Author: admin

Truesec claims new Cicada3301 ransomware-as-a-service group could have ties to ALPHV/BlackCat and Brutus

Proofpoint has uncovered a new cyber-espionage campaign deploying new malware dubbed “Voldemort”

Interesting vulnerability:

…a special lane at airport security called Known Crewmember (KCM). KCM is a TSA program that allows pilots and flight attendants to bypass security screening, even when flying on domestic personal trips.

The KCM process is fairly simple: the employee uses the dedicated lane and presents their KCM barcode or provides the TSA agent their employee number and airline. Various forms of ID need to be presented while the TSA agent’s laptop verifies the employment status with the airline. If successful, the employee can access the sterile area without any screening at all.

A similar system also exists for cockpit access, called the Cockpit Access Security System (CASS). Most aircraft have at least one jumpseat inside the cockpit sitting behind the flying pilots. When pilots need to commute or travel, it is not always possible for them to occupy a revenue seat, so a jumpseat can be used instead. CASS allows the gate agent of a flight to verify that the jumpseater is an authorized pilot. The gate agent can then inform the crew of the flight that the jumpseater was authenticated by CASS.

[attack details omitted]

At this point, we realized we had discovered a very serious problem. Anyone with basic knowledge of SQL injection could login to this site and add anyone they wanted to KCM and CASS, allowing themselves to both skip security screening and then access the cockpits of commercial airliners.

We ended up finding several more serious issues but began the disclosure process immediately after finding the first issue.

Three men in the United Kingdom have pleaded guilty to operating otp[.]agency, a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.

Launched in November 2019, OTP Agency was a service for intercepting one-time passcodes needed to log in to various websites. Scammers who had already stolen someone’s bank account credentials could enter the target’s phone number and name, and the service would initiate an automated phone call to the target that warned them about unauthorized activity on their account.

The call would prompt the target to enter a one-time passcode that was sent to the user via SMS when the thieves attempted to log in. Any codes shared by the target were then relayed to the scammer’s user panel at the OTP Agency website.

A statement published Aug. 30 by the U.K.’s National Crime Agency (NCA) said three men pleaded guilty to running OTP Agency: Callum Picari, 22, from Hornchurch, Essex; Vijayasidhurshan Vijayanathan, 21, from Aylesbury, Buckinghamshire; and Aza Siddeeque, 19, from Milton Keynes, Buckinghamshire.

KrebsOnSecurity profiled OTP Agency in a February 2021 story about arrests tied to another phishing-related service based in the U.K. Someone claiming to represent OTP Agency then posted several comments on the piece, wherein they claimed the story was libelous and that they were a legitimate anti-fraud service. However, the service’s Telegram channel clearly showed its proprietors had built OTP Agency with one purpose in mind: To help their customers take over online accounts.

Within hours of that publication, OTP Agency shuttered its website and announced it was closing up shop and purging its user database. The NCA said the February 2021 story prompted a panicked message exchange between Picari and Vijayanathan:

Picari said: bro we are in big trouble… U will get me bagged… Bro delete the chat

Vijayanathan: Are you sure

Picari: So much evidence in there

Vijayanathan: Are you 100% sure

Picari: It’s so incriminating…Take a look and search ‘fraud’…Just think of all the evidence…that we cba to find…in the OTP chat…they will find

Vijayanathan: Exactly so if we just shut EVERYTHING down

Picari: They went to our first ever msg…We look incriminating…if we shut down…I say delete the chat…Our chat is Fraud 100%

Vijayanathan : Everyone with a brain will tell you stop it here and move on

Picari: Just because we close it doesn’t mean we didn’t do it…But deleting our chat…Will f*^k their investigations…There’s nothing fraudulent on the site

Despite deleting its Telegram channel, OTP Agency evidently found it difficult to walk away from its customers (and/or the money). Instead of shutting down as Vijayanathan wisely advised, just a few days later OTP Agency was communicating with customers on a new Telegram channel, offering a new login page and assuring existing customers that their usernames, passwords and balances would remain the same.

But that revival would be short-lived. The NCA said the site was taken offline less than a month later when the trio were arrested. NCA investigators said more than 12,500 people were targeted by OTP Agency users during the 18 month the service was active.

Picari was the owner, developer and main beneficiary of the service, and his personal information and ownership of OTP Agency was revealed in February 2020 in a “dox” posted to the now-defunct English-language cybercrime forum Raidforums. The NCA said it began investigating the service in June 2020.

OTP Agency might be gone, but several other similar OTP interception services are still in operation and accepting new customers, including a long-running service KrebsOnSecurity profiled in September 2021 called SMSRanger. More on SMSRanger in an upcoming post.

Text messages, emails and phone calls warning recipients about potential fraud are some of the most common scam lures. If someone (or something) calls saying they’re from your bank, or asks you to provide any personal or financial information, do not respond.  Just hang up, full stop.

If the call has you worried about the security and integrity of your account, check the account status online, or call your financial institution — ideally using a phone number that came from the bank’s Web site or from the back of your payment card.

Further reading: When in Doubt, Hang Up, Look Up, and Call Back

Forescout highlighted a 43% increase in published vulnerabilities in H1 2024, with attackers targeting flaws in VPNs and network infrastructure for initial access

In a campaign targeting Mongolian government websites, Russian-backed APT29 leveraged exploits previously used by spyware vendors NSO Group and Intellexa

Details.

