Author: admin

Twitter was fined $150 million for using phone numbers and email addresses collected for two-factor authentication for ad targeting.

https://origin-blogs.mcafee.com/blogs

The post Test Test 2 appeared first on McAfee Blog.

McAfee Labs have been observing a spike in phishing campaigns that utilize Microsoft office macro capabilities. These malicious documents reach victims via mass spam E-mail campaigns and generally invoke urgency, fear, or similar emotions, leading unsuspecting users to promptly open them. The purpose of these spam operations is to deliver malicious payloads to as many people as possible. 

A recent spam campaign was using malicious word document to download and execute the Ursnif trojan. Ursnif is a high-risk trojan designed to record various sensitive information. It typically archives this sensitive data and sends it back to a command-and-control server. 

 

This blog describes how attackers use document properties and a few other techniques to download and execute the Ursnif trojan. 

Threat Summary 

• The initial attack vector is a phishing email with a Microsoft Word document attachment. 
• Upon opening the document, VBA executes a malicious shellcode 

• Shellcode downloads the remote payload, Ursnif, and invokes rundll32.exe to execute it. 

Infection Chain 

The malware arrives through a phishing email containing a Microsoft Word document as an attachment. When the document is opened and macros are enabled, Word downloads a DLL (Ursnif payload). The Ursnif payload is then executed using rundll32.exe 

 

Figure-1: flowchart of infection chain 

Word Analysis 

Macros are disabled by default and the malware authors are aware of this and hence present an image to entice the victims into enabling them.  

Figure-2: Image of what the user sees upon opening the document 

 

VBA Macro Analysis of Word Document 

Analyzing the sample statically with ‘oleId’ and ‘olevba’ indicates the suspicious vectors.. 

 

Figure-3: Oleid output 

 

 

Figure-4: Olevba output 

 

 

 

 

 

 

The VBA Macro is compatible with x32 and x64 architectures and is highly obfuscated as seen in Figure-5 

 

Figure-5: Obfuscated VBA macro 

 

To get a better understanding of the functionality, we have de-obfuscated the contents in the 2 figures shown below. 

 

Figure-6: De-obfuscated VBA macro (stage 1) 

Figure-7: De-obfuscated VBA macro (stage 2) 

 

 

An interesting characteristic of this sample is that some of the strings like CLSID, URL for downloading Ursnif, and environment variables names are stored in custom document properties in reverse. As shown in Figure-7, VBA function “ActiveDocument.CustomDocumentProperties()” is used to retrieve the properties and uses “StrReverse” to reverse the contents. 

We can see the document properties in Figure-8  

    

Figure-8: Document properties 

 

Payload Download and Execution: 

The malicious macro retrieves hidden shellcode from a custom property named “Company” using the “cdec” function that converts the shellcode from string to decimal/hex value and executes it. The shellcode is shown below. 

 

Figure-9: Raw Company property 

 

The shellcode is  written to memory and the access protection is changed to PAGE_EXECUTE_READWRITE. 

 

Figure-10: Code of VirtualProtect 

 

 

Figure-11: Shellcode’s memory and protection after calling VirtualProtect() 

 

After adding the shellcode in memory, the environment variable containing the malicious URL of Ursnif payload is created. This Environment variable will be later used by the shellcode. 

 

Figure-12: Environment variable set in Winword.exe space 

 

 

The shellcode is executed with the use of the SetTimer API. SetTimer creates a timer with the specified time-out value mentioned and notifies a function when the time is elapsed. The 4th parameter used to call SetTimer is the pointer to the shellcode in memory which will be invoked when the mentioned time is elapsed. 

 

Figure-13: SetTimer function (Execution of shellCode) 

 

The shellcode downloads the file from the URL stored in the environmental variable and stores it as ” y9C4A.tmp.dll ” and executes it with rundll32.exe. 

