Home   Blog   Twitter   Database  

Microsoft and dance partners coordinate firmware defenses with Secure-core PCs

Windows code armors its arse

Pointing to a five-fold increase in firmware vulnerabilities over the last three years and not saying much about the growing number of Windows vulnerabilities, Microsoft on Monday said it has been working with PC-selling and silicon-making partners to ship kit that implements protection from malicious low-level device code.…

Posted: 21 Oct 2019 | 11:54 pm

How Googling Our Favourite Celebrities Is A Risky Business

Did you know that searching for your favourite celebrities online may very well increase your chance of running into trouble?

For the thirteenth year running, McAfee has put together its Most Dangerous Celebrities List which includes the celebrities who generate the riskiest search results that could potentially expose their fans to malicious websites and viruses. And, as usual, Aussies feature!!

Who Are the Riskiest Aussie Celebrities?

After a tumultuous year in and out of love, Liam Hemsworth – Aussie actor and ex-husband of popstar Miley Cyrus – has taken out top honours as the most dangerous Australian born celebrity coming in at 19th place on the list. Rose Byrne, Cate Blanchett and Kylie Minogue also feature on the list coming in at 37th, 41st and 52nd place respectively.

Talk Show Hosts Top the List

While previous years have seen Reality TV stars, such as The Kardashians, top of the list, in 2019 – it’s all about talk show hosts. In fact, there are 4 talk show hosts in the top 10. John Oliver takes out 1st place, followed by James Corden in 4th place, Jimmy Kimmel in 6th place and Jimmy Fallon in 10thplace.

Whether it’s their karaoke singing or their viral views on politics, our fascination with charismatic talk show hosts is clearly very strong. McAfee’s research also shows that the names of these 4 hosts are strongly associated with the search term ‘torrent’. This indicates people may be trying to avoid paying expensive subscriptions to view these cult shows and are pursuing free yet riskier alternatives.

Singers Are Also Proving Risky!

English singer Dua Lipa came in at no 2 on the list, followed by Scottish singer/DJ Calvin Harris in 5th place and teen favourite Billie Eilish at no 7. Our quest for immediate or free content about our favourite singers could mean that we visit sites purposefully designed by cybercriminals to extract our personal information or even better, our credit card details!

And then there’s Game of Thrones

The world’s love affair with Game of Thrones saw Emilia Clarke take out the 9th spot in this year’s list of risky celebs to search for online. Clarke, who played Daenerys Targaryen in the HBO fantasy series, was joined by Hollywood royalty Morgan Freeman in the top 10 list.

Cybercriminals Capitalise on Our Love for Celebrities

Our love of ‘all things celebrity’ has clearly not escaped the attention of cybercriminals with many spending a lot of time

and energy creating malicious websites designed to trick consumers into visiting. Whether it’s the promise of a ‘sneak-peak’ of the latest Star Wars movie, or free access to full episodes of a favourite American talk show, consumers will often drop their guard in favour of speed or convenience and quickly enter their personal details to gain access to a site without thinking about the consequences.

How to Avoid Getting Stung!

The good news is that you don’t need to give up your obsession with your favourite celebrity to stay safe online. Instead, develop some patience and trust your gut. Here are my top tips to help you stay ahead of the cybercriminals:

  1. Be Careful What You Click

Only stream and download movies and TV shows from reliable sources. While it may feel boring, the safest thing to do is wait for the official release of a movie instead of visiting a 3rd party site that could contain malware.

  1. Avoid Using Illegal Streaming Sites – No Exceptions!

Many illegal streaming sites are riddled with malware or adware disguised as pirated videos. Do yourself a favour and stream the show from a reputable source.

  1. Use a Web Reputation Tool

A web reputation tool such as McAfee’s freely available WebAdvisor will alert users if they are about to visit a malicious website. Very handy!

  1. Consider Parental Control Software

Kids love celebrities too! Ensure you set limits on device usage with your kids and use parental control software to help minimise exposure to potentially malicious or inappropriate websites.

But if you aren’t convinced your kids are going to take your advice on board then why not invest in some comprehensive security software like McAfee’s Total Protection for the whole family? This Rolls Royce cybersecurity software will protect you (and your kids) against malware and phishing attacks. A complete no-brainer!!

