*** The Security News Thread ***

Details in the link.

Quote:

---

How to Check If You're Infected with CrossRAT?


Since CrossRAT persists in an OS-specific manner, detecting the malware will depend on what operating system you are running.

For Windows:

• Check the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Ru n\' registry key.
• If infected it will contain a command that includes, java, -jar and mediamgrs.jar.

For macOS:

• Check for jar file, mediamgrs.jar, in ~/Library.
• Also look for launch agent in /Library/LaunchAgents or ~/Library/LaunchAgents named mediamgrs.plist.

For Linux:

• Check for jar file, mediamgrs.jar, in /usr/var.
• Also look for an 'autostart' file in the ~/.config/autostart likely named mediamgrs.desktop.

---

https://thehackernews.com/2018/01/crossrat-malware.html

Unauthorized Monero Mining Campaign Impacting Up to 30M Systems

By: Sean Michael Kerner| January 26, 2018


The Palo Alto Networks Unit 42 security research team reveals a new cryptocurrency attack that makes use of URL shorteners to trick users into installing Monero mining software.


Palo Alto Networks is warning of a new cryptocurrency mining attack that is using URL shorteners as a way to infect victims' systems.
In a Jan. 24 report, the Palo Alto Networks Unit 42 security research group revealed that up to 30 million systems may be impacted by the attack, which has been ongoing since October 2017. The attack payload installs the open-source XMRig mining software on a victim's machine to consume CPU resources and mine the Monero cryptocurrency. It's currently not known who is behind the new attack.

Attackers Use URL Shorteners in Cryptocurrency Mining Attack

Privacy Tools Adds Transparency to Microsoft Windows Data Collection

By: Pedro Hernandez| January 25, 2018


The upcoming Windows Diagnostic Data Viewer app and revamped Privacy Dashboard will allow users to see the data Microsoft has collected on them.


Wondering exactly what kind of data Windows is sending to Microsoft? A new tool, called the Windows Diagnostic Data Viewer, lifts the veil on the previously opaque communications between Windows PCs and Microsoft's telemetry-gathering operations.
To many Windows users, particularly those concerned about the privacy of their data, it comes as no surprise that Microsoft's operating system can collect and transmits data regarding a PC's configuration, device health, application usage and other information.
Microsoft analyzes this data to shed light on how the system software is faring across a wide variety of hardware combinations and usage patterns, information that the software maker then uses to address issues, improve the OS and help guide the software giant's ongoing OS development efforts.


It's a practice that stoked privacy concerns when Windows 10 first hit the scene. Privacy advocates were alarmed by breadth of information Microsoft collected on people who used its operating system software and cloud services.
Soon, with the Windows Diagnostic Data Viewer, users will be able to see exactly what kind of data their Windows 10 PCs are sharing with Microsoft, announced Marisa Rogers, the Windows and Devices Group Privacy Officer at Microsoft.
"Our commitment is to be fully transparent on the diagnostic data collected from your Windows devices, how it is used, and to provide you with increased control over that data. This is all part of our commitment to increase your trust and confidence in our products and services," she wrote in a Jan. 24 blog post, authored just days before Data Privacy Day (Jan. 28).
"You are able to see and search all Windows diagnostic data that's in the cloud related to your specific device," continued the executive. Users will be able to view information on their devices and their configurations, including connected peripherals, settings and the network information pertaining to a given device.
Delving deeper, Windows Diagnostic Data Viewer can show reliability and performance information, along with data on a user's file queries and movie consumption. Alarming as it may sound to some users, Rogers claimed that the "functionality is not intended to capture user viewing or, listening habits."
Users can also explore their application usage, along with an inventory of installed applications and device updates.
Windows Diagnostic Data Viewer will be released to the Microsoft Store app marketplace as part of the next major Windows 10 update. Members of the Windows Insider program can take the app for an early spin.
In addition to the viewer app, Microsoft has revamped its Privacy Dashboard, providing users with a clearer view of the data that is saved to their Microsoft accounts. More updates are on the way, stated Rogers.
An updated Activity History page will soon allow users to access and manage their media, product and Microsoft services activity information. Additionally, users will be able to export their dashboard data and delete specific items.

New Privacy Tools Lets Users View Data Windows Sends to Microsoft

Hackers forced US ATM machines to spit out cash
on Sunday, January 28, 2018


Two of the world's largest ATM manufacturers in the US, Diebold Nixdorf Inc and NCR Corp have warned their clients that hackers are targeting their machines with tools that force them to spit out money via hacking schemes “jackpotting.”


Both the makers have not identified any victims or how much money they had lost till now.


The attack was reported for the first time on 27 January by the security news website Krebs on Security. Immediately, companies sent out alerts to clients warning of the trend on Saturday.


'This should be treated by all ATM deployers as a call to action to take appropriate steps to protect their ATMs against these forms of attack,' the company said.


Jackpotting has been widely used around the world in recent years, but still, it is unclear how much cash has been stolen because victims and police do not disclose details.


Diebold Nixdorf has admitted that US authorities had warned them about one of its ATM models Opteva, which they stopped manufacturing several years ago, being targetted by the hackers, but they did not take the warning seriously.


Krebs on Security reported, "a confidential US Secret Service alert sent to banks said the hackers targeted stand-alone ATMs typically located in pharmacies and big-box retailers as well as drive-thru ATMs."


However, Federal Bureau of Investigation has started investigating the matter.


http://www.ehackingnews.com/2018/01/hackers-forced-us-atm-machines-to-spit.html

You publish 20,000 clean patches, but one goes wrong and you're a PC-crippler forever

Malwarebytes pushed a patch, then a patch for the patch

By Richard Chirgwin 29 Jan 2018 at 03:04


Security software vendor Malwarebytes has overwritten two updates to its products and apologised to users who found their machines turned into near-bricks.
The problem started with a production update the company pushed out last Friday, which sent users to their keyboards complaining of excessive RAM and CPU consumption.
Affected products included Malwarebytes for Windows Premium, Malwarebytes for Windows Premium Trial, Malwarebytes Endpoint Security (MBES) and Malwarebytes Endpoint Protection (Cloud Console).
Irritated users lit up the company's forums with hundreds of messages about the issue.
The company moved to resolve the issue, but its first fix failed and users kept venting. That led to this Sunday apology, as the company pushed out a second fix.
“The root cause of the issue was a malformed protection update that the client couldn’t process correctly,” the apology post said, something Malwarebytes says is rare since “we have pushed upwards of 20,000 of these protection updates routinely”.
The company also published the timeline below, in its analysis [PDF] of the issue.

https://teakdoor.com/attachment.php?a...tid=7517&stc=1



The company explained that the snafu arose because of work to try and improve its Web protection detection syntax controls.
“Recently we have been improving our products so that we can show the reason for a block, i.e. the detection 'category' for the web protection blocks. In order to support this new feature, we added enhanced detection syntaxes to include the block category in the definitions. The unfortunate oversight was that one of the syntax controls was not implemented in the new detection syntax, which cause the malformed detection to be pushed into production.” ®


https://www.theregister.co.uk/2018/0..._patchy_patch/

Keylogger campaign infects 2,000 WordPress sites
Monday, January 29, 2018 |




Security researchers have discovered over 2,000 WordPress sites —possibly more— infected with a keylogger that's being loaded on the WordPress backend login page and a crypto jacking script (in-browser cryptocurrency miner) on their frontends.


Researchers at Sucuri who made the discovery said the recent campaign is tied to threat actors behind a December 2017 campaign. Both incidents used a keylogger/cryptocurrency malware called cloudflare[.]solutions. The name is derived from the domain used to serve up the malicious scripts in the first campaign, cloudflare[.]solutions.


Cloudflare[.]solutions is in no way related to network management and security firm Cloudflare.


The attack is quite simple. Miscreants find unsecured WordPress sites —usually running older WordPress versions or older themes and plugins— and use exploits for those sites to inject malicious code into the CMS' source code.


Attackers use injection scrips on WordPress sites with weak or outdated security. “The cdjs[.]online script is injected into either a WordPress database (wp_posts table) or into the theme’s functions.php file,” Sinegubko wrote.


HTLM is obfuscated to include JavaScript code, such as “googleanalytics.js”, that load the malicious scripts “startGoogleAnalytics” from the attackers’ domains.


The malicious code includes two parts. For the admin login page, the code loads a keylogger hosted on a third-party domain. For the site's frontend, crooks load the Coinhive in-browser miner and mine Monero using the CPUs of people visiting the site.


“While these new attacks do not yet appear to be as massive as the original cloudflare[.]solutions campaign, the reinfection rate shows that there are still many sites that have failed to properly protect themselves after the original infection,” wrote Denis Sinegubko, a senior malware researcher at Sucuri who authored research blog this week.


For the late-2017 campaign, crooks loaded their keylogger from the "cloudflare.solutions" domain. Those attacks affected nearly 5,500 WordPress sites but were stopped on December 8 when the registrar took down the miscreants' domain.


Keylogger campaign infects 2,000 WordPress sites - E Hacking News

Microsoft Issues Out-of-Band Fix for Intel’s Broken Spectre Patch
Infosecurity 20h

Microsoft has been forced to issue an out-of-band patch to fix problems caused by a buggy Intel update for one of the Spectre vulnerabilities disclosed earlier this month.
The Redmond fix (KB4078130) was issued over the weekend and disables the mitigation for branch target injection vulnerability CVE-2017-5715.
The fix covers Windows 7 (SP1), Windows 8.1 and all versions of Windows 10, for client and server.
Intel first reported “reboot issues” for Broadwell and Haswell platforms on January 11.
Last week it claimed to be making good progress on fixing the problem, and recommended that in the meantime “OEMs, cloud service providers, system manufacturers, software vendors and end users stop deployment of current versions, as they may introduce higher than expected reboots and other unpredictable system behavior.”
The chip giant then claimed during its fourth quarter financials that the ‘fix’ may also lead to “data loss or corruption.”
Microsoft agreed, but said its new out-of-band update reverses the problem. It can be applied by downloading from the Microsoft Update Catalog website or – for advanced users – via registry setting changes.
Microsoft added:
“As of January 25, there are no known reports to indicate that this Spectre variant 2 (CVE 2017-5715 ) has been used to attack customers. We recommend Windows customers, when appropriate, reenable the mitigation against CVE-2017-5715 when Intel reports that this unpredictable system behavior has been resolved for your device.”
This is the second unscheduled fix Redmond has been forced to issue since the Spectre and Meltdown flaws were made public at the start of the year.
The previous one was issued in the first week of January to address the Meltdown vulnerability, but itself ended up causing problems for customers because of compatibility issues with some AV tools. These caused blue screen (BSOD) errors for some customers.

https://www.infosecurity-magazine.co...nd-fix-intels/

https://www.economist.com/blogs/gull...8/01/free-bird full post in news for those unable to open link

Techrader says the best free antimalware of 2018 is Bitdefender.


