order in May requiring federal agencies to modernize their cybersecurity defenses.

 

 

Microsoft Warns Of Widespread Phishing Attacks Using Open Redirects.

 

Microsoft is warning of a widespread credential phishing campaign that leverages open redirector links in email communications as a vector to trick users into visiting malicious websites while effectively bypassing security software.

 Attackers combine these links with social engineering baits that impersonate well-known productivity tools and services to lure users into clicking.

 Doing so leads to a series of redirections — including a CAPTCHA verification page that adds a sense of legitimacy and attempts to evade some automated analysis systems — before taking the user to a fake sign-in page. This ultimately leads to credential compromise, which opens the user and their organization to other attacks.

Although redirect links in email messages serve a vital tool to take recipients to third-party websites or track click rates and measure the success of sales and marketing campaigns, the same technique can be abused by adversaries to redirect such links to their own infrastructure, at the same time keeping the trusted domain in the full URL intact to evade analysis by anti-malware engines, even when users attempt to hover on links to check for any signs of suspicious content.

In order to lead potential victims to phishing sites, the redirect URLs embedded in the message are set up using a legitimate service, while the final actor-controlled domains contained in the link leverage top-level domains .xyz, .club, .shop, and .online (e.g. "c-tl[.]xyz"), but which are passed as parameters so as to sneak past email gateway solutions.

Microsoft said it observed at least 350 unique phishing domains as part of the campaign — another attempt to obscure detection — underscoring the campaign's effective use of convincing social engineering lures that purport to be notification messages from apps like Office 365 and Zoom, a well-crafted detection evasion technique, and a durable infrastructure to carry out the attacks.

This not only shows the scale with which this attack is being conducted, but it also demonstrates how much the attackers are investing in it, indicating potentially significant payoffs,to give the attack a veneer of authenticity, clicking the specially-crafted links redirects the users to a malicious landing page that employs Google reCAPTCHA to block any dynamic scanning attempts. Upon completion of the CAPTCHA verification, the victims are displayed a fraudulent login page mimicking a known service like Microsoft Office 365, only to swipe their passwords upon submitting the information.

This phishing campaign exemplifies the perfect storm of [social engineering, detection evasion, and a large attack infrastructure] in its attempt to steal credentials and ultimately infiltrate a network, and given that 91% of all cyber attacks originate with email, organizations must therefore have a security solution that will provide them multi-layered defense against these types of attacks.

Cryptography Tutorial: What Is Cryptanalysis, RC4 And CrypTool.

 

Information plays a vital role in the running of business, organizations, military operations, etc. Information in the wrong hands can lead to loss of business or catastrophic results. To secure communication, a business can use cryptology to cipher information. Cryptology involves transforming information into the Nonhuman readable format and vice versa.

In this Cryptography and Network Security tutorial, we will introduce you to the world of cryptology and how you can secure information from falling into the wrong hands. 

Topics covered in this tutorial

• What is Cryptography?
  
• What is cryptanalysis?
  
• What is cryptology?
  
• Encription Algorithms.
• Hacking Activities: Hack Now!

 

What is Cryptography?

Cryptography is the study and application of techniques that hide the real meaning of information by transforming it into nonhuman readable formats and vice versa.

Let’s illustrate this with the aid of an example. Suppose you want to send the message “I LOVE APPLES”, you can replace every letter in the phrase with the third successive letter in the alphabet. The encrypted message will be “K NQXG CRRNGU”. To decrypt our message, we will have to go back three letters in the alphabet using the letter that we want to decrypt.

The process of transforming information into nonhuman readable form is called encryption.

The process of reversing encryption is called decryption.

Decryption is done using a secret key which is only known to the legitimate recipients of the information. The key is used to decrypt the hidden messages. This makes the communication secure because even if the attacker manages to get the information, it will not make sense to them.

 The encrypted information is known as a cipher. Next in this Cryptography tutorial, we will learn what is cryptanalysis. 

What Is Cryptanalysis?

Cryptanalysis is the art of trying to decrypt the encrypted messages without using the key that was used to encrypt the messages. Cryptanalysis uses mathematical analysis and algorithms to decipher the ciphers. It is used to breach security systems to gain access to encrypted content and messages even the cryptographic key is unknown.

The success of cryptanalysis attacks depends on

• Amount of time available
• Computing power available
• Storage capacity available
  

 

The following is a list of the commonly used Cryptanalysis attacks;

• Brute force attack– this type of attack uses algorithms that try to guess all the possible logical combinations of the plaintext which are then ciphered and compared against the original cipher.
• Dictionary attack– this type of attack uses a wordlist in order to find a match of either the plaintext or key. It is mostly used when trying to crack encrypted passwords.
• Rainbow table attack– this type of attack compares the cipher text against pre-computed hashes to find matches.
  

 

What is cryptology?

