Here’s a story of someone who, with three compatriots, rented textbooks from Amazon and then sold them instead of returning them. They used gift cards and prepaid credit cards to buy the books, so there was no available balance when Amazon tried to charge them the buyout price for non-returned books. They also used various aliases and other tricks to bypass Amazon’s fifteen-book limit. In all, they stole 14,000 textbooks worth over $1.5 million.
The article doesn’t link to the indictment, so I don’t know how they were discovered.
In a world of contact-free pickup and payments, an old hacker’s trick is getting a new look—phony QR code scams.
QR codes have been around for some time. Dating back to industrial use in the 1990s, QR codes pack high volumes of visual information in a relatively compact space. In that way, a QR code shares many similarities with a barcode, yet a QR code can hold more than 300 times the data of a barcode.
With the rise of the smartphone, QR codes have taken on more consumer applications. Especially in the latter days of the pandemic in the form of contact-free conveniences. Now, by pointing your smartphone’s camera at a QR code, you can order food at a restaurant, pay for parking, download coupons from the shelf at your drugstore or several other convenient things.
Yet as it is in places where people, devices, and money meet, hackers are there with a scam ready to go. Enter the QR code scam. By pointing your smartphone’s camera at a bogus QR code and giving it a scan, hackers can lead people to malicious websites and commit other attacks on their phones.
The good news is that there are several ways you can spot these scams, along with several other ways you can avoid them altogether, all so you can get the best out of QR code convenience without the hassle.
Classically, phishing attacks use doctored links that pose as a legitimate website in the hopes you’ll follow them to a hacker’s malicious website. Once there, that site is designed to trick you into providing your personal information, credit card numbers, and so forth, perhaps in the context of a special offer or a phony account alert. Likewise, it could send you to a site that simply infects your device with malware.
It’s much the same with a QR code, yet here’s are a couple of big differences:
The QR code itself. There’s really no way to look at a QR code and determine if it’s legitimate or not, such as by spotting clever misspellings, typos, or adaptations of a legitimate URL.
Aside from appearing in emails, direct messages, in social media ads, and such, there are plenty of other places phony QR codes can show up. Here are a few that have been making the rounds in particular:
Locations where a hacker may have replaced an otherwise legitimate QR code with a phony one, like in public locations such as in airports, bus stops, and restaurants.
On your windshield, in the form of fake parking tickets designed to make you think you parked illegally and need to pay a fine.
Scanning a QR code may open a notification on your smartphone screen to follow a link. Like other phishing-type scams, hackers will do their best to make that link look legitimate. They may alter a familiar company name so that it looks like it could have come from that company. Also, they may use link shorteners that take otherwise long web addresses and compress them into a short string of characters—the trick there being that you really have no way of knowing where it will send you simply by looking at it.
In this way, there’s more to using QR codes than simply “point and shoot.” A mix of caution and eagle-eyed consideration is called for to spot the legitimate uses from the malicious ones.
How to avoid QR code scams
Luckily some very basic rules about avoiding QR code attacks. The U.S. Better Business Bureau (BBB) has put together a great list that can help. Their advice is right on the mark, which we’ve paraphrased and added to here:
1. Don’t open links or scan QR codes from strangers. Unsolicited messages with these links or codes could lead you to a scam site or access the functionality of your smartphone in unwanted ways.
2. Some scams will appear to come from legitimate sources. Double-check and see if it indeed is. You can check the official website to confirm, such as by accessing your account or contacting a customer service rep to follow up on the communication sent to you.
3. Try alternative payment methods. If you receive a bill with a QR code for payment, see if there’s another way to pay it—such as on the company’s website or simply through online bill pay to their known, legitimate address. These are less susceptible to fraud. Likewise, check to see if the requested payment is legitimate in the first place.
4. Think twice about following shortened links. As mentioned above, shortened links can be a shortcut to a malicious website. This can particularly be the case with unsolicited communications. And it can still be the case with a friend or family member if their device or account has been hacked.
5. If someone you know sends you a QR code, also confirm before scanning it. Whether you receive a text message from a friend or a message on social media from your workmate, contact that person directly before you scan the QR code to make sure they haven’t been hacked.
6. Watch out for tampering. Hackers have been known to stick their own QR codes over legitimate ones. If you see any sign of altering or placement that looks slapdash, don’t give that code a scan.
7. Install mobile security.Comprehensive online protection software can protect your mobile devices as well as your computers and laptops. In this case, it can detect bad links associated with QR codes and steer you clear of accessing the malicious sites and downloads associated with them.
