Exploit Brokers Hacker News Episode 09

Intro

Hey guys, welcome to exploit brokers today. We’re going to be going over four different articles. Let’s talk about Twitch. Let’s talk about ricochet, the freakout botnet and the Mykings botnet. Let’s jump into it.

Cool. So guys, welcome back. I know I’ve been offline for a little bit, but I am here to bring you back your hacker news goodness. So today we’re going to jump right into it.

Freakout Botnet Attacks DVRs

We’re going to talk about the freakout botnet. It turns out they are using their botnet to turn DVRs into Monero crypto miners. So Monero is one of the favorite type of crypto miners in the criminal industry, because it’s very hard to track compared to like Bitcoin and all that.

So the transactions are much more. Privacy oriented. I guess if you can say it that way, so let’s jump right into it. Let’s see. And I will list the articles and the show notes. This one is by threatpost.com titled freak-out botnet turns DVR’d into Monero, crypto miners. You what we’re talking about today.

I’ll start out by saying the article says the new Necro Python exploit targets visual tools DVRs used in surveillance systems. So we’re not talking about just like, you know, your old DVR. If anyone still has a DVR for tvservices. I imagine a lot of people. Still do, but no, this is specifically the visual tools, DVRs first surveillance systems.

So if you think about surveillance systems, they’re going to be on all the time. They’re going to be pulling feed for everything. So, you know, Hey, if they’re always on anyways, and most people aren’t going to be checking them normally. ’cause, you know, you don’t really check them unless you need them, then you could totally put something on there.

The Juniper threat labs, researchers issued a new detail. There’s apparently something known as Niekro Python and Python, IRC bot. For some people IRC, they may be familiar with that. That’s the internet relay chat. It’s kind of like the predecessor to like messaging. You’d put up an IRC server.

People could join, you could talk Kind of like a messaging board, but more interactive . According to this the malware in late September was targeting the visual tools, DVR VX16 4.2.28.0 models with crypto mining attacks. What this usually seems to be is like, Hey, Grabbing their botnets and they’re targeting this specific model.

Maybe there’s a firmware of a vulnerability. Maybe there’s something else we’ll just kind of keep going and see if there’s anything we can find. Right. They’re using command injection. . The script can run in both windows and Linux environments and the script has a polymorphic engine to morph itself.

Ooh. So, okay. This is actually really cool. Polymorphic engines, if you think about like something being able to evolve itself or change itself over time you know, viruses or bacteria and stuff like that. The polymorphic engine is actually a very cool way that some viruses, I mean, I say cool, but it’s kind of devastating.

It’s a very cool way that some computer viruses, they keep morphing themselves and antivirus, sometimes use signature-based defenses. Right. So what that means is they’re looking for. A specific type of code or for the binary’s to look a certain way. And then that will allow it to be like, Hey, this looks an awful lot, like this kind of virus or this specific virus.

So by morphing itself, you’re changing your signature. Every couple executions or every execution, right? So the next time you infect somebody while you’re using the next variant of what it was. And typically I was looking into polymorphic, see how they kind of work. Right. And they have their base encrypted.

That’ll get re encrypted and then you have the actual delivery system. There’s a way that you can keep that encrypted in the program. Then you can decrypt it, recompile it, but also re encrypted as well. You have the payloads being constantly changed and the signature will look different.

According to the article freakout, which is the ones who originated the botnet have been doing this since at least January. They’ve been trying to launch distributed denial of service attacks and crypto mining attacks. So they’re trying to bring people down and trying to make money kind of makes sense. Right?

They have several iterations of the Necrobot. According to what I’m seeing here There’s been even recent changes. Cool. They’re using, what’s known as a domain generation algorithm for added persistence. Based off my research, the domain generation algorithm, how it works is it’ll guess a certain kinds of domains. And then it’ll go reach out and like, Hey, are you my C to C server?

Are you my command and control server? If it doesn’t find it well, then, Hey, that’s fine. It just tries again and tries again . The first Necrobot used to scan ports, 22, 80, 443, 8081, and 7001. Then if, if it detected it, then according to the article an XM rig, which is a high-performance Monero miner linked to a specific wallet.

Then it would just try to mine and then throw whatever Monero to that wallet. So the vulnerabilities for those of you that are kind of wondering. Is the CVE-2021-15568 TerraMaster TOS before 4.1.29, CVE-2021-2900. The Genexis. Sorry. If I butchered that Genexis platinum 4410 2.1 P4410-V2-1.28.

There’s five of these, we were already covered two. The third one is CVE-2020-25494 Xinuos, formerly SCO, OpenServer version five and version six. Next is the CVE-2020-28188 TerraMaster TOS every version up to, and including 4.2.06 and the last one is the CVE-2019-12725 Zeroshell 3.9.0.

So something I’d like to point out. We do have what looks to be like one extremely recent exploit 2021. Like, you know, last year, exploits, 2020s and the 2019. This virus has exploits that are pretty recent. The chances that an organization is using something that hasn’t been patched or that the software’s haven’t had a patch for like the 2021 let’s say, then, you know, that’s, that’s pretty high.

As a software engineer, turnaround time is not like, Hey, there’s an exploit. Cool. I could totally get that fixed by this afternoon. If you just find out about it and you’re in process of normal code delivery code release right. You may not have team members to go fix critical patches that night.

You may have to pull them off that could throw your deadlines off. Very much a cat and mouse and a delivery standpoint, right? So of course you have to do bug. But do you have time to do bug fixes and your main release as well? From this, I don’t know too much about TerraMaster or the CVS in question, but from a software engineering perspective, you got to be careful with that.