Cryptology combines the techniques of cryptography and cryptanalysis.

Encryption Algorithms.

MD5– this is the acronym for Message-Digest 5. It is used to create 128-bit hash values. Theoretically, hashes cannot be reversed into the original plain text. MD5 is used to encrypt passwords as well as check data integrity.  MD5 is not collision resistant. Collision resistance is the difficulties in finding two values that produce the same hash values. 

• SHA– this is the acronym for Secure Hash Algorithm. SHA algorithms are used to generate condensed representations of a message (message digest). It has various versions such as;

• SHA-0:  produces 120-bit hash values. It was withdrawn from use due to significant flaws and replaced by SHA-1.
• SHA-1:  produces 160-bit hash values. It is similar to earlier versions of MD5. It has cryptographic weakness and is not recommended for use since the year 2010.
• SHA-2:  it has two hash functions namely SHA-256 and SHA-512. SHA-256 uses 32-bit words while SHA-512 uses 64-bit words.
• SHA-3: this algorithm was formally known as Keccak.

• RC4– Brute force RC4 algorithm is used to create stream ciphers. It is mostly used in protocols such as Secure Socket Layer (SSL) to encrypt internet communication and Wired Equivalent Privacy (WEP) to secure wireless networks.
• BLOWFISH– this algorithm is used to create keyed, symmetrically blocked ciphers. It can be used to encrypt passwords and other data.

Now in this Cryptography tutorials series, we will learn how to crack RC4 and create a cipher using CrypTool. 

Hacking Activity: How to create a Cipher using CrypTool

In this practical Cryptool tutorial, we will create a simple cipher using the RC4 brute force tool. We will then attempt to decrypt it using brute-force attack. For this exercise, let us assume that we know the encryption secret key is 24 bits. We will use this information to break the cipher.

Creating the RC4 stream cipher

Step 1) Download and intall CryptTool

We will use CrypTool 1 as our cryptology tool. CrypTool 1 is an open source educational tool for crypto logical studies. You can download it from https://www.cryptool.org/en/ct1/

Step 2) Open CryptTool and replace the text

We will encrypt the following phrase

Never underestimate the determination of a kid who is time-rich and cash-poor

We will use 00 00 00 as the encryption key.

• Open CrypTool 1
  

 

 

Replace the text with Never underestimate the determination of a kid who is time-rich and cash-poor.

Step 3) Encrypt the text

• Click on Encrypt/Decrypt menu
  

 

• Point to Symmetric (modern) then select RC4 as shown above
• The following window will appear
  

 

Step 4) Select encryption key

• Select 24 bits as the encryption key
• Set the value to 00 00 00
• Click on Encrypt button
•  You will get the following stream cipher 

Attacking The Stream Cipher.

Step 5) Start Analysis

• Click on Analysis menu

• Point to Symmetric Encryption (modern) then select RC4 as shown above
• You will get the following window

• Remember the assumption made is the secret key is 24 bits. So make sure you select 24 bits as the key length.
• Click on the Start button. You will get the following window

• Note: the time taken to complete the Brute-Force Analysis attack depends on the processing capacity of the machine been used and the key length. The longer the key length, the longer it takes to complete the attack.

 

Step 6) Analyse the results

• When the analysis is complete, you will get the following results.

• Note: a lower Entropy number means it is the most likely correct result. It is possible a higher than the lowest found Entropy value could be the correct result.
• Select the line that makes the most sense then click on Accept selection button when done

Summary

• Cryptography is the science of ciphering and deciphering messages.
• A cipher is a message that has been transformed into a nonhuman readable format.
• Deciphering is reversing a cipher into the original text.
• Cryptanalysis is the art of deciphering ciphers without the knowledge of the key used to cipher them.
• Cryptology combines the techniques of both cryptography and cryptanalyst.
• RC4 brute force online algorithm is used to create stream ciphers. It is mostly used in protocols such as Secure Socket Layer (SSL) to encrypt internet communication and Wired Equivalent Privacy (WEP) to secure wireless networks.

 

What Is Social Engineering? Attacks, Techniques & Prevention.

 

What Is Social Engineering?

Social engineering is the art of manipulating users of a computing system into revealing confidential information that can be used to gain unauthorized access to a computer system. The term can also include activities such as exploiting human kindness, greed, and curiosity to gain access to restricted access buildings or getting the users to installing backdoor software.

Knowing the tricks used by hackers to trick users into releasing vital login information among others is fundamental in protecting computer systems

In this tutorial, we will introduce you to the common social engineering techniques and how you can come up with security measures to counter them. 

Topics Covered In This Tutorial.

• How Social Engineering Works.
  
• Common Social Engineering Techniques.
  
• Social Engineering Counter Measures.

 

How Does Social Engineering Work?