QR codes—a handy, helpful tool that still requires your caution
QR codes have made transactions smoother and accessing helpful content on our phones much quicker, especially in recent months as they’ve seen an uptick in use. And useful as they are like other means of paying or browsing online, keep an eye open when using them. With this advice as a guide, if something doesn’t feel right, keep your smartphone in your pocket and away from that QR code.
McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter, Telegram and PUBG game accounts. This malware hides in a game assistant tool called “DesiEsp” which is an assistant tool for PUBG game available on GitHub. Basically, cyber criminals added their own malicious code based on this DesiEsp open-source tool and published it on Telegram. PUBG game users are the main targets of this Android malware in all regions around the world but most infections are reported from the United States, India, and Saudi Arabia.
What is an ESP hack?
ESP Hacks, (short for Extra-Sensory Perception) are a type of hack that displays player information such as HP (Health Points), Name, Rank, Gun etc. It is like a permanent tuned-up KDR/HP Vision. ESP Hacks are not a single hack, but a whole category of hacks that function similarly and are often used together to make them more effective.
How can you be affected by this malware?
After investigation, it was found that this malware was spread in the channels related to PUBG game on the Telegram platform. Fortunately, this malware has not been found on Google Play.
Figure 1. Re-packaged hacking tool distributed in Telegram
Main dropper behavior
This malware will ask the user to allow superuser permission after running:
Figure 2. Initial malware requesting root access.
If the user denies superuser request the malware will say that the application may not work:
Figure 3. Error message when root access is not provided
When it gains root permission, it will start two malicious actions. First, it will steal accounts by accessing the system account database and application database.
Figure 4. Get a Google account from the Android system account database.
Second, it will install an additional payload with package name“com.android.google.gsf.policy_sidecar_aps” using the “pm install” command.The payload package will be in the assets folder, and it will disguise the file name as “*.crt” or “*.mph”.
Figure 5. Payload disguised as a certificate file (crt extension)
Stealing social and gaming accounts
The dropped payload will not display icons and it operates directly on the screen of the user’s device. In the apps list of the system settings, it usually disguises the package name as something like “com.google.android.gsf” to make users think it is a system service of Google. It runs in the background in the way of Accessibility Service. Accessibility Service is an auxiliary function provided by the Android system to help people with physical disabilities use mobile apps. It will connect to other apps like a plug-in and can it access the Activity, View, and other resources of the connected app.
The malware will first try to get root permissions and IMEI (International Mobile Equipment Identity) code that later access the system account database. Of course, even if it does not have root access, it still has other ways to steal account information. Finally, it also will try to activate the device-admin to difficult its removal.
Methods to steal account information
The first method to steal account credentials that this malware uses is to monitor the login window and account input box text of the stolen app through the AccessibilityService interface to steal account information. The target apps include Facebook (com.facebook.kakana), Twitter (com.twitter.android), Google (com.google.android.gms) and PUBG MOBILE game (com.tencent.ig)
The second method is to steal account information (including account number, password, key, and token) by accessing the account database of the system, the user config file, and the database of the monitored app. This part of the malicious code is the same as the parent sample above:
Figure 6. Malware accessing Facebook account information using root privileges
Finally, the malware will report the stolen account information to the hacker’s server via HTTP.
Gaming users infected worldwide
PUBG games are popular all over the world, and users who use PUBG game assistant tools exist in all regions of the world. According to McAfee telemetry data, this malware and its variants affect a wide range of countries including the United States, India, and Saudi Arabia:
Figure 7. Top affected countries include USA, India , and Saudi Arabia
Conclusion
The online game market is revitalizing as represented by e-sports. We can play games anywhere in various environments such as mobiles, tablets, and PCs (personal computers). Some users will be looking for cheat tools and hacking techniques to play the game in a slightly advantageous way. Cheat tools are inevitably hosted on suspicious websites by their nature, and users looking for cheat tools must step into the suspicious websites. Attackers are also aware of the desires of such users and use these cheat tools to attack them.
This malware is still constantly producing variants that use several ways to counter the detection of anti-virus software including packing, code obfuscation, and strings encryption, allowing itself to infect more game users.
McAfee Mobile Security detects this threat as Android/Stealer and protects you from this malware attack. Use security software on your device. Game users should think twice before downloading and installing cheat tools, especially when they request Superuser or accessibility service permissions.
A 40-year-old man from California has admitted his role in a conspiracy to break into the private digital photo libraries of Apple customers to locate and steal sexually explicit images.
Hao Kuo Chi, a resident of the city of La Puenta in Los Angeles County, pleaded guilty to charges of computer fraud and conspiracy on Friday, October 15.
