Author: admin

Some attacks also linked to LockBit deployment

When Doug says, “Happy Remote Code Execution Day, Duck”… it’s irony. For the avoidance of all doubt 🙂

Stanford and Georgetown have a new report on the security risks of AI—particularly adversarial machine learning—based on a workshop they held on the topic.

Jim Dempsey, one of the workshop organizers, wrote a blog post on the report:

As a first step, our report recommends the inclusion of AI security concerns within the cybersecurity programs of developers and users. The understanding of how to secure AI systems, we concluded, lags far behind their widespread adoption. Many AI products are deployed without institutions fully understanding the security risks they pose. Organizations building or deploying AI models should incorporate AI concerns into their cybersecurity functions using a risk management framework that addresses security throughout the AI system life cycle. It will be necessary to grapple with the ways in which AI vulnerabilities are different from traditional cybersecurity bugs, but the starting point is to assume that AI security is a subset of cybersecurity and to begin applying vulnerability management practices to AI-based features. (Andy Grotto and I have vigorously argued against siloing AI security in its own governance and policy vertical.)

Our report also recommends more collaboration between cybersecurity practitioners, machine learning engineers, and adversarial machine learning researchers. Assessing AI vulnerabilities requires technical expertise that is distinct from the skill set of cybersecurity practitioners, and organizations should be cautioned against repurposing existing security teams without additional training and resources. We also note that AI security researchers and practitioners should consult with those addressing AI bias. AI fairness researchers have extensively studied how poor data, design choices, and risk decisions can produce biased outcomes. Since AI vulnerabilities may be more analogous to algorithmic bias than they are to traditional software vulnerabilities, it is important to cultivate greater engagement between the two communities.

Another major recommendation calls for establishing some form of information sharing among AI developers and users. Right now, even if vulnerabilities are identified or malicious attacks are observed, this information is rarely transmitted to others, whether peer organizations, other companies in the supply chain, end users, or government or civil society observers. Bureaucratic, policy, and cultural barriers currently inhibit such sharing. This means that a compromise will likely remain mostly unnoticed until long after attackers have successfully exploited vulnerabilities. To avoid this outcome, we recommend that organizations developing AI models monitor for potential attacks on AI systems, create—formally or informally—a trusted forum for incident information sharing on a protected basis, and improve transparency.

Authored by Dexter Shin 

Minecraft is a popular video game that can be played on a desktop or mobile. This is a sandbox game developed by Mojang Studios. Players create and break apart various kinds of blocks in 3-dimensional worlds and they can select to enjoy Survivor Mode to survive in the wild or Creative Mode to focus on being creative. 

Minecraft’s popularity has led to many attempts to recreate similar games. As a result, there are so many games with the same concept as Minecraft worldwide. Even on Google Play, we can easily search for similar games. McAfee Mobile Research Team recently discovered 38 games with hidden advertising. These HiddenAds applications discovered on the Google Play Store and installed by at least 35 million users worldwide, have been found to send packets stealthily for advertising revenue in bulk.  

McAfee, a member of the App Defense Alliance, focused on protecting users by preventing threats from reaching their devices and improving app quality across the ecosystem. reported the discovered apps to Google, which took prompt action and the apps are no longer available on Google Play. Android users are protected by Google Play Protect, which can warn users of identified malicious apps on Android devices, and McAfee Mobile Security detects this threat as Android/HiddenAds.BJL. For more information, and to get fully protected, visit McAfee Mobile Security. 

How is it distributed to users? 

They were officially uploaded to Google Play under various titles and package names. Many games have already been downloaded by users, including apps with 10M+ downloads. 

Figure 1. 10M+ downloaded app being one of them 

Also, because they can play the game, users can’t notice the large amount of advertising packets being generated on their devices. 

Figure 2. Game screen that can be played 

What does it do?

After the game is running, the user can play without any problems in the block-based world, only like Minecraft-type games. However, advertisement packets of various domains continuously occur on the device. For example, the four packets shown in the picture are questionable packets generated by the ads libraries of Unity, Supersonic, Google, and AppLovin. Unfortunately, nothing is displayed on the game screen. 

Figure 3. Continuous advertising packets 

What’s even more interesting is the initial network packets of these games. The structure of the initial packet is very similar. All domains are different. But using 3.txt as the path is equivalent. That is, packets in the form of https://(random).netlify.app/3.txt commonly occur first. The picture below is an example of the first packet extracted from three different apps. 

Figure 4. Similarity of the initial packet form 

Users affected worldwide 

This threat has been detected in various countries around the world. Indicated by our telemetry, the threat has been most prominently detected in the United States, Canada, South Korea, and Brazil.