• Gather Information: This is the first stage, the learns as much as he can about the intended victim. The information is gathered from company websites, other publications and sometimes by talking to the users of the target system.
• Plan Attack: The attackers outline how he/she intends to execute the attack
• Acquire Tools: These include computer programs that an attacker will use when launching the attack.
• Attack: Exploit the weaknesses in the target system.
• Use acquired knowledge: Information gathered during the social engineering tactics such as pet names, birth dates of the organization founders, etc. is used in attacks such as password guessing.
  

 

Common Social Engineering Techniques:

Social engineering techniques can take many forms. The following is the list of the commonly used techniques.

• Familiarity Exploit: Users are less suspicious of people they are familiar with. An attacker can familiarize him/herself with the users of the target system prior to the social engineering attack. The attacker may interact with users during meals, when users are smoking he may join, on social events, etc. This makes the attacker familiar to the users. Let’s suppose that the user works in a building that requires an access code or card to gain access; the attacker may follow the users as they enter such places. The users are most like to hold the door open for the attacker to go in as they are familiar with them. The attacker can also ask for answers to questions such as where you met your spouse, the name of your high school math teacher, etc. The users are most likely to reveal answers as they trust the familiar face. This information could be used to hack email accounts and other accounts that ask similar questions if one forgets their password.
• Intimidating Circumstances: People tend to avoid people who intimidate others around them. Using this technique, the attacker may pretend to have a heated argument on the phone or with an accomplice in the scheme. The attacker may then ask users for information which would be used to compromise the security of the users’ system. The users are most likely give the correct answers just to avoid having a confrontation with the attacker. This technique can also be used to avoid been checked at a security check point.
• Phishing: This technique uses trickery and deceit to obtain private data from users. The social engineer may try to impersonate a genuine website such as Yahoo and then ask the unsuspecting user to confirm their account name and password. This technique could also be used to get credit card information or any other valuable personal data.
• Tailgating: This technique involves following users behind as they enter restricted areas. As a human courtesy, the user is most likely to let the social engineer inside the restricted area.
• Exploiting human curiosity: Using this technique, the social engineer may deliberately drop a virus infected flash disk in an area where the users can easily pick it up. The user will most likely plug the flash disk into the computer. The flash disk may auto run the virus, or the user may be tempted to open a file with a name such as Employees Revaluation Report 2013.docx which may actually be an infected file.
• Exploiting human greed: Using this technique, the social engineer may lure the user with promises of making a lot of money online by filling in a form and confirm their details using credit card details, etc. 

Social Engineering Counter Measures.

Most techniques employed by social engineers involve manipulating human biases. To counter such techniques, an organization can;

• To counter the familiarity exploit, the users must be trained to not substitute familiarity with security measures. Even the people that they are familiar with must prove that they have the authorization to access certain areas and information.
• To counter intimidating circumstances attacks, users must be trained to identify social engineering techniques that fish for sensitive information and politely say no.
• To counter phishing techniques, most sites such as Yahoo use secure connections to encrypt data and prove that they are who they claim to be. Checking the URL may help you spot fake sites. Avoid responding to emails that request you to provide personal information.
• To counter tailgating attacks, users must be trained not to let others use their security clearance to gain access to restricted areas. Each user must use their own access clearance. 
• To counter human curiosity, it’s better to submit picked up flash disks to system administrators who should scan them for viruses or other infection preferably on an isolated machine.
• To counter techniques that exploit human greed, employees must be trained on the dangers of falling for such scams.

Summary.

• Social engineering is the art of exploiting the human elements to gain access to unauthorized resources.
• Social engineers use a number of techniques to fool the users into revealing sensitive information.
• Organizations must have security policies that have social engineering countermeasures.

 

         

 

Skills Required To Become A Certified Hacker.

 

Skills allow you to achieve your desired goals within the available time and resources. As a hacker, you will need to develop skills that will help you get the job done. These skills include learning how to program, use the internet, good at solving problems, and taking advantage of existing security tools.

In this article, we will introduce you to the common programming languages and skills that you must know as a hacker. 

Topics Covered In This Short Tutorial.

• What is a programming language?
  
• Why should you learn how to program?
• What languages should you learn?
  
• Other skills.
  
• Summary.

 

What Is A Programming Language?

A programming language is a language that is used to develop computer programs. The programs developed can range from operating systems; data based applications through to networking solutions. 

Why Should You Learn How To Program?

• Hackers are the problem solver and tool builders, learning how to program will help you implement solutions to problems. It also differentiates you from script kiddies.
• Writing programs as a hacker will help you to automate many tasks which would usually take lots of time to complete.
• Writing programs can also help you identify and exploit programming errors in applications that you will be targeting.
• You don’t have to reinvent the wheel all the time, and there are a number of open source programs that are readily usable. You can customize the already existing applications and add your methods to suit your needs.
  

 

What Languages Should I Learn?