According to documents submitted to a court in Tampa, Florida, Chi conspired with other unknown individuals to gain unauthorized access to the Apple iCloud accounts of hundreds of individuals across the United States.
In a scheme that went on for years, Chi marketed his services as a hacker online in underground forums. Using the handle “icloudripper4you,” Chi advertised that he was able to break into iCloud accounts and exfiltrate their contents.
During the conspiracy, Chi gained entry to more than 300 iCloud accounts by impersonating Apple employees. To mask his identity, the hacker created fake email accounts that appeared to belong to Apple customer support representatives.
“Chi created email accounts for the purpose of impersonating Apple customer support representatives, and Chi’s conspirators sent Apple IDs and passwords of unsuspecting victims to these email accounts,” said the US Attorney’s Office for the Middle District of Florida in a statement released October 15.
After breaking into a victim’s iCloud account, Chi would search specifically for images in which a female subject was depicted as partially clothed or naked.
“Chi and his conspirators specifically sought out nude photographs and videos of young women, which the conspirators referred to as ‘wins’,” said the US Attorney’s Office for the Middle District of Florida.
Chi shared and traded these images with his conspirators, using a foreign-based, end-to-end encrypted email service. The hacker also admitted that he kept hundreds of thousands of stolen images for his personal collection and maintained a terabyte of cloud storage for this purpose.
A date has not yet been set for Chi’s sentencing. If convicted on both charges, the self-confessed cyber-criminal could be ordered to spend a maximum of 20 years locked up in federal prison with no possibility of parole.
A hacker from Michigan who stole and sold the sensitive data of tens of thousands of University of Pittsburgh Medical Center (UPMC) employees has been sent to prison.
Former Federal Emergency Management Agency (FEMA) IT specialist Justin Sean Johnson pleaded guilty on May 20 to counts 1 and 39 of a 43-count indictment.
The court heard that the 30-year-old former resident of Detroit admitted infiltrating and hacking into the UPMC’s human resources server database in 2013 and 2014.
Johnson used his tech skills to steal personal information belonging to 65,000 UPMC employees, which included W-2 wage and tax forms. Using the handles TheDearthStar, Dearthy Star, TDS, and DS, Johnson then sold the stolen data on the dark web via illicit marketplaces.
The criminals who purchased the stolen employee data used it to file hundreds of false 1040 tax returns.
“These false 1040 filings claimed hundreds of thousands of dollars of false tax refunds, which they converted into Amazon.com gift cards, which were then used to purchase Amazon merchandise, which was shipped to Venezuela,” stated the US Attorney’s Office for the Western District of Pennsylvania.
As a result of the fraudulent claims, the United States Internal Revenue Service lost approximately $1.7m.
UPMC wasn’t Johnson’s only target. The offender confessed to stealing and selling nearly 90,000 additional (non-UPMC) sets of personally identifiable information (PII) to buyers on dark web forums from 2014 to 2017.
On Friday, Chief United States District Judge Mark Hornak handed Johnson the statutory maximum sentence of 60 months of incarceration for Conspiracy to Defraud the United States, and the statutory maximum of 24 months for Aggravated Identity Theft. Johnson’s sentences will run consecutively, meaning the cyber-crook will spend the next seven years behind bars.
“The actions of criminals like Justin Johnson can have long-lasting and devastating effects on the lives of innocent people,” said Yury Kruty, acting special agent in charge of IRS-Criminal Investigation.
“Johnson carried out his intricate scheme with no regard for his victims. Today’s sentencing will hopefully be a deterrent to other potential crooks who may be considering carrying out similar conduct.”
A cyber-attack on the vendor of a network of dental practices may have exposed the data of tens of thousands of patients.
A cyber-criminal used a phishing attack to gain access to the computer systems of North American Dental Management between March 31 and April 1, 2021. Pittsburgh-based North American Dental Management provides administrative and technology support services for Professional Dental Alliance (PDA) offices.
Following the security breach, PDA notified patients that an unauthorized individual may have accessed some of their protected health information (PHI).
The information that may have been exposed was stored in email accounts that the attacker was able to breach.
“Professional Dental Alliance (‘PDA’) was recently notified that a few email accounts of its vendor, North American Dental Management, containing some limited patient information were accessed by an unauthorized person between March 31 and April 1, 2021, as the result of an email phishing incident,” stated PDA affiliate Grove Dental Associates in a data breach notice published on its website.
“At this time, the identity of some individuals is known, but the vendor’s investigation is ongoing.”
After discovering the breach, North American Dental Management took steps to secure the compromised email accounts and launched an investigation.