Alex xx

 

The post How Googling Our Favourite Celebrities Is A Risky Business appeared first on McAfee Blogs.

Posted: 21 Oct 2019 | 10:17 pm

Don’t look now, but Pixel 4’s Face Unlock works with eyes closed

There's a risk that someone might get hold of a device and unlock it by holding the screen to the face of its sleeping or unconscious owner.

Posted: 21 Oct 2019 | 4:47 am

Fake Photo Beautification Apps on Google Play can Read SMS Verification Code to Trigger Wireless Application Protocol (WAP)/Carrier Billing

By Song Wang (Mobile Threat Analyst)

At the start of the year, Google updated its permission requests in Android applications, and in particular, restricted access to SMS and CALL Log permissions. Google also added requirements for non-default applications (or those that don’t provide critical core features), allowing them to prompt and ask users for permission to access the device’s data.

This restriction is meant to prevent fake or malicious apps from abusing these features to deliver malware, steal personally identifiable information, or perpetrate fraud. But as last year’s mobile threat landscape showed, fraudsters and cybercriminals will always try to follow the money, whether fine-tuning their strategies, finding ways to bypass restrictions, or, in a recent case we’ve seen, revert to old but tried-and-tested techniques.

This is recently exemplified by an app we found on Google Play named “Yellow Camera” (detected by Trend Micro as AndroidOS_SMSNotfy), which poses as a camera and photo beautification or editing app — an increasingly common trick we’ve observed, what with the various information-stealing as well as malware- or adware-ridden apps we’ve uncovered so far this year. While the functions work as advertised, it is embedded with a routine that reads SMS verification codes from the System Notifications, and, in turn, activate a Wireless Application Protocol (WAP) billing. We disclosed our findings to Google, and the app, along with similar ones we saw, are no longer in the Play store.

Based on the name of the file downloaded by the app, it appears it is mostly targeting users in Southeast Asian countries (e.g., Thailand, Malaysia). However, we’ve also seen the app targeting Chinese-speaking users, so it won’t be a surprise if the app to gradually shift or expand their targets. While Google already removed the app from the Play store, we found that the fraudsters uploaded similar apps to the iOS App Store, as shown in Figure 5.

WAP-billing services are widely used as an alternative payment method for users to buy content from WAP-enabled sites. These services charge purchases directly to the user’s phone bill or credits without having to register for services, key in credentials, or use credit or debit cards. Unfortunately, fraudsters appear to have also taken advantage of this convenience. Based on the app’s reviews on the Play Store (Figure 1), some of the users already lost phone credits to the app.


Figure 1. Screenshot showing reviews about the app; one user noted how she lost mobile credits after installing the app
Figure 2. Infection chain of the malicious app

Yellow Camera’s Infection Chain

Here are additional details of Yellow Camera’s infection chain, as visualized in Figure 2:

For persistence, the malicious app uses the startForeground API to put the service in a foreground state, where the system considers it to be something the user is actively aware of and thus would not be terminated even if the device is low on memory.

We also found other apps (Figure 5), posing as photo filtering or beautifying apps, bearing the same routine of fraudulently subscribing the device to a WAP service. While they do share similar codes, we can’t fully confirm if these apps came from the same operators, or the group behind the Yellow Camera app.


Figure 3. Code snippet showing the file being downloaded by the app


Figure 4. Snapshot of WAP-billing site where TAC is requested and subscription is confirmed


Figure 5. Screenshots of apps with malicious routines similar to those of the Yellow Camera app

Best practices and Trend Micro solutions

The fraudsters’ technique may appear undistinguished, as WAP billing scams and fraudulent subscription to premium services aren’t new. However, this can be seen as a different approach or response to security controls designed to mitigate threats or deter abuse of device functionalities, particularly the Notifications feature. Previous scams, for example, relied on SMS to fetch verification codes, and would often require the device to switch connections between Wi-Fi and mobile data. Given how it affected the users who installed the apps, the malicious app showed how it can conveniently steal money by abusing the device’s other functionalities.

Also of note is how scammers and cybercriminals adapt their tactics — or the way they ride social networking trends — in their social engineering lures, as we’ve seen increased incidence in using photo editing or beautification apps as decoys to entice unwitting users into downloading fraudulent or malicious apps.