Ooh, so the head of Juniper labs has told threat posts, which is the article that I’m reading this off. Most security teams need to be able to handle DGA domain attempts. What I’m assuming he means right? From an IT perspective, if a computer, a box, right, is sending out 400 DNS requests looking for similar things will an average user, shouldn’t be sending 400 DNS requests in an hour.

Right. They might go to like four or five, but if they’re doing their job, Even if you’re Googling, right. You’re not going to hit 300 domains, 400 domains. Two hours, three hours. That’s my guess. By having a route switch firewall with a rule that kinda says like, Hey, if any machine is throwing like 300 or more than 200 or whatever threshold .

X amount of DNS requests in X time or Y time, then you need to throw an alert. You need a block that cause Hey, that could be a malicious or compromised box. I could totally see where that’s, kind of where they’re getting at. But you know, that’s just my opinion. So let’s roll into the next one.

Source: https://threatpost.com/freakout-botnet-dvrs-monero-cryptominers/175467/

Ricochet Anti-Cheat Kernel

So ricochet call of duty for any of you gamers who are interested, ricochet is an anti cheat engine. Call of duty, wants to use for Warzone and Vanguard. The reason I’m bringing this up is they have a Kernel level driver. It’s first going to come to call of duty. Kernel level, for those of you who may or may not be aware, you have the user level and you have the kernel level.

Kerner level is anything that runs windows privileges versus user space is, you know, users kind of straight forward. Right? The problem with Kernel drivers is they tend to have a lot of control over the system due to the nature that they are integrated tightly with the operating system. They’re trying to calm people down.

I kind of pre-read this article right there, trying to calm people down by saying, Hey, it’s not always on and it only checks for software that interacts with call of duty, but that doesn’t mean it can’t change. That doesn’t mean that there couldn’t be false flags, right? So my biggest concern with any security tool with any AI thing..

Is false positives. Right? False positives could give people a really bad day. Do we want to stop hackers? Yeah, we want to stop hackers. Do we want to stop people from ruining the game ? Yeah, we want to stop people from ruining the game. What happens if the driver accidentally sees overclocking software as a flag.

So you’re going to have a lot of tech enthusiasts. A lot of people build gaming, rigs, gaming computers with the idea. Cool. I can play games, but I can also overclock this thing and get the most performance or just some people just like to do it for fun. Even I’ve played around with overclocking.

It’s just one of those things like, Hey, I have a really cool PC. Can I try this? My other concern as well. You have a kernel level driver that can interact with a system that’s been developed by this company. Well like any kernel level thing. What if there’s a vulnerability in that kernel?

How fast would they be able to patch it? How much will they care? Are they going to be invested to be able to like, Hey, a CVE came out on our kernel driver that is installing Monero miners or whatever should we patch it? Do we care?

That’s almost any company, but this is one more company. What I’m reading, the way I’m understanding is you will not be able to play the game unless the kernel driver is installed. For you to be able to play call of duty on your gaming PC, you would need to have this Kernel Installed.

That doesn’t make me feel great about it. Call of duty I’m seeing maybe a hundred million yeah, about a hundred million players, which means that if you target, let’s say, let’s say a quarter of them are gaming PC players, right

You have a quarter of the 100 million. So you have 25 million people who are now running this driver on their computers. If a CVE breaks out 25 million is, you know, pretty substantial base considering it’s one company. You should be worried about that for anything and everything.

Windows is not exactly, the most secure system there’s a lot of faults they’re getting better, but they do have a lot faults. Not related, but it appears that part of the driver is actually using or could possibly use machine learning algorithms. I don’t know this definitively, but they’re saying that they want to use machine learning to analyze server data, to determine patterns.

Now this goes back to my false positive concern, right? So machine learning algorithms are. At current time, most of them are not 100, truly 100% accurate. If you think it’s a hundred percent, you’re maybe you’re over-fitting, which means you’re, you’re saying, Hey, this data looks this way. Cool. But then when you throw real data at it, it doesn’t fit the training data exactly.

So you’ll overfit and that’s just, that’s just one thing I’m concerned about. Say, say it’s half a percent, right? What’s half a percent of a hundred million players is like 50,000 players that you may. Automatically flag. If you doing anything like an auto ban based on the flags, cool. You just falsely band 50,000 players.

Not to mentioned that even false positive, be like, well, Hey, what about the hackers that do get through? You are reducing the amount, but this is not a catchall solution. This is not a cool, we can fix everything.

You have to do it in a nuanced way. You can’t just have the machine learning, AI be able to auto ban people without some sort of appeal process, without some sort of safety checks to prevent those who get falsely flagged to be able to come back because it’s going to suck. You pay $60, a hundred dollars, or, you know, $60 plus DLC.

I mean, Warzone is free, but if you’re buying the season pass or whatever, you’re still paying, it’s going to suck that you falsely get flagged and you lose access to the thing that you were paying money. And I don’t think anybody wants that.

I was pulling the information, I’m going to put it in the show notes off CallOfDuty.com, it’s self.

Source: https://www.callofduty.com/blog/2021/10/ricochet-anti-cheat-initiative-for-call-of-duty

MyKings Botnet

Let’s kind of segment into the next article.

The next article comes from bleepingcomputer.com titled “MyKings botnet, still active and making massive amounts of money”. Cool. Botnets making money seems to be like a recurring theme. The MyKings botnet, according to the article is still actively spreading and is making tons of crypto.

The first appearance was like five years ago. Being that it’s one of the most analyzed I’m kind of pair I’m paraphrasing slash reading the article. MyKings is particularly interested in researchers thanks to his vast infrastructure versatile features. What does it mean by versatile features will list a few, right.

I’ll kind of touch on what they mean. So the article states that it includes: bootkits, miners, droppers, clipboard stealers, and more. Bootkits are particularly problematic because they install themselves in the boot sector of the operating system. You don’t want a virus that manipulates your system on boot or just as it’s booting, because it becomes very hard to truly get rid of that.