The answer to this question depends on your target computer systems and platforms. Some programming languages are used to develop for only specific platforms. As an example, Visual Basic Classic (3, 4, 5, and 6.0) is used to write applications that run on Windows operating system. It would, therefore, be illogical for you to learn how to program in Visual Basic 6.0 when your target is hacking Linux based systems. 

Programming Languages That Are Useful To Hackers.

 1.   HTML.

2.    JAVASCRIPT.

3.    PHP.

4.    SQL.

5.    PYTHON, RUBY, BASH, PERL.

6.    C & C++

7.    JAVA, C SHARP, VISUAL BASIC, VB SCRIPT.

Other Skills.

In addition to programming skills, a good hacker should also have the following skills:

• Know how to use the internet and search engines effectively to gather information.
• Get a Linux-based operating system and the know the basics commands that every Linux user should know.
• Practice makes perfect, a good hacker should be hard working and positively contribute to the hacker community. He/she can contribute by developing open source programs, answering questions in hacking forums, etc.

Summary.

• Programming skills are essential to becoming an effective hacker.
• Network skills are essential to becoming an effective hacker
• SQL skills are essential to becoming an effective hacker.
• Hacking tools are programs that simplify the process of identifying and exploiting weaknesses in computer systems.

 

 

 

Potential Security Threats To Your Computer Systems.

 A computer system threat is anything that leads to loss or corruption of data or physical damage to the hardware and/or infrastructure. Knowing how to identify computer security threats is the first step in protecting computer systems. The threats could be intentional, accidental or caused by natural disasters. 

Topics Covered In This Short Tutorial.

• What is a security threat?
• What are physical threats?
  
• What are non physical threats?
  

 

What Is A Security Threat?

Security Threat is defined as a risk that which can potentially harm computer systems and organization. The cause could be physical such as someone stealing a computer that contains vital data. The cause could also be non-physical such as a virus attack. In these tutorial series, we will define a threat as a potential attack from a hacker that can allow them to gain unauthorized access to a computer system.

What are Physical Threats?

A physical threat is a potential cause of an incident that may result in loss or physical damage to the computer systems.

The following list classifies the physical threats into three (3) main categories;

• Internal: The threats include fire, unstable power supply, humidity in the rooms housing the hardware, etc.
• External: These threats include Lightning, floods, earthquakes, etc.
• Human: These threats include theft, vandalism of the infrastructure and/or hardware, disruption, accidental or intentional errors.

To protect computer systems from the above mentioned physical threats, an organization must have physical security control measures.

The following list shows some of the possible measures that can be taken:

• Internal: Fire threats could be prevented by the use of automatic fire detectors and extinguishers that do not use water to put out a fire. The unstable power supply can be prevented by the use of voltage controllers. An air conditioner can be used to control the humidity in the computer room.
• External: Lightning protection systems can be used to protect computer systems against such attacks. Lightning protection systems are not 100% perfect, but to a certain extent, they reduce the chances of Lightning causing damage. Housing computer systems in high lands are one of the possible ways of protecting systems against floods.
• Humans: Threats such as theft can be prevented by use of locked doors and restricted access to computer rooms.
  

 

What are Non-physical threats?

A non-physical threat is a potential cause of an incident that may result in;

• Loss or corruption of system data
• Disrupt business operations that rely on computer systems
• Loss of sensitive information
• Illegal monitoring of activities on computer systems
• Cyber Security Breaches
• Others

The non-physical threats are also known as logical threats. The following list is the common types of non-physical threats;

• Virus
• Trojans
• Worms
• Spyware
• Key loggers
• Adware
• Denial of Service Attacks
• Distributed Denial of Service Attacks
• Unauthorized access to computer systems resources such as data
• Phishing
• Other Computer Security Risks

To protect computer systems from the above-mentioned threats, an organization must have logical security measures in place. The following list shows some of the possible measures that can be taken to protect cyber security threats.

To protect against viruses, Trojans, worms, etc. an organization can use anti-virus software. In additional to the anti-virus software, an organization can also have control measures on the usage of external storage devices and visiting the website that is most likely to download unauthorized programs onto the user’s computer.

Unauthorized access to computer system resources can be prevented by the use of authentication methods. The authentication methods can be, in the form of user ids and strong passwords, smart cards or bio-metric, etc.

Intrusion-detection/prevention systems can be used to protect against denial of service attacks.There are other measures too that can be put in place to avoid denial of service attacks.

Summary

• A threat is any activity that can lead to data loss/corruption through to disruption of normal business operations.
• There are physical and non-physical threats
• Physical threats cause damage to computer systems hardware and infrastructure. Examples include theft, vandalism through to natural disasters.
• Non-physical threats target the software and data on the computer systems.

Latest Web Hacking Tools – Q3 2021.

 

The benefits offered by the latest batch of open-sourced hacking tools are familiar godsends to DevOps or security teams, simplifying workflows, tackling human error through automation, and uncovering otherwise hard-to-find flaws.