For the end users’ part, however, it pays to read an app’s reviews before installing them, as they can help identify apps with fraudulent or suspicious behaviors. Users should also adopt best practices for securing mobile devices, especially against socially engineered threats.

Users can also benefit from security solutions that can thwart stealthy adware, such as Trend Micro™ Mobile Security for Android™ (also available on Google Play), which blocks malicious apps. End users can also benefit from its multilayered security capabilities that secure the device owner’s data and privacy and that safeguard them from ransomware, fraudulent websites, and identity theft.

For organizations, the Trend Micro™ Mobile Security for Enterprise suite provides device, compliance and application management, data protection, and configuration provisioning, as well as protects devices from attacks that exploit vulnerabilities, prevents unauthorized access to apps and detects and blocks malware and fraudulent websites. Trend Micro’s Mobile App Reputation Service (MARS) covers Android and iOS threats using leading sandbox and machine learning technologies to protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerability.

The indicators of compromise (IoCs) are in this appendix.

MITRE ATT&CK techniques:

Tactic Technique ID Description
Initial Access Deliver Malicious App via Authorized App Store T1475 Used to upload malware to Google Play store
Persistence App Auto-Start at Device Boot T1402 Used to listen for the BOOT_COMPLETED broadcast
Impact Premium SMS Toll Fraud T1448 Used to autofill content on WAP billing page by embedded JS
Exfiltration Alternate Network Mediums T1438 Used to connect cellular networks rather than Wi-Fi
Command and Control Standard Application Layer Protocol T1437 Used to communicate with remote C&C server

The post Fake Photo Beautification Apps on Google Play can Read SMS Verification Code to Trigger Wireless Application Protocol (WAP)/Carrier Billing appeared first on .

Posted: 18 Oct 2019 | 5:05 am

Masad Clipper and Stealer - Windows spyware exfiltrating data via Telegram (samples)



Reference


2019-09-25 Juniper. Masad Stealer: Exfiltrating using Telegram 



“Masad Clipper and Stealer” steals browser information, computer files,  and automatically replaces cryptocurrency wallets from the clipboard with its own.
It is written using Autoit scripts and then compiled into a Windows executable.
It uses Telegram to exfiltrate stolen information.