If the boot kit installs itself, well, you may have to completely wipe the entire system and there goes all your data, right? Minors going back to the Monero Miner, or if you know, Bitcoin minor that could be done. There’s there’s dozens of variations. There’s probably a couple different miners per coin.

Right? Droppers, I’ve heard this term before. I have to come back to you on that clipboard stealers, you know, straight up just steals your clipboard. The reason that could be problematic is if you’re mining or if you’re doing something else cool, now they have your wallet and have other stuff.

Every time that it sees your wallet, they could inject their wallet. And there you go. Now they’re now they’re using the hacker’s wallet for reasons that they would use there’s deposits, trades, et cetera.

Let’s jump into the article. Bleeping computer seems to be referencing the Avast threat labs. The earnings reflected in the wallet linked to the makings are approximately 24.7 million. So they’ve been, they, they make quite a bit of money off this, right. They’re using substitution.

Oh, cool. Kind of what I was touching on. So they are using the clipboard manipulation thing to inject their to inject their wallet. The latest I’m going to read from the article. The latest version of the malware also features a new url manipulation system in the clipboard stealer module, which the attackers created to hijack steam item trade transactions. Cool they’re even targeting Steam here, the module changed the trade off offer URLs.

So the actors placed at the receiving end. So not only are they trying to probably look for digital wallets, now they’re even targeting games. So they’re targeting steam. Which is kind of interesting. I mean, in games, items sell for a lot I know there’s this one game don’t remember off the top of my head that uses real world money to kind of be like a one-to-one, but you’re not supposed to take the money out.

At least the developers, I think don’t want you to . Hey, that’s one way that now criminals are trying to make more money. Now let’s go after games too. So there was also functionality added for the Yandex, disc storage, cloud service, and it looks like they’re essentially using that for a social engineering style spread. They are putting a photos archive, you unzip it, it’s actually the malware, but you are a trusted person sending your other friend, this link, they’re going to download it, run it because it came from you and it’s actually gonna infect them because your clipboard was manipulated behind the scenes.

Source: https://www.bleepingcomputer.com/news/security/mykings-botnet-still-active-and-making-massive-amounts-of-money/

Twitch Hacked

Now onto our last article.

Article by 9to5mac.com, “PSA: Twitch.tv was hacked, everything leaked, including creator payouts”. I’m pretty sure you’ve seen this on the news. It’s been everywhere. Right? So Twitch TV, the very popular streaming channel for, or streaming website for games. And I guess other stuff was hacked.

So if you have an account there they’re recommending you change your password, which I will recommend if your data’s ever in a breach. Yes. Change your password. Yeah, do it. Password managers are also pretty cool. Those can get hacked too, but Hey, at least you have like only one master password that you need to be changing often and you don’t got to remember the other ones.

Going through the article. There was an anonymous hacker who posted a huge download link. Apparently the entire website source code, various console phone stuff. Ooh, an unreleased steam competitor talking about steam earlier, right?. Payouts and encrypted passwords all got leaked. So encrypted passwords that could or could not be problematic depending on how good the encryption is. By the way don’t trust it, change your password. Payouts, that’s just, ah, man. Now you’re going to know what every streamer makes. Apparently 125 gigabyte torrent link was posted to 4Chan. I think last Wednesday. This was October 6th.

Ooh. So very early Wednesday, I think like maybe late September Wednesday. So I’m a little bit late to this article. One anonymous company told and I’m reading from the art from the article. “One anonymous company told VGC”, which I’m guessing is where 9to5Mac original quoted their stuff.

“That the leak data is legitimate. Including the source code for the Amazon owned streaming platform. Internally, Twitch is aware of the breach, the source said, and it’s believed that the data was obtained as recently as Monday. We’ve requested comment from Twitch and will update this story when it replies”.

I guess there hasn’t been any update, going over, right. All of that. That’s, that’s rich. So as well as the data that got. Internal penetration testing tools got leaked too. Right? So the hackers got hacked. Twitch TV isn’t exactly hackers, but they’re hacking tools got hacked. Reminds me of, I think it was a government agency, got their stuff stolen by hackers too.

It kinda reminds me of that realm, right. When you look in, when you look into the abyss, the abyss will stare back kind of thing. ‘ The entirety of Twitch’s source code with comment history “going back to its early beginnings”‘. They got all the Twitch, pretty much all the repo all the creator payouts from 2019, mobile desktop and console client, proprietary SDK and internal AWS services used by twitch. So they can completely make a Twitch clone tomorrow. Wow. ‘”Every other property that Twitch owns”, including IGDB and CurseForge’.

No idea what those are, but Hey, it’s Amazon owned, so it’s big. “An unrelased Steam competitor, codenamed Vapor from Amazon Game Studios”. So something I’ve, I’ve been seeing from the Amazon side. Right. As a developer, I like AWS. It’s kind of cool. I’m not super big on only one platform, but anyways, I’ve seen where Amazon is pushing I think I forget their name of it, but they, they have, they’re starting to push into the game market and I think it’s because Hey, Vapor or whatever this thing is. If it’s a steam competitor, they want to get in on selling games. I know they’re trying to get in on the game engine side.

It kind of makes sense. Gaming is a very profitable or not profitable, but is a very big industry people game on their mobile people game on console people game on PC , it’s what people do. The last point of what was stolen includes a penetration tools, which I was talking about, it looks like it was red team tools for my listeners who are not aware, red team essentially means attacker, right?

You have red team attack, the blue team defends, and kind of variations of those. You have some people that try to do both. That will be another episode. Another thing to talk about. A Twitter user has actually been quick to post spreadsheets about who the highest-paid earners were. So I will link the article in the description or in the show notes, if you want to go check out what that Twitter is and see, you know, who were the higher paid ones? All I will say here is it’s like a couple of million dollars from August 2019 to October 2021. I mean that. That’s pretty big.

