Colombian Real Estate Agency Leak Exposes Records Of Over 100,000 Buyers.

 

More than one terabyte of data containing 5.5 million files has been left exposed, leaking personal information of over 100,000 customers of a Colombian real estate firm, according to cybersecurity company WizCase.

The breach was discovered by Ata Hakçıl and his team in a database owned by Coninsa Ramon H, a company that specializes in architecture, engineering, construction, and real estate services. "There was no need for a password or login credentials to see this information, and the data was not encrypted,"

The data exposure is the result of a misconfigured Amazon Web Services (AWS) Simple Storage Service (S3) bucket, causing sensitive information such as clients' names, photos, and addresses to be disclosed. The details stored in the bucket range from invoices and income documents to quotes and account statements dating between 2014 and 2021. The complete list of information contained in the documents is as follows -

• Full names
• Phone numbers
• Email addresses
• Residential addresses
• Amounts paid for estates, and
• Asset values

In addition, the bucket is also said to contain a database backup that includes additional information such as profile pictures, usernames, and hashed passwords. Troublingly, the researchers said they also found malicious, backdoor code in the bucket that could be exploited to gain persistent access to the website and redirect unsuspecting visitors to fraudulent pages.

It's not immediately clear if these files were put to use by bad actors in any campaign. Coninsa Ramon H did not respond to inquiries from The Hacker News sent via email regarding the vulnerability.

"Based on viewing a sample of the documents, […] the misconfiguration revealed $140 to $200 billion in transactions, or an annual transaction history of at least $46 billion," the researchers said. "For perspective, that's roughly 14% of Colombia's total economy."

The highly confidential nature of the data contained within the database makes it highly susceptible to exploitation by cybercriminals to mount phishing attacks and conduct a variety of fraud or scam activities, including tricking users into making additional payments and worse, reveal more personally identifiable information by tampering with the website's backend infrastructure.

 

 

 

Microsoft Warns Of A Wide-Scale Phishing-As-A-Service Operation.

 

Microsoft has opened the lid on a large-scale phishing-as-a-service (PHaaS) operation that's involved in selling phishing kits and email templates as well as providing hosting and automated services at a low cost, thus enabling cyber actors to purchase phishing campaigns and deploy them with minimal efforts.

"With over 100 available phishing templates that mimic known brands and services, the BulletProofLink operation is responsible for many of the phishing campaigns that impact enterprises today," Microsoft 365 Defender Threat Intelligence Team said in a Tuesday report.

"BulletProofLink (also referred to as BulletProftLink or Anthrax by its operators in various websites, ads, and other promotional materials) is used by multiple attacker groups in either one-off or monthly subscription-based business models, creating a steady revenue stream for its operators."

The tech giant said it uncovered the operation during its investigation of a credential phishing campaign that used the BulletProofLink phishing kit on either on attacker-controlled sites or sites provided by BulletProofLink as part of their service. The existence of the operation was first made public by OSINT Fans in October 2020.

 

 

Phishing-as-a-service differs from traditional phishing kits in that unlike the latter, which are sold as one-time payments to gain access to packaged files containing ready-to-use email phishing templates, they are subscription-based and follow a software-as-a-service model, while also expanding on the capabilities to include built-in site hosting, email delivery, and credential theft.

Believed to have been active since at least 2018, BulletProofLink is known to operate an online portal to advertise their toolset for as much as $800 a month and allow cybercrime gangs to register and pay for the service. Customers can also avail of a 10% discount should they opt to subscribe to their newsletter, not to mention pay anywhere between $80 to $100 for credential phishing templates that allow them to siphon login information entered by unsuspected victims upon clicking a malicious URL in the email message.

Troublingly, the stolen credentials are not only sent to the attackers but also to the BulletProofLink operators using a technique called "double theft" in a modus operandi that mirrors the double extortion attacks employed by ransomware gangs.

"With phishing kits, it is trivial for operators to include a secondary location for credentials to be sent to and hope that the purchaser of the phish kit does not alter the code to remove it," the researchers said. "This is true for the BulletProofLink phishing kit, and in cases where the attackers using the service received credentials and logs at the end of a week instead of conducting campaigns themselves, the PhaaS operator maintained control of all credentials they resell."