Also surfacing recently was a demonstration showing how to weaponize the humble USB cable, and a novel but simple way of deterring ransomware attacks emerged – in timely fashion – during the same month that the US Coloniel Pipeline attack netted the assailants a payout of $4.3 million (much of which may have been later seized by the US Department of Justice).

Here’s our roundup of the latest hacking tools available to pen testers, security teams, and DevOps personnel for the third quarter of 2021:

VSCode Integration With Mitre ATT&CK Framework Streamlines Code Editing Work.

 

VSCode-ATT&CK is a plugin through which security analysts and researchers can interact with the Mitre ATT&CK framework without leaving their Visual Studio Code (VSCode) environments.

Developed and open sourced by managed detection and response vendor Red Canary, the extension for Microsoft’s popular code editor integrates with the Mitre ATT&CK framework and offers an integrated ATT&CK technique search command, among other features.

Red Canary detection engineer Thomas Gardner told The Daily Swig that the tool helps security teams “maintain focus within VSCode without having to leave the application and access information about ATT&CK via their browser”.

Jenkins Attack Framework Helps Red Teams Harden ‘Soft Targets’ In CI/CD Environments.

 

Jenkins Attack Framework (JAF) helps pen testers and red teamers uncover ways in which the popular automation server can be abused.

Released by Accenture, the tool automates and simplifies many common, and some less common, Jenkins attack techniques.

Jenkins, an open source CI/CD pipeline that often stores powerful credentials and proprietary code, has historically not been securely configured by default, often rendering it “a soft target”, JAF developer Shelby Spencer, formerly of Accenture.

Deadshot Uncovers All-Too-Common DevOps Blunders Made When Uploading Code To GitHub.

 

A free tool that warns developers when they inadvertently include sensitive information in their code before it’s uploaded to a repository was launched by security specialists at communications technology company Twilio.

Deadshot monitors GitHub pull requests in real time and flags potentially sensitive data that surfaces in code, as well as “changes to sensitive functionality”.

A ‘deploy and forget’ tool, it runs in every commit and should alert project owners before any data leaves the organization – a potentially invaluable benefit after Twilio security expert Yashvier Kosaraju observed that most published secrets come “from unsuspecting developers that unknowingly committed them to GitHub”.

DIY Malicious USB Cable For $30.

 

Hackers – ethical or otherwise – can make their own keystroke-injecting USB cable for around $30, according to a blog post from Daniel Scheidt, information security consultant at German cybersecurity firm r-tec.

Scheidt documented how he did just that, implanting a UNIFY receiver into an innocent-looking USB cable – which, incidentally, would still charge your phone – in order to inject keystrokes.

In building this ‘Evil Logitech’ keyboard, the researcher acknowledged the groundwork laid by Luca Bongiorni’s similar USBsamurai, Rogan Dawes’ LOGITacker, which enumerates and tests Logitech wireless input devices for vulnerabilities, and Marcus Mengs’ ‘munifying’, which extracts AES link encryption keys and device RF addresses of paired devices from a Logitech receiver dongle via USB.

Cyrillic Keyboard Simulation Thwarts Russia-Affiliated Ransomware Attacks.

 Unit221B founder Lance James released a Windows batch script to help organizations dupe ransomware into believing they are based in Russian-speaking regions and therefore are less likely to be attacked.

The short, clickable script adds a Russian language reference in the Windows registry keys to make it appear that the Windows PC has a Russian keyboard installed, circumventing the need to download relevant script libraries from Microsoft.

Most ransomware strains – but certainly fewer malware overall – fail to install if they detect a Russian or Ukrainian keyboard, reflecting the recognition among Russian-affiliated cyber crime gangs that attacks on home soil could spark unwanted attention from Russian law enforcement.

 

 

 

 

Eight Arrests Made As Eurojust Dismantles €2 Million E-Commerce Fraud Operation.

 

Romanian and Greek police have arrested eight members of an organized crime group that defrauded online shoppers of at least €2 million ($2.4 million).

Authorities also seized €220,000 ($261,000) in cash, mobile phones, and travel documents during raids at 30 locations, in an operation coordinated by Eurojust, the EU agency that facilitates cross-border cooperation in criminal cases.

The criminal network deployed phishing scams to dupe victims into paying for what they believed were goods and services via legitimate websites, including €50,000 ($59,000) cars via eBay, goods from Amazon, and accommodation through Airbnb.

Using forged identity documents, the gang set up at least 300 bank accounts in Hungary, Spain, Poland, Germany, and the Netherlands in which “to hide their profits”, according to a Eurojust press release.

The scammers created fictitious advertisements, along with fake transport and payment companies whose names sounded similar to legitimate enterprises.

Data Theft.

As well as stealing cash, the social engineering attack infected victims’ devices with malware and captured their login details, credit card and bank account numbers, and other sensitive personal data.