Most people don’t make a couple of million dollars unless you’re a CEO or something also, Hey, props to them.

‘The hacker said their motivation was to disrupt the space because “their community is a disgusting, toxic cesspool”‘, nine to five quoting somebody else. Not me.

It seems just like the hacker was disgruntled because of Twitch’s politics. Not going to get into that, but Hey, if you don’t like Twitch, don’t get on Twitch. If you like Twitch, well, then get on Twitch. It’s going to be completely up to you, I do agree with the notion rules should be applied evenly.

You can’t just pick and choose, you know, you’re profitable people can bend the rules, stuff like that. I don’t, I, it should be across the board. Right. It said Twitch is working hard to address this, but many people are unhappy about the results. According to the article, I mean kind of makes sense.

Your whole data was leaked or your tools are leaked or internal stuff was leaked. Now everyone knows how much they made. You know, people can see how much they made from this year to this year.

According to this, you know, but you, people are unhappy. And I know a lot of people have been unhappy with the touch platform as a generality, but you reap what you sow I guess.

Source: https://9to5mac. com/2021/10/06/twitch-tv-was-hacked/

Outro

Guys that’s the last article. So thank you for sticking with me again. This has been Exploitbrokers Hacker News with your host Lauro, and I will see you in the next one

Hey Guys It’s your host Lauro with Exploit Brokers, back with episode 08.

IT Multinational Corporation Cognizant hit with Ransomware, COVID-19 Scams in April, Pulse VPN Patch is not patchy enough, and over 700 developer libraries contains malicious code We have some interesting stuff to cover, so let’s login.

Maze ransomware hits Cognizant

The Multinational Corporation Cognizant known for providing IT services has been hit by malware. In an article by BleepingComputer titled, “IT services giant Cognizant suffers Maze Ransomware cyber attack“, Cognizant has informed the public of a Maze ransomware attack.

The article by bleeping computer indicates a few Indicators of Compromise including some IP Addresses of servers and file hashes for kepstl32.dll, meme.tmp, and maze.dll files. These are IP and files known to be used in Maze ransomware attacks.

The article also indicated a Yara rule that was released by an InfoSec researcher Vitali Kremez. For my readers who may not be familiar with YARA. YARA is a cyber security tool to help researcher identify and classify malware and a YARA Rule is a way to define what to flag as an identified malware.

Although it appears BleepingComputer reached out to Maze Operators to discuss the attacks nothing promising has come of it yet.

There is something that distinguishes Maze ransomware from other ransomware. Maze likes to steal files before the ransom process begins. This is done to be able to release some files to increase urgency to pay the ransom. It also appears as though this practice is becoming more prevalent among ransomware operators.

To clarify for some of my listeners ransomware is a type of malware. Ransomware encrypts a victim’s computer and puts up a ransom to be able to recovery the precious data. It can not be stressed enough the importance of creating backups locally and offsite.

As more is released, I will report on it in a future episode.

Furthemore, I want to point a few ways you can strength yourself or your network assets from ransomware attacks.

• Firstly, use strong passwords, don’t reuse passwords, and always make sure default passwords are changed.
• Secondly, Make backups as often as makes sense and make sure you have offsite backups. You don’t want your backup machine to be encrypted because you’re still out of luck if your backups get encrypted too.
• Thirdly, Use anti-ransomware protection as often as possible.
• Fourthly, Cautiously patch and keep up to date as many of your systems as possible. Sometimes patches cause a lot of trouble but in general patching can help prevent previously effective malware from taking over an asset.
• Lastly, lock down Remote Desktop Protocol or RDP to prevent abuse. Minimize who can and how to access RDP on windows machines. Try using 2 factor or rdp within a VPN to help improve security.

source: https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/

COVID-19 April Scams

So the US is receiving stimulus checks and Scammers are trying to take those checks. It’s a game of Cat and Mouse but with a new target, stimulus money.

In an article by Tripwire titled, “COVID-19 Scam Roundup – April 20, 2020″, tripwire discusses the latest COVID-19 scams found in April 2020.

In a report by the FTC there was 22,853 COVID-19 complaints reported between Janurary 1st 2020 and April 20th 2020. During that period was was a total fraud loss of 17.53 million and a median fraud loss of $533. Let’s break down the types of scams that were being used.

Firstly, there is a phishing email, found by inky.com,  that opens up a digital twin of the White Houses’s official COVID-19 informational website. Once you open up that fake twin there is a download button that proceeds to download a malicious Microsoft word documents. If you’ve listened to previous episodes then you are already familiar with malicious word documents. When the victim opens the word document and enables or has enabled macros, then the malicious document proceeds to download malware and infect the computer.

Next up is another malicious email found by Bitdefender. The malicious email pretends to be from a health related sender and is themed around being sent to a business related email. It uses wording similar to hey your staff is infected click a malicious file. Although the scam email uses similar techniques to the previously noted attack, the file in question is disguised as an image file. The image file is actually a malicious file that mounts as a DVD and has a malicious executable to find the victim’s machine.

In addition to the previous email scams the next one is primarily aimed at older individuals. The scam refers to a U.S. Emergency Grants Foundation but instead of an email relies on Facebook posts to spread the malicious payload. Once a victim clicked the link it would redirect to a website labeled as the “U.S. Emergency Grants Federation” and touted that it could help individuals apply for funds to help their situation amidst the current pandemic that is spreading. In reality a victim who gives the fraudulent website their social just opened themselves up to identity fraud and other attacks at a later point.