It does seem to have an impressive feature set for a freebie.


Details here:

The best free anti-malware software 2018 | TechRadar

I used it for a while, but changed again. Can't precisely remember why but irritating "please upgrade" pop ups all the time seems to ring a bell.

Quote:

---

Originally Posted by pseudolus

I used it for a while, but changed again. Can't precisely remember why but irritating "please upgrade" pop ups all the time seems to ring a bell.

---

Well all the free ones tend to do that... they want your subscription.

Last year, attackers linked to the Russian hacking group APT28 (sometimes called Fancy Bear) started hacking like its 1999 with Microsoft Word-based malware that doesn’t trigger security warnings along the way. These types of attacks are called “macro-less malware” because they bypass the security warnings added to Microsoft Office programs in response to traditional macro malware like the Melissa virus at the end of the 20th century.

In a November 2017 analysis, security giant McAfee noted one APT28 campaign that used a combination of phishing and macro-less malware to drop spyware onto victim computers.

Macro-less malware exploits a Microsoft protocol called Dynamic Data Exchange (DDE) to run malicious code within Microsoft Office documents. DDE has its legitimate uses too, mainly to share data between applications. In this case, attackers can use DDE to launch other applications, like PowerShell, and execute malicious code.

These new DDE attacks still require some amount of user interaction, just like traditional Office macro attacks. In order for the malicious DDE code to execute, the attacker must convince the victim to disable Protected Mode and click through at least one additional prompt. Where they differ from traditional Office macro attacks though, is how the prompts are framed to the user.

With Microsoft Office 2003 and later, Microsoft changed macro warning prompts to highlight their security implications, using yellow shields and prominent “Security Warning” messages. DDE execution prompts however, are simple grey boxes, sometimes with no mention of security, that ask users “This document contains links that may refer to other files. Do you want to update this document with the data from the linked file?” In other words, DDE is now handled similarly to how traditional macros were handled 20 years ago back in Office ’97. New attack method, but the same user interaction.

Both traditional macro malware and macro-less malware have the same end result – they allow attackers to leverage the Microsoft Windows scripting engine to download and execute malicious payloads. While macros can embed Visual Basic code directly into a Word document, DDE must launch a separate application, like PowerShell, to perform complex tasks like downloading and executing malware.

So why are attackers doing this? Macro-less malware attacks are successful for the same reason that macro malware has stuck around for over 20 years. A large amount of end users simply do not read pop up prompts before clicking “yes.” Attackers often increase their chances of successfully infecting their targets by using social engineering tactics like explicit instructions to accept all prompts in order to “view the important message.” Bad actors are notorious for recycling anything that works, so it’s common for malicious tactics like this to resurface in different forms time and time again.

Luckily, there are steps you can take to protect yourself. In the wake of the APT28 attacks, Microsoft published a security advisory with instructions for enabling DDE controls to disable the protocol entirely. Many advanced malware sandboxing solutions can detect DDE-based malware and stop it from ever entering your network. Most importantly though, end users need to be trained to spot phishing attacks and the social engineering tricks that attackers use to trick their victims into clicking through DDE prompts.

Microsoft has already started to improve Office’s handling of macro-less malware by adding several behind-the-scenes controls to stop malicious DDE code in its tracks. It likely won’t be long until Microsoft improves their DDE security prompts to provide better guidance to would-be victims. But, these prominent security warnings have failed to end macro malware, which means both types of attacks are still something to watch out for in the future. As always, when in doubt, don’t click on anything you don’t understand or expect.

https://www.helpnetsecurity.com/2018/02/05/macro-less-malware/

Flaw in Grammarly’s extensions opened user accounts to compromise

A vulnerability in the Grammarly Chrome and Firefox extensions allowed websites to read users’ authentication tokes and use to them to log in to the users’ Grammarly accounts and access all the (potentially sensitive) information held in them.
The vulnerability was discovered by Google project Zero researcher Tavis Ormandy, who reported it to Grammarly on Friday.
“I’m calling this a high severity bug because it seems like a pretty severe violation of user expectations. Users would not expect that visiting a website gives it permission to access documents or data they’ve typed into other websites,” Ormandy noted.
He also provided proof-of-concept code for triggering the bug.
By Monday, the company pushed out a new version of the popular extension, with the hole plugged.
“At this time, Grammarly has no evidence that any user information was compromised by this issue. The bug potentially affected text saved in the Grammarly Editor,” the company stated on Tuesday.
“This bug did not affect the Grammarly Keyboard, the Grammarly Microsoft Office add-in, or any text typed on websites while using the browser extension. The bug is fixed, and there is no action required by our users. We’re continuing to monitor actively for any unusual activity.”
Ormandy praised the company’s swiftness in responding to the report and issuing the fix.
“I’ve verified that Mozilla now also has the update, so users should be auto-updated to the fixed version,” he noted.
The vulnerable Chrome extension has been downloaded by over 10 million users. The Firefox Grammarly extension has over 600,000 users.

https://www.helpnetsecurity.com/2018...vulnerability/

Once again, the record has been broken for both the most breaches and the most data compromised in a year. There were 5,207 breaches recorded last year, surpassing 2015’s previous high mark by nearly 20%, according to the 2017 Data Breach QuickView Report by Risk Based Security.

The number of records compromised also surpassed all other years with over 7.8 billion records exposed, a 24.2% increase over 2016’s previous high of 6.3 billion.

“The level of breach activity this year was disheartening”, commented Inga Goddijn, Executive VP for Risk Based Security. “We knew things were off to a bad start once the phishing season for W-2 data kicked into high gear. But by the time April 18th came and went, breach disclosures leveled off and we went into summer hopeful the worst was behind us. Unfortunately, that wasn’t the case.”

Record number of exposed records

In addition to the number of breaches and amount of data lost, 2017 stood out for another reason. For the past eight years, hacking has exposed more records than any other breach type. In 2017, breach type Web – which is largely comprised of accidentally exposing sensitive data to the Internet – took over the top spot compromising 68.8% or 5.4 billion records.

Hacking still remained the leading breach type, account for 55% of reported incidents, but its impact on records exposed fell to the number two spot, with 2.3 billion records compromised. For the first time since 2008, inadvertent data exposure and other data mishandling errors caused more data loss than malicious intrusion into networks.

“We’re seeing a lot of interest in calling out organizations that mishandle sensitive data”, said Ms Goddijn. “Several of the security researchers that are actively engaged in searching for exposed datasets are no longer willing to keep their findings confidential. Likewise, more individuals are calling out breaches when they discover their own data is exposed.”

Aetna breach

A prime example of this is the August breach impacting 11,887 Aetna members. An unnamed mail processing vendor working for Aetna sent letters to HIV patients, informing them of changes to the prescription fulfillment process. Unfortunately the letter shop used envelopes with an especially large glassine window, exposing highly sensitive HIV status information.

The breach was brought to light by a letter recipient – triggering both civil lawsuits and an investigation by the New York Attorney General and ending with Aetna agreeing to pay $18.3 million in order to settle the various proceedings. While this is an extreme example, 2017 saw many other situations where customers, clients and unrelated third parties discovered the problem and chose to take action.

Types of breaches

Comparing the number of breaches discovered internally to the number of breaches found by outsiders highlights one dynamic behind the trend. Of the 3,904 breaches with a confirmed discovery method, only 728 or 18.6%, were discovered by the organization responsible for protecting the data.

The remaining 3,176 were found by law enforcement, external fraud detection or monitoring, customers, or unrelated parties including disclosure by the malicious actors themselves. While there is not a direct correlation between discovery method and interest in publicizing breach activity, this data does show that the majority of breaches still go undetected by the compromised organization.

https://www.helpnetsecurity.com/2018...activity-2017/

One of the world’s most popular free VPN services is leaking sensitive data on its users, a security researcher has claimed.

A flaw in Hotspot Shield, which boasts more than 500 million users, leaks information such as what country a user is located in and the name of their Wi-Fi network.

https://tech.thaivisa.com/worlds-lea..._campaign=news

If you find yourself hit with something like this, just open Task Manager and kill Chrome. And then stay away from the offending site.

:)

Quote:

---

A New Trick discovered to block Visitors and Scare Non-Technical Users into Paying for Unneeded Software and Servicing Fees
5 E Hacking News - Latest Hacker News and IT Security News by Medha


The administrators of some technical support scam websites have discovered a new trick to block visitors on their shady sites and scare non-technical users into paying for unneeded programming or overhauling charges.


The trick depends on utilizing JavaScript code stacked on these vindictive pages to start thousands of file download tasks that rapidly take up the client/user's memory assets, solidifying or (freezing more likely) Chrome on the con scammer's webpage.


The trap is intended to drive the already panicked clients into calling one of the technical support telephone numbers that appear on the screen. A GIF of one of these noxious locales freezing a Chrome program running the most recent rendition (64.0.3282.140) is implanted underneath.


https://teakdoor.com/attachment.php?a...tid=8126&stc=1

A New Trick discovered to block Visitors and Scare Non-Technical Users into Paying for Unneeded Software and Servicing Fees - E Hacking News

---

Quote:

---

Originally Posted by Latindancer

One of the world’s most popular free VPN services is leaking sensitive data on its users, a security researcher has claimed.

A flaw in Hotspot Shield, which boasts more than 500 million users, leaks information such as what country a user is located in and the name of their Wi-Fi network.

https://tech.thaivisa.com/worlds-lea..._campaign=news

---

It's worse than that describes, but I'd expect that from those Thaivisa mongs.

Quote:

---

According to the entry for the vulnerability (CVE-2018-6460) in the National Vulnerability Database, Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895, and the web server uses JSONP and hosts sensitive information including configuration.
But user-controlled input is not sufficiently filtered: “An unauthenticated attacker can send a POST request to /status.js with the parameter func=$_APPLOG.Rfunc and extract sensitive information about the machine, including whether the user is connected to a VPN, to which VPN he/she is connected, and what is their real IP address.”
According to researcher Paulos Yibelo, who discovered the flaw, the attacker can also extract information such as the users’ country code and Wi-Fi network name, if the user is connected to one.

---

Meanwhile, on with the show....