The ill-gotten data was shared among the criminal network, said Eurojust.

The operation also involved the cooperation of Dutch and Spanish authorities.

The arrests follow a further two arrests made last month in another Eurojust-backed operation related to the same criminal gang’s involvement in an online fraud targeting the Dutch housing market.

Interpol Ransomware Warning.

News of the arrests landed on July 8 – the same day that Interpol concluded its annual conference focused on ‘National Central Bureaus’, which serve as a bridge between the organization and frontline police around the world.

During the event, senior police officials from 167 Interpol member countries discussed the expansion of Interpol’s I-24/7 secure communications network to national police and border control agencies, as well as the burgeoning ransomware threat.

“A global strategy in response to the threat of ransomware is critical – one where we successfully build trust, see effective exchange of data, and maximize rapid operational assistance to law enforcement agencies,” said Interpol secretary general Jürgen Stock in a press release.

 

 

UK National Lottery Community Fund Data Breach Impacts Grant Applicants.

 The UK National Lottery Community Fund has reported a data breach exposing the sensitive personal data, including bank account information, of grant holders and applicants.

The National Lottery Community Fund distributes funds raised by National Lottery ticket sales to various good causes, awarding more than £588 million ($807 million) to 8,189 community projects in 2019 and 2020.

“The breach relates to data provided to us between September 2013 and December 2019 by UK Portfolio, England funding and Building Better Opportunities customers,” said the public body in a data breach notice posted yesterday (July 22).

Anyone who has submitted grant applications via National Lottery funding programs for Northern Ireland, Scotland, and Wales are not affected by the breach, it added.

The compromised data was submitted both during grant applications and by existing grant holders supplying additional information.

The organization did not indicate how the breach occurred or how many victims might be involved.

Exposed Data.

The National Lottery Community Fund said exposed data includes names, physical addresses, email addresses, landline and mobile numbers, dates of birth, bank account details, and applicant organizations’ addresses and websites.

The organization emphasized that bank account PINs, passwords, and bank card details were not involved since it does not collect such details.

“This is an ongoing investigation however, and other personal data may be affected – we will update our website if this is confirmed,” it added.

The National Lottery Community Fund said it has reported the incident to the Information Commissioner’s Office (ICO).

Advice, Apologies.

Anyone who thinks they may be affected has been urged to consider updating passwords for their online accounts, and watch out for phishing emails or phone calls, and fraudulent activity on their bank accounts.

“We are sorry for the worry and inconvenience this may cause,” said the National Lottery Community Fund.

“This is the first time we have reported a data breach to the ICO. We have a long track record of serving communities and our grant holders efficiently and securely – we have made a mistake here, and we want to reassure grant holders that we are taking this incident seriously and are committed to learning and improving from it.”

A spokesperson from The National Lottery Community Fund told The Daily Swig: “Our priority here is to support customers. Due to the nature of the data involved it is highly unlikely that we will be able to identify specific customers.

“Given this we are sharing everything we know now that will help customers to understand whether they may be affected or not, as well as information on how those affected can protect themselves. We are still actively looking into it and will update our website as further information becomes available.”

 

 

 

 

Pakistan Government Approves New Cybersecurity Policy, Cybercrime Agency.

 

The Pakistan Telecommunication Authority (PTA) has announced that a new cybersecurity policy and accompanying cybersecurity agency has been approved for the South Asian nation.

The new policy aims to support both public and private institutions, including national information systems and critical infrastructure, replacing a system whereby government institutions have separate security operations.

It comes at a delicate time for Pakistan, which recently accused India of using the Isreali spyware Pegasus to spy on Prime Minister Imran Khan – and designates cyber-attacks on any Pakistani institution as an attack on national sovereignty.

“The IT ministry and all relevant public and private institutions will be provided all possible assistance and support to ensure that their data, services, ICT products and systems are in line with the requirements of cybersecurity,” said IT minister Syed Aminul Haq, as quoted in local press.

Shields Up.

Pakistan’s new cybersecurity policy will include a new governance and institutional framework for a ‘secure cyber ecosystem’, along with computer emergency response teams (CERTs) and security operations centers (SOCs) at national, sector, and institutional levels.

And the policy calls for new information-sharing mechanisms, along with skills development and training programs and public awareness campaigns.

“The cybersecurity policy announced by Pakistan is a welcome development,” Javvad Malik, security awareness advocate at KnowBe4, tells The Daily Swig.

“Security awareness is essential. People need to be informed of the risks that come with interconnected systems, and what their role is in ensuring security. Once this groundwork is laid, then putting in place technologies and procedures to support these become easier and more effective.”

Poor Track Record.

Pakistan has a poor record on cybersecurity, ranking 79th in the ITU’s Global Cyber Security Interest.