Next up is a scam that is interesting if you travel frequently. A fake email was being sent to unsuspecting victims masquerading as a canceled flight refund. The email had a link that would redirect to a website where users could submit personal information. Among the personal information collected included mobile phone number, email address, and payment information. Once a user submitted the form the malicious actor would harvest the data to fraudulently charge the card or attempt to steal a victim’s identity.

Lastly, if any of my listeners use Internet Explorer then be careful with a new Malicious Advertising Campaign also known as Malvertising. Malicious actors registered the domain “covid19onlineinfo[dot]com and multiple other domains to host an exploit kit on. The use of multiple domains is used as a tactic to attempt to evade Anti-Virus detection. The exploit kit attempted to use a vulnerability found in older IE browsers. The exploit kit attempted to install Kpot v2.0, a virus intended to steal credentials such as personal information and passwords.

That wraps up the COVID-19 wrap up. Again as I’ve noted in previous episodes to my listeners. Please help spread the world about these scams and any information you find important to non-technical and non-security oriented users. There are many people who fall victims to these scams and it’s up to the security oriented and security interested community to help those who are not as security or technically inclined.

source: https://www.tripwire.com/state-of-security/security-awareness/covid-19-scam-roundup-april-20-2020/

source: https://www.inky.com/hubfs/Understanding%20Phishing%20-%20Operation%20White%20House.pdf

source: https://hotforsecurity.bitdefender.com/blog/malicious-spam-is-adapting-to-the-pandemic-bitdefender-telemetry-shows-22917.html

source: https://www.wnct.com/news/north-carolina/bbb-scam-alert-government-economic-impact-payments-trigger-latest-coronavirus-scam/

source: https://www.theregister.co.uk/2020/04/15/flight_refund_email_scam/

source: https://blog.avast.com/malvertising-campaign-targeting-internet-explorer-users

Pulse VPN Patches May Not Be Enough

So Virtual Private Networks or VPNs are generally not a new concept to many people. Whether using or managing a VPN, it’s become a vital part of many corporate environments. This widespread adoption and underlying value of a VPN makes it a high value target for hackers to try to compromise.

An article by SecurityWeek.com titled, “Patching Pulse Secure VPN Not Enough to Keep Attackers Out, CISA Warns” covers details and critical information about a Pulse Secure VPN related issue.

In 2019 10 major vulnerabilities were disclosed to Pulse Secure. One of the vulnerabilities being a CVSS or Common Vulnerability Scoring System score of 10/10. The reason it scored so high is that it allowed a remote and unauthenticated user to execute arbitrary code. In general Remote Code Execution ranks a CVSS high. For my users who may be wondering why, allowing a random person to run a malicious program on a company server can cost the company lots of money and can wreak havoc on the network.

To further make this a problem, in August of 2019 the NSA found that 14,500 servers were vulnerable and sent out alerts. Furthermore as recent of January 2020, it was found that cyber-criminals were still trying to exploit the vulnerability and were trying to distribute ransomware.

The Cybersecurity and Infrastructure Agency, also known as CISA, noticed that although servers were patched compromised credentials were being used months later. If the administrator applied a patch but did not change the credentials then the attacker may still be able to get in, even though the underlying vulnerability was patched.

The attackers use Tor and Virtual Private Servers or VPSs to avoid being detected and many would create a persistent connection. The persistent connection involved scheduled tasks, Remote Access Trojans also known as RATs, and using legit software like TeamViewer to keep a line to the compromised victims. Many hackers opted to execute ransomware or steal data to sell.

There is good news. CISA was able to create a tool to determine if a network was compromised before they could have been patched. CISA recommends administrators use the tool to validate and find any possible Indicator of Compromise to finish clearing their systems of malicious actors and malware.

source: https://www.securityweek.com/patching-pulse-secure-vpn-not-enough-keep-attackers-out-cisa-warns

Ruby Developers Beware

So if any of my listeners develop on Ruby I have an interesting warning for you. In an article by threatpost.com titled, “Bitcoin Stealers Hide in 700+ Ruby Developer Libraries“, new malicious libraries are brought to light.

Hackers are using typos to spread malicious libraries. Close to 760 malicious libraries were found. These libraries were found to sniff around trying to snatch some Bitcoin. Researchers at ReversingLabs found that simple mistakes or slightly off wording could leads unsuspecting users to download and use the library. Simple things like replacing a letter i with a 1 could lead to an erroneous download and use of the malicious library.

It didn’t seem to be targeted and was more geared as a spray tactic. The malicious library developers used ruby’s extensions system to execute malicious code on a victim’s computer. Ruby’s extension system essentially wraps C code and libraries in a ruby wrapper for execution within ruby. In one of the researcher’s finding there was a malicious extension file that would rename an image file that was included in the library to a dot exe and would execute it on windows. The malicious program would extract a Vb-script that would create a new Vb-script and create an auto-run registry key. The primary focus of the malware was to replace a cryptocurrency address in a user’s clipboard data with the attackers address. This would eventually lead to someone transferring currency to the attacker’s wallet instead of the intended address.

Although the researcher’s reached out to the RubyGems security team, the attacks seem to keep cropping up on more malicious ruby libraries. The signature file path and cryptocurrency motive point to the thought that all the attacks are coming from a consolidated source. Only time will tell as more data is revealed. The researches also noticed they found compromised libraries in NPM and PyPI in the past.

To all my developer listeners, remember to vet and carefully use external libraries. Although adding functionality using an import statement is useful it is a double edged sword that can easily cut you.

There are more libraries being attack and the researchers are still working to report malicious libraries.

source: https://threatpost.com/bitcoin-stealers-700-ruby-developer-libraries/154937/

Conclusion

To wrap up, we’ve discussed several interesting hacking events occurring. Keep security on the back of your mind as we traverse this unique time in our history. Lastly, It’s always going to be a back and forth fight between security White hats and malicious actors.

