Cyber Training Group International (CTGI)

Tag: cyber security

  • Security researcher updates OMG Cables to record user keystrokes

    Security researcher updates OMG Cables to record user keystrokes

    Security researcher Mark Green, (who goes by MG) has revealed to the Vices team at Motherboard that he and his team have upgraded their version of a hacked Lightning cable in a way that allows a hacker to record keystrokes and then to send the data to a designated site. This would allow the device to be used to steal passwords and other sensitive information.

    A Lightning cable allows for charging a  such as a smartphone using a computer or laptop instead of a charger. Back in 2019, MG demoed a cable that looked like a Lightning cable but had hacking capabilities built into it. Shortly thereafter, MG reportedly partnered with a cybersecurity vendor called Hak5 and began selling the cables. The idea behind the development of the cable and sales of it were meant not just to highlight, but demonstrate how such simple devices can be altered in minor ways that allow real hackers to take advantage of consumers.

    More recently, MG spoke with the team at Motherboard and told them that he has updated the cable to allow it to both record keystrokes and to use an added WiFi chip to broadcast the data it captures to a designated site where hackers could conceivably study the data and use it to their advantage.

    MG also told the team at Motherboard that part of the reason he built the new cable was because other experts in the field had claimed that it could not be done due to size and space limitations—there was not enough room inside the connective housing on Type C Lightning cables. MG claims to have proven such experts wrong by adding tiny chips to the cables and then demonstrating that they work in a YouTube of his cable in action.

    He also told Motherboard that the new cable also has geofencing features that allow for blocking data. Motherboard also tested the cable, and found that it worked as advertised, though admittedly in a close-proximity environment. MG claimed the cable could deliver data as far as a mile and that it works equally well with smartphones and tablet computers. He noted that he had also added an ability to alter keyboard mapping and to allow the  to mimic identity-specific USB devices.

    Credit: Techxplore

    Photo credit: Pixabay/CC0 Public Domain

  • Why You Should Stop Using Your Facebook Messenger App

    Why You Should Stop Using Your Facebook Messenger App

    If you’re one of Facebook Messenger’s 1.3 billion users, then you have just been given a serious reason to quit. While recent headlines suggest the platform is adding new security protections, there’s a nasty twist which makes this more risky than it seems, raising new questions about Facebook and its secretive backend systems.

    While Apple’s controversial CSAM update and surprise backtrack have dominated the headlines, Facebook has quietly made a huge change to Messenger that arguably has more serious implications for your security and privacy than anything Apple has done.

    Messenger’s biggest issue has always been its lack of default end-to-end encryption. Now after years of delays and disappointments, Facebook says it is finally teasing out some of this long-awaited functionality. But there are two huge issues buried under the surface here, both of which you need to know if you continue to use the app.

    Facebook is in the data collection business—we all know this. But it’s also in the user collection business. Just look at the numbers. Facebook has four apps that have topped 3 billion installs—Facebook itself, Messenger, WhatsApp and Instagram. TikTok is the only other app to hit those heights. Think that through for a moment.

    But not all those users are the same. Facebook, Messenger and Instagram are tightly linked. The main platform and its photo-sharing subsidiary grip you with algorithmic timelines literally coded to learn from their mistakes—when you look up, exit the app, do something else. Meanwhile, Messenger and Instagram DMs enable you to engage your social graph, linking all that catchy content in one place with everyone you know.

    WhatsApp is different—it has always been different. There’s no algorithmic content to pull you in, no timeline to scroll, just a bunch of chats and groups where users message each other in relative privacy. Facebook is desperate to mine the metadata, the social graphs, to push ads and business services. But WhatsApp remains different, aloof.

    And so, what to make of Facebook finally pushing forwards with its horribly delayed end-to-end encryption for Messenger and Instagram DMs to match WhatsApp’s security? Let’s be clear, you should use a fully encrypted messenger—but that doesn’t mean all messengers should be fully encrypted or that encryption in of itself is a silver bullet that suddenly makes everything private and secure.

    Many respected security professionals are adamant that end-to-end encryption should be ubiquitous. “Digital eavesdropping is dangerous,” says ESET’s Jake Moore. “Messenger has made the correct decision to highlight the importance of end-to-end encryption by making it default on all communication. This will no doubt increase confidence in a platform which has been chipped away at over recent years.”

    I would ordinarily agree—but Facebook Messenger is different. It is part of a social media platform that collects vast amounts of observational data on its users as they use the platform; it is also used by children and enables users to search for people and then initiate contact with them—you simply cannot do that on WhatsApp or Signal.

