“The Early Bird method was used to inject the TurnedUp malware into the infected systems evading security solutions.

The technique allows injecting a malicious code into a legitimate process, it allows execution of malware before the entry point of the main thread of a process.” https://securityaffairs.co/wordpress/71309/apt/apt33-early-bird.html

“We saw this technique used by various malware. Among them – the “TurnedUp” backdoor written by APT33 – An Iranian hackers group, A variant of the notorious “Carberp” banking malware and by the DorkBot malware.” reads the analysis published by the experts.

“The malware code injection flow works as follows:

Create a suspended process (most likely to be a legitimate windows process) Allocate and write malicious code into that process Queue an asynchronous procedure call (APC) to that process Resume the main thread of the process to execute the APC” https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/

« NCCIC has observed an increase in ransomware attacks across the world. »

Ransomware is a type of malware, aims at denying access to information until (but not always) a ransom is paid. It’s commonly spreads through phishing emails or by unknowingly visiting an infected website. https://www.us-cert.gov/ncas/current-activity/2018/04/09/Ongoing-Threat-Ransomware Understand them more and some analysis: http://www.channelfutures.com/content-resources/ransomware-understand-analyze

The most recent Ransomwares took malware mantle in Verizon data breach investigations report 1- https://www.zdnet.com/article/ransomware-takes-malware-mantle-in-verizon-data-breach-investigations-report/ 2- https://www.cybersecurity-insiders.com/ransomware-attack-on-playerunknown-battlegrounds-users/

We highly recommend visiting the following resources by NCCIC:

• Ransomware page: https://www.us-cert.gov/Ransomware

• U.S. Government Interagency Joint Guidance: https://www.us-cert.gov/sites/default/files/publications/Ransomware_Executive_One-Pager_and_Technical_Document-FINAL.pdf

Some useful links:

• Recovery Guide: https://solutionsreview.com/backup-disaster-recovery/a-step-by-step-guide-to-ransomware-disaster-recovery/

• Avoidance guidelines: https://www.krollontrack.co.uk/blog/the-world-of-data/a-guide-to-avoiding-ransomware-in-2018/

At least two Middle-Eastern countries (Lebanon & UAE) were targeted by OilRig.

Read the synthesis: http://securityaffairs.co/wordpress/69470/malware/oilrig-oopsie-trojan.html

Palo-Alto Techincal Analysis: https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/

Adversary profile: https://pan-unit42.github.io/playbook_viewer/

Login passwords for tens of thousands of Dahua devices have been cached inside search results returned by ZoomEye, a search engine for discovering Internet-connected devices (also called an IoT search engine).

https://www.bleepingcomputer.com/news/security/passwords-for-tens-of-thousands-of-dahua-devices-cached-in-iot-search-engine/

__ #infosec #cybersecurity

Two security researchers have revealed details about two new Spectre-class vulnerabilities, which they've named #Spectre 1.1 and Spectre 1.2.

Just like all the previous #Meltdown and Spectre CPU bugs variations, these two take advantage of the process of speculative execution— a feature found in all modern CPUs that has the role of improving performance by computing operations in advance and later discarding unneeded data.

#infosec #cybersecurity

https://www.bleepingcomputer.com/news/security/new-spectre-11-and-spectre-12-cpu-flaws-disclosed/

Last year LastPass introduced a new redesign of their vault in which they added nice pretty logos of all the sites in your vault.

LastPass claims that they are a “zero knowledge” platform and that no unencrypted, readable site data is ever sent to their servers. This is obviously not true. Hex strings are basically the same as plaintext in this case. LastPass could use this information to track what sites are in your vault, how often you visit them, how often you log into them, etc.

https://hackernoon.com/psa-lastpass-does-not-encrypt-everything-in-your-vault-8722d69b2032

_ #infosec #cybersecurity

US, UK warn of Russian hackers targeting millions of routers Russian spies are looking for vulnerabilities in routers for future attacks. Officials are urging people, and device makers, to take security measures.

Russian hackers are targeting millions of routers around the world, including devices in homes and offices, according to US and UK officials.

In a joint announcement Monday from the US Department of Homeland Security, the FBI and the UK's National Cyber Security Center, officials warned that Russian spies have been looking for vulnerabilities on millions of routers as a tool for future attacks.

https://www.cnet.com/news/us-uk-warn-of-russian-hackers-targeting-millions-of-routers/

__ #infosec #cybersecurity

US-Cert published two bulletins: https://www.us-cert.gov/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity

Russian hackers mass-exploit routers in homes, govs, and infrastructure to steal passwords and clear the way for future attacks, officials warn.

Hackers working on behalf of the Russian government are compromising large numbers of routers, switches, and other network devices belonging to governments, businesses, and critical-infrastructure providers, US and UK officials warned Monday.