Quote:

---

Swiss telecoms giant Swisscom has admitted suffering a data breach late last year which exposed the personal details of around 800,000 customers to unauthorized parties.
The company, which is majority-owned by the government, claimed that the intruders accessed the data via a sales partner last Autumn.
Most of those affected were mobile customers, although a “few” fixed network subscribers were also hit. The number of breached customers represents around 10% of the entire population of Switzerland.
Customers’ names, addresses, telephone numbers and dates of birth were compromised. Although Swisscom maintained this data is “non-sensitive” it would be enough to give fraudsters a useful start to help craft convincing follow-on phishing attacks.
That said, the firm has claimed no such activity has affected customers as yet.
“Swisscom discovered the incident during a routine check of operational activities and made it the subject of an in-depth internal investigation,” the company continued.
“Swisscom stresses that the system was not hacked and no sensitive data, such as passwords, conversation or payment data, was affected by the incident. Rigorous long-established security mechanisms are already in place in this case.”
After discovering the incident, Swisscom said it blocked the offending partner’s access rights immediately. It promised to introduce two-factor authentication for all sales partners this year, put in place systems to raise the alarm in the case of any unusual activity and make it impossible to run high-volume queries for all customer info.
Ilia Kolochenko, CEO of High-Tech Bridge, argued that security exposure via partners is still a widely unacknowledged problem.
“Many large financial institutions and e-commerce businesses have lost millions of records because of hacked third-parties. Cyber-criminals won't assault the castle, but will instead find a weak supplier with legitimate access to the crown jewels,” he explained.
“However, the good news is that we see more and more companies who rigorously implement, for example, vendor risk assessment policies now, to prevent such risks. Swisscom's efforts to mitigate and investigate the breach are laudable, but they won't really help the victims.”

---

Inside North Korea’s Hacker Army

The regime in Pyongyang has sent hundreds of programmers to other countries. Their mission: Make money by any means necessary. Here's what their lives are like.

In most respects, Jong Hyok looks like any other middle-aged male tech worker you might see on the skyscraper-shadowed streets of Seoul’s Gangnam district: smartphone in hand, dark-blue winter coat over a casual, open-collared work shirt. Sit him down at a sushi restaurant and start asking him questions, though, and you soon sense that Jong is harboring an extraordinary tale. He slouches, staring intently at the table before him and speaking haltingly, his sentences often trailing away unfinished.


Jong tells you he’s in his late 30s, but his tired eyes and wizened skin make him look a decade older. He says he’s concerned that you’ll be indiscreet with details that could expose him or his family. You wonder momentarily if he suspects you’re a North Korean spy. But no, you’re here to relate the remarkable story of his years spent cracking computer networks and programs to raise money for the regime in Pyongyang.


North Korea’s hacking prowess is almost as feared globally as its nuclear arsenal. Last May the country was responsible for an internet scourge called WannaCry, which for a few days infected and encrypted computers around the world, demanding that organizations pay ransom in Bitcoin to unlock their data. A few years before that, North Korea stole and published the private correspondence of executives at Sony Pictures Entertainment, which had produced a Seth Rogen satire of the country called The Interview.


Jong wasn’t involved in those attacks, but for half a decade before defecting, he was a foot soldier in North Korea’s hacker army. Unlike their counterparts elsewhere, who might seek to expose security vulnerabilities, steal corporate and state secrets, or simply sow chaos, North Korean hackers have a singular purpose: to earn money for the country, currently squeezed by harsh international sanctions for its rogue nuclear program. For most of the time Jong spent as part of this brigade he lived and worked in a crowded three-story home in a northeastern Chinese city. The hackers he shared it with were required to earn up to $100,000 a year, through whatever means they could, and were allowed to keep less than 10 percent of that. If they stepped out of line, the consequences could be severe.


Experts in the South Korean government say that over the years, North Korea has sent hundreds of hackers into neighboring countries such as China, India, and Cambodia, where they’ve raised hundreds of millions of dollars. But actually finding one of these cyberwarriors is, for obvious reasons, difficult. Sources in South Korea’s government and the North Korean defector community provided Bloomberg Businessweek with the name of someone who has deep knowledge of the latter group—a fixer of sorts. This contact, a middle-aged man who chose his words with painstaking deliberation, asked that his name not be used. After several meetings, he offered the phone numbers of three contacts, requesting that Businessweek shield their identities. Jong—which is not his real name—was one of them.


For decades, North Korea’s government has sought to use modern technology to transform one of the most isolated, impoverished parts of the world. During the 1990s, Kim Jong Il, the father of current leader Kim Jong Un, touted programming as a way for the country to rebuild its economy after years of catastrophic famine. He established technology degrees at Pyongyang’s universities and attended annual software-writing contests to put gold watches on the wrists of winners.


Reports from Korea watchers suggest that, sometime in the back half of the decade, Kim Jong Il formed a cyber army designed to expand North Korea’s hacking activities. Initially the unit managed only random incursions, on targets like government websites and banking networks, but when Kim died in 2011, his son expanded the program. Soon it was launching attacks more consistently and on more important targets, such as nuclear plants, defense networks, and financial institutions.


Formally, North Korea denies engaging in hacking and describes accusations to that effect as enemy propaganda. It says its overseas computer efforts are directed at promoting its antivirus software in the global market. The country has for more than a decade been working on such programs, including one called SiliVaccine. It also has a homegrown operating system, Red Star, that software developers have pointed out looks suspiciously like macOS. Kim Jong Un’s affinity for Apple products is well-known. In 2013, he was photographed sitting in front of an iMac during a meeting with military officials to discuss missile attacks on the U.S.; a picture released a few years later showed him with an Apple laptop on his private jet.


Kim has also moved to make more smartphones available to North Korea’s 25 million citizens and begun rewarding computer scientists with nicer homes and higher salaries. And he’s sent increasing numbers of them into neighboring countries, where internet access is better and they can more easily hide their tracks. Defectors say programmers cross the border clutching bean paste, hot pepper paste, dried anchovy, and other comforts of home.


“Elite programmers? No way. We were just a bunch of poor, low-paid laborers”


Jong was part of an earlier wave sent by Kim Jong Il. Born in Pyongyang during the early 1980s, he was raised by parents who were faithful to the Workers’ Party of Korea and Kim Il Sung, North Korea’s founder, who led the party and is Kim Jong Un’s grandfather. Growing up, Jong heard tales of his own grandfather’s brave fight against Japan’s imperial army in Manchuria alongside Kim Il Sung during World War II.


As a child, Jong’s favorite subject was biology, and he aspired to become a doctor. His parents were supportive, but the state determined from his test scores that he should study computer science. There was no questioning the decision. Heartbroken at first, he eventually became fascinated by the inner workings of computers, and in his junior year of university, in the late 1990s, he was selected by the government to study in China.


The years he spent there were a revelation. A government minder accompanied each delegation, but Jong’s was lax, and he managed to go drinking, dancing, and camping with Chinese students. The biggest shock was having almost unlimited access to the internet. The computers back home were so strictly controlled that they were useful mostly for calculating figures or displaying diagrams. The ones in China showed Jong much more of the world. “I felt like a colt cut loose on the field,” he says.


For a brief moment, North Korea seemed to be moving in a more open direction. During school breaks, Jong would return home to find that some of his wealthier friends owned personal computers. They played video games like Counter-Strike and watched DVDs of South Korean soap operas, which were becoming so easy to obtain that Jong almost believed unification was at hand. Soon, though, government authorities were storming homes to confiscate such material in a crackdown on the so-called yellow wind of capitalism.


Jong graduated and returned home to get his master’s degree, for which he worked at a state agency, creating office software. The government was at the time investing in a variety of tech projects, including one that used power lines to transmit data. Once again, Jong glimpsed hope that the regime might see technology as a means for advancement, not just a threat.


After graduation, he went to work for a state-affiliated software development agency. Before he could settle in, the government informed him that it had other plans. He was being moved to China, to conduct software research that would “brighten the future” of North Korea’s information technology sector.


Jong knew exactly what that meant: Go make money for your country.


Not long after, Jong crossed the border on foot and caught a bus to his assigned city. There, he made his way to a relatively large house set on a busy street amid a forest of high-rises. The place was owned by a Chinese tycoon with business ties to Pyongyang. Dozens of graduates from North Korea’s elite universities—all men—slept in cots and bunks on the top floor. A warren of cubicles and computers occupied the lower floors, and portraits of Kim Jong Il and Kim Il Sung hung on the walls.


At first Jong didn’t have a computer, so he borrowed one from his roommates, promising to pay a rental fee once he’d made enough money to buy his own machine. He began his new career by obtaining beta versions of commercial software such as video games and security programs, then making pirate replicas his clients could sell online. Orders came in via word of mouth and broker websites from around the world; many were from China or South Korea, allowing for easier communication.


Each unit was overseen by a “chief delegate,” a non-coder who arranged transactions and collected payments. A separate minder from North Korea’s state police was there to handle security issues. The work was arduous, involving reverse-engineering code and intercepting communications between the source program and the servers of the company that made it. Jong recalls that it took 20 programmers to build a functioning replica of one program. The hackers often found themselves racing to decipher vulnerabilities in a piece of software before its creators could patch the security holes.


Jong got up to speed quickly and was soon considered a senior member of the house. When orders were slow, he and his colleagues hacked gambling sites, peeking at the cards of one player and selling the information to another. They created bots that could roam around in online games such as Lineage and Diablo, collecting digital items like weapons and clothes and scoring points to build up their characters. Then they’d sell the characters for nearly $100 a pop. Every so often, to maintain the facade that he was pursuing research to benefit North Korea, Jong would create scholarly software, for example a data-graphing program, and send it across the border.


All in all, the work was unglamorous. “Elite programmers? No way. We were just a bunch of poor, low-paid laborers,” Jong recalls. He denies any complicity in the kinds of crimes that security experts have attributed in recent years to North Korea, such as snatching credit card numbers, installing ransomware on corporate servers, and swiping South Korean defense secrets. But he doesn’t doubt that such things were going on. “North Korea will do anything for money, even if that means asking you to steal,” he says.


Any moral qualms that he or other programmers might have felt were subordinated by their mission. They had targets to meet—or else. Failing to clear a benchmark known as juk-bol-e (“enough to buy a bowl of soup”) could mean being sent home. More serious offenses, such as skimming profits or not showing sufficient fealty to the regime, could result not only in repatriation but “revolutionization,” hard labor at a factory or farm.


On Saturdays the handlers, sometimes alongside visiting officials, would hold two-hour meetings with the units to discuss the philosophies of Kim Il Sung and Kim Jong Il, as well as any new ideological tenets dispensed by Kim Jong Un. Key statements would be memorized and recited in a loyalty pledge of sorts. A few times, Jong says, he dealt with two especially talented hackers who handled military espionage assignments, infiltrating the websites and servers of foreign countries. They were staunchly loyal to the regime, and he was particularly careful not to make any comments they might see as critical.