 

Figure 5. Users around the world who are widely affected 

 

As we featured in the McAfee 2023 Consumer Mobile Threat Report, one of the most accessible content for young people using mobile devices is games. Malware authors are also aware of this and try to hide their malicious features inside games. Not only is it difficult for general users to find these hidden features, but they can easily trust games from official stores such as Google Play. 

 

We first recommend that users thoroughly review user reviews before downloading applications from the store. And users should install security software on their devices and always keep up to date. 

 

Indicators of Compromise 

 

Package Name	Application Name	SHA256	GooglePlay  Downloads
com.good.robo.game.builder.craft.block	Block Box Master Diamond	300343e701afddbf32bca62916fd717f2af6e8a98fd78cc50d11f1154971d857	10M+
com.craft.world.fairy.fun.everyday.block	Craft Sword Mini Fun	72fa914ad3460f9e696ca2264fc899cad20b06b640a7adf8cfe87dd0ea19e137	5M+
com.skyland.pet.realm.block.rain.craft	Block Box Skyland Sword	d15713467be2f60b2bc548ddb24f202eb64f2aed3fb8801daec14e708f5cee5b	5M+
com.skyland.fun.block.game.monster.craft	Craft Monster Crazy Sword	cadbc904e77feaaf4294d218808f43d50809a87202292e78b0e6a3e164de6851	5M+
com.monster.craft.block.fun.robo.fairy	Block Pro Forrest Diamond	08429992bef8259e3011af36ad9d3c2a61b8df384860fd2a007a32a1e4d634af	1M+
com.cliffs.realm.block.craft.rain.vip	Block Game Skyland Forrest	34ef407f2bedfd8485f6a178f14ee023d395cb9b76ff1754e8733c1fc9ce01fb	1M+
com.block.builder.build.clever.craft.boy	Block Rainbow Sword Dragon	23aa3cc9481591b524a442fa8df485226e21da9d960dc5792af4ae2a096593d5	1M+
com.fun.skyland.craft.block.monster.loki	Craft Rainbow Mini Builder	88fa7de264c5880e65b926df4f75ac6a2900e3718d9d3576207614e20f674068	1M+
com.skyland.craft.caves.game.monster.block	Block Forrest Tree Crazy	010c081e5fda58d6508980528efb4f75e572d564ca9b5273db58193c59987abf	1M+
com.box.block.craft.builder.cliffs.build	Craft Clever Monster Castle	11c5e2124e47380d5a4033c08b2a137612a838bc46f720fba2a8fe75d0cf4224	500K+
com.block.sun.game.box.build.craft	Block Monster Diamond Dragon	19ad0dc40772d29f7f39b3a185abe50d0917cacf5f7bdc577839b541f61f7ac0	500K+
com.builder.craft.diamond.block.clever.robo	Craft World Fun Robo	746e2f552fda2e2e9966fecf6735ebd5a104296cde7208754e9b80236d13e853	500K+
com.block.master.boy.craft.cliffs.diamond	Block Pixelart Tree Pro	25b22e14f0bb79fc6b9994faec984501d0a2bf5573835d411eb8a721a8c2e397	500K+
com.fun.block.everyday.boy.robo.craft	Craft Mini Lucky Fun	9fdddf4a77909fd1d302c8f39912a41483634db66d30f89f75b19739eb8471ff	500K+
com.builder.craft.block.sun.game.mini	Block Earth Skyland World	b9284db049c0b641a6b760e7716eb3561e1b6b1f11df8048e9736eb286c2beed	500K+
com.dragon.craft.world.pixelart.block.vip	Block Rainbow Monster Castle	d6984e08465f08e9e39a0cad8da4c1e405b3aa414608a6d0eaa5409e7ed8eac1	500K+
com.craft.vip.earth.everyday.block.game	Block Fun Rainbow Builder	f3077681623d9ce32dc6a9cbf5d6ab7041297bf2a07c02ee327c730e41927c5f	500K+
com.block.good.mini.craft.box.best	Craft Dragon Diamond Robo	e685fb5a426fe587c3302bbd249f8aa9e152c1de9b170133dfb492ed5552acc9	500K+
com.lucky.robo.craft.loki.block.good	Block World Tree Monster	06c3ba10604c38006fd34406edd47373074d57c237c880a19fb8d3f34572417d	100K+
com.caves.robo.craft.dragon.block.earth	Block Diamond Boy Pro	122406962c303eaeb9839d767835a82ae9d745988deeef4c554e1750a5106cf0	100K+
com.tree.world.city.block.craft.crazy	Block Lucky Master Earth	e69fe06cb77626be76f2c92ad4229f6eb04c06c73e153d5424386a1309adbd15	100K+
com.game.skyland.craft.monster.block.best	Craft Forrest Mini Fun	e5fc2e6e3749cb4787a8bc5387ebb7802a2d3f9b408e4d2d07ee800056bb3e16	100K+
com.everyday.vip.caves.house.block.craft	Craft Sword City Pro	318165fd8d77a63ca221f5d3ee163e6f2d6df1f2df5c169aca6aca23aef2cf25	100K+
com.cell.rain.block.craft.loki.fairy	Block Loki Monster Builder	4f22be2ce64376f046ca180bd9933edcd62fd36f4a7abc39edf194f7170e2534	100K+
com.block.good.sun.boy.craft.fun	Block Boy Earth Mini	3b0cf56fb5929d23415259b718af15118c44cf918324cc62c1134bf9bc0f2a00	100K+
com.fairy.builder.sun.skyland.craft.block	Block Crazy Builder City	537638903f31e32612bddc79a483cb2c7546966cca64c5becec91d6fc4835e22	100K+
com.monster.house.good.block.earth.craft	Craft Sword Vip Pixelart	5f85f020eb8afc768e56167a6d1b75b6d416ecb1ec335d4c1edb6de8f93a3cad	100K+
com.block.best.boy.craft.sword.cell	Block City Fun Diamond	698544a913cfa5df0b2bb5d818cc0394c653c9884502a84b9dec979f8850b1e7	100K+
com.crazy.clever.city.block.caves.craft	Craft City Loki Rainbow	ba50dc2d2aeef9220ab5ff8699827bf68bc06caeef1d24cb8d02d00025fcb41c	100K+
com.cliffs.builder.craft.block.lucky.earth	Craft Boy Clever Sun	77962047b32a44c472b89d9641d7783a3e72c156b60eaaec74df725ffdc4671b	100K+
com.lucky.best.block.game.diamond.craft	Block City Dragon Sun	ac3d0b79903b1e63b449b64276075b337b002bb9a9a9636a47fdd1fb7a0fe368	100K+
com.build.craft.boy.loki.master.block	Craft Loki Forrest Monster	a2db1eba73d911142134ee127897d5857c521135a8ee768ae172ae2d2ee7b1d4	100K+
com.build.lokicrafts.master.forest	Lokicraft: Forrest Survival 3D	0f53996f5e3ec593ed09e55baf1f93d32d891f7d7e58a9bf19594b235d3a8a84	50K+
com.sun.realm.craft.lucky.dragon.block	Craft Castle Sun Rain	1e74e73bc29ce1f55740e52250506447b431eb8a4c20dfc75fd118b05ca18674	50K+
com.block.craft.vip.sun.game.box	Craft Game Earth World	7483b6a493c0f4f6309e21cc553f112da191b882f96a87bce8d0f54328ac7525	50K+
com.rain.crazy.lucky.pro.block.craft	Craft Lucky Castle Builder	de5eb8284ed56e91e665d13be459b9a0708fa96549a57e81aa7c11388ebfa535	50K+
com.JavaKidz.attacksnake	Craftsman: Building City 2022	e19fcc55ec4729d52dc0f732da02dc5830a2f78ec2b1f37969ee3c7fe16ddb37	50K+
com.skyland.house.block.craft.crazy.vip	Craft Rainbow Pro Rain	a7675a08a0b960f042a02710def8dd445d9109ca9da795aed8e69a79e014b46f	50K+

