Author: admin

Latest episode – listen now!

Privilege escalation flaw discovered in the Jupiter and JupiterX Core Plugin affects more than 90,000 sites.

A surprising number of websites include JavaScript keyloggers that collect everything you type as you type it, not just when you submit a form.

Researchers from KU Leuven, Radboud University, and University of Lausanne crawled and analyzed the top 100,000 websites, looking at scenarios in which a user is visiting a site while in the European Union and visiting a site from the United States. They found that 1,844 websites gathered an EU user’s email address without their consent, and a staggering 2,950 logged a US user’s email in some form. Many of the sites seemingly do not intend to conduct the data-logging but incorporate third-party marketing and analytics services that cause the behavior.

After specifically crawling sites for password leaks in May 2021, the researchers also found 52 websites in which third parties, including the Russian tech giant Yandex, were incidentally collecting password data before submission. The group disclosed their findings to these sites, and all 52 instances have since been resolved.

“If there’s a Submit button on a form, the reasonable expectation is that it does something — that it will submit your data when you click it,” says Güneş Acar, a professor and researcher in Radboud University’s digital security group and one of the leaders of the study. “We were super surprised by these results. We thought maybe we were going to find a few hundred websites where your email is collected before you submit, but this exceeded our expectations by far.”

Research paper.

Authored by Jyothi Naveen and Kiran Raj

McAfee Labs have been observing a spike in phishing campaigns that utilize Microsoft office macro capabilities. These malicious documents reach victims via mass spam E-mail campaigns and generally invoke urgency, fear, or similar emotions, leading unsuspecting users to promptly open them. The purpose of these spam operations is to deliver malicious payloads to as many people as possible.

A recent spam campaign was using malicious word documents to download and execute the Ursnif trojan. Ursnif is a high-risk trojan designed to record various sensitive information. It typically archives this sensitive data and sends it back to a command-and-control server.

This blog describes how attackers use document properties and a few other techniques to download and execute the Ursnif trojan.

Threat Summary

• The initial attack vector is a phishing email with a Microsoft Word document attachment.
• Upon opening the document, VBA executes a malicious shellcode
• Shellcode downloads the remote payload, Ursnif, and invokes rundll32.exe to execute it.

Infection Chain

The malware arrives through a phishing email containing a Microsoft Word document as an attachment. When the document is opened and macros are enabled, Word downloads a DLL (Ursnif payload). The Ursnif payload is then executed using rundll32.exe

Word Analysis

Macros are disabled by default and the malware authors are aware of this and hence present an image to entice the victims into enabling them.

VBA Macro Analysis of Word Document

Analyzing the sample statically with ‘oleId’ and ‘olevba’ indicates the suspicious vectors..

The VBA Macro is compatible with x32 and x64 architectures and is highly obfuscated as seen in Figure-5

To get a better understanding of the functionality, we have de-obfuscated the contents in the 2 figures shown below.

An interesting characteristic of this sample is that some of the strings like CLSID, URL for downloading Ursnif, and environment variables names are stored in custom document properties in reverse. As shown in Figure-7, VBA function “ActiveDocument.CustomDocumentProperties()” is used to retrieve the properties and uses “StrReverse” to reverse the contents. 

We can see the document properties in Figure-8  

Payload Download and Execution: 

The malicious macro retrieves hidden shellcode from a custom property named “Company” using the “cdec” function that converts the shellcode from string to decimal/hex value and executes it. The shellcode is shown below. 

The shellcode is written to memory and the access protection is changed to PAGE_EXECUTE_READWRITE. 

After adding the shellcode in memory, the environment variable containing the malicious URL of Ursnif payload is created. This Environment variable will be later used by the shellcode. 

The shellcode is executed with the use of the SetTimer API. SetTimer creates a timer with the specified time-out value mentioned and notifies a function when the time is elapsed. The 4th parameter used to call SetTimer is the pointer to the shellcode in memory which will be invoked when the mentioned time is elapsed. 

The shellcode downloads the file from the URL stored in the environmental variable and stores it as ” y9C4A.tmp.dll ” and executes it with rundll32.exe. 