Jong estimates that he was eventually bringing in around $100,000 a year. Because he and his cohorts were regarded as productive, they were allowed to live relatively well. They enjoyed air conditioning during the summer and ventured into the neighborhood in chaperoned groups. In their spare time they played Counter-Strike, sometimes sneaking down at night to their cubicles to catch up on South Korean soap operas. On Saturdays, after their indoctrination session, they might go outside to the sizable backyard to play soccer, badminton, or volleyball. Twice a year, they would meet with hacking units from across China to celebrate propaganda events such as the blossoming of Kimilsungia and Kimjongilia, orchids named for Kim Jong Un’s father and grandfather.


Jong’s abilities also led him to be sent on trips elsewhere in China with North Korean officials. As he traveled, he got a view of how the hacker corps were organized and learned that not every unit was as lucky as his. Government agencies and state-affiliated corporations would each send their own units abroad to generate cash. All of their activities were planned and directed by a shadowy branch of the Workers’ Party called Office 91. The hacking units tended to keep in close touch with North Korea’s consulates, gathering there to drink, talk shop, and trade computer gear.


“Some hackers barely fed themselves and were just fortunate to have orders to work on”


One summer, Jong and some colleagues visited a cramped, run-down building in the northeastern city of Yanji. Living there were a dozen coders who’d been sent by North Korea’s railways ministry. They were trying to crack high-end software that analyzed live orchestral performances and wrote musical scores. It was the rainy season, and the men worked in shorts and relied on fans to combat the heat and humidity; water dripped from the ceiling.


Stacked against one wall were packages of ramen. “Some hackers barely fed themselves and were just fortunate to have orders to work on,” Jong says. One of them was being treated for tuberculosis; another had required medical treatment after waking up with a cockroach lodged in his ear. But they weren’t getting the kind of care his crew would have received.


Other programmers told Jong similarly gruesome stories. He heard about a young coder in Beijing, known for boasting of his elite education, whose colleagues had severely beaten him, shattering his ribs, after finding out he’d been receiving kimchi from a South Korean businessman. A hacker in Guangzhou was said to have died of dengue fever a year after leaving his home and children behind. The man’s boss apparently decided it would be too expensive to repatriate the body, so it was cremated and six months later another programmer took the ashes home. Hackers joked darkly that while they’d arrived as protein, they might return as powder.


Finally, after he’d been working in China for a few years, Jong himself landed in trouble. He’s spare with the details, describing only an “unsavory incident” involving a government official. He fled before the regime could mete out the inevitable beating or trip home for revolutionization. For two years he roamed southern China, earning money by hacking, sleeping in hotels, and tasting the sort of freedom he’d previously only imagined. His last stop in the region was Shenzhen, near Hong Kong, where, after making $3,000 and quickly spending it in ways he vaguely describes as “enjoying life,” he realized he was tired.


Returning home wasn’t an option—desertion could be punishable by death. Instead, Jong bought a fake Chinese passport for 10,000 yuan (about $1,600), traveled to Bangkok by train and bus, and knocked on the door of the South Korean embassy. He lived inside the compound for a month, undergoing a security check, before being flown to Seoul.


The two other defectors I spoke with confirmed the broad contours of Jong’s story, though their own work was somewhat different from his. They were among a group of programmers that North Korea had deployed to China to develop and sell iPhone and Android applications. Using fake identities, they posted on freelancing websites such as Upwork.com and took jobs developing apps for taxi-hailing, online shopping, facial recognition—anything that generated money. They say they were required to make around $5,000 a month for the government, working up to 15 hours a day and operating under the same pressures and threats as Jong and his peers.


One of the defectors, who worked under the auspices of a state agency called the Korea Computer Center, had long been cynical about his country; he’d come to hate bellowing out the loyalty oath to Kim Jong Un every Saturday and finally concluded that everything about the regime was a lie. He managed to escape when a Chinese client who liked his work asked to meet in person. He declined at first but changed his mind and wound up confessing that he was from North Korea. When he said he wanted out, the client offered to help.


The other defector says that one day he simply snapped from overwork and left, roaming around China on foot in hopes of encountering one of the South Korean spies he’d been warned about before leaving home. For six days he slept inside greenhouses, gyms, any place with a roof, worrying the whole time that he’d made a huge mistake. It was already too late, though—if he went back he’d be punished. Finally, he found a shop whose sign indicated it was run by someone from South Korea. The shopkeeper was willing to help.


Lim Jong In, head of the department of cyberdefense at Korea University in Seoul and a former special adviser to South Korea’s president, says that North Korea’s hacking strategy has evolved since Jong defected. At the program’s height, he says, well over a hundred businesses believed to be fronts for North Korean hacking were working in the Chinese border cities of Shenyang and Dandong alone. China has since cracked down on these operations in an effort to comply with United Nations sanctions, but they’ve simply been moved elsewhere, to countries such as Russia and Malaysia. Their value to the regime—and to the hackers themselves—is simply too high to forgo. “North Korea kills two birds with one stone by hacking: It shores up its security posture and generates hard currency,” Lim says. “For hackers it offers a fast track to a better life at home.”


Jong is doing well for himself in Seoul. He blushes when congratulated for a promotion he recently received at a local software security company, saying he had to work especially hard for it. “I feel like my value as a programmer is discounted by half when I tell people I’m from North Korea,” he says. Others in the 30,000-odd defector community express similar frustrations about their outsider status; some display contempt for their adopted country’s concerns about appearances and money, and recall with pride their homeland’s penchant for bluntness.


Still, there’s no going back. Jong is sometimes visited by South Korean and U.S. agents who ask him for details that might fill holes in ongoing investigations. The South Koreans ask about Office 91—what its hackers are like and what they’ve worked on in the past. The Americans recently inquired whether he knew anything about a four-story building in Pyongyang where Western-designed semiconductors are photographed and X-rayed for replication.


At night, Jong returns home to a quiet life with his South Korean wife. Their baby son, he says, babbles happily and has just started to walk.


https://www.bloomberg.com/news/features/2018-02-07/inside-kim-jong-un-s-hacker-army

If you have a Netgear, go into Admin and check for a firmware update.

Quote:

---

Wish you could log into someone's Netgear box without a password? Summon a &genie=1

Get patching – there's this auth bypass and loads of other bugs

By Iain Thomson in San Francisco 9 Feb 2018 at 00:34


If you're using a Netgear router at home, it's time to get patching. The networking hardware maker has just released a tsunami of patches for a couple of dozen models of its kit.

The flaws were found by Martin Rakhmanov at infosec shop Trustwave, which has spent over a year hunting down programming gremlins in Netgear's firmware.

Software updates to address these uncovered vulnerabilities have now been released – you should ensure they are installed as soon as you can before scumbags and botnets start exploiting them to hijack broadband gateways and wireless points. Instructions on how to apply the fixes are included in the linked-to advisories.

Some 17 Netgear routers have a remote authentication bypass, meaning malware or miscreants that are on your network, or that are able to reach the device's web-based configuration interface from the internet, can gain control without having to provide a password. Just stick &genie=1 in the URL, and bingo.

That's pretty bad news for any vulnerable gateways with remote configuration access enabled, as anyone on the internet can exploit the cockup to take over the router, change its DNS settings, redirect browsers to malicious sites, and so on.
Another 17 Netgear routers – with some crossover with the above issue – have a similar bug, in that the genie_restoring.cgi script, provided by the box's built-in web server, can be abused to extract files and passwords from its filesystem in flash storage – it can even be used to pull files from USB sticks plugged into the router.

Other models have less severe problems that still need patching just in case. For example, after pressing the Wi-Fi Protected Setup button, six of Netgear's routers open up a two-minute window during which an attacker can potentially execute arbitrary code on the router as root over the air.

"Trustwave SpiderLabs has worked with Netgear through our responsible disclosure process to make sure that these vulnerabilities are addressed," Trustwave's Rakhmanov said.

"We'd also like to thank Netgear for their responsive and communicative product security incident response team. It's obvious that their participation in bug bounties has helped them improve their internal process for addressing issues like these." ®

https://www.theregister.co.uk/2018/0...urity_patches/

---

Probably good practice, but will probably cause a few people to panic.

But of course if you read this thread you won't bat an eyelid, because you'll know all about it.

:)

Quote:

---

Google announced earlier today plans to mark all HTTP sites as "Not Secure" in Chrome, starting with July 2018, when the company plans to release Google Chrome 68.
The company's decision comes after HTTPS adoption increased among website owners and a large chunk of today's traffic is now encrypted.
Google said that more than 68% of Chrome traffic on both Android and Windows and over 78% of Chrome traffic on both Chrome OS and Mac, is now being sent via HTTPS.

---

https://www.bleepingcomputer.com/new...ing-july-2018/

Handy if you want to stop your curiosity getting the better of you:

Quote:

---

If you ever come across a link in email or on a website, always hover your mouse cursor over it to see the destination URL at the bottom of the browser to ensure it’s safe. But, this trick doesn’t work with shortened URLs that are quite common these days on social media websites.

However, this also doesn’t mean you have to facecheck every short URL and risk your security. There are multiple ways to check what’s behind a shortened URL without opening it. And in this post, I’ll show you how to do it on your PC and your smartphone.


Use the built-in preview

Most of the popular link shortening services let you preview the link by tweaking the shortened URL. Just memorize these simple tweaks, and for most short URLs you won’t have to depend on a third-party service. Below is the list of preview tweaks:

TinyURL

Add preview before the tinyurl.com part of the link. For example:
convert https://tinyurl.com/2loblt to https://preview.tinyurl.com/2loblt


Goo.gl

Add + (plus sign) at the end of the original URL. For example, convert goo.gl/0WhZa7 into goo.gl/0WhZa7+.

Bitly.com

Similar to Goo.gl, add a + at the end of the URL.

is.gd

Add - (hyphen) at the end of the URL. For example, convert https://is.gd/1j6nkFinto https://is.gd/1j6nkF-.

Tiny.cc

Add ~ (tilde) at the end of the URL.

BudURL

Add ? (question mark) at the end of the URL.