 

URL	hxxp://docmasterpassb.top/kdv/x7t1QUUADWPEIQyxM6DT3vtrornV4uJcP4GvD9vM/
CMD	rundll32 “C:UsersuserAppDataLocalTempy9C4A.tmp.dll”,DllRegisterServer

 

 

Figure-14: Exports of Downloaded DLL 

 

After successful execution of the shellcode, the environment variable is removed. 

 

Figure-15: Removal of Environment Variable 

IOC 

TYPE	VALUE	PRODUCT	DETECTION NAME
Main Word Document	6cf97570d317b42ef8bfd4ee4df21d217d5f27b73ff236049d70c37c5337909f	McAfee LiveSafe and Total Protection	X97M/Downloader.CJG
Downloaded dll	41ae907a2bb73794bb2cff40b429e62305847a3e1a95f188b596f1cf925c4547	McAfee LiveSafe and Total Protection	Ursnif-FULJ
URL to download dll	hxxp://docmasterpassb.top/kdv/x7t1QUUADWPEIQyxM6DT3vtrornV4uJcP4GvD9vM/	WebAdvisor	Blocked

 

MITRE Attack Framework 

Technique ID	Tactic	Technique Details	Description
T1566.001	Initial Access	Spear phishing Attachment	Manual execution by user
T1059.005	Execution	Visual Basic	Malicious VBA macros
T1218.011	Defense Evasion	Signed binary abuse	Rundll32.exe is used
T1027	Defense Evasion	Obfuscation techniques	VBA and powershell base64 executions
T1086	Execution	Powershell execution	PowerShell command abuse

 

Conclusion 

Macros are disabled by default in Microsoft Office applications, we suggest keeping it that way unless the document is received from a trusted source. The infection chain discussed in the blog is not limited to Word or Excel. Further threats may use other live-off-the-land tools to download its payloads.  

McAfee customers are protected against the malicious files and sites detailed in this blog with McAfee LiveSafe/Total Protection and McAfee Web Advisor. 

The post Test Post appeared first on McAfee Blog.

Mobile banking and finance apps have become increasingly popular in recent years. These apps provide a quick and convenient way to see checking and savings account balances and make and receive payments.  

It’s no surprise that many people use these third-party apps to manage their finances. In 2021, the U.S. saw 573.1 million finance app downloads, a 19% increase from the previous year. 

However, despite its benefits, mobile banking isn’t immune to risks. This article will discuss the safety and security of mobile finance apps and give you a few pointers to protect yourself while using these apps. 

Is mobile banking safe?

Yes, mobile banking is a pretty safe way to manage your finances; however, there can still be some risks associated with it, including fraud and scams.  

If you’re careful, there are plenty of ways to protect yourself while using this incredibly easy banking method. 

6 tips to improve mobile finance app security

Here are a few tips to help you improve the safety of your online financial accounts. 

Ensure you’re downloading the official app

A bank’s website will often include links to their mobile apps that provide related mobile banking services, along with details about the app’s features and how users can use it. You should use a trusted platform when installing the app, like the App Store for iPhone or iOS users or the Google Play Store for Android users.  

You should also take time to go through reviews and related information about the app before downloading it to ensure its legitimacy. If you have any doubts, clarify the issue with your bank before downloading what could be a fake banking app. 

Set a strong password 

While this may seem obvious, the reality is that many people don’t pay enough attention to their passwords. To create a strong password, you should use a combination of uppercase and lowercase letters, numbers, and special characters in no particular order or pattern.  

In addition, security experts recommend long, complex passwords to exponentially increase the time it takes to crack them. It also helps to have unique passwords for each of your accounts.  

If you’re concerned about remembering and managing multiple passwords, you can use a reputable and secure password manager like McAfee True Key to store your passwords.  

Use two-factor authentication when possible

Many services nowadays offer two-factor or multifactor authentication. This function refers to the additional layers of security against hackers. On top of a traditional username-password login, users are required to identify themselves with a code that’s sent to their cellphone or email. 