Download

             Other malware






Hashes

SHA256SHA1MD5
1acf5a461ee16336eb8bbf8d29982c7e26d5e11827c58ca01adac671a28b52ad6001b34c17c122d201613fffd846b056614b66dae03234c2259c474aeb69500423ddeed7
290a1b89517dec10bfd9938a0e86ae8c53b0c78ed7c60dc99e4f8e5837f4f24a32800c10588053813f55bf8c87771311c5f7f38e2df4c1cf093c8373a8f2f194e77b69a2
7937a1068f130a90b44781eea3351ba8a2776d0fede9699ba8b32f3198de045ba2a67b06344e4f1cf85086f6b584316ec53d5e548368f1c4d8f0d908f5f4ff671df5f1da
87e44bca3cc360c64cc7449ec1dc26b7d1708441d471bf3d36cd330db35762942fe5483e6b82220eeeef12e531eb3347fea16ac11082ce517dd23eee335bedfc6bcd8205
cf97d52551a96dacb089ac41463d21cab2b004ba8c38ffc6cb5fb0958ddd34db5b79a15cb61f5260f0b9d807faa160e6d49590e4b5fdf9653eb1ffbdae8cb4f1f2d71747
79aa23c5a25c7cdbaba9c6c655c918dac3d9823ac62ebed9d7d3e94e1eaafc074a279a6b82fe801d3c8be9d16df2ef5623b177040029ab0fd56cd7e493b46a331ef18bd3
03d703f6d341be258ac3d95961ff0a67d4bf792f9e896530e193b091dca29c2ea9740352af2c9cc926deba7dffc452f213f7f05fa462aac76def5b53351b3b1ddb41124c
a368b6755e62e5c0ff79ea1e3bd146ee8a349af309b4acf0558a9c667e78293ae16167ab646381c277c2ca84319ceb57bacb2c92c4cdc7665adb1cda5897d4df4a560f88
ba933cefbe9a8034f0ba34e7d18481a7db7451c8ef4b6172fb0cad6db0513a5100749407e97085af470c75ef004f2235d30af44fc26a3f2317507a09d91014469b045384
3ba3c528d11d1df62a969a282e9e54534fb3845962672ad6d8bbc29cb6d062f5b8100890c0f1894544b3f99168377ec46c38e9114a0607b4488cd539b8b0b443abd121e3
b763054180cd4e24c0a78b49055ad36dbc849f1a096cddf2db8cee0b9338c21d7bec99308ce4bf409417b642cd9432000a5c19d22dfb1d606e5539399aa1a536baafd2f8
d5ce4b04b7eec6530a4a9d40510177468fadc235253e5a74530a8c9d990f3c5027fc204ffa42262b7570b6fccb435d4d38a3610fc5d8b73da810646407c333fe52186281
965a5949d8f94e17ebcd4cb6d0a7c19f49facbfc1b1c74111e5ceb83550d6c8f7698584b2e7c62061447a6a2583ed6957180c205e7ebe4411664672359b393f530fc2fc1
44134b9d4b10d94f6381b446a1728b116d62e65c1a52db45235af12caf7e38c0fd114077927d501606575ba9ab38ecfb3407d432a4388980d7e3539d74a950dab23d00ac
848d76a227f4fe282b7ddfd82a6dfc4c25da2735a684462b42fe4e1c413d8e34135cee7610890497183eb6251efef307ea013fe17bb23077b4f80df48b91b425eda05828
5ca0a957fe6c253827f344da4ba8692d77a4e21a1df4251594be2d27d87dd8aed231874332ca462fb462e4f68450d2c2c22d4bcddda77b3f3f74a2bdffd167917686e139
016fa511f6546ed439d2606c6db8821685a99f5a14ef3f710668b58dc89c69265c83749c62ee0131710bf26931cb1e463a8fbda3b0c34df85677d8f752dc1e1a5eeba0c9
22be594fbfa878f631c0632f6c4d260b00918817ff66a1f9f15efe44c1a58460856d635fca52631305f1fefc58eafa74496524b660ebf41953d5c6e212fc306cdb0c6519
f3571ec66288405dab43332ca03812617f85fb08832fbbe1f1d89901fe034b8a819485e20d841195e2e8a7ae5b41ff709887bb216984d37863c08b9fdd969297d35d3538
04c949eca23103b1de05278b49f42c3ab6b06f4bf20aafa5f2faefaa84c16ecd0487db2df1802dd4ee4ae3b62b5f08937dd5c77c4366ee61cbd7e636aea8540836a60036
d6fc04acda8f33a6d35eb577c27754c2f2b4d6f4869576c7c4e11b2c5e9b017683ae89826114662dad8553d5eeed5217b57047f22bc964e294d7ab314c34e5934d91a5a9
18c0bd4dd98008383fc52045ad896449fa7f0037593bb730ed1ef88aa547006dbcaa05b60a9d625852ac4f2d0d805ab16498815535d9f08c39c4cf396427f3a345e5c09a
4c9d5469e9095813418260045c2b11e499e4eaa0ffb25293f90f580c464157df4c6aacc0b893ed366f9f307326e59efa61e5153450dddaf7e5bb24aabf66eecd0c8b79cf
0b5f1fbc05dc8baca492b748adeb01fb4904e02723b59211ecde222f7b12d91e87f898e0d41c0f2c22d4e9278a942326877fc368da780b72140535d4c2d391e76dc8181d