 

The post HiddenAds Spread via Android Gaming Apps on Google Play appeared first on McAfee Blog.

A shocking number of organizations — including banks and healthcare providers — are leaking private and sensitive information from their public Salesforce Community websites, KrebsOnSecurity has learned. The data exposures all stem from a misconfiguration in Salesforce Community that allows an unauthenticated user to access records that should only be available after logging in.

Salesforce Community is a widely-used cloud-based software product that makes it easy for organizations to quickly create websites. Customers can access a Salesforce Community website in two ways: Authenticated access (requiring login), and guest user access (no login required). The guest access feature allows unauthenticated users to view specific content and resources without needing to log in.

However, sometimes Salesforce administrators mistakenly grant guest users access to internal resources, which can cause unauthorized users to access an organization’s private information and lead to potential data leaks.

Until being contacted by this reporter on Monday, the state of Vermont had at least five separate Salesforce Community sites that allowed guest access to sensitive data, including a Pandemic Unemployment Assistance program that exposed the applicant’s full name, Social Security number, address, phone number, email, and bank account number.

Vermont’s Chief Information Security Officer Scott Carbee said his security teams have been conducting a full review of their Salesforce Community sites, and already found one additional Salesforce site operated by the state that was also misconfigured to allow guest access to sensitive information.