    I take a simple view here. If my kids are using social media, I don’t want a stranger to be able to trawl the site, find their profiles and secretly message with them. Facebook tells me it has technology to prevent this. But funnily enough, I don’t trust Facebook’s assurances that its technology can manage this—neither does leading child advocacy group NSPCC, which warns the evidence shows encryption will lead to “a significant drop in reports of child abuse… a [failure] to protect children from avoidable harm.”

    Facebook tells me that Messenger encryption will not reduce its ability to flag child abuse on its platform. But internally the company doesn’t seem so sure. Earlier this year, Facebook’s head of global policy management was asked whether reported cases of child abuse might “disappear” with encryption and said “I would expect the numbers to go down. If content is being shared and we don’t have access to that content, if it is content, we cannot see then it is content we cannot report.”

    For its part, Facebook now says it will add controls to allow users to “prevent unwanted interactions by deciding who can reach your chats list, who goes to your requests folder, and who can’t message you at all.” But putting the onus fully on kids to protect themselves from unwanted contacts is every bit as bad an idea as it sounds.

    Is there some acknowledgement of this in the other news from Facebook about its “opt-in end-to-end encryption for Instagram DMs?” Maybe. The platform says that it now plans “a limited test with adults in certain countries that lets them opt-in to end-to-end encrypted messages and calls for 1:1 conversations on Instagram.” Keeping full encryption adult-only on Instagram would be a welcome move.

    Whatever view you took on Apple’s on-device CSAM and iMessage filtering—it is clearly impossible to trawl iMessage looking for people to contact. You need to have a phone number or iCloud ID to reach out. But it emphasizes the point. Shielded messaging and open social media platforms are a toxic combination.

    You can’t trawl WhatsApp either, of course, and a private conversation there is more or less exactly that. Yes, it will give metadata to law enforcement if asked, but there’s not that much metadata. it knows your number, contacts, groups, times and places you logon. It says it doesn’t even (usually) capture data on who you message and when.

    A private conversation on Messenger or Instagram is very different. Those platforms know everything about you, they’re mining your data by default. With Messenger encryption, you may be whispering in your friend’s ear, and Facebook may not be able to overhear, but it’s watching everything else you do, and it can fill in the gaps. Your actual messaged content might be shielded, but everything else remains fair game.

    Facebook is the world’s messaging giant—each of Messenger and Instagram (with its DMs) reach a billion-plus users, while WhatsApp has twice as many. Looking at how WhatsApp competes with iMessage and Android Messages and smaller rivals like Telegram and Signal is interesting. But what’s much more interesting is the way in which Facebook’s own platforms now compete with each other, and specifically that WhatsApp and Messenger are becoming rivals, with their interests far from aligned.

    WhatsApp is evolving into a much more complete messenger month by month: Disappearing and view-once messages, multi-device access, stickers and rich chat features, soon (we’re told) quick emoji responses. All of these eat into the advantages Messenger holds over WhatsApp. Yes, this makes integration simpler, but it also plugs major gaps in WhatsApp which might have been keeping you on Messenger.

    Of these, the long-awaited news that WhatsApp has finally addressed its biggest weakness, with multi-device access finally live as a public beta ahead of its production release, is a twist with huge implications. “For years,” WhatsApp said, “people have been asking us to create a true multi-device experience that allows people to use WhatsApp on other devices without requiring a smartphone connection.”

    As things stand, you now have two Facebook messaging options that are becoming much more closely featured rivals than ever before. WhatsApp, a point-to-point, dedicated messenger, and the combination of Messenger and Instagram, both add-ons to social media platforms, both heavily used by kids and under fire for algorithmically spreading harmful content and endangering users.

    If you follow the logic, these three (becoming two) messaging platforms should remain separate. WhatsApp is now closing the feature-gap with multi-device access. You won’t need integration to message WhatsApp users from your tablet or desktop using a different Facebook app, you will be able to use a WhatsApp app for that instead.

    The more serious issue is that if Facebook does persist with its Messenger plans, it risks lawmakers forcing backdoors into its encryption given the child safety issues, and if those Facebook plans continue to include backend integration, then WhatsApp will be impacted by this. WhatsApp’s boss Will Cathcart has been publicly beating the drum on encryption all year. Messenger might be the biggest threat to this. Again, we see that interesting agenda, with WhatsApp and Facebook’s interests diverging.

    All of which raises the specter for Facebook that it may need to maintain the ring fence around WhatsApp that it promised when it acquired the platform, and which has been under threat ever since. Does Facebook need to accept that the safest option is to preserve WhatsApp’s security, paying the price of restricting security enhancements to Messenger and keeping WhatsApp outside any back-end integration? The imminent threat of carving WhatsApp out of Facebook seems to have diminished, to the extent that integration was a defensive move, can that now be rethought?