 

Worm, Virus & Trojan Horse.

 

Some of the skills that hackers have are programming and computer networking skills. They often use these skills to gain access to systems. The objective of targeting an organization would be to steal sensitive data, disrupt business operations or physically damage computer controlled equipment. Trojans, viruses, and worms can be used to achieve the above-stated objectives.

In this article, we will introduce you to some of the ways that hackers can use Trojans, viruses, and worms to compromise a computer system. We will also look at the countermeasures that can be used to protect against such activities.

What Is A Trojan Horse?

A Trojan horse is a program that allows the attack to control the user’s computer from a remote location. The program is usually disguised as something that is useful to the user. Once the user has installed the program, it has the ability to install malicious payloads, create backdoors, install other unwanted applications that can be used to compromise the user’s computer, etc.

The list below shows some of the activities that the attacker can perform using a Trojan horse.

• Use the user’s computer as part of the Botnet when performing distributed denial of service attacks.
• Damage the user’s computer (crashing, blue screen of death, etc.)
• Stealing sensitive data such as stored passwords, credit card information, etc.
• Modifying files on the user’s computer
• Electronic money theft by performing unauthorized money transfer transactions
• Log all the keys that a user presses on the keyboard and sending the data to the attacker. This method is used to harvest user ids, passwords, and other sensitive data.
• Viewing the users’ screenshot
• Downloading browsing history data

What Is A Worm?

 

A worm is a malicious computer program that replicates itself usually over a computer network. An attacker may use a worm to accomplish the following tasks;

• Install backdoors on the victim’s computers. The created backdoor may be used to create zombie computers that are used to send spam emails, perform distributed denial of service attacks, etc. the backdoors can also be exploited by other malware.
• Worms may also slowdown the network by consuming the bandwidth as they replicate.
• Install harmful payload code carried within the worm.

What Is A Virus?

 

• A virus is a computer program that attaches itself to legitimate programs and files without the user’s consent. Viruses can consume computer resources such as memory and CPU time. The attacked programs and files are said to be “infected”. A computer virus may be used to;
• Access private data such as user id and passwords
• Display annoying messages to the user
• Corrupt data in your computer
• Log the user’s keystrokes

Computer viruses have been known to employ social engineering techniques. These techniques involve deceiving the users to open the files which appear to be normal files such as Word or Excel documents. Once the file is opened, the virus code is executed and does what it’s intended to do.

Trojans, Viruses, And Worms Counter Measures.

 

• To protect against such attacks, an organization can use the following methods.
• A policy that prohibits users from downloading unnecessary files from the Internet such as spam email attachments, games, programs that claim to speed up downloads, etc.
• Anti-virus software must be installed on all user computers. The anti-virus software should be updated frequently, and scans must be performed at specified time intervals.
• Scan external storage devices on an isolated machine especially those that originate from outside the organization.
• Regular backups of critical data must be made and stored on preferably read-only media such as CDs and DVDs.
• Worms exploit vulnerabilities in the operating systems. Downloading operating system updates can help reduce the infection and replication of worms.
• Worms can also be avoided by scanning, all email attachments before downloading them.

 

Modified Version Of WhatsApp For Android Spotted Installing Triada Trojan.

 

A modified version of the WhatsApp messaging app for Android has been trojanized to intercept text messages, serve malicious payloads, display full-screen ads, and sign up device owners for unwanted premium subscriptions without their knowledge.

"The Trojan Triada snuck into one of these modified versions of the messenger called FMWhatsApp 16.80.0 together with the advertising software development kit (SDK)," researchers from Russian cybersecurity firm Kaspersky said in a technical write-up published Tuesday. "This is similar to what happened with APKPure, where the only malicious code that was embedded in the app was a payload downloader."