Use an online service


If you don’t deal with short URLs often, then an online expander may workbetter for you. For this purpose, I like GetLinkInfo for its extensive support of URL shortening websites and detailed information about the link. Just paste the link on the website and press enter.

https://teakdoor.com/attachment.php?a...tid=8327&stc=1


GetLinkInfo will tell you the main title of the page, starting description, exact long URL, and any external links on the page. It also uses Google to check the safety of the website content.
Use a browser extension

In case you deal with short URLs frequently, then a dedicated browser extension is a better choice. Unshorten.It! is a good extension for this purpose that is available for both Chrome and Firefox.
The cool thing about Unshorten.It! is that it doesn’t depend on the URL shortening service’s API, therefore, it can expand almost all types of short links. Once the extension is installed, right-click on any short link and select Unshorten it from the menu. The extension will expand the link in a new tab and also show safety information based on the Web Of Trust score.

https://teakdoor.com/attachment.php?a...tid=8328&stc=1



I also really liked the non-intrusive nature of the extension as it allows you to choose which links to expand and which to leave.
Expand short URLs on Android

On Android, you can use the free URL Manager app. This is actually an all-in-one link manager, but we will only be Looking at the expanding feature of the app. Here’s how to expand a link:

1. Copy the short URL that you want to expand.
2. Tap on the + icon in its main interface and select Expand.
3. Now paste the URL into the text field and tap on Expand. The original link will be shown below.

https://teakdoor.com/attachment.php?a...tid=8329&stc=1

Expand short URLs on iOS

On iOS, you can use the free URL X-ray app. Although URL X-ray is popular for its web service, its iOS app does a fine job of expanding URLs. Once installed, you can copy/paste the short URL in the URL X-ray interface to expand it. It also adds a button in the share menu to let you directly share URLs from other apps.

https://teakdoor.com/attachment.php?a...tid=8330&stc=1


Summing up

You should be very careful while opening short links and always check what’s on the other side before opening, especially if you received them via email or a direct message. Memorizing short URL preview tweaks might involve some work, but it will make the process very easy if you deal with short URLs often. But of course, you can always get help from a third-party app when you are in doubt.

https://www.hongkiat.com/blog/see-sh...-opening-them/

---

Over 4000 websites including several belonging to UK and US government agencies were found over the weekend to be running hidden crypto-mining malware.

Security researcher Scott Helme first investigated the website of the Information Commissioner’s Office (ICO) after a tip-off that AV filters were raising red flags.

“At first the obvious thought is that the ICO were compromised so I immediately started digging into this after firing off a few emails to contact people who may be able to help me with disclosure. I quickly realised though that this script, whilst present on the ICO website, was not being hosted by the ICO, it was included by a third-party library they loaded” he explained.

“If you want to load a crypto miner on 1,000 websites you don't attack 1,000 websites, you attack the one website that they all load content from. In this case it turned out that Texthelp, an assistive technology provider, had been compromised and one of their hosted script files changed.”

It turned out that attackers had compromised a JavaScript file which was part of the Texthelp Browsealout product, adding malicious code which effectively installed the CoinHive miner.

Some of the sites affected by CoinHive included United States Courts, the General Medical Council, the UK’s Student Loans Company, NHS Inform and many others.
Helme argued that mitigating the attack only requires a small code change to how the Browsealoud script is loaded.

“What I've done here is add the SRI Integrity Attribute and that allows the browser to determine if the file has been modified, which allows it to reject the file. You can easily generate the appropriate script tags using the SRI Hash Generator and rest assured the crypto miner could not have found its way into the page,” he explained.

“To take this one step further and ensure absolute protection, you can use Content Security Policy and the require-sri-for directive to make sure that no script is allowed to load on the page without an SRI integrity attribute.”

The good news is the attack took place on Sunday morning and Texthelp has been quick to recognise the issue and take its service temporarily offline to fix it.

Crypto-mining is an increasingly popular way for cyber-criminals to make money; in fact, many are turning away from ransomware to focus on the new tactic, according to Cisco Talos.

IBM claimed to have seen a six-fold increase crypto-mining malware attacks between January and August 2017.

https://www.infosecurity-magazine.co...found-on-4000/

In case you're interested in what security features Microsoft are adding to Windows 10 with each new update...

Quote:

---

What’s new in Windows 10 security features: The anti-ransomware edition

Here's what you need to know about each security update to Windows 10 as they roll out from Microsoft. Now updated for 1709, Fall Creators Edition.


With the new era of Windows as a service, Microsoft is rolling out changes to the operating system twice a year. Many of those changes will allow you to improve your security posture and offer more security choices. You no longer have to wait for a new operating system to deploy new security features.

Below is a summary of all the new security features and options in Windows 10 version 1709, also known as the Fall Creators Edition. Bookmark this article, because we will be adding new security features as Microsoft releases future Windows updates.

Windows 10 1709: The anti-ransomware edition

The Windows 10 Fall Creators Edition release is, in my opinion, is the first release where Microsoft is vastly increasing and acknowledging the impact of ransomware. Key security features included in the 1709 release give IT professionals the ability to provide additional means to prevent and defend against ransomware. Here are the edition’s key features:

Window Defender Exploit Guard

Window Defender Exploit Guard is the name of four different feature sets that help to block and defend from attacks. The four features of Exploit Guard include Exploit Protection, Attack Surface Reduction tools, Network Protection, and Controlled Folder Access. Exploit Protection is the only feature that works if you use a third-party antivirus tool. The other three features require Windows Defender and will not work if you use third-party antivirus software. This prerequisite is unlikely to change due to the reliance on Windows Defender to provide the needed API and infrastructure to support the features.

Exploit Protection

This is the only one of the four Exploit Guard technologies that does not require Windows Defender to be your primary antivirus. Exploit Protection can be controlled via group policy or PowerShell. An additional cloud-based logging service called Windows Defender Advanced Threat Protection provides forensic tracking evidence of threats and attacks can be used to better track and investigate Exploit Guard events. It is not mandatory to enable this technology.
To enable Exploit Protection, begin by deploying the technology on test machines before deploying widely. Open Settings, go to Update and Security, open the Windows Defender app, and then open the Windows Defender Security Center. Then go into App and Browser Control and scroll down to Exploit Protection. Open Exploit Protection Settings.
By default, Windows 10 has the following settings:

• Control Flow Guard (CFG) (on by default) is a mitigation that prevents redirecting control flow to an unexpected
• Data Execution Prevention (DEP) (on by default) is a security feature that was introduced in Vista and later platforms. The feature helps to prevent damage to your computer from viruses and other security threats. DEP protects your computer by monitoring programs to make sure they use system memory safely. When DEP senses malware, it might trigger a blue screen of death to protect the operating system.
• Force Randomization for Images (Mandatory ASLR) (off by default) is a technique to evade attackers by randomizing where the position of processes will be in memory. Address space layout randomization (ASLR) places address space targets in unpredictable locations. If an attacker attempts to launch an exploit, the target application will crash (blue screen), therefore stopping the attack.
• Randomize Memory Allocations (Bottom-up ASLR) (on by default) enables bottom-up allocations (VirtualAlloc() VirtualAllocEx()) to be randomized. Attacks that use bypassed ASLR and DEP on Adobe Reader are prevented with this setting.
• Validate Exception Chains (SEHOP) (on by default) prevents an attacker from using the Structured Exception Handler (SEH) overwrite exploitation technique. Since first being published in September 2003, this attack has often been in many hackers’ arsenal.
• Validate Heap Integrity (on by default) protects against memory corruption attacks.

You can set both system settings and program settings and then export them in an XML file to then deploy them to other computers via PowerShell.

Attack Surface Reduction

Attack Surface Reduction is a new set of tools that block primarily Office, Java, and other zero-day-type attacks. With the addition of a Windows E5 license and Windows Advanced Threat Protection, you will receive a cloud-based alerting system when these rules are triggered. However, it’s not mandatory to have the E5 license to manage and defend systems. This is one of the three Windows Defender Exploit Guard features that will not work with third-party antivirus deployed. You must use Windows Defender to enable this protection.
To enable these protections, you can use group policy, registry keys, or mobile device management. To enable via group policy, go to Computer Configuration in the Group Policy Management Editor, then Policies, then Administrative Templates. Expand the tree to Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack surface reduction. Double-click the Configure Attack surface reduction rules setting and set the option to Enabled. To enable Attack Surface Reduction using PowerShell, enter Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions Enabled.
Now you need to determine what you plan on blocking. It is recommended to begin in audit mode to evaluate the impact on your network and devices. The values you can set to enable Attack Surface Reduction are:

• Block mode = 1
• Disabled = 0
• Audit mode = 2

Once you have determined that the protection will not impact productivity, you can set the value to Block Mode to fully enable the protections. Enter each rule on a new line as a name-value pair with a GUID code and then the value of 1 to enforce blocking, 0 to disable the rule, or 2 to set the rule to audit. When beginning to evaluate rules, set the value to 2 and monitor the results in the event log.

• Name column: Enter a valid ASR rule ID or GUID
• Value column: Enter the status ID that relates to state you want to specify for the associated rule

The following rules can be enabled to better protect your computer and your network.
Rule: Block executable content from email client and webmail. ASR Rule ID or GUID: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550

• Blocks executable files (such as .exe, .dll, or .scr)
• Blocks script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file)
• Block script archive files

Rule: Block Office applications from creating child processes. ASR Rule ID or GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A

This rule blocks Microsoft Office applications from creating child content. This is typical malware behavior, especially with macro-based attacks.
Rule: Block Office applications from creating executable content. ASR Rule ID or GUID: 3B576869-A4EC-4529-8536-B80A7769E899.

This rule blocks Office applications from creating executable content. This is typical malware behavior. Attacks often use Windows Scripting Host (.wsh files) to run scripts.
Rule: Block Office applications from injecting code into other processes. ASR Rule ID or GUID: 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84.

Office applications such as Word, Excel, and PowerPoint will not be able to inject code into other processes. Malware typically uses this to avoid antivirus detection.
Rule: Block JavaScript or VBScript from launching downloaded executable content. ASR Rule ID or GUID: D3E037E1-3EB8-44C8-A917-57927947596D

This rule blocks the use of JavaScript and VBScript to launch applications, thus preventing malicious use of scripts to launch malware.
Rule: Block execution of potentially obfuscated scripts. ASR Rule ID or GUID: 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC

This rule prevents scripts that appear to be obfuscated from running. It uses the AntiMalware Scan Interface (AMSI) to determine if a script is malicious.
Rule: Block Win32 API calls from Office macro. ASR Rule ID or GUID: 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B

Malware often uses macro code Office files to import and load Win32 DLLs, which then use API calls to further infect the system.