URL	hxxp://docmasterpassb.top/kdv/x7t1QUUADWPEIQyxM6DT3vtrornV4uJcP4GvD9vM/
CMD	rundll32 “C:UsersuserAppDataLocalTempy9C4A.tmp.dll”,DllRegisterServer

After successful execution of the shellcode, the environment variable is removed. 

IOC 

TYPE	VALUE	PRODUCT	DETECTION NAME
Main Word Document	6cf97570d317b42ef8bfd4ee4df21d217d5f27b73ff236049d70c37c5337909f	McAfee LiveSafe and Total Protection	X97M/Downloader.CJG
Downloaded dll	41ae907a2bb73794bb2cff40b429e62305847a3e1a95f188b596f1cf925c4547	McAfee LiveSafe and Total Protection	Ursnif-FULJ
URL to download dll	hxxp://docmasterpassb.top/kdv/x7t1QUUADWPEIQyxM6DT3vtrornV4uJcP4GvD9vM/	WebAdvisor	Blocked

MITRE Attack Framework 

Technique ID	Tactic	Technique Details	Description
T1566.001	Initial Access	Spear phishing Attachment	Manual execution by user
T1059.005	Execution	Visual Basic	Malicious VBA macros
T1218.011	Defense Evasion	Signed binary abuse	Rundll32.exe is used
T1027	Defense Evasion	Obfuscation techniques	VBA and powershell base64 executions
T1086	Execution	Powershell execution	PowerShell command abuse

 Conclusion 

Macros are disabled by default in Microsoft Office applications, we suggest keeping it that way unless the document is received from a trusted source. The infection chain discussed in the blog is not limited to Word or Excel. Further threats may use other live-off-the-land tools to download its payloads.  

McAfee customers are protected against the malicious files and sites detailed in this blog with McAfee LiveSafe/Total Protection and McAfee Web Advisor. 

The post Phishing Campaigns featuring Ursnif Trojan on the Rise appeared first on McAfee Blog.

There’s a digital counterpart for nearly everything we do, which means more of our personal information is online. And although this tends to make our lives easier, it opens the door for information to land in the wrong hands. Identity theft happens when someone uses your personal identifiable information (PII) for their own monetary or personal gain. Sensitive data like credit card numbers and Social Security numbers can be incredibly valuable if it gets into the wrong hands.  

The good news is that you can take steps to minimize the risk of identity theft. This article breaks down some of the most interesting fraud statistics and trends about identity theft in the United States and offers ways to protect your personal data from cybercriminals. 

Identity theft by the numbers

The number of identity theft cases reported to the Federal Trade Commission (FTC) has increased in the last five years. According to the FTC’s Consumer Sentinel Network (CSN) report, the number of reported cases more than doubled from 2019 to 2020.  

One possible reason for this upward trend is the coronavirus pandemic. Congress passed legislation that included more than $5 trillion in various government benefits. This money was helpful to out-of-luck Americans, but it was also extremely attractive to scammers who used the opportunity to create fake identities and steal unemployment checks. In fact, the most common type of identity theft this past year was government documents and benefits fraud.  

What else do the numbers say about the rise in identity theft? Let’s take a closer look: 

• An estimated 15 million Americans had their identity stolen in 2021, according to Javelin Strategy; however, a huge majority of cases went unreported (Source: Javelin Strategy & Research | 2022 Identity Fraud Study: The Virtual Battleground) 
• Last year, the FTC received more than 1.4 million reports of identity theft (Source: Federal Trade Commission | Consumer Sentinel Network Data Book 2021)  
• Identity thieves stole around $52 billion from Americans last year (Source: Javelin Strategy & Research | 2022 Identity Fraud Study: The Virtual Battleground) 
• More than 40 million U.S. consumers fell victim to identity theft in 2021 (Source: Javelin Strategy & Research | 2022 Identity Fraud Study: The Virtual Battleground) 
• The most likely victims of identity theft in 2021 were people from 30 to 39 years old (Source: Federal Trade Commission | Consumer Sentinel Network Data Book 2021)  
• Criminals have stolen more than $750 million from taxpayers through COVID-19 stimulus scams since January 2020 (Source: Federal Trade Commission | FTC COVID-19 and Stimulus Reports)  

These statistics only scratch the surface, though. Keep reading to learn more about the latest identity theft data and what you can do to protect your personal information.  

How common is identity theft in the U.S.?