This has been Lauro your host, i’m signing off until next time!

Hey Guys It’s your host Lauro with Exploit Brokers. I’m happy to say the Show Will Go On!

So let’s start with a quick intro! Malware is being disguised as Textbooks, the Marriott Hotels had a data breach which means more than just a mint on your pillow, we discuss the top 10 application vulnerabilities for 2019, and we wrap up this episode by going over the anatomy of Magecart malware. Some of you may remember Magecart as previously mentioned in another episode. This time we’ll be covering a general anatomy of it, so let’s login.

 

Malware Ridden Textbooks and Educational Related Content

So in an article by kaspersky.com titled as “Student surprise: Malware masked as textbooks and essays”, Kaspersky shares their findings of Malware being disguised as educational content such as essays, books, and more. So let’s break that down here.

So the article opens up by pointing out that malware can come as TV Shows, and game sheets. Now for some of my listeners who have come across malicious file hidden as some other file, I would like to give a quick explanation as to why. Windows will generally identify a file not by the contents but by the ending file type, the dot jpg for example. Windows by default doesn’t show the file type ending so you may see something.jpg but you won’t see it’s really something.jpg.exe and the .exe means windows will try to execute it. So with this in mind let’s keep going.

Here is a breakdown of the numbers. It’s important to note the numbers and articles only represent the individuals who used Kaspersky as their AntiVirus. The numbers reflect data gathered by Kaspersky using their Anti Virus Software.

Kaspersky noted 356,000 attacks on users. 74,000 users attempted to downloaded 233,000 malware ridden essays but the malware was blocked by kaspersky. If these numbers reflect the users correctly  then each user on average attempted to download a malware disguised as an essay roughly 3 times.

Furthermore, 30,000 users attempted to download malware disguised as textbooks about 122,000 times. Which comes out roughly to 4 malicious textbook download attempts per user.

So now that we know the textbook attempts we can break down the textbook subjects. The highest infection attempts were primarily English textbooks at around 2,000 attempted downloads. This is followed by around 1,200 attempted downloads of Math textbooks. Lastly Literature is the 3rd highest download attempt at around 870 attacks. There were also 18 Natural Science and an undisclosed amount in foreign language textbooks.

We’ve covered the numbers but we haven’t covered the types of malware that was found in Kaspersky’s finding. Let’s go over that.

So the 4th most found malware in their study is the MediaGet torrent application. This download a torrent client instead of the file they were originally looking for. You can find this on download sites usually hidden as another Download button.

Next, the 3rd most found malware is WinLNK.Agen.gen. The malware hides itself in a compressed file like a RAR or ZIP Archive. When you unzip the malware and open it then the malware displays the document and begins executing the malicious code that came with the payload. This is sometimes accomplished with a LNK, Shortcut, file that pretends to be another file like an image or pdf but is really just code to display and execute malicious actions. The trojan can download various malicious software like Adware, cryptominers, botnet software, you name it.

Furthermore, the second most found malware is Win32.Agent.ifdx. This malware acts very similarly to WinLink.Agen.gen and is primarily a downloader for other malware such as cryptominers. This malware does spoof itself as a PDF, DOC, or DOCX document but is just a trojan to download other malware.

Lastly, the most found malware was the Stalk worm. The stalk worm, also known as Worm.Win32 Stalk.a, has the highest number of victims and is primarily used to infect educational related users and networks. The Stalk worm infects devices and distributes itself via email found on the victim computer.

So if any system, network, or admin of any kind is listening remember to keep your network and devices as up to date as possible.

src: https://www.kaspersky.com/blog/back-to-school-malware-2019/28316/

Magecart Attack Toolkit: Anatomy of Skimming-as-a-Service

So some of you may remember Magecart from a previous episode. For those of you who don’t let me explain. MageCart is a hacker group that creates malicious software to infect checkout carts and skim, also known as stealing the information by sniffing it during a transaction, credit cards from victims. The PerimeterX research team published an article titled as “Skimming-as-a-Service: Anatomy of a Magecart Attack Toolkit”, that goes into their findings, dissects part of how the Inter toolkit works,  and their conversation with one of the Toolkit developers.

So let’s dive into the toolkit first. The Inter toolkit was originally found in 2018 and was being marketed as an easier way for hackers, who had access to compromised shopping carts, to steal credit cards. At the time in 2018, paying $1,300 meant you had a way to take data from your compromised sites, no coding skills needed. The PerimeterX research later found a post in another public forum that hinted the Inter developers were still building and maintaining the toolkit.

So what did the researchers actually find?

The Inter toolkit has an easy to recognize control panel login with a logo of a red square in a blue circle. The PerimeterX team note this made it easier to track the control panels as they found them in the wild. The server they came upon showed not the panel but the directory tree of the app. This essentially means when they went to the site they could see how everything was organized and access the files of the app instead of the actual app contents. This is very useful because you can see the source files instead of the output generated when you go to a URL.

The PerimeterX team found what appeared to be a staging site with open login and found a text file that the developer left on by accident used for debugging.

The Inter toolkit has functionality as follows:

• An admin panel with CAPTCHA
• A Command and Control drop zone url, used to collection the stolen card data
• A Pipeline for the stolen credit card numbers to add geolocation data of the victim IP and adjusting names for an easy way to aggregate the data
• Filter and export functions for the credit card data
• Creation of a loader and a skimmer script (great for non-developer oriented hackers)
• The skimmer fields can be adjusted to customize for the need of every checkout page.
• The loader has Obfuscation to evade Anti-Malware scanners.

A notable feature is that the Obfuscation provided includes the Caesar obfuscator which is worth around $100 on it’s own but is included as part of the toolkit.