    So, as you see the PR coming separately from Facebook and WhatsApp, keep this context in mind. Ask yourself are we not hearing two very different, contradictory points of view—does WhatsApp now know that the best thing it can take from 2021 is more independence, even if that comes at Messenger’s (and Facebook’s) expense?

    While Apple has been hogging the headlines with the CSAM backlash, the irony is that the quiet news from Facebook that Messenger encryption has progressed has deeper implications for child protection. And Facebook progressing that encryption may have deeper implications for WhatsApp than Apple’s CSAM updates being abused by governments and opening the door to backdoors. Facebook has been repeatedly warned that Messenger encryption is a step too far, and yet here we are.

    If you’re still on Messenger, if you’re tied to its multi-device access, then as soon as WhatsApp’s full update reaches your phone you should switch. Unlike Messenger, it will be end-to-end encrypted across all your devices, it harvests much less of your data, and your security doesn’t come at the expense of added risk for others.

    Credits: Forbes

     

  • Ransomware gang’s script shows exactly the files they’re after

    A PowerShell script used by the Pysa ransomware operation gives us a sneak peek at the types of data they attempt to steal during a cyberattack.

    When ransomware gangs compromise a network, they usually start with limited access to a single device.

    Once they gain access to a Windows domain controller, they search for and steal data on the network before encrypting devices.

    The threat actors use this stolen data in two ways.

    The first is to generate a ransom demand based on company revenue and whether they have insurance policies. The second is to scare the victims into paying a ransom because the gang will leak the data.

    Searching for valuable data

    Yesterday, MalwareHunterTeam shared a PowerShell script with BleepingComputer used by the Pysa ransomware operation to search for and exfiltrate data from a server.

    This script is designed to scan each drive for data folders whose names match certain strings on a device. If a folder matches the search criteria, the script will upload the folder’s files to a remote drop server under the threat actor’s control.

    Of particular interest are the 123 keywords that the script searches for, which give us a glimpse into what the ransomware gang considers valuable.

    Also Read: RANSOMWARE BREACH AT FLORIDA IT FIRM HITS 200 BUSINESSES

    As we would expect, the script seeks out files related to the companies financials or personal information, such as audit, banking information, login credentials, tax forms, student information, social security numbers, and SEC filings.

    However, it also looks for more intriguing keywords that could be particularly harmful to a company if leaked, such as folders containing the words ‘crime’, ‘investigation’, ‘fraud’, ‘bureau’, ‘federal’, ‘hidden’, ‘secret’, ‘illegal’, and ‘terror.’

    The full list of 123 keywords targeted by the threat actors’ script is listed in the table below.

    941confidentInfoRRHH
    1040Crimeinsidersaving
    1099claimInsurancescans
    8822Terrorinvestigationsec
    9465Confidential*DisclosureIRSsecret
    401KcontactITINsecurity
    4506-TcontrK-1studen
    ABRHCPFletterseed
    AuditCRHListSigned
    AddresTransactLoginsin
    agreemDDRHmailsoc
    Agreement*DisclosureDemogNDASS#
    ARHDetailNumbSS-4
    AssignmentDisclosure*AgreementPartnSSA
    balancDisclosure*ConfidentialpassportSSN
    bankDRHpasswdStaf
    Bank*Statementemplopasswordstatement
    BenefEnrolpayStatement*Bank
    billingfederalpaymentSWIFT
    budgetFinanpayrolltax
    bureaufinancepersonTaxpayer
    BrokFormPhoneunclassified
    cardfraudprivacyVend
    cashgovernmentprivatW-2
    CDAhiddenpwdw-4
    checkinghirRecursos*HumanosW-7
    clandestineHRreportW-8BEN
    compilationHumanResourw-9
    compromatei-9resurses*humanW-9S
    concealedillegalRHO 
    confidimportantrouting 

    It does not make sense to change your folder names, so they do not include these strings, as the threat actors will likely perform manual sweeps of data.

    However, knowing what types of data a ransom gang is searching for gives you a better indication of how ransomware gangs will attempt to extort their victims.

    Pysa is not the only one searching for particular files after breaching a network.

    Earlier this month, an angry Conti affiliate leaked the training material for the ransomware operation.

    This training material told affiliates to immediately search for data containing the following keywords after they gained control of a Windows domain controller.

    cyber
policy
insurance
endorsement
supplementary
underwriting
terms
bank
2020
2021
Statement

    Once again, this illustrates how vital data theft is to a ransomware attack and how important it is to safeguard it adequately.

    Credits: Bleeping Computer

  • Ransomware breach at Florida IT firm hits 200 businesses

    Ransomware breach at Florida IT firm hits 200 businesses

    WASHINGTON, July 2 (Reuters) – Hundreds of American businesses were hit Friday by an unusually sophisticated ransomware attack that hijacked widely used technology management software from a Miami-based supplier called Kaseya.