Identity theft is a huge issue in the United States, and it doesn’t seem to be going away anytime soon. Fraud reports show that the number of identity thefts in the U.S. continues to grow and grow. The graph below shows the number of identity theft reports from the first quarter of 2017 to the first quarter of 2021.  

The reported instances of identity theft have risen sharply from just over 100,000 in the first quarter of 2017 to well over 500,000 in the first quarter of 2021. 2020 had the sharpest increase in reports, as cybercriminals did their best to capitalize on the pandemic to take people’s government benefits.  

Identity theft, by state  

Not every state is affected by ID theft equally. Where you live can have a big impact on your likelihood of experiencing identity theft. The graph below shows the amount of identity theft cases reported to the FTC per 100,000 residents for each state in the U.S.  

With a closer look, the five states with the most identity theft reports include Georgia, Louisiana, Illinois, Kansas, and Rhode Island, which takes the top spot. The number of reports in Rhode Island more than doubled in 2021, from 1,191 in 2020 to 2,857.  

At the other end of the spectrum, South Dakota remained the state with the lowest occurrence of identity theft, with only 76 residents per 100,000 experiencing it.  

Here’s a list of the 20 metro cities where you have the highest chance of having your identity stolen. 

Who are the victims of identity theft?

Anyone can become the victim of identity theft, in large part because so much of our information is online. However, certain age groups are more likely to experience different types of scams.  

For example, baby boomers are more likely than Generation Z to benefit from government programs. This makes them more susceptible to scams like benefits fraud (where a criminal poses as someone else to steal government benefits).  

On the other hand, younger generations like millennials have grown up with the internet, and activities like shopping online are more frequent. This makes them more susceptible to identity theft through credit card fraud.  

Here’s a breakdown of the most common identity theft types from various generations:  

Types of identity theft

There are several different types of identity theft, ranging from stolen financial information to compromised health care data. Some forms are pretty straightforward. For instance, credit card fraud occurs when somebody steals your credit card number and uses it to buy things. Others, like medical identity theft, might be a bit harder to recognize.  

Here’s a list of five of the most common types of identity theft:  

• Financial identity theft: This form of identity theft is exactly what it sounds like and involves a criminal stealing your financial information. For instance, your credit card number can be stolen and used to make a purchase.  
• Medical identity theft: With medical identity theft, someone steals your personal information to obtain health care services. An example is someone else using your identity to obtain prescription drugs. 
• Criminal identity theft: This form of identity theft occurs when someone else uses your name when arrested. You’ll know this has happened to you if you receive a court summons, for instance, that you had no involvement with. 
• Synthetic identity theft: A rising form of identity theft, synthetic identity theft is when someone creates a fake identity using someone’s real information. For instance, an imposter might create a fake identity using someone else’s real birthdate and Social Security number to apply for a loan. 
• Child identity theft: With child identity theft, a criminal uses a minor’s personal information to commit bank fraud or another form of identity theft. 

Although these are five of the most common types of identity theft, they can serve as umbrella terms for more specific forms of fraud. The diagram below shows the number of reported fraud cases of these various types of identity theft In 2021. 

While the internet has made our day-to-day lives more convenient, it’s also made it much easier for scammers to steal our personal information. Identity theft has become increasingly more common in the United States over the past five years.  

The more you use the internet, the more opportunities scammers have to steal your data and sell it on places like the dark web. Social media platforms, e-commerce businesses, banking companies, and a host of other online businesses can store your information for a variety of reasons.  

If you use the internet for online shopping, for instance, there’s a good chance a large number of databases stored your personal and financial data. While businesses use your information to give you a better online experience, scammers can also access it to steal your identity.  

The graph below shows the growth of different types of identity theft from 2017 to 2021.  

What should I do if I think I’m a victim of identity theft?

Criminals use many tricks to get your information. Scammers or hackers might send phishing emails pretending to be the IRS, snoop around social media pages for password clues, get info through a data breach, or simply buy information on the dark web.  