31ad5c4547ceae4d0550c8460524c16a6105afc056760e872c4966656256c9dc37f485d3fa8f6cf13061cb1ea38ae0d5d2edfd95134aefcf640c24a1ab5344a96150fb05
edb00a0e5ff70e899857549e3263c887a799416c8bbab43ab130ca1be9bbd78c42c30dc551a3cb3bc935c0eae79b79f17942e439c2722241f765d2ad4fb58edd76a4adea
96f852b81760a425befaa11ea37c0cdea2622630bf2a0c94bb95042211ab614d5d9782064bc38d40c88f32c0410479cbd61caa40f332cfcda8c0ef579ede59eff23caa1e
57fd171a5b1a88e9583b42439851a91a940eb31105ab29cb314846da2ed43b820bfec2059823b936d782bea7bc16abd9923dddb56fff82df7a565b4570d299486697310f
277018b2cc6226dca6c7678cac6718c8584f7231340ad8cd7c03477559fdf48b261f916ce97ffc6817a4772705df68e6ccca8181009dc7d8766a85d85bb6a26ee69b66fe
e968affb1fc7756deb0e29807a06681d09a0425990be76b31816795875469e3dcf78484a999183324da9affdf2aaeff508d1dc473e1b8f6313447b8a4b49671ddeb8a4ee
4b1ccf6b823ee82e400ba25b1f532cd369d7e536475a470e2011b77ffeaf7bb3bc988f7cd32d411f2a9888afc72c7a892e2a1def55128a3da6f70129acdbf9dbe955cfe7
fc84d6636a34ad1a11dbaa1daec179e426bdcd9887b3d26dc06b202417c08f951df31bec02e35c9a4656bb3a3bdf631bb37605a855d77ab16377a8a314982f723fcc6fae
9ca15f15fbae58cb97b0d48a0248461e78e34e6d530338e3e5b91f209a1662678505dfaad6d10b84c73544eb748d547cb5bad9bdebc12c530dab0a65c37ffd72612fa705
31f3a402c1662ed6adffbf2b1b65cf902d1df763698eb76d21e4e94b4c62971418c972722d984ff6da2bc26a0aca4c7f209cc39c05bbf6e72b5b24c0c81e0671bf17b1e7
8d9f124ddd69c257189f1e814bb9e3731c00926fc2371e6ebe2654f3950ca02e553cd98c83e945ee3013aa40897baec0305b34a2b4030025e039c54c2d3923057447494c
a0923d7645604faaa864a079adeb741a5d6e65507a2819b2fee4835d396077d9f8e6995e28c789d8b24e982ac53d5d6ba453de73b796f85c8a7de71407d6e3c4206edda3
a19b790ea12f785256510dde367d3313b5267536a58ca0c27dbdac7c693f57e1a92f7393daf7ead9a44b12e35f850705798fc879a6defec886d31f6375712466dd794a96
f030fb4e859ee6a97c50c973a73dced3640befe37f579cfd15367ce6a9bbede2ad3a1e779f02539ccd07bff735e0823add9730b2c259564a8fe72333604a5686e30f6242
f01db6d77ac21211992ceae4e66e1e03c1cb39d61e03645b9369f28252ca769314c6bf63ff4d32d8a0a42e81ea39304fb7ab13c880fe593ef5538fbf66b3b3e1cb7b9b8b
dfe3d0e95feaed685a784aed14d087b019ba2eb0274947a840d2bdbae4ae36742107d057478328df8f538102508de00b0c4b37c7b5a85a0e7a2c4197c3794c8bb2eb5763
bf6083040ca51e83415f27c9412d9e3d700bd0841493b207bc96abf944ab0ca709a695ce6c35c029dd7577e29f403d7144698b417a2edceb31a9c0d05e5f13c6caee0576
b154151dc8ace5c57f109e6bb211a019db20c4f0127c4d13c7703f730bf492768c0cda049c85493df4e97db3db4ddc94075ba62cb6a895ac5ba5b6472680d47410a238a5
6bf6b1bde63cee9b81902efd187fdd56ecee5853754ce0a19d5ab5c3b02429886e2d4f0bcc97ce130ae89647f648d3e96548a391a29f9d176b913e7f693355700aaadbb9
0dcf547bd8f4074af97416d8b84ea64b2f3319064aa4bce64ad0c2e2d3957175a996b925e9391a69140caf6e4adba928694ffe66dd575413a40839f2807593aa21c71152
6cff1249cc45b61ce8d28d87f8edc6616447e38168e610bed142f0b9c46ea6849baa823deb9075e8df77b891115c019244de09de488bb5c0739485721182c01a82b01d14
5b5ebe019806885bbaafe37bc10ca09549e41c240b793fd29a70690a5d80b4963d46711f9064b96ff2d0affdef1ecd82d120659db95e2d8a8509ac05f5445d18d32cc7cb
103d87098c9702cab7454b52869aeeb6a22919f29a7f19be7509255ce2d8c83ee29a163488438c9ea9014ddf1a9b2d382cc5d7e6baf2587fafaedbab4a78b9b7fd8b55f8
c73675005a09008bc91d6bc3b5ad59a630ab4670dca6ac0d926165a3ecfd8d92d8ea2280cd06a5cc32b7d668e2b4b2e68f3a7e2a98ecc6fbb2cb5649daf751fcbfb81bcb
ef623aadd50330342dc464a31b843b3d8b5767d62a62f5e515ac2b380b208fbe620ff5a7aaf7f3fcf4abc9365e0e77b3ec4b434db14535c5835c9dfb3cbbc7f6fef6034c