    The attackers changed a Kaseya tool called VSA, used by companies that manage technology at smaller businesses. They then encrypted the files of those providers’ customers simultaneously.

    Security firm Huntress said it was tracking eight managed service providers that had been used to infect some 200 clients.

    Kaseya said on its own website that it was investigating a “potential attack” on VSA, which is used by IT professionals to manage servers, desktops, network devices and printers.

    It said it shut down some of its infrastructure in response and that it was urging customers that used VSA on their premises to immediately turn off their servers.

    “This is a colossal and devastating supply chain attack,” Huntress senior security researcher John Hammond said in an email, referring to an increasingly high profile hacker technique of hijacking one piece of software to compromise hundreds or thousands of users at a time.

    Hammond added that because Kaseya is plugged in to everything from large enterprises to small companies “it has the potential to spread to any size or scale business.” Many managed service providers use VSA, although their customers may not realize it, experts said.

    Some employees at service providers said on discussion boards that their clients had been hit before they could get a warning to them.

    Reuters was not able to reach a Kaseya representative for further comment. Huntress said it believed the Russia-linked REvil ransomware gang – the same group of actors blamed by the FBI for paralyzing meat packer JBS (JBSS3.SA) last month – was to blame for the latest ransomware outbreak.

    DEMANDS FOR RANSOM

    A private security executive working on the response effort said that ransom demands accompanying the encryption ranged from a few thousand dollars to $5 million or more.

    The corruption of an update process shows a marked escalation in sophistication from most ransomware attacks, which take advantage of security loopholes such as common passwords without two-factor authentication.

    An email sent to the hackers seeking comment was not immediately returned. In a statement, the U.S. Cybersecurity and Infrastructure Security Agency said it was “taking action to understand and address the recent supply-chain ransomware attack” against Kaseya’s VSA product.

    Supply chain attacks have crept to the top of the cybersecurity agenda after the United States accused hackers of operating at the Russian government’s direction and tampering with a network monitoring tool built by Texas software firm SolarWinds.

    Kaseya has 40,000 customers for its products, though not all use the affected tool.

    Credit: Reuters

  • A huge trove of credit card records and Social Security numbers just got hacked

    A huge trove of credit card records and Social Security numbers just got hacked

    Not a week goes by anymore, it seems like, when we don’t have multiple hacks to report on, as well as a fresh data breach or systems intrusion on the part of attackers constantly probing for weaknesses anywhere that consumer records are stored.

    Many of these episodes garner headlines simply because of the scale of the data breach and the target of the attack. Facebook is one example of this, as the social network is still facing an onslaught of criticism online over the revelation from this past weekend that the company has suffered yet another embarrassingly massive data leak — encompassing personal information from more than 533 million Facebook users across 106 countries. Meantime, hackers themselves are also getting hacked, as word of a separate breach at a hub for stolen data has also just been reported.

    Threat research firm Group-IB posted a report on Thursday documenting how Swarmshop — described as a “neighborhood” store for stolen personal and payment records, such as credit card data — saw a major cache of its user and administrator data leaked online to another underground hacker forum. Appropriately, the title of the Group-IB report summarizing what happened here is “What Goes Around Comes Around,” but make no mistake — there’s just as good of a chance that your data may be caught up in this as there is that hackers acquired stolen data on other hackers.

    According to the report on this hack, the Swarmshop database that was posted on a different underground forum contained 12,344 records of the card shop administrators, sellers, and buyers. That’s per a Twitter thread from Group-IB, which goes on to note that this database also “exposed all compromised data traded on the website, including 623,036 payment card records, 498 sets of online banking account credentials and 69,592 sets of US Social Security Numbers and Canadian Social Insurance Numbers.”

    Given the nature of the treasure trove of data that Swarmshop represents, it should probably come as no surprise that this is also not the first time that the stolen data hub has found itself in the crosshairs of other cybercriminals. In January 2020, the site’s records were leaked on an underground forum, reportedly by a user motivated by revenge. Meantime, here’s what else we know about this new hack — the data dump included records on more than 623,000 payment cards, almost 63% of which were issued by US banks.

    “While underground forums get hacked from time to time, cardshop breaches do not happen very often,” Group-IB CTO Dmitry Volkov said. “In addition to buyers’ and sellers’ data, such breaches expose massive amounts of compromised payment and personal information of regular users. Although the source remains unknown, it must be one of those revenge hacks cases. This is a major reputation hit for the card shop as all the sellers lost their goods and personal data. The shop is unlikely to restore its status.”

    Culled from bgr.com