The country’s current cyber law, the ‘Prevention of Electronic Crime Act’ (PECA), is poorly implemented, according to ethical hacker and security researcher Rafay Baloch.

“To quote a few examples, the federal government has yet to designate a digital forensics laboratory to provide expert opinion to the court independent of the investigative agency which is mandated by the section 40 of PECA,” he tells The Daily Swig.

“Similarly, under section 49 of PECA, the federal government was required to designate national and sectoral CERTs for protecting against critical infrastructure.”

Baloch says that the new policy should improve Pakistan’s cybersecurity, in particular by harmonizing practices across different bodies.

“The major challenge pertaining to the policy is its implementation. A national cybersecurity policy is accompanied by a strategy document with an action plan to achieve the objectives laid out in the policy,” he says.

“The strategy document would include prioritization of action items, timelines, roles and responsibilities of organizations responsible for implementing the objectives laid out in the policy.”

He also calls for the government to develop an institutional framework consisting of dual civil-military agencies:

“That would be raised with the specific purpose of implementing the aforementioned policy objectives and maintaining national cyber defenses in government, commercial and military domains.”

 

 

 

Five Riskiest Mobile Apps.

 

Unsanctioned software and applications running on corporate mobile devices is a security nightmare. These can range from meeting genuine business needs—commonly referred to as Shadow IT—such as efficient, remote communication with colleagues or corporate document management via downloadable messaging and file sharing apps, to using apps for non-work-related lifestyle or entertainment purposes such as socializing, fitness, gaming, and watching sports.

Unmanaged, personal apps on corporate devices introduce numerous vectors and vulnerabilities for exploitation, including avenues for data exfiltration, cyber attack, surveillance of employee activity from a malicious third party, and so many other things that we see as potential risks to organizations.

The risks posed to businesses by unsolicited apps have intensified since the outbreak of the COVID-19 pandemic and subsequent move to mass remote working with fewer face-to-face meetings and interactions, employees are looking for new methods to communicate without the formality of an email or Teams call. However, with new attack tactics, exploits, and tools emerging through unsolicited apps, mobile devices and apps have never posed as great a threat to organizations as they do now. Most
users tend to disbelieve that cyber criminals will target them, but these apps often request a lot of access to personal information or integration with privileged accounts. “They can be quite effective threat vectors for cunning attackers."

Popular attacks on mobile devices include remote access Trojans (RATs) and man-in-the-middle (MITM) attacks for accessing user data or eavesdropping, ransomware for restricting access to devices, and fake certificates for side-loading malicious apps.

Seemingly genuine and trustworthy apps and app stores can be anything but. For example, Turner alludes to applications posing as one thing and approved onto Apple’s and Google’s walled store gardens that end up being something much more malicious, such as some calculator apps in fact being file transfer mechanisms.

Likewise, it’s not unheard of for trusted app stores such as Google Play to contain apps riddled with malware. Even the legitimate TikTok app was caught out last year for capturing copy buffer data from Apple devices when it shouldn’t have been, While the social networking service has since stopped capturing such data, it is an example of the hidden risks potentially posed by such apps if not carefully vetted.

Most concerning of all, new cloud threat research from Netskope discovered that 97% of cloud apps used in the enterprise are unmanaged and often freely adopted. Businesses clearly need to be doing much more to vet which apps employees use on work devices.

So, what unauthorized app types should be highest on the risk list and why?.

1. Social Media And Messaging Apps.

Probably the most commonly found app types on company-owned devices, social media and messaging apps can cause significant security and privacy headaches for security leaders. “Social media apps have been guilty of tracking what you do across your device, websites you visit, locations you go to, and so much more,” e.g Facebook, which is known to have suffered from security holes and vulnerabilities, privacy troubles, and confidential information leaks in the past.

You wouldn’t want to see social media apps from outside of the countries that your company is doing business in Apps from other countries on a device opens up the doorway/pathway for violating privacy and data retention laws and regulations as they could be potentially utilized for conducting business, malicious insiders exfiltrating data, or malicious actors using the apps to exfiltrate data or compromise a device via a backdoor or zero day. Some countries require everything to go through the central government. Is it worth exposing your company’s device to those risks when they don’t even do business in that country?

China-based apps are a particular concern, there is not much that needs to be said regarding the inherent security and cyber risk these  apps developed and sourced out of China tend to have back doors, malicious code, and they expose an enterprise’s sensitive data. 

Regarding the security issues surrounding messaging apps, a prevalent issue is that popular services such as WhatsApp, Signal, and Telegram are vendor-hosted, centralized consumer-grade apps. “That means employees’ work-related discussions are sucked onto the app’s servers, leaving the company with no control over how its data is stored or managed and potentially subject to data mining and exfiltration. Moreover, there’s no formalized moderation and no way to ensure discussion groups are inclusive or contain all relevant parties. Worse, there’s no control around deprovisioning someone who leaves the organization nor auditing, which leads to unaccountable decision-making.Security leaders should indeed be concerned if employees are conducting business via consumer- rather than enterprise-grade collaboration and messaging apps.