Modified versions of legitimate Android apps — a practice called Modding — are designed to perform functions not originally conceived or intended by the app developers. FMWhatsApp, billed as a custom build of WhatsApp, allows users to refashion the app with different themes, personalize icons, and hide features like last seen, and even deactivate video calling features. The app is only available via third-party websites.

The tampered variant of the app detected by Kaspersky comes equipped with capabilities to gather unique device identifiers, which are sent to a remote server that responds back with a link to a payload that's subsequently downloaded, decrypted, and launched by the Triada trojan.

The payload, for its part, can be employed to carry out a wide range of malicious activities ranging from downloading additional modules and displaying full-screen ads to stealthily subscribing the victims to premium services and signing into WhatsApp accounts on the device. Even worse, the attackers can hijack and take control of the WhatsApp accounts to carry out social engineering attacks or distribute spam messages, thus propagating the malware to other devices.

"It's worth highlighting that FMWhatsapp users grant the app permission to read their SMS messages, which means that the Trojan and all the further malicious modules it loads also gain access to them," the researchers said. "This allows attackers to automatically sign the victim up for premium subscriptions, even if a confirmation code is required to complete the process."

 

 

Microsoft, Google To Invest $30 Billion In Cybersecurity Over Next 5 Years.

 Google and Microsoft said they are pledging to invest a total of $30 billion in cybersecurity advancements over the next five years, as the U.S. government partners with private sector companies to address threats facing the country in the wake of a string of sophisticated malicious cyber activity targeting critical infrastructure, laying bare the risks to data, organizations, and governments worldwide.

 The White House cybersecurity meeting, which brought together executives from the education, energy, finance, insurance, and tech sectors, included companies like ADP, Amazon, Apple, Bank of America, Code.org, Girls Who Code, Google, IBM, JP Morgan Chase, Microsoft, and Vantage Group, among others.

To that end, the U.S. government on Wednesday announced a collaboration between the National Institute of Standards and Technology (NIST) and industry partners to develop a new framework to improve the security and integrity of the technology supply chain, alongside plans to expand the Industrial Control Systems Cybersecurity Initiative to secure natural gas pipelines.

The big tech sector is also rallying behind with a roster of initiatives including —

• Microsoft will invest $20 billion over the next five years to deliver advanced security solutions, in addition to making available $150 million in technical services to help federal, state, and local governments with upgrading security protections.
• Google will invest over $10 billion to bolster cybersecurity, including expanding zero-trust programs, helping secure the software supply chain and enhancing open-source security. It's worth noting that the search giant, earlier this June, announced a framework called the Supply chain Levels for Software Artifacts (SLSA or "salsa") to safeguard the integrity of software supply chains.
• Apple will work with more than 9,000 of its suppliers to push for mass adoption of multi-factor authentications, vulnerability remediation, event logging, and security training.
• IBM will train 150,000 people in cybersecurity skills over the next three years, and will partner with 20 Historically Black Colleges & Universities to establish a more diverse cyber workforce.
• Amazon will make available to all Amazon Web Services account holders a multi-factor authentication device to protect against phishing and password theft at no extra cost.

 While it remains to be seen how these efforts will unfold in practice, the commitments demonstrate the urgency in prioritizing and elevating cybersecurity after a relentless stretch of high-profile cyber attacks targeting Solar Winds, Microsoft, Colonial Pipeline, IBS, and Kaseya in recent months. The incidents also prompted U.S. President Joe Biden to issue an executive order in May requiring federal agencies to modernize their cybersecurity defenses.

 

 

Microsoft Warns Of Widespread Phishing Attacks Using Open Redirects.

 

Microsoft is warning of a widespread credential phishing campaign that leverages open redirector links in email communications as a vector to trick users into visiting malicious websites while effectively bypassing security software.

 Attackers combine these links with social engineering baits that impersonate well-known productivity tools and services to lure users into clicking.

 Doing so leads to a series of redirections — including a CAPTCHA verification page that adds a sense of legitimacy and attempts to evade some automated analysis systems — before taking the user to a fake sign-in page. This ultimately leads to credential compromise, which opens the user and their organization to other attacks.