Posted: 6 Oct 2019 | 8:53 pm

Measuring up to the NIST Cybersecurity Framework: A Q&A with Matt Barrett

Read the Q&A with Matt Barrett, Chief Operating Officer of CyberESI, published on JUNTO by eRiskHub. Exchanging ideas on cyber risk & privacy liability

First introduced in 2014, the National Institute of Standards and Technology (NIST) CyberSecurity Framework (CSF) has since become a widely held best practice far beyond the commerce industry. To get some perspective on the framework and how it’s evolved over the past five years, we talked to Matt Barrett, who was the program manager for CSF. (Note: Barrett currently serves as COO for Cyber Engineering Services Inc (CyberESI), a cyber risk management firm.)

The post Measuring up to the NIST Cybersecurity Framework: A Q&A with Matt Barrett appeared first on CyberESI.

Posted: 28 Jun 2019 | 10:29 am

Introducing Reneo

Reneo is a Windows tool to help incident responders, forensics specialists, and security researchers analyze and reverse engineer malicious and obfuscated scripts and other content. This tool can convert from/to various formats, transform, deobfuscate, encode/decode, encrypt/decrypt, and hash strings. The … Continue reading

Posted: 27 Jun 2018 | 8:14 am

The Trusted Internet: Who governs who gets to buy spyware from surveillance software companies?

Posted by FSLabs @ 02:31 GMT

When hackers get hacked, that's when secrets are uncovered. On July 5th, Italian-based surveillance technology company Hacking Team was hacked. The hackers released a 400GB torrent file with internal documents, source code, and emails to the public - including the company's client list of close to 60 customers.

The list included countries such as Sudan, Kazakhstan and Saudi Arabia - despite official company denials of doing business with oppressive regimes. The leaked documents strongly implied that in the South-East Asian region, government agencies from Singapore, Thailand and Malaysia had purchased their most advanced spyware, referred to as a Remote Control System (RCS).

According to security researchers Citizen Lab, this spyware is extraordinarily intrusive, with the ability to turn on microphone and cameras on mobile devices, intercept Skype and instant messages, and use an anonymizer network of proxy servers to prevent harvested information from being traced back to the command and control servers.

Based on images of the client list posted to pastebin the software was purchased in Malaysia by the Malaysia Anti-Corruption Commission (MACC), Malaysia Intelligence (MI) and the Prime Minister's Office (PMO):

hacking_team_client_list (86k image)

Additional images of leaked invoices posted to medium.com indicated the spyware was sold through a locally-based Malaysian company named Miliserv Technologies (M) Sdb Bhd (registered with the Ministry of Finance Malaysia), which specializes in providing digital forensics, intelligent gathering and public security services:

hacking_team_hack_1 (95k image)

hacking_team_hack_2 (72k image)

Why the Prime Minister's Office would need surveillance software remains puzzling. Mind you, professional grade spyware ain't cheap - a license upgrade could cost you MYR400, 000 and maintenance renewal will set you back about MYR160,000.

According to reports of the incident in Malaysian alternative media, Malaysian government agencies have probably been using the spyware even before discovery of the FinFisher malware that was detected in the run-up to the 2013 General Elections.

Coincidentally, Malaysia has also been the frequent host of the annual ISS World Asia tradeshow, where companies promote their arsenal of 'lawful' surveillance software to law enforcement agencies, telco service provider or government employees. During the 2014 event, the Hacking Team was present and the associate lead sponsor of the event.

MiliServ Technologies is currently involved in the upcoming 2015 ISS World Asia in Kuala Lumpur. The event is invitation-only – though it may be interesting to see if Hacking Team will make it there this year.


Post by – Su Gim




On 08/07/15 At 02:31 AM

Posted: 15 Oct 2015 | 3:49 am