Here are a few things you can do if you believe you are the victim of identity theft:  

• Be on the lookout: To avoid identity theft, you’ll want to be alert for signs that someone has stolen your identity. Check your bank statement and credit report regularly to ensure no extra charges to your account. Pay attention to red flags like bills that arrive at your home with your information but someone else’s name, mysterious calls from debt collectors, or emails from new accounts for online services you don’t remember starting.  
• Reach out to local law enforcement: Some banks may make you show them a police report before they reimburse you for any fraudulent charges or withdrawals. 
• Contact the company where your ID is being used: Let the businesses where your information is being used know what’s happened. For instance, you’ll want to contact your bank and cancel your credit cards if you find out a criminal is using them. 
• Get in touch with the three big credit bureaus: Call or message TransUnion, Equifax, and Experian right away. They may be able to diminish the impact an identity thief has on your credit score.  
• File a report with the FTC: Reporting identity fraud to the FTC can help spread awareness of scams and identity theft tactics so others don’t fall victim to them.  
• Visit the Identity Theft Resource Center: The ITRC has tools and information to help you protect yourself against identity theft and recover from it.  

We’re here to help protect your personal information

The internet makes our lives easier in many ways. Although identity theft is rising, you shouldn’t let online scams prevent you from enjoying these digital conveniences. Identity thieves are an unavoidable part of using the internet, but you can greatly limit your risk of falling victim to cybercrime if you know what to watch out for and you’re smart online.  

Recognizing the signs of identity theft can help you stay ahead of fraudsters, and investing in McAfee Identity Protection services can offer another layer of protection. When you sign up for our identity protection services, you get perks like $1 million in identity theft protection insurance and email address and bank account monitoring. With our help, you can continue to use the internet with confidence. 

The post A Guide to Identity Theft Statistics for 2022 appeared first on McAfee Blog.

The devices employees use as they work from home could be the ones that put their companies at risk.

With businesses continuing to support remote and hybrid workplaces, more employees are connecting more of their personal devices to corporate networks, yet these devices aren’t always well protected from malware, breaches, and theft—which can affect them and the companies

they work for.

Prior to the pandemic, a major topic for employee and business security was BYOD, or “bring your own device.” And it remains so. That catchy little abbreviation took root several years ago as many employees started bringing their own devices to work for both personal and business use, whether that was their smartphone for company calls and email or swapping files once in a while with an external drive or a USB stick.

The argument for BYOD is that it potentially increases employee productivity by allowing people to use the devices they’re familiar with—plus that company can save on costs by having employees bring their own tech into the office. However, there’s a flip side. Because these devices can and often do connect to sensitive corporate resources and data, they can potentially compromise those very same resources and data. Unless they have strong security in place, which they often do not. Employees simply don’t always protect their own devices.

Our most recent global research shows that only 68% of adults say that they protect their laptops with basic antivirus protection. Note that basic antivirus does not include comprehensive security software that also protects them from the pandemic and post-pandemic rise in account theft, ransomware, email fraud, and phishing attacks. With this, only 68% of adults employ baseline protection, let alone more thorough protections beyond that. 

This figure drops dramatically when it comes to protecting their smartphones, classically the leading BYOD device in the corporate landscape. Here, only 41% of adults said they protect their phones with basic antivirus. Moreover, only 56% said they protect their smartphone with a password or passcode to unlock it—making nearly half of them an open book to cyber crooks in the event of loss or theft. 

Now, with remote and hybrid workplaces becoming more commonplace, BYOD gets all that much more complicated. Businesses are now faced with an unprecedented number of BYOD devices on their networks. In the U.S. alone, a Gallup poll found that half of the full-time workforce was “remote capable,” some 60 million people in all.  

Of them, 53% said they expect to work in a hybrid model moving forward and another 24% to work fully remotely. That means somewhere around 46 million workers in the U.S. will work remotely in some form or fashion and will likely use one or more of their own devices to do so—a clear concern for any security-minded business if these employee devices remain unprotected.  

The realities of BYOD and WFH 

In an ideal world, employees would stick to some hard and fast rules about device usage. They’d do their work on one laptop and then use another for streaming shows, doing their shopping, playing games, managing their finances and so on. Yet that doesn’t appear to be the case.  

A recent global study found that 55% of remote workers use a personal laptop or smartphone for work at least part of the time. Moreover, this begs the question if the employee is the only one using that BYOD device. After all, they’re likely working in their own home, where other family members may use that device to some extent as well, which adds yet more security risks for businesses. With multiple users on a single device, the additional browsing, downloading, emailing, and shopping could expose that device to more security risks than from a single user alone. 