Although redirect links in email messages serve a vital tool to take recipients to third-party websites or track click rates and measure the success of sales and marketing campaigns, the same technique can be abused by adversaries to redirect such links to their own infrastructure, at the same time keeping the trusted domain in the full URL intact to evade analysis by anti-malware engines, even when users attempt to hover on links to check for any signs of suspicious content.

In order to lead potential victims to phishing sites, the redirect URLs embedded in the message are set up using a legitimate service, while the final actor-controlled domains contained in the link leverage top-level domains .xyz, .club, .shop, and .online (e.g. "c-tl[.]xyz"), but which are passed as parameters so as to sneak past email gateway solutions.

Microsoft said it observed at least 350 unique phishing domains as part of the campaign — another attempt to obscure detection — underscoring the campaign's effective use of convincing social engineering lures that purport to be notification messages from apps like Office 365 and Zoom, a well-crafted detection evasion technique, and a durable infrastructure to carry out the attacks.

This not only shows the scale with which this attack is being conducted, but it also demonstrates how much the attackers are investing in it, indicating potentially significant payoffs,to give the attack a veneer of authenticity, clicking the specially-crafted links redirects the users to a malicious landing page that employs Google reCAPTCHA to block any dynamic scanning attempts. Upon completion of the CAPTCHA verification, the victims are displayed a fraudulent login page mimicking a known service like Microsoft Office 365, only to swipe their passwords upon submitting the information.

This phishing campaign exemplifies the perfect storm of [social engineering, detection evasion, and a large attack infrastructure] in its attempt to steal credentials and ultimately infiltrate a network, and given that 91% of all cyber attacks originate with email, organizations must therefore have a security solution that will provide them multi-layered defense against these types of attacks.

Cryptography Tutorial: What Is Cryptanalysis, RC4 And CrypTool.

 

Information plays a vital role in the running of business, organizations, military operations, etc. Information in the wrong hands can lead to loss of business or catastrophic results. To secure communication, a business can use cryptology to cipher information. Cryptology involves transforming information into the Nonhuman readable format and vice versa.

In this Cryptography and Network Security tutorial, we will introduce you to the world of cryptology and how you can secure information from falling into the wrong hands. 

Topics covered in this tutorial

• What is Cryptography?
  
• What is cryptanalysis?
  
• What is cryptology?
  
• Encription Algorithms.
• Hacking Activities: Hack Now!

 

What is Cryptography?

Cryptography is the study and application of techniques that hide the real meaning of information by transforming it into nonhuman readable formats and vice versa.

Let’s illustrate this with the aid of an example. Suppose you want to send the message “I LOVE APPLES”, you can replace every letter in the phrase with the third successive letter in the alphabet. The encrypted message will be “K NQXG CRRNGU”. To decrypt our message, we will have to go back three letters in the alphabet using the letter that we want to decrypt.

The process of transforming information into nonhuman readable form is called encryption.

The process of reversing encryption is called decryption.

Decryption is done using a secret key which is only known to the legitimate recipients of the information. The key is used to decrypt the hidden messages. This makes the communication secure because even if the attacker manages to get the information, it will not make sense to them.

 The encrypted information is known as a cipher. Next in this Cryptography tutorial, we will learn what is cryptanalysis. 

What Is Cryptanalysis?

Cryptanalysis is the art of trying to decrypt the encrypted messages without using the key that was used to encrypt the messages. Cryptanalysis uses mathematical analysis and algorithms to decipher the ciphers. It is used to breach security systems to gain access to encrypted content and messages even the cryptographic key is unknown.

The success of cryptanalysis attacks depends on

• Amount of time available
• Computing power available
• Storage capacity available
  

 

The following is a list of the commonly used Cryptanalysis attacks;

• Brute force attack– this type of attack uses algorithms that try to guess all the possible logical combinations of the plaintext which are then ciphered and compared against the original cipher.
• Dictionary attack– this type of attack uses a wordlist in order to find a match of either the plaintext or key. It is mostly used when trying to crack encrypted passwords.
• Rainbow table attack– this type of attack compares the cipher text against pre-computed hashes to find matches.
  