“My team is frustrated by the permissive nature of the platform,” Carbee said.

Carbee said the vulnerable sites were all created rapidly in response to the Coronavirus pandemic, and were not subjected to their normal security review process.

“During the pandemic, we were largely standing up tons of applications, and let’s just say a lot of them didn’t have the full benefit of our dev/ops process,” Carbee said. “In our case, we didn’t have any native Salesforce developers when we had to suddenly stand up all these sites.”

Earlier this week, KrebsOnSecurity notified Columbus, Ohio-based Huntington Bank that its recently acquired TCF Bank had a Salesforce Community website that was leaking documents related to commercial loans. The data fields in those loan applications included name, address, full Social Security number, title, federal ID, IP address, average monthly payroll, and loan amount.

Huntington Bank has disabled the leaky TCF Bank Salesforce website. Matthew Jennings, deputy chief information security officer at Huntington, said the company was still investigating how the misconfiguration occurred, how long it lasted, and how many records may have been exposed.

KrebsOnSecurity learned of the leaks from security researcher Charan Akiri, who said he wrote a program that identified hundreds of other organizations running misconfigured Salesforce pages. But Akiri said he’s been wary of probing too far, and has had difficulty getting responses from most of the organizations he has notified to date.

“In January and February 2023, I contacted government organizations and several companies, but I did not receive any response from these organizations,” Akiri said. “To address the issue further, I reached out to several CISOs on LinkedIn and Twitter. As a result, five companies eventually fixed the problem. Unfortunately, I did not receive any responses from government organizations.”

The problem Akiri has been trying to raise awareness about came to the fore in August 2021, when security researcher Aaron Costello published a blog post explaining how misconfigurations in Salesforce Community sites could be exploited to reveal sensitive data (Costello subsequently published a follow-up post detailing how to lock down Salesforce Community sites).

On Monday, KrebsOnSecurity used Akiri’s findings to notify Washington D.C. city administrators that at least five different public DC Health websites were leaking sensitive information. One DC Health Salesforce Community website designed for health professionals seeking to renew licenses with the city leaked documents that included the applicant’s full name, address, Social Security number, date of birth, license number and expiration, and more.

Akiri said he notified the Washington D.C. government in February about his findings, but received no response. Reached by KrebsOnSecurity, interim Chief Information Security Officer Mike Rupert initially said the District had hired a third party to investigate, and that the third party confirmed the District’s IT systems were not vulnerable to data loss from the reported Salesforce configuration issue.

But after being presented with a document including the Social Security number of a health professional in D.C. that was downloaded in real-time from the DC Health public Salesforce website, Rupert acknowledged his team had overlooked some configuration settings.

Washington, D.C. health administrators are still smarting from a data breach earlier this year at the health insurance exchange DC Health Link, which exposed personal information for more than 56,000 users, including many members of Congress.

That data later wound up for sale on a top cybercrime forum. The Associated Press reports that the DC Health Link breach was likewise the result of human error, and said an investigation revealed the cause was a DC Health Link server that was “misconfigured to allow access to the reports on the server without proper authentication.”

Salesforce says the data exposures are not the result of a vulnerability inherent to the Salesforce platform, but they can occur when customers’ access control permissions are misconfigured.

“As previously communicated to all Experience Site and Sites customers, we recommend utilizing the Guest User Access Report Package to assist in reviewing access control permissions for unauthenticated users,” reads a Salesforce advisory from Sept. 2022. “Additionally, we suggest reviewing the following Help article, Best Practices and Considerations When Configuring the Guest User Profile.”

In a written statement, Salesforce said it is actively focused on data security for organizations with guest users, and that it continues to release “robust tools and guidance for our customers,” including:

Guest User Access Report 

Control Which Users Experience Cloud Site Users Can See

Best Practices and Considerations When Configuring the Guest User Profile

“We’ve also continued to update our Guest User security policies, beginning with our Spring ‘21 release with more to come in Summer ‘23,” the statement reads. “Lastly, we continue to proactively communicate with customers to help them understand the capabilities available to them, and how they can best secure their instance of Salesforce to meet their security, contractual, and regulatory obligations.”

ISACA’s Rob Clyde tells Infosecurity about the role of the guidance as well as new findings about cyber insurance

As tensions rise between China and Taiwan, US Government officials are keen to implement lessons learned from Ukraine’s cyberwar

CISOs from the NBA, NFL and NHL discuss their close cooperation to mitigate the unique cyber risks they experience

Bug has potential to facilitate 2200x amplification attacks

According to Unit 42, the variant uses the same AES key as the original Windows PE malware