Unlike company-issued devices, employee-owned devices aren’t subject to the centralized policies and protections that corporate IT can put in place. This leads to devices on the corporate network that may be without up-to-date antivirus protection, have malicious apps on them, or use browsers with compromised extensions that illicitly gather data on their users. 

Once again, with employees sometimes taking lax, if any security measures to protect their devices, this can present serious risks to the business, such as the dramatic rise in business email compromise. As reported by the Federal Bureau of Investigation (FBI), businesses lost $2.4 billion in 2021 to this form of scam alone. Meanwhile, phishing attacks, device theft, and credential theft all remain painfully common forms of attack on small and mid-sized businesses. 

How online protection for employees makes for a more secure business 

One way businesses can address these issues is by helping employees do what they haven’t done for themselves—provide them with comprehensive online protection software as a company benefit. 

Comprehensive online protection goes beyond basic antivirus (which as we’ve seen, only 68% of people use). It covers the three pillars of security—privacy, identity, and device security, and by protecting those three things for their employees on their BYOD devices, companies can then protect themselves.  

A brief list illustrates several of the top ways online protection for remote employees can help keep the business secure: 

1) Protect company information as it travels 

If your company doesn’t already support one, employees can use a VPN to create an encrypted tunnel when they connect to the company network, which makes it highly difficult for bad actors to intercept that traffic. Our secure VPN uses bank-grade AES 256-bit encryption to help keep data and information safe. 

2) Shield company data and resources from attacks 

With one bad click, a phishing attack in email, text, or direct message may give an attacker access to login credentials or to install malware known as a keylogger that can likewise steal usernames and passwords. Safe web browsing features found in online protection can help sidestep these attacks before they happen with clear warnings of risky websites, links, files, and other attachments. 

3) Strong, unique passwords for all 

When it comes to employee passwords, no two should be alike. Yet with dozens of logins of their own, in addition to the ones they use exclusively for work, that’s a rule few people follow. A password manager can help. It can store, auto-fill, and even generate strong, unique passwords for each account—across computers, laptops, and smartphones. 

4) Digitally shred sensitive documents permanently 

Employees can permanently delete sensitive files with an application such as McAfee Shredder, which removes files so that thieves can’t access them. (Quick fact: deleting files in your trash doesn’t actually delete them in the truest sense. They’re still there until they’re “shredded” or otherwise overwritten such that they can’t be restored.) 

5) Device protection that goes beyond the basics 

Absolutely, antivirus is a must. Comprehensive online protection will include that, and much more. Ours offers that in addition to protection that safeguards your employee’s identity and privacy—along with a personalized Protection Score that checks the health of their online protection and provides simple steps to improve their security. 

Think about theft and loss as well 

Beyond online protection software, is remote locking and wiping of devices. We’ve mentioned physical loss and theft of devices as a significant security issue. Many laptops and mobile devices offer location tracking services to help locate a lost device—and yet others allow the owner to remotely lock or even wipe the contents of that device if they fear it’s lost for good or fallen into the wrong hands.  

Showing employees how to enable and use these features can further protect all parties involved in such a worst-case scenario. Apple provides iOS users with a step-by-step guide for remotely wiping devices and Google offers up a guide for Android users as well. For laptops, Microsoft and Apple users can enable the following settings:   

• Windows: Enable in Settings > Update & Security > Find my device 
• macOS: Setup iCloud on your device. Enable via Settings > Your Name > iCloud > Find My Mac 

Online protection—good for employees, good for business 

By providing employees with comprehensive online protection that complements the security measures the company already has in place, they get the benefit of a far safer time online for themselves. Potentially their families as well. In turn, because they’re more secure, the business is more secure—an important point to consider when millions are still working from home on their BYOD devices.  

The post WFH Unprotected: How Organizations Can Keep Their Employees and Their Business Safer appeared first on McAfee Blog.

Pharmacy retailer Dis-Chem announced that an unauthorized party gained access to its customer database

The leak was caused by a programming issue at the Texas Department of Insurance

Andrew Elliot from DCMS provides an update on government initiatives to boost cybersecurity talent pipeline

Commodity kit invites new entrants into the market