 

What is cryptology?

Cryptology combines the techniques of cryptography and cryptanalysis.

Encryption Algorithms.

MD5– this is the acronym for Message-Digest 5. It is used to create 128-bit hash values. Theoretically, hashes cannot be reversed into the original plain text. MD5 is used to encrypt passwords as well as check data integrity.  MD5 is not collision resistant. Collision resistance is the difficulties in finding two values that produce the same hash values. 

• SHA– this is the acronym for Secure Hash Algorithm. SHA algorithms are used to generate condensed representations of a message (message digest). It has various versions such as;

• SHA-0:  produces 120-bit hash values. It was withdrawn from use due to significant flaws and replaced by SHA-1.
• SHA-1:  produces 160-bit hash values. It is similar to earlier versions of MD5. It has cryptographic weakness and is not recommended for use since the year 2010.
• SHA-2:  it has two hash functions namely SHA-256 and SHA-512. SHA-256 uses 32-bit words while SHA-512 uses 64-bit words.
• SHA-3: this algorithm was formally known as Keccak.

• RC4– Brute force RC4 algorithm is used to create stream ciphers. It is mostly used in protocols such as Secure Socket Layer (SSL) to encrypt internet communication and Wired Equivalent Privacy (WEP) to secure wireless networks.
• BLOWFISH– this algorithm is used to create keyed, symmetrically blocked ciphers. It can be used to encrypt passwords and other data.

Now in this Cryptography tutorials series, we will learn how to crack RC4 and create a cipher using CrypTool. 

Hacking Activity: How to create a Cipher using CrypTool

In this practical Cryptool tutorial, we will create a simple cipher using the RC4 brute force tool. We will then attempt to decrypt it using brute-force attack. For this exercise, let us assume that we know the encryption secret key is 24 bits. We will use this information to break the cipher.

Creating the RC4 stream cipher

Step 1) Download and intall CryptTool

We will use CrypTool 1 as our cryptology tool. CrypTool 1 is an open source educational tool for crypto logical studies. You can download it from https://www.cryptool.org/en/ct1/

Step 2) Open CryptTool and replace the text

We will encrypt the following phrase

Never underestimate the determination of a kid who is time-rich and cash-poor

We will use 00 00 00 as the encryption key.

• Open CrypTool 1
  

 

 

Replace the text with Never underestimate the determination of a kid who is time-rich and cash-poor.

Step 3) Encrypt the text

• Click on Encrypt/Decrypt menu
  

 

• Point to Symmetric (modern) then select RC4 as shown above
• The following window will appear
  

 

Step 4) Select encryption key

• Select 24 bits as the encryption key
• Set the value to 00 00 00
• Click on Encrypt button
•  You will get the following stream cipher 

Attacking The Stream Cipher.

Step 5) Start Analysis

• Click on Analysis menu

• Point to Symmetric Encryption (modern) then select RC4 as shown above
• You will get the following window

• Remember the assumption made is the secret key is 24 bits. So make sure you select 24 bits as the key length.
• Click on the Start button. You will get the following window

• Note: the time taken to complete the Brute-Force Analysis attack depends on the processing capacity of the machine been used and the key length. The longer the key length, the longer it takes to complete the attack.

 

Step 6) Analyse the results

• When the analysis is complete, you will get the following results.

• Note: a lower Entropy number means it is the most likely correct result. It is possible a higher than the lowest found Entropy value could be the correct result.
• Select the line that makes the most sense then click on Accept selection button when done

Summary

• Cryptography is the science of ciphering and deciphering messages.
• A cipher is a message that has been transformed into a nonhuman readable format.
• Deciphering is reversing a cipher into the original text.
• Cryptanalysis is the art of deciphering ciphers without the knowledge of the key used to cipher them.
• Cryptology combines the techniques of both cryptography and cryptanalyst.
• RC4 brute force online algorithm is used to create stream ciphers. It is mostly used in protocols such as Secure Socket Layer (SSL) to encrypt internet communication and Wired Equivalent Privacy (WEP) to secure wireless networks.