Blog moderation policy.

Mobile banking is highly secure — when you take a few straightforward steps, it becomes even safer.

And those steps only take minutes, leaving you and your finances far more secure than before.

Use strong passwords.

Start here. Strong and unique passwords for each of your accounts form your first line of defense. However, one thing that can be a headache is the number of passwords we have to juggle — a number that seems like it’s growing every day. To help with that, you should strongly consider using a password manager. A good choice generates strong, unique passwords for each of your accounts and stores them securely for you.

If you want to set up your own passwords, check out this article on how you can make them strong and unique.

Use two-factor authentication to protect your accounts.

Two-factor authentication is practically a banking standard nowadays. What exactly is two-factor authentication? It’s an extra layer of defense for your accounts. With two-factor authentication, you also receive a special one-time-use code when logging in. That code might be sent to you via email or to your phone by text. In some cases, you can also receive that code by a call to your phone. In all, this makes it much tougher for a hacker to hijack your account.

Quick note — never share your unique code with anyone. If someone asks you for it at any time, it’s a scam.

Keep an eye out for phishing attacks.

Scammers use phishing attacks to steal personal info through emails, texts, and even social media messages. In the case of banking, they look to phish (“fish”) personal and financial info out of you by posing as your bank. They typically make their message sound urgent, like your account shows some unusual activity.

When you get these messages, always check the sender. Is the address or phone number one that your bank uses? And note that scammers often “spoof” addresses and phone numbers — making them look legit even though they’re fake. If you’re ever unsure, don’t reply. Contact your bank directly to see if your account indeed has an issue. Also, ignore such messages on social media. Banks don’t use social media messages to contact their account holders.

Yet better, you can use our Text Scam Detector to detect the sketchy links scammers use in their attacks. AI technology automatically detects scams by scanning URLs in your text messages. If you accidentally tap? Don’t worry, it can block risky sites if you tap on a suspicious link in texts, emails, social media, and more.

Be skeptical about calls as well. Fraudsters use the phone too.

It might seem a little traditional, yet criminals still like to use phone calls. In fact, they rely on the fact that many still see the phone as a trusted line of communication. This is known as “vishing,” which is short for “voice phishing.” The aim is the same as it is with phishing. The fraudster is looking to lure you into a bogus financial transaction or attempting to steal info, whether that’s financial, personal, or both.

The same advice applies here. End the call and then dial your bank directly to follow up.

Steer clear of financial transactions on public Wi-Fi in cafes, hotels, and elsewhere.

There’s a good reason not to use public Wi-Fi: it’s not private. They’re public networks, and that means they’re unsecured and shared by everyone who’s using it. With that, determined hackers can read any data passing through them like an open book. And that includes your accounts and passwords.

Instead of public Wi-Fi, use your smartphone’s data connection, which is far more secure. Yet better, consider connecting with a VPN. Short for a “virtual private network,” a VPN helps you stay safer with bank-grade encryption and private browsing. Think of it as a secure tunnel for your data, which keeps unwanted eyes from snooping. It’s a particularly excellent option if you find yourself needing to use public Wi-Fi, as a VPN effectively makes a public network connection private.

Protect your banking and finances even further

Some basic digital hygiene goes a long way toward protecting you even more. It’ll protect your banking and finances and all the things you do online as well.

Update your software.

That includes the operating system of your computers, smartphones, and tablets, along with the apps that are on them. Many updates include security upgrades and fixes that make it tougher for hackers to launch an attack.

Lock up.

Your computers, smartphones, and tablets have a way of locking them with a PIN, a password, your fingerprint, or your face. Take advantage of that protection, which is particularly important if your device is lost or stolen.

Use security software.

Protecting your devices with comprehensive online protection software fends off the latest malware, spyware, and ransomware attacks. Online protection like our McAfee+ plans further protects your privacy and identity in several ways:

• Credit Monitoring helps you keep an eye on changes to your credit score, report, and accounts with timely notifications. Spot something unusual? It offers guidance so you can tackle identity theft.
• Identity Monitoring checks the dark web for your personal info, including email, government IDs, credit card and bank account numbers, and more. If any of it shows up on the dark web, it sends you an alert with guidance that can help protect you from identity theft.
• Our online protection software also offers several transaction monitoring features. They track transactions on credit cards and bank accounts — shooting you a notice if unusual activity occurs. They also track retirement accounts, investments, and loans for questionable transactions. Finally, further features can help prevent a bank account takeover and keep others from taking out short-term payday loans in your name.
• And finally, should the unexpected happen, our Identity Theft Coverage & Restoration can get you on the path to recovery. It offers up to $2 million in coverage for legal fees, travel, and funds lost because of identity theft. Further, a licensed recovery pro can do the work for you, taking the necessary steps to repair your identity and credit.

The post How to Safely Bank Online appeared first on McAfee Blog.

North Korean groups exploited npm packages in coordinated attacks, targeting developers and cryptocurrency wallet browser extensions

BlackByte, linked to the Conti group, exploited VMware ESXi CVE-2024-37085 to control virtual machines