Network Protection

Network Protection is designed to protect your computer and your network from domains that may host phishing scams, exploits, and other malicious content on the internet. It can be enabled either via PowerShell or Group Policy. In the Group Policy Management Editor go to Computer Configuration, then Policies, then Administrative Templates. Expand the tree to Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Network Protection. Double-click the Prevent Users and Apps from Accessing Dangerous Websites setting and set the option to Enabled.
To enable using PowerShell, enter Set-MpPreference -EnableNetworkProtection Enabled. To enable audit mode type in Set-MpPreference -EnableNetworkProtection AuditMode. To fully enable protection, you need to reboot the computer.
Once enabled you can test the feature by going to this website. The site should be blocked and you should see a notification indicating the site’s threat status in the system tray. The system now relies on Microsoft SmartScreen technology to block web sites. If a false positive is found, you must submit a request to whitelist a website using Microsoft’s submission page.
This is one of the three Windows Defender Exploit Guard features that will not work with third-party antivirus deployed. You must use Windows Defender to enable this protection.

Controlled Folder Access

Controlled Folder Access protection is designed to prevent and defend from typical ransomware attacks. It can be enabled using Windows Defender Security Center app via Group Policy, PowerShell or configuration service providers for mobile device management. All applications that access any executable file (including .exe, .scr, and .dll files) use the Windows Defender Antivirus interface to determine if the application is safe. If the application is malicious, it is blocked from making changes to files in protected folders.
Certain folders are protected by default and then the administrator can add folders they deem need additional protection. To enable controlled folder access via PowerShell type in the following command: Set-MpPreference -EnableControlledFolderAccess Enabled. To enable controlled folder access via group policy, Group Policy Management Editor, go to Computer Configuration, click Policies, then Administrative Templates, and then expand the tree to Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled folder access. Double-click the Configure Controlled Folder Access setting and set the option to Enabled.
By default, the following folders are enabled for protection:

• C:\Users\<user>\Documents
• C:\Users\Public\Documents
• C:\Users\<user>\Pictures
• C:\Users\Public\Pictures
• C:\Users\<user>Videos
• C:\Users\Public\Videos
• C:\Users\<user>\Music
• C:\Users\Public\Music
• C:\Users\<user>\Desktop
• C:\Users\Public\Desktop
• C:\Users\<user>\Favorites

You can then manually add folders as you see fit. If you have an application that is blocked by Controlled Folder Access, you can allow an application. To allow an override, go into Group Policy Management Editor and then go to Computer Configuration. Click on Policies and then Administrative Templates. Expand the tree to Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled Folder Access. Double-click the Configure Allowed Applications setting and set the option to Enabled. Click Show and enter each app. To allow an application via PowerShell, enter Add-MpPreference -ControlledFolderAccessAllowedApplications "<the app that should be allowed, including the path>". You will want to test the settings before widespread deployment to note what adjustments you need to make for full application compatibility.
This is the final one of the three Windows Defender Exploit Guard features that will not work with third-party antivirus deployed. You must use Windows Defender to enable this protection.

Windows Security Baselines

Windows Security Baseline configurations have been updated to support Windows 10 1709. Security baselines are a set of recommended configurations to best secure systems in enterprises. Organizations can use the Security Compliance Toolkit to review recommended group policy settings. Microsoft certifies that they test updates against these configurations.

Windows Defender Advanced Threat Protection (ATP)

Windows Defender ATP is a cloud-based console that allows for forensic tracking of threats and attacks. It is enabled once you purchase a Windows E5 or Microsoft Office 365 E5 subscription. Once you purchase the subscription, you can enroll workstations via group policy or registry keys, which then upload telemetry to a cloud service. The service monitors for lateral attacks, ransomware, and other typical attacks. Release 1709 increases the analytics and security stack integration for better reports and integration.

Windows Defender Application Guard


Application Guard ensures that enterprises can control Microsoft’s new Edge browser to best block and defend workstations from attacks. Application Guard must be deployed on 64-bit machines, and the machines must have Extended Page Tables, also called Second Level Address Translation (SLAT), as well as either Intel VT-x extensions or AMD-V. Windows 10 Enterprise version is also mandated.
Application guard can be controlled via group policy, Intune, or System Center. Application Guard can be deployed via features or PowerShell using Enable-WindowsOptionalFeature -online -FeatureName Windows-Defender-ApplicationGuard. Once enabled, you can limit websites to block outside content in Internet Explorer and Edge, limit printing, the use of clipboard, and isolate the browser to only use local network resources.

Windows Defender Device Guard

Device Guard is a new name for software restriction policies. Unless an application is trusted, it cannot be run on the system. Rather than the current model of software that we use now, where we trust software by default, Device Guard assumes all software is suspect and only allows software you trust to run on your system. Like Application guard, the requirements include virtualization technology.

Windows Information Protection (WIP)

WIP now works with Office and Azure Information Protection. WIP used to be called Enterprise Data Protection. Setting a WIP policy ensures that files downloaded from an Azure location will be encrypted. You can set a listing of apps that are allowed to access this protected data.
BitLocker

The minimum PIN length for BitLocker was changed in version 1709 from six to four, with six as the default.

Windows Hello

Microsoft’s facial authentication system has been improved in version 1709 to use proximity settings to allow multifactor authentication in more sensitive deployments.

Windows Update for Business

The group policy settings that allow you to better control updating in Windows 10 now include the ability to control the use of Insider Edition on systems in your network. This allows you to enroll business systems in Microsoft’s beta testing process. Organizations may wish to opt into this program to better test and prepare for feature releases.

Security features prior to version 1709

Security changes and enhancements introduced in previous editions include the following:

Windows Defender Advanced Threat Protection

Windows 10 1703 introduced the ability to use the threat intelligence API to build custom alerts. Improvements were made in operating system memory and kernel sensors to better detect attacks deep into the operating system. It also allowed for six months of historical detection to better review for patterns. Antivirus detection and Device Guard events were placed in the Threat Protection portal. Windows 10 1607 originally introduced the online cloud forensic tool to the Windows 10 platform for the first time.

Windows Defender Antivirus

This was renamed from Windows Defender in Version 1703 and was integrated into the Windows Defender Security Center Application. In addition, updated behavior monitoring and real-time protection was enhanced. In Windows 10 1607, PowerShell cmdlets were introduced to configure options and run scans.

Windows Defender Credential Guard

Usernames and passwords are stolen on a regular basis to gain access into systems. An attacker gains access into one compromised system and then using attacks such as “Pass the hash” or “Pass the ticket” can harvest credentials saved in systems to perform lateral movement attacks across a network. Credential guard protects NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials from attackers. However, be aware that single sign-on applications may not work if credential guard is enabled.
Windows 10 1703 increased the hardware requirement to deploy Device Guard and Credential Guard to better protect from vulnerabilities in UEFI runtime scenarios:

• Support for virtualization-based security (required)
• Secure boot (required)
• TPM 2.0 either discrete or firmware (preferred - provides binding to hardware)
• UEFI lock (preferred - prevents attacker from disabling with a simple registry key change)

If you want to enable credential guard on virtual machines where the risk of lateral movement may be higher, additional hardware requirements include:

• 64-bit CPU
• CPU virtualization extensions plus extended page tables
• Windows Hypervisor

Windows 10 1511 introduced the ability to enable Credential Guard by using the registry to allow you to disable Credential Guard remotely.

Group Policy Security

Windows 10 1703 introduced a new security policy specifically to make the username more private during sign in. Interactive logon: Don't display username at sign-in allows for more granular control over the sign in process.

Windows Hello for Business

Windows 10 1703 introduced the ability to reset a forgotten PIN without losing profile data. Windows 10 1607 combined the technologies of Microsoft Passport and Windows Hello.

Windows Update for Business

Feature update installation can be deferred by 365 days, increased from the prior 180 days allowed.

Virtual Private Network (VPN)

Windows 10 1607 allowed the VPN client to integrate with the Conditional Access Framework and can integrate with the Windows Information Protection policy for more security.

Applocker

Windows 10 1507 introduced a new parameter that allows you to choose if executable and DLL rules will apply to non-interactive processes.

BitLocker

BitLocker received new features in Windows 10 1511 including enhancements in the XTS-AES encryption algorithm to better protect from attacks on encryption that utilize manipulating cipher texts. Windows 10 1507 introduced the ability to encrypt and recover a device with Azure Active Directory.

Windows 10 auditing

Windows 10 Version 1507 added more auditing events and increased fields to better track processes and events.

https://www.csoonline.com/article/32...es.html?page=2

---

An Essex man has been given two years in jail for running a website which allowed would-be hackers to test whether their malware could bypass AV filters.
Goncalo Esteves, of Cape Close, Colchester, operated the reFUD.me site which charged visitors to test their tools against anti-malware scanners.
Using the pseudonym 'KillaMuvz', he also sold custom-made malware-disguising products and offered technical support to users.
These products are known as 'crypters' — tools which can be used by black hats to help evade AV.
Esteves sold his Cryptex Lite product for $7.99/month, while a lifetime license for Cryptex Reborn cost $90. He also provided support via a dedicated Skype account and accepted payment in conventional currency, Bitcoin or even Amazon vouchers.
His PayPal account alone netted him £32,000 between 2011 and 2015, although the amount received in Bitcoin and Amazon vouchers is unknown.
“Esteves helped hackers to sharpen their knives before going after their victims. His clients were most likely preparing to target businesses and ordinary people with fraud and extortion attempts,” argued Mike Hulett, head of operations at the National Crime Agency’s National Cyber Crime Unit (NCA NCCU).
“He made a fair bit of money, but he’d probably have made much more, and certainly for longer, if he’d pursued a legitimate career in cybersecurity.”
The NCA also thanked Trend Micro, which helped conduct a joint operation with the agency to catch Esteves.
This came after the two parties signed an MoU in 2015 formalizing their co-operation in the form of a ‘virtual team’ comprising members of the NCCU and Trend Micro’s Forward Looking Threat Research team (FTR).
Esteves was sentenced at Blackfriars Crown Court in relation to two charges under the Computer Misuse Act.