Cleverly, the toolkit generates loaders with obfuscation and anti-forensic features such as preventing loading of the skimmer if the loader detects a debugger is open.If you have devtools or firebug the loader won’t fetch the skimmer so you won’t see it execute the skimming code.

Now we have spoken about the technical aspect of this skimmer but onto why the article refers to it as Skimming-as-a-service. The developers treat this as a commercial software, albeit a malicious software. At the time of the article’s writing the toolkit retails for $1000 and includes 24/7 support. If you need help setting it up the developers offer malicious clients a 30/70 split of revenue. This bring software as a service model to the criminal side as malicious developers bring their skillsets to the blackhat side.The PerimeterX team indicate this article is part of a series so I do encourage you to go check them out. Link is in the shownotes at https://exploitbrokers.com/podcasts/hn07 .

I can’t agree with the developers writing software for nefarious purposes but as a developer I can understand how code can fill a need, again a malicious need. So it’s interesting that a team of security researchers not only talked to the developers of this malware but shared their research and part of their conversation with the security community and the world.

src: https://www.perimeterx.com/resources/blog/2020/skimming-as-a-service-anatomy-of-a-magecart-attack-toolkit/

COVID-19 IRS Scam

So we’ve gone over Malware Textbooks and Skimming-As-A-Service, but time to give out some good security info on social engineering. In an article by Sophos.com’s NakedSecurity titled “Watch out for the new wave of COVID-19 scams, warns IRS”, Sophos describes a new wave of COVID-19 Scams.

Many American listeners are probably aware that a stimulus bill was passed where most American adults will receive $1,200 , there are conditions of-course.

The article outlies the following IRS warned red flags:

• If someone emphasizes the words “Stimulus Check” or “Stimulus Payment”, run. Economic Impact Payment is the proper term being used.
• If someone says they can get your tax refund or economic payment faster by working on your behalf, run.
• If someone asks for personal banking info or any Personal Identifiable Information (PII) and they say it’s to help receive or speed up the economic payment or stimulus, you guessed it RUN!
• If you get a check in an odd amount and there are instructions to call a number to verify information online to cash it, run.
• Lastly, if they ask you to sign over your economic impact payment to them, run.

The IRS will not call, email, or contact you to get information to process your payment faster, that’s just not how they operate.

Although the IRS Criminal Investigation Division is hard at work trying to shut down these scammers there will be many scammers who fall through the cracks.

Here are some important highlights to note.

• If you have direct deposit setup for your 2019 and/or your 2019 tax return the IRS should be using that.
• If you don’t have direct deposit they will mail it to you and anyone offering to submit your direct deposit or banking info is not to be believed.
• Retirees will be receiving their payment automatically and the IRS won’t be reaching out to them. If someone reaches out to a retiree claiming to be IRS and wants to help them, RUN.

There are two things I hope my listeners will do.

1. Share this information with loved ones and anyone in older age they know. At times like this many non-security oriented people are most vulnerable and it’s important security oriented or security interested people help those they can.
2. If you or someone you know gets swindled, report it so the IRS can try to stop the scammers in their tracks. If you get any text messages, social media messages, unsolicited emails that seem to be from the IRS or systems like the Electronic Federal Tax Payment System (EFTPS) then forward as much of the info as you can to [email protected]

I know some people like to mess with scammers but I feel I also have to share that it appears the IRS does not want anyone interacting with the potential scammers and prefers people report the scammers to them.

src: https://nakedsecurity.sophos.com/2020/04/03/watch-out-for-the-new-wave-of-covid-19-scams-warns-irs/

Marriott data breach

Moving on, our show is has discussed breaches in the past and this is another breach. This time it appears the large hotel chain Marriott has informed the public that 5.2 million hotel guest’s information has been hacked in a recent data breach. Zdnet.com’s article titled “Marriott discloses new data breach impacting 5.2 million hotel guests”, shares some of the details.

The 5.2 million users affected are hotel guests who used the company’s loyalty app. The hotel discovered the breach late February. Login credentials from two employees from a franchine property had access to the app’s backend system. It’s thought the breach can be dated from mid-January but nothing has been released on how the credentials were swiped.

Here is the information believed to have been pulled:

• Contact details such as Name, Mailing Address, Email Address, and Phone number.
• Loyalty Info such as Account Number and Point Balance
• Personal Details such as Company, Gender, Birth-day, and Birth-month
• Affiliations such as any linked accounts including airline loyalty programs and their respective account numbers
• Personal Preferences such as language and room preferences.

Now it does state that Marriott does not believe passwords, pins, payment info, passport info, national id, nor driver’s license info was pulled from their system.

It’s also interesting to note this is the second breach Marriott has had in the past year or so. Back in November they had their Starwood Hotels reservation system compromised and 383 million guest details stolen as well.

We will see how much further this goes and how many more details are disclosed by Marriott

src: https://www.zdnet.com/article/marriott-discloses-new-data-breach-impacting-5-2-million-hotel-guests/

Wrap-Up

So guy’s thank you for tuning in. Remember to stay safe and secure and always keep learning. This has been your host Lauro, signing off!

Hey guys the Croatian government has been hacked, malware developers are stepping up their game, cloud flare crashed and more in this hacking news segment. Let’s login.

Croatian Government Cyber Attack

So in a new article by zdnet.com titled “Croatian government targeted by mysterious hackers”, ZDNet discusses a series of spear phishing attacks against the Croatian government. Let’s break that down.

As it currently stands an unknown hacking group has been targeting Croatian government employees. The hacking group is thought to be government-sponsored and the attack follows a spear-phishing style campaign to infect users.

A spear-phishing campaign, for my listeners who are curious, is generally an email based attacked that sends malicious payloads to specific types of individuals in the hopes the victim downloads malware.