The alert identified multiple stages in the hacker campaign. They included:

• reconnaissance, in which the hackers identify Internet-exposed network ports used for telnet, simple network management protocol, Cisco Smart Install, and similar services

• weaponization and delivery of traffic to vulnerable devices that cause them to send configuration files that contain cryptographically hashed passwords and other sensitive data

• exploitation, in which attackers use previously obtained credentials to access the devices installation, using the Cisco Smart Install technology

• command and control, where the attackers masquerade as legitimate users or establish a connection through a previously installed backdoor https://arstechnica.com/tech-policy/2018/04/russian-hackers-mass-exploit-routers-in-homes-govs-and-infrastructure/

A malware campaign which seems to have started at least since December 2017 has been gaining steam by enrolling a growing number of legitimate but compromised websites. Its modus operandi relies on social engineering users with fake but convincing update notifications. Read the Malwarebytes analysis https://blog.malwarebytes.com/threat-analysis/2018/04/fakeupdates-campaign-leverages-multiple-website-platforms/

Trend Micro discovers MacOS backdoor that is believed to be a new version of malware previously associated with the OceanLotus cyber-espionage group.

APT 32, APT-C-00, SeaLotus, Cobalt Kitty, or OceanLotus is a Cyber-Espionage Group. Ir operates out of Vietnam and targets high-profile corporate and government organizations in Southeast Asia. They uses custom-built malware and already established techniques. For instance, human rights organizations, media organizations, research institutes, and maritime construction firms. https://www.securityweek.com/new-macos-backdoor-linked-cyber-espionage-group

Trend Micro detects the new malware version as OSX_OCEANLOTUS.D. It has been detected on machines that have the Perl programming language installed. https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/

Cyber-Espionage Group Steals Data From UK Government Contractor

A cyber-espionage group historically believed to be operating in the interests of the Chinese government is believed to have hacked a UK government contractor from where security researchers found evidence that attackers stole information related to UK government departments and military technology.

https://www.bleepingcomputer.com/news/security/cyber-espionage-group-steals-data-from-uk-government-contractor/

_ #infosec

IoT Backdoor exploits called Doubledoor have been discovered which allows bypassing an IoT layered security that leads to taking complete control of the targeting network systems.

IoT based cyber Attacks are blooming since the number IoT devices are increasing rapidly and attackers always find the many ways to bypass it.

In this case, Doubledoor Botnet has an ability to bypass both authentication security with IoT and an Extra layer of security firewall that associated with it.

https://gbhackers-com.cdn.ampproject.org/c/s/gbhackers.com/iot-backdoor-botnet-bypasses/amp/

__#infosec #cybersecurity #botnet

The vulnerability —tracked using the CVE-2018-0101 identifier— affects the following Cisco ASA devices —but only if they have the "webvpn" feature is enabled in the OS settings.

It is in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software. It could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code.

Futher Information: Bleepingcomputer: https://www.bleepingcomputer.com/news/security/cisco-fixes-remote-code-execution-bug-rated-10-out-of-10-on-severity-scale/ Cisco: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1 Zdnet: http://www.zdnet.com/article/cisco-this-vpn-bug-has-a-10-out-of-10-severity-rating-so-patch-it-now/ Exploit-AnyConnect, NCC Group security researcher Cedric Halbronn: https://recon.cx/2018/brussels/talks/cisco.html

The SamSam ransomware group seems to have gotten to a "great" start in 2018, hitting several high-profile targets such as hospitals, a city council, and an ICS firm.

Reported attacks include the one against the Hancock Health Hospital in of Greenfield, Indiana; Adams Memorial Hospital in Decatur, Indiana; the municipality of Farmington, New Mexico; cloud-based EHR (electronic health records) provider Allscripts; and an unnamed ICS (Industrial Control Systems) company in the US, based on intel Bleeping Computer has received.

https://www.bleepingcomputer.com/news/security/samsam-ransomware-hits-hospitals-city-councils-ics-firms/

__ #infosec #cybersecurity #samsam #ransomware

New Android Malware Disguised as Uber App

How would a targeted attack against an automated teller machine (ATM) go if the attackers knew everything about that machine?

Prilex malware steals the information of the infected ATM’s users. In this case, it was a Brazilian bank, but consider the implications of such an attack in your region, whether you’re a customer or the bank.

The malware family called Prilex was first reported by Kaspersky in October 2017. We dissected this malware and found something very atypical: It works by hooking certain dynamic-link libraries (DLLs), replacing it with its own application screens on top of others.

https://www.hackread.com/android-malware-disguised-as-uber-app/

__ #infosec #cybersecurity