https://www.infosecurity-magazine.co...stermind-gets/

Microsoft has deluged administrators with this month’s patch update round, fixing a total of 50 CVEs, 14 of them listed as critical.
Most experts have highlighted CVE-2018-0825 for urgent treatment. It’s an RCE flaw in Structured Query.
“This bug allows an attacker to get code execution through vulnerable versions of Microsoft Outlook. What’s truly frightening with this bug is that the Preview Pane is an attack vector, which means simply viewing an email in the Preview Pane could allow code execution,” explained Dustin Childs of the Zero Day Initiative.
“The end user targeted by such an attack doesn’t need to open or click on anything in the email – just view it in the Preview Pane. If this bug turns into active exploits – and with this attack vector, exploit writers will certainly try – unpatched systems will definitely suffer.”
Also worthy of note is the single publicly disclosed vulnerability in the list: CVE-2018-0771 is a Security Feature Bypass flaw in Edge that could allow an attacker to host a specially crafted website designed to exploit the vulnerability.
“Compromised websites and websites that accept or host user-provided content or advertisements are also susceptible,” explained Ivanti director of product management, Chris Goettl. “The attacker could force the browser to send data that would otherwise be restricted.”
Goettl also flagged a number of elevation of privilege flaws which could be leveraged by hackers who have already infiltrated systems, for example during an APT-style attack.
“CVE-2018-0820 (a vulnerability in the Windows Kernel), CVE-2018-0821 (Windows AppContainer), CVE-2018-0822 (NTFS Global Reparse Point), CVE-2018-0826 (Windows Storage Services), CVE-2018-0844 (Windows Common Log File System Driver), CVE-2018-0846 (Windows Common Log File System Driver), and CVE-2018-0823 (Named Pipe File System) each have an exploit index of 1 for the latest Windows versions,” he explained.
“These updates cover a lot of services and the kernel so the monthly OS updates will affect a broad surface area. This is also a good example of the importance of layered security. If you are running least privilege for users in your environment, vulnerabilities such as these can still enable an attacker to gain full control of a system.”
Elsewhere there was plenty from Adobe to keep admins busy this month: APSB18-02resolves 41 vulnerabilities, including 17 critical ones.
Most urgent is the out-of-band update released earlier this month to fix a zero-day actively being exploited in the wild.

https://www.infosecurity-magazine.co...-flaws-to-fix/

Try as I might I can't get TD to upload an expandable version of this, so just click the link.

https://hakin9.org/ransomware-gone-g...s-slowing-tsg/



https://teakdoor.com/attachment.php?a...tid=8767&stc=1

The North Korean–linked hacking group known as Reaper is expanding its operations in both scope and sophistication, and it has now graduated to the level of an advanced persistent threat.
According to FireEye, the threat actor has carried out long-term targeting of North Korea’s interests in South Korea since 2013, but it’s now focusing on multinational campaigns using advanced capabilities. For instance, the group recently exploited a zero-day vulnerability in Abode Flash Player, CVE-2018-4878, which represents a concerning level of technical sophistication.
“The slow transformation of regional actors into global threats is well established,” the firm said in a report on the group, which has added a new moniker to its name: APT37. “Minor incidents in Ukraine, the Middle East and South Korea have heralded the threats, which are now impossible to ignore. In some cases, the global economy connects organizations to aggressive regional actors. In other cases, a growing mandate draws the actor on to the international stage. Ignored, these threats enjoy the benefit of surprise, allowing them to extract significant losses on their victims, many of whom have never previously heard of the actor.”
Reaper has set its sights primarily on corporations in vertical industries, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare – and has been seen recently targeting Japan, Vietnam and the Middle East. It uses social engineering tactics tailored specifically to desired targets, strategic web compromises and torrent file-sharing sites to distribute malware more indiscriminately.
That malware represents a diverse bag of tricks to be used for both initial intrusion and data exfiltration, including custom malware used for espionage purposes. Its tool set includes access to zero-day vulnerabilities and destructive wiper malware, FireEye said.
The firm also noted that it’s possible that APT37’s distribution of malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service (DDoS) attacks, or for other activity such as financially motivated campaigns or disruptive operations.
As far as attribution, “disruptive and destructive cyber-threat activity (including the use of wiper malware, public leaks of proprietary materials by false hacktivist personas, DDoS attacks and electronic warfare tactics such as GPS signal jamming) is consistent with past behavior by other North Korean actors,” the firm said. FireEye also detected malware development artifacts that points to Pyongyang, and the targeting aligns with North Korean state interests.
“North Korea has repeatedly demonstrated a willingness to leverage its cyber capabilities for a variety of purposes, undeterred by notional redlines and international norms,” FireEye noted. “Though they have primarily tapped other tracked suspected North Korean teams to carry out the most aggressive actions, APT37 is an additional tool available to the regime, perhaps even desirable for its relative obscurity. We anticipate APT37 will be leveraged more and more in previously unfamiliar roles and regions, especially as pressure mounts on their sponsor.

I hope you've all got a long and complex TD password.....

Quote:

---

An extraordinary 43 per cent of all attempted online account logins are malicious, Akamai claims in its latest internet security report.
"Credential abuse" is an increasingly popular line of attack, thanks in large part to the readily availability of huge user/password databases that has been stolen and are sold online.
Akamai identifies two main types of such attacks: "bursty, high-speed login attempts" to break into people's accounts, and "low and slow attempts to avoid apprehension by spreading login tries across longer time periods," again to gain unauthorized access to profiles and systems.
The web hosting giant even reckons it may be underestimating the problem because it only gathered data from websites that use an email address as a username, which included no less than six billion login attempts over two months. Banks typically require you to select a username rather than an email and are often the most persistent focus of attackers attention, for obvious reasons, so are likely missing from this dataset.
In addition to detailing credential abuse, Akamai's quarterly State of the Net report, out this week, identifies mobile devices, the internet of things, and APIs as the biggest, and somewhat bleeding obvious, new threats to online security.
API attacks more than doubled in the last quarter, we're told. Akamai has also noticed a new trend in miscreants breaking into systems in order to use their computing power for activities including mining cryptocurrencies, rather than simply stealing information.
"We are seeing a new trend of enterprise systems being targeted, not only to steal their data, but to steal their computing resources, perhaps driven in part by the rise of cryptocurrencies and the potential value of mining resources," the report notes.

---

This made me laugh.

Fucking Nazis complaining because Twitter deleted all their fake Russian followers!

:rofl:

https://gizmodo.com/conservative-twi...ers-1823185428

Allentown Struggles with $1 Million Cyber-Attack


The city of Allentown, Pennsylvania, is struggling to remediate a malware attack that could cost nearly $1 million to mitigate.
According to local paper The Morning Call, the city’s critical systems have been hit by the malware known as Emotet, impacting both financial and public safety operations, according to Mayor Ed Pawlowski. Allentown’s finance department can’t complete any external banking transactions, the city’s 185 surveillance cameras are impacted and the police department can’t access Pennsylvania State Police databases, Pawlowski said.
Emotet spread like wildfire around the city’s networks, self-replicating (Emotet can spread itself to other systems by stealing an address book from a computer on the network) and harvesting city employees’ credentials along the way. There’s an intimation that phishing was the initial infection vector: Pawlowski warned city residents not to open emails and attachments from city employees. In the past Emotet has been spread via weaponized Microsoft Word documents.
The virus impacted all city systems that run Microsoft, so the city has hired Microsoft engineers to handle emergency response to the crisis for an initial $185,000. Though the virus has now been contained, Pawlowski said it will cost $800,000 to $900,000 to fully remediate the damage.
Further details remain shadowy.
“I’m not trying to in any way shape or form hide anything from the public,” Pawlowski told the city council. “But we just don’t want to divulge how we’re aggressively attacking this because if it is a hacker, they can always modify their attack.”
“Shame on us for doing a disservice to our intelligence community,” said Allentown IT director Matthew Leibert, chastising the council for holding an open hearing on the incident, given that there’s an ongoing criminal investigation into where the virus came from.
Pawlowski also said the virus evaded the city’s “extensive” antivirus and firewall systems.
“This particular virus actually is unlike any other virus,” he said. “It has intelligence built in, so it keeps adapting to our systems, thus evading any firewalls that we have up.”
Emotet first emerged in 2014 as a Trojan designed to steal banking credentials from targets in Austria and Germany. It searches the targeted system for sensitive information that will be exfiltrated to the command-and-control (C2) servers under the attackers’ control. The attacker can then sell the information harvested or log into the account themselves to steal more information.
Starting late last year, the malware began spreading beyond financial targets and into the US and other arenas, while adding new capabilities, including a new dropper, sandbox awareness and anti-analysis capabilities.

https://www.infosecurity-magazine.co...ith-1-million/

^ obviously they did not seperate their networks via VPNs and some numbnut has connected his latest aliexpress IoT device

Quote:

---

Originally Posted by harrybarracuda

the city’s 185 surveillance cameras are impacted and the police department can’t access Pennsylvania State Police databases

---

Good! Fuck that city! They got what they deserved.

Quote:

---

Originally Posted by baldrick

^ obviously they did not seperate their networks via VPNs and some numbnut has connected his latest aliexpress IoT device

---

..... Or not.

Quote:

---

Emotet can spread itself to other systems by stealing an address book from a computer on the network) and harvesting city employees’ credentials along the way. There’s an intimation that phishing was the initial infection vector: Pawlowski warned city residents not to open emails and attachments from city employees.

---

Security flaw in uTorrent allows hackers remote access

on Thursday, February 22, 2018 |

Tavis Ormandy, a vulnerability researcher at Google and a part of Google Project Zero, a team of security analysts specializing in finding zero-day vulnerabilities, revealed on Wednesday a vulnerability in BitTorrent’s uTorrent Windows and web client that allows hackers to either plant malware on the user’s computer or see their download activity.

Google Project Zero published their research once the 90-day window that it gave to uTorrent to fix the flaw before publicly disclosing it was over.

According to Ormandy, the flaws are easy to exploit and make it possible for hackers to remotely access downloaded files or download malware on their computers using the random token generated upon authentication.

He reported on Twitter that the initial fix that BitTorrent rolled out seemed to only generate a second token, which did not fix the flaw and said, “you just have to fetch that token as well.”

Quote:

---

✔@taviso



Hmm, it looks like BitTorrent just added a second token to uTorrent Web. That does not solve the DNS rebinding issue, it just broke my exploit. https://teakdoor.com/images/imported/2018/02/17.png
12:08 AM - Feb 21, 2018

• 
  

---

• 
  

BitTorrent issued a statement on Wednesday regarding the issue:

On December 4, 2017, we were made aware of several vulnerabilities in the uTorrent and BitTorrent Windows desktop clients. We began work immediately to address the issue. Our fix is complete and is available in the most recent beta release (build 3.5.3.44352 released on 16 Feb 2018). This week, we will begin to deliver it to our installed base of users. All users will be updated with the fix automatically over the following days. The nature of the exploit is such that an attacker could craft a URL that would cause actions to trigger in the client without the user’s consent (e.g. adding a torrent).

Security flaw in uTorrent allows hackers remote access - E Hacking News

Intel releases Spectre 2 microcode updates for Kaby Lake, Coffee Lake, Skylake

Intel has released to OEMs a new set of Spectre firmware updates. They include microcode for Kaby Lake, Coffee Lake, and Skylake processors.