PDA said that it had not found any evidence of any actual misuse of personal information and that its investigation of the matter indicates that the attack was limited to email credential harvesting.
The threat actor did not access PDA’s patient electronic dental record or dental images; however, the Alliance found that some sensitive personal information may have been present in the compromised email accounts.
Grove Dental Associates said: “The full extent of the potentially affected personal information is not yet known and will vary between persons, but it may include the following: name, address, email address, phone number, dental information, insurance information, Social Security Number, and/or financial account numbers.”
The breach was reported to the DHS’s Office for Civil Rights as impacting 125,760 patients in Connecticut, Florida, Georgia, Illinois, Indiana, Massachusetts, Michigan, New York, Texas, and Tennessee.
PDA is offering complimentary credit monitoring and identity theft services for two years for potentially affected patients.
More than four in five (83%) ransomware victims in the last 12 months felt they had no option but to pay the extortion demand to restore their data, according to a new report by ThycoticCentrify.
The study, which was based on a survey of 300 US IT business decision-makers, also found that close to two-thirds (64%) of companies were victims of ransomware attacks in the last 12 months.
The latest research demonstrates rising ransomware cases and extortion payments since the start of the COVID-19 pandemic. These findings are particularly worrying given so many victim organizations didn’t feel like they had any choice other than pay the demand once their data was encrypted, showing how effective this tactic is.
The research further highlighted the substantial damage caused to organizations by ransomware attacks. Half (50%) of respondents said their company had experienced a loss of revenue and reputational damage from an attack, and 42% admitted they lost customers due to an attack. Additionally, around one-third attributed the ransomware attack as the cause for employee layoffs.
The most vulnerable vectors for ransomware attacks are email (53%), applications (41%) and the cloud (38%), according to the IT business decision-makers surveyed.
Encouragingly, there appears to be growing recognition of the need to improve cyber-defenses amid surging ransomware incidents. Nearly three-quarters of respondents have seen their cybersecurity budgets increase due to ransomware threats, while 93% of businesses are allocating a special budget to fight ransomware threats.
Art Gilliland, CEO at ThycoticCentrify, commented: “Our research shows ransomware is a threat to organizations of all sizes and levels of sophistication.
“The first line of defense should be solutions that secure privileged access, including multi-factor authentication (MFA) and other methods of enforcing zero trust, to keep would-be cyber-criminals contained and limit the damage they can inflict.”
Shared Responsibility Key to Protecting Critical Infrastructure
Protecting critical infrastructure from cyber-attacks requires adopting a shared responsibility model between vendors, network operators and governments, according to a panel speaking during a recent FT webinar.
The panel, moderated by Alex Irwin-Hunt, global markets editor of fDi Intelligence at FT Group, agreed that a range of parties has different responsibilities in ensuring the integrity of software and hardware products. The process begins with manufacturers “making sure that their product that’s released into the market is a quality one, and that includes reducing vulnerabilities as much as possible,” according to Dr Wendy Ng, cloud security architect lead at OneWeb.
However, this process can never be 100% effective, and vendors still have obligations to release patches for the product once it has gone to market. “Then it becomes a real partnership between the end-user and vendor,” observed Ng.
Colm Murphy, senior cybersecurity advisor, Huawei, reiterated the need for a shared responsibility model and emphasized the role played by service providers in keeping products secure. “They own and operate the networks, they manage the services, and they have to look after things like patching and security configurations.”
Additionally, governments have an important role in setting the standards and regulations for products and creating a regulatory arm to oversee and enforce these rules. Murphy also believes organizations need standards bodies to “tell us what good looks like.” This should be determined by consensus, involving all stakeholders in a given industry.
Ultimately, however, the people at the top of these organizations determine the strength of critical infrastructure security, according to Jane Frankland, CEO of KnewStart. “Unless there is understanding at the very top, with the CEO and board of executive directors, then you’re going to have a problem.” This awareness at the top needs to filter down to those in senior security positions, like CIOs and CISOs.
Going forward, the panelists said what is needed is a greater level of collaboration. For example, Ng outlined the benefits of different cyber vendors working and learning from one another. Frankland added that the next phase of the cybersecurity industry’s maturity is global cooperation. “I see that as being the next phase in our maturity because we are still very immature – we are still a new industry,” she pointed out.
“There are a lot more things connected now, and that gives more opportunities to bad actors to go about their work”
Such approaches are increasingly vital given the expanded attack surface. Murphy noted that particularly since the COVID-19 pandemic, businesses are becoming more reliant on the “functioning of technologies, and those systems are vastly more complex than they ever have been.” He added: “There are a lot more things connected now, and that gives more opportunities to bad actors to go about their work.”