2. Remote Access And Cloud Storage Apps.

Amid the migration to mass remote working over the last 18 months, use of remote access and cloud storage applications has grown significantly as organizations and employees have sought out new ways to work securely and efficiently. Unwarranted remote access apps can redirect all network traffic on a device to an unknown server/VPN/remote access infrastructure where all company app traffic is now flowing and potentially being collected or analyzed by a third party. Likewise, alternative cloud storage solutions can be configured to automatically backup files, photos, and other data on your device to them. If your job works with files and photos locally on your device, this is another scenario where data can purposely or inadvertently be stored elsewhere, not protected by your company’s security solutions,those same apps can be used by attackers and configured to their own accounts to get a copy of the data you’re working with on your device. All this exposes organizations to potential compromise and data breach incidents by harvesting credentials, sensitive data being exfiltrated and stored improperly, etc. These risks will continue to increase for many reasons if unchecked, including ongoing remote working and the vast utilization of apps like Office 365 or Dropbox to share information within organizations, among partners and with customers.

3. Security Tool Apps.

It is possible, on some Windows 10 machines, to download software from the Microsoft Store without the need for administrator privileges, This creates the risk of installing and using unauthorized, sophisticated security tools that should only be used by those in specialist roles. Unauthorized users that play with security tools such as wireshark or Kali Linux may have no idea of the damage they could cause to an organization,While the tools are legal, unauthorized use is not. Users could use the tools to eavesdrop on a corporate network, which is particularly harmful if they were a disgruntled employee or inside threat.In addition, employees using these tools for fun will likely never have heard of bad actors living off the land, and unauthorized use of these tools can make the job of a bad actor far easier as you’ve essentially given them the tools they need to hack an organization from within,For example, within Kali Linux, there are hundreds of DDoS tools that have the potential to disrupt the entire corporate network. Particularly given that most DDoS protection layers sit on the perimeter of the network, any DDos from within is likely to be missed by scanning tools and therefore cannot prevent exploitation.

4. Third-Party App Plugins.

Third-party app plugins designed to add functionality to even verified apps have the potential to greatly threaten the data of organizations. According to the Netskope report cited earlier, 97% of Google Workspace users have authorized at least one third-party app access to their corporate Google account, potentially exploiting data to third parties due to scopes like view and manage files within a Google Drive.For example, the CamScanner app plugin can access all of your documents in Google Drive. Camscanner was found to contain malware and was banned by the Indian government. In other words, third-party app plugins may provide a valid service, but the organizations operating the apps may not be trustworthy enough to handle sensitive data.

Attackers have also discovered that gaining access to a Google account that controls the mobile device via the App Store/Play Store is much more effective than trying to find vulnerabilities and develop exploits for mobile, which is labor- and time-intensive,Such access provides the keys to the kingdom: confidential data, credit card information, and more. An attacker with a compromised account can access backups and recover data belonging to all apps on a mobile device, including messages, contacts, and call logs.If someone steals these accounts, they can permanently track a device and remotely control several key actions (such as making unauthorized purchases or installing malicious apps), causing further damage.

5. Gaming Apps.

Corporate devices and networks are not made available to support game playing, whether it’s during work hours or outside, but some try regardless. While this represents a gross misuse of company property and unnecessary expenditure, the security concerns of using corporate devices to install and play gaming software are even worse. “The Steam client, for example, is equivalent to opening a can of worms if installed on any device that has access to the corporate network,the sheer quantity of games that can be installed using Steam makes it very difficult for security to maintain visibility of what is on the network and respond accordingly. Any unauthorized software would then fall out of the security team’s patch management process, so gaps could be left open to exploit.” He points to an example from last year when researchers found four vulnerabilities within Valve, Steam’s developer, allowing hackers to take over the third-party service to execute arbitrary code and steal credentials.

The most dangerous gaming app in our opinion is 9Game.com, a portal for downloading free Android games,we have seen more malicious apps come out of this mobile app store than any other over the past couple of years.

Reducing The Risks Of Unsanctioned Mobile Apps.

When it comes to addressing the risks posed by unsolicited applications on corporate devices by stopping people from installing unapproved software, experts agree that a combination of policy and education is required.This helps to support the drive to monitor and manage the usage across the rest of the staff. Device/app whitelisting to allow only certain executable and associated files to run. This would mean that any application that was not approved would be stopped before it could be run. This would also help with a malware infested copy of a legitimate application as the executable would be different, usually picked up by the MD5 hash being different. This option can be quite labor intensive to setup and manage but is often worth the effort. Such policies can be enforced through endpoint management solutions by instituting an approval flow for unsanctioned apps and remediation of existing unapproved unsanctioned apps.