By confirming the user’s identity this way, organizations eliminate a degree of uncertainty. While it isn’t foolproof, two-factor or multifactor authentication helps increase security. It’s worth checking if your finance app offers this feature. 

Avoid public Wi-Fi when using finance apps

Public Wi-Fi networks are convenient in urgent situations; however, they often come with a warning saying the network is unsecured. This means that the network is unencrypted, making it easy for hackers to access your personal information. The best practice is to avoid using public Wi-Fi networks, especially when carrying out any form of financial transaction.  

If you need to make purchases or send and receive money while on the move, though, you’ll want to consider a virtual private network (VPN) like McAfee Secure VPN. The VPN provides a secure network even when using public Wi-Fi by hiding your IP address and encrypting your data. 

Get email/text alerts for potential fraud

The easiest way to protect your finances is to keep a vigilant eye on all of your transactions. However, security notifications from your bank are a great added measure. Most credit card companies allow you to turn on transaction alerts for various services, such as balance transfer requests, international purchases, and exceeded credit limits, which can help you recognize any suspicious activity on your account.  

It’s also important to remember that financial institutions will never contact you over the phone or through email to ask for your banking information. If you receive such a message, it’s most certainly a scam. A common way people get duped is through calls or emails claiming they’ve won a prize and need to share personal account details to receive the money. Never share your bank account details, passwords, or one-time codes with strangers.  

Always check with your bank to confirm any activity that seems out of the ordinary. In addition to alert notifications, banks can also send helpful tips to protect your account against fraud. 

Use McAfee Security for Mobile

McAfee Security for Mobile is an award-winning cybersecurity tool that helps address the issues mentioned above and more. It’ll scan your device for malware, suspicious websites, and unsecured Wi-Fi networks so you can use social media or shop online with complete peace of mind.  

It also comes with other features, like system cleaning services that clean junk from your phone’s storage. These features can boost battery life and help locate your phone if it’s ever stolen or misplaced.  

Are mobile banking apps as safe as online banking?

Mobile and online banking both have their benefits and drawbacks, but which is the safer option? Experts often have varied opinions on the matter.  

Some people believe it might be easier to download malware on a computer unknowingly, as it’s tricky to judge the authenticity of a website or malicious links. Users typically download apps from reputed app stores when using mobile devices, which lowers the risk. 

On the other hand, professionals believe that both methods are equally safe. The choice depends on the network available to the user, as private networks are significantly less susceptible to hacking than public ones. Some users may prefer computers to mobile phones simply because they find it easier to perform tasks on a bigger screen. 

See how McAfee Security for Mobile keeps your device safe

Both internet and mobile banking are convenient and offer a quick way to manage your personal finances, as you don’t have to travel to a physical bank or carry large amounts of cash in your wallet.  

However, while mobile banking is generally considered a safe method of managing your finances, it can have some vulnerabilities that scammers may try to take advantage of. 

Following the tips mentioned above — like using a private network, not sharing personal details with anyone, and using a comprehensive mobile security tool like McAfee Security for Mobile — can make all the difference.  

The tool’s security features include safe browsing, a secure VPN, and antivirus software. This means you can use your mobile finance apps confidently knowing McAfee is looking out for you. 

The post How to Know If Your Mobile Finance Apps Are Safe appeared first on McAfee Blog.

Government and law enforcement officials joined with Microsoft outlined how they took down the most impactful nation-state attackers

CISA published a new advisory warning organizations about China-based, state-sponsored cyber-attacks

Vendor assessment process expert Whistic announced the closing of its Series B Funding on Tuesday.

A panel discussion at RSA gave organizations a chance to prioritize upcoming attack vectors

Carol Barkes discussed the physiological considerations a CISO should consider when dealing with a panicked C-suite

Current cyber activities and future trends from criminal and nation-state actors was set out during a session at RSA 2022