Frankland added that the growth of cloud adoption has significantly increased the attack surface cyber-criminals can target. “Misconfigurations in the cloud is the number one risk, so it’s absolutely vital we look at the whole environment and reduce as many risks as possible.”
Amid this riskier threat landscape, it is critical that all staff in an organization, not just security teams, are well-versed in cybersecurity. Frankland believes we need to reach a stage where “we’re all becoming security practitioners in the organization.”
The discussion then moved on to strategies to address the cyber-skills gap, and in particular, attracting more women into the sector. Frankland noted that the industry has broadened in recent years, creating positions that are not as focused on tech as they were in the past. Therefore, “we need to market more” and recruit people from other industries such as lawyers, HR and teachers. “If we can train them and get them up to speed in terms of what we’re doing, it means we can actually increase our workforce very fast,” said Frankland.
Ng concurred, stating that greater gender diversity is essential to filling the skills gap, “otherwise you’re missing out on 50% of your population.”
The panellists also discussed the growing need for organizations to demonstrate their security capabilities and credentials, with internal and external stakeholders increasingly aware of cyber risks. Demonstrating this effectively and independently requires input from multiple parties, according to Murphy. For example, third party assurance involves accredited labs to conduct tests agreed and determined by standards bodies. Therefore, it comes back to “everybody working together in collaboration and cooperation,” he stated.
The US authorities have released more details on emerging ransomware group BlackMatter, which it says has already targeted multiple critical infrastructure providers in the country.
The alert comes from the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the National Security Agency (NSA).
The ransomware-as-a-service (RaaS) operation appeared in July. It has been suggested that it may have links to the DarkSide group that came under pressure from Washington after the Colonial Pipeline attack. That group subsequently disappeared.
BlackMatter is said to eschew healthcare, NGO, government, oil and gas and other critical infrastructure sectors. However, last month it targeted a US grain producer, which claimed to play a key role in the US food supply chain. New Cooperative was hit with a $5.9m ransom at that time.
Demanding payments of up to $15m from its victims, BlackMatter has been observed using remote monitoring and desktop software to achieve persistence. It may also use previously compromised credentials embedded in LDAP and SMB to access Active Directory and discover all hosts on the network, the alert noted.
Data exfiltration is attempted over the web, and SMB is used to encrypt shares remotely. There’s also a warning that BlackMatter may wipe backup stores rather than encrypt them as most variants do.
The group is also known for encrypting VMware ESXi virtual machines with a separate Linux-based binary.
The alert lists a series of best practice mitigations: including good password management and multi-factor authentication (MFA), regular patching, network segmentation, and implementing the Snort detection signatures listed in the document.
The US agencies also recommended organizations limit access to network resources, enforce the principle of least privilege in identity and access management, and enforce best practice backup and restoration policies.
VPN Provider’s Misconfiguration Exposes One Million Users
At least one million users of a Chinese-run VPN service have had their personally identifiable information (PII) exposed due to a misconfigured Elasticsearch server, Infosecurity can reveal.
The privacy concern affects Quickfox, a free VPN used mainly by the Chinese diaspora to visit sites otherwise inaccessible from outside mainland China, according to reviews site WizCase.
Unfortunately, Quickfox owner Fuzhou Zixun Network Technology had not adequately configured its Elastic Stack security, leaving an Elasticsearch server exposed and accessible – with no password–protection or encryption enforced.
The 100GB trove found by the researchers contained 500 million records, including PII on one million users and system data on 300,000 customers. WizCase told Infosecurity that the server has yet to be secure.
The exposed PII included customers’ emails, IP addresses, phone numbers, details to identify device type, and MD5 hashed passwords. WizCase warned that MD5 is itself far from secure and can be cracked by modern technology.
This would have been enough for fraudsters to follow up with phishing emails, vishing phone calls and other tactics designed to elicit further sensitive information like credit card or bank details.
“The leaked information about device type and installed software could make this con very convincing,” warned WizCase. “It’s unclear why the VPN was collecting this data, as it is unnecessary for its process and it is not standard practice seen with other VPN services.”
This leaked data included the names of other software installed on users’ devices, alongside file location, install date, and version number.
By unmasking the MD5 hashed passwords and using credential stuffing techniques, cyber-criminals could also try to hijack other accounts across the web, which users might protect with the same credential, WizCase warned.
It urged users to carefully vet VPN providers before choosing them and be aware that free services may profit by collecting and using customer data.
Those affected in the Quickfox incident were mainly located in the US, Japan, Indonesia and Kazakhstan.