“This represents our 6th, 7th, and 8th Generation Intel Core product lines as well as our latest Intel Core X-series processor family. It also includes our recently announced Intel Xeon Scalable and Intel Xeon D processors for data center systems,” Navin Shenoy, general manager of the Data Center Group at Intel Corporation, pointed out.
The release follows that of microcode updates for some Skylake-based platforms in early February, and Intel’s January advice to stop deploying initial firmware updates that addressed Spectre (variant 2) due to a higher than expected incidence of reboots and other unpredictable system behavior.
Shenoy advised users to implement OEM firmware updates as the OEMs release them.
Intel also offers a constantly updated document that offers insight into the current situation regarding Spectre patches, i.e., released microcode. As can be seen, the status of the various updates varies from “planning” and “pre-beta” to “production.”
Microsode updates for older processors using the Broadwell and Haswell cores are still in “beta”.
Mitigation instead of an update?

Shenoy also noted the existence of a Google-developed mitigation technique for Variant 2 called Retpoline.
“‘Retpoline’ sequences are a software construct which allow indirect branches to be isolated from speculative execution. This may be applied to protect sensitive binaries (such as operating system or hypervisor implementations) from branch target injection attacks against their indirect branches,” Google explains.
“The name ‘retpoline’ is a portmanteau of ‘return’ and ‘trampoline.’ It is a trampoline construct constructed using return operations which also figuratively ensures that any associated speculative execution will ‘bounce’ endlessly.”
Intel has provided more information on Retpoline in a newly published white paper.

https://www.helpnetsecurity.com/2018...ocode-updates/

Google Chrome ALERT - Password stealing malware hits ‘thousands’ of PCs, are YOU affected?


GOOGLE Chrome users have been put on alert about a strain of password stealing malware.
By DION DASSANAYAKE
PUBLISHED: 08:01, Sat, Feb 24, 2018




Google Chrome fans are being warned about password stealing malware that could have made its way onto their machines.


Google Chrome is without a doubt the most popular internet browser in the world right now.


NetMarketShare stats for the whole of last year show Google Chrome as having a staggering 58.90 per cent chunk of the internet browser marketplace.


Its nearest rival, Mozilla’s FireFox, has a 13.29 per cent share while Internet Explorer is on 13 per cent.


Microsoft’s newer Edge browser, which is bundled in with Windows 10, lags behind with a 3.78 per cent market share.


These stats underline how Chrome’s crown as the world’s most popular internet browser is undisputed.


And fans of Google Chrome have been put on alert about a strain of password stealing malware.


However, the way the malware may have been distributed onto Google Chrome users’ machines could leave them stunned.


The malware warning first emerged on Reddit, with user crankyrecursion making the discovery.


They claimed to have found a suspicious file hidden away on an add-on installer for a flight-simulator.


FlightSimLabs (or FSLabs) make add-ons for the hugely popular Microsoft Flight Simulator.


And they were accused by the Reddit user of adding a file called ‘test.exe’, which is allegedly a password stealer, to their A320X add-on installer.


Andrew Mabbitt, founder of cybersecurity company Fidus Information Security, also flagged the issue to Motherboard.


Mabbitt said he scanned the file through malware search engine VirusTotal, and it was flagged up by a number of anti-virus products as malicious.


He said: “When run, the programme extracts all saved usernames and passwords from the Chrome browser and appears to send them to FSLabs.


“This is by far one of the most extreme, and bizarre, methods of Digital Rights Management (DRM) we've ever seen.”


Founder and owner of FSLabs Lefteris Kalamaras took to the flight simulator’s forums to speak out about the malware claims.


He said: “First of all—there are no tools used to reveal any sensitive information of any customer who has legitimately purchased our products.


“We all realise that you put a lot of trust in our products and this would be contrary to what we believe.


“There is a specific method used against specific serial numbers that have been identified as pirate copies and have been making the rounds on ThePirateBay, RuTracker and other such malicious sites.”


Google Chrome users have been warned the malware could have reached 'thousands' of PCs


Kalamaras explained the installer would check whether a user entered in a serial number that had previously been identified as one used by pirates.


If a serial number was entered that matched one that had been flagged up, then the Chrome password dump tool would kick in.


Kalamaras said this was only meant to target specific pirates that were trying to bypass its DRM (digital rights management) system.


He added: “Test.exe is part of the DRM and is only targeted against specific pirate copies of copyrighted software obtained illegally.


“That programme is only extracted temporarily and is never under any circumstances used in legitimate copies of the product.


“The only reason why this file would be detected after the installation completes is only if it was used with a pirate serial number (not blacklisted numbers).”


Kalamaras admitted his firm’s approach to DRM was “overly heavy-handed” and a new installer has been released without the Text.exe file.


He wrote: ”We have already replaced the installer in question and can only promise you that we will do everything in our power to rectify the issue with those who feel offended, as well as never use any such heavy-handed approach in the future.


“Once again, we humbly apologise."


However, cybersecurity expert Mabbitt told ZDNet that what had been done was “incomprehensible”.


He also said the malware itself, while not activated, would have been “dropped on every single PC it [the FSLabs software] was installed on”.


He said: "Their statement is more a personal justification of what they've done, and they're not comprehending what exactly they just did.


“The fact is they dropped malware on [potentially] thousands of machines, secretly, in an attempt to gather information on a single target.


"Regardless if the target in question was pirated copies of the game or not, dumping their Chrome usernames/passwords and siphoning them off, insecurely too, to servers under their control is incomprehensible.


"They've noted they knew what serials the pirate was using. Surely, the logical next step was simply to blacklist those serials and prevent them from being used."

https://www.express.co.uk/life-style...alware-warning

AutoSploit: Making Massive Cyber Attacks Too Easy?


he introduction on January 30th of AutoSploit, a self-described "automated mass exploiter" that makes it disturbingly easy for less technical hackers to launch cyber attacks, caused some panic in the security community.
The tool leverages the Shodan search engine to find potential targets, and can provide targets in response to search terms. "After [the search] operation has been completed the 'Exploit' component of the program will go about the business of attempting to exploit these targets by running a series of Metasploit modules against them," AutoSploit author VectorSEC wrote.
In an analysis of the tool, Rapid7 research director Tod Beardsley noted that AutoSploit "doesn't appear to offer any mechanism to assess and exploit targets that aren't picked essentially at random."
"In the end, I can't figure out how to use Autosploit.py in a way that isn't merely a random act of vandalism," Beardsley added. "As a user, I have little to no control over target selection, which means I am necessarily going to cause headaches and harm to innocent bystanders."

In response, VectorSEC tweeted, "Don't worry guys. The new version will have an option included that will allow the user to select a custom list of targets."
Regardless, it's worth questioning how much of a threat AutoSploit presents on its own. British security architect Kevin Beaumont suggested, "If anybody is concerned about this, your threat model collapses at kids being bored running python scripts."
An opportunity for script kiddies

Still, AutoSploit could provide a less skilled attacker with an unprecedented amount of power. Stephanie Weagle, vice president of Corero, told eSecurity Planet by email that AutoSploit "provides an unending opportunity for cybercriminals and script kiddies to hijack vulnerable devices and subsequently launch attacks against online organizations with ease."
And Weagle said companies have to respond. "It is now imperative for organizations to implement a next generation Internet gateway that includes a DDoS layer of security to immediately detect and mitigate DDoS attacks," she said. "Without this DDoS mitigation layer, companies who are hit with a DDoS attack could face significant loss of revenues and reputation due to outages."
At the same time, Plixer director of strategic relationships and marketing Bob Noel said it's important to remember that AutoSploit doesn't introduce anything new in terms of malicious code or attack vectors. "What it does present is an opportunity for those who are less technically adept to use this tool to cause substantial damage," he said.
Ultimately, Noel said, AutoSploit expands the threat landscape by allowing a wider range of people to launch major attacks. "It also demonstrates that it is impossible for organizations to prevent all cyber attacks, and this should act as a wake-up call to invest in incident response technologies, people and best security practices," he said.
But Synopsys vice president of security technology Gary McGraw cautioned against overreacting to the news. "Tools for improving computer security can also be used to do bad things," he said. "Try to do good things with them."
"Oh, and fix the broken software," he added. "Really."

https://www.esecurityplanet.com/thre...-too-easy.html

Some interesting facts in a report about Phishing:

Quote:

---

The company based the report on data from tens of millions of simulated phishing attacks, and they found that:

• Personalized phishing tests (personalized email address, first name or last name) are no more effective than non-personalized ones.
• End users are most likely to report suspicious emails in the middle of the week.
• The topics and themes that are most tempting to end users are “online shopping security updates,” “corporate voicemail from an unknown caller,” and “corporate email improvements.”
• Two simulated phishing templates had a near 100% click rate: one that masqueraded as a database password reset alert, and another that claimed to include an updated building evacuation plan.
• Organizations in the telecommunications, retail, consumer goods, government, and hospitality industries have, on average, the worst click rate (15% to 13%), while those in the energy, finance, transportation and defense industrial base industries have the best (8% to 3%).

---

https://www.helpnetsecurity.com/2018/02/23/phishing-messages/

German government confirms hackers blitzkrieged its servers to steal data

Probably-Russian Fancy Bear team fingered for attack

By Iain Thomson in San Francisco 1 Mar 2018 at 06:03

]

The German Interior ministry has confirmed that it has identified a serious attack against its servers, amidst reports that the culprits were the Russian APT28 – aka Fancy Bear – hacking group.
On Wednesday local news site DPA International reported that the German government discovered a serious intrusion into its servers in December 2017. The attack is thought to have seen data exfiltrated for up to a year before its discovery.
Johannes Dimroth, a spokesman for the ministry, confirmed that "government information technology and networks," had been affected by an intrusion. "The incident is being treated as a high priority and with substantial resources," he said.
Fancy Bear has been active for at least a decade. Its activities have often non-Russian government targets. The group was fingered for the Democratic National Committee hack ahead of the 2017 US Presidential election, attacks during the 2017 French election, brazen rummaging in Finnish security forces' servers and even attacks on the sports doping authorities.
In December 2016 Germany's Federal Office for the Protection of the Constitution took the unusual step of issuing a public warning about hacking ahead of national elections in September 2017. That warning named Russia as the likely culprit.
Russia has always denied that it has anything to do with Fancy Bear, but the types of malware used, the software and coding styles, and its choice of targets suggest that Putin and his pals might have Fancy Bear dancing to their tune.
This latest attack on Germany will not serve to warm relations between these two historical enemies. With Russia looking to take an increasingly muscular role in European affairs, hopefully such conflicts will not leave the online realm. ®

https://www.theregister.co.uk/2018/0...to_steal_data/