The spear-phishing email contained an excel sheet with an embedded macro. When a user opens the email, downloads and opens the file they are prompted with enabling macros. Once the macros are turned on then a malware payload is downloaded to the computer to infect the victim. Two variants of downloadable malware were found when examining the campaign.

The first malware is known as the ‘Empire backdoor’ that is a backdoor that is part of the Empire post-exploitation framework.

A post-exploitation framework is pretty much what it sounds like. A framework meant to be used once you have exploited a target. Once a hacker is within the victim machines then they usually do things similar to the following:

1. Plant a backdoor for future access
2. Patch the way in to prevent others from hacking in and kicking them out
3. Download their payloads, such as a botnet, miner, or other resources for their gain
4. Clean records and traces of their activity
5. Repeat the process with new machines sometimes using the newly infected machine in the attack.

Back to the story. The other malware that is downloaded is known as SilentTrinity, which is part of another post-exploitation tool like Empire. A major difference the article notes is that a presentation held at Positive Hack Days or PHDays has concluded the SilentTrinity tool has never before been weaponized for malware as this phishing campaign has.

The campaign was invisible for two months before the Information Systems Security Bureau issues two alerts about the attacks. The Information Systems Security Bureau distributed shared indicators of compromise with Croatian agencies and asked to verify they were not infected.

Now some speculation I would like to discuss. The articles discuss a possible related FireEye report that may point to Russian threat actors being behind these attacks. The report tries to tie hackers who used a WinRAR vulnerability together with the Empire backdoor against Ukraine government agencies to these attacks because they used the same Command and Control server.

My opinion, and just that my opinion is as follows:

If the command and control server of one malware is the same as another malware then generally it is safe to assume it is the same hacker or hacker group. There can be instances when the same IP is used because there are only a finite number of ipv4 addresses but that falls under a very small percentage of possibility. Again that is just my two cents.

 

src: https://www.zdnet.com/article/croatian-government-targeted-by-mysterious-hackers/

 

Golang Malware Hits Linux

So for all my Linux enthusiasts out there, I have some interesting and troubling news. Since mid-2018 and still active, a crypto miner malware has been targeting Linux servers. According to an article by infosecurity-magazine.com titled “Golang Malware Targets Linux-Based Servers” Two very interesting aspects of this malware are the fact it targets Linux servers and that it is written in Golang. A

For my listeners who aren’t familiar with Golang, Golang is a language from Google that was introduced almost 10 years ago and is popular among some developers but not actively used for malware.

The malware has currently infected several thousand machines and once a machine is infected the malware uses Cryptonight algorithm to mine XMR, which is also known as Monero. Cryptonight is a CPU based crypto mining algorithm that can mine altcoins such as Bytecoin, XMR, and Bitcoal.

The malware appears to be using the following vulnerabilities:

1. ThinkPHP or CVE-2019-9082
2. Atlassian Confluence Vulnerability or CVE-2019-3396
3. Drupal or CVE-2018-7600 which also goes by Druppalgeddon2

The malware also uses the following seven methods for spreading:

1. Four separate web application exploits
2. SSH credential enumeration
3. Redis database password  enumeration
4. Lastly, it uses SSH keys found in the infected machine

A very interesting aspect of Golang malware is that it is currently not detected by most Anti-Virus software. This leaves a very open avenue for creating malware that hackers can exploit with some ease. You do need to have programming language and learn to program in Golang but just the fact that a language makes the malware undetectable is a nice feature to have.

I find it very interesting that a programming language makes a malware invisible but it’s a development that I imagine will have anti-virus developers running to upgrade in their software. Well, it will have them running if we continue to see more malware written in Golang anyways.

 

src:https://www.infosecurity-magazine.com/news/golang-malware-targets-linuxbased/

 

The Cloud Crashed: Cloudflare Network Outage

I want to preface this story with 2 words: Bad Deployment. According to a notice by Cloudflare, there was a 30 minutes window when Cloudflare sites would display a 502 error. This error was not because Cloudflare was hacked but because a spike in CPU usage by their network meant that normal traffic could not be processed and was dropped.

You may be wondering, how did this happen? Well back to my 2 words Bad Deployment. The notice goes on to discuss a misconfigured rule within their Cloudflare WAF or Web Application Firewall.

Generally, a new deployment runs in a simulation mode so they can test, benchmark, and tweak the rules. This time a regular expression caused a massive CPU spike and created the outage.

For my listeners who are interested, a regular expression is a sequence of characters and/or symbols that are used to match a specific string within a larger text. To put it simply it’s a way to define a pattern to search text.

One simple example would be a regular expression that looks for two forward slashes, any characters up until a period and then either com, net, org. If you think a regular would match website URLs in documents or text then you guessed correct.

Back to the story, Cloudflare rolled back the deployment and the incident was stopped. Although it took 30 minutes that could cost some businesses a large revenue and Cloudflare has apologized and taken steps to prevent this from happening again.

src: https://blog.cloudflare.com/cloudflare-outage/

Christmas Gaming Grinch Jailed

If any of my listeners have been gamers for a few years then you may have heard or remembered the DDoS attacks back in December 2013 and January 2014 that caused gaming services to be out. This was a major Grinch and troll move against gamers since certain games require online access to authenticate or downloads updates and services such as online play are non-existent without access to the wire.

Well, the Grinch has been caught and sentenced. According to an article by thehackernews.com titled “DDoS Attacker Who Ruined Gamers’ Christmas Gets 27 Months in Prison”, a 23-year-old hacker from Utah who launched the DDoS attacks has received a 27-month jail sentence.

A hacker going by DerpTroll has pleaded guilty November 2018. Along with his plead he confessed to be a part of a hacker group going by DerpTrolling. This was the actual hacker group behind the gaming DDoS attacks.

The Attacks caused at least $95,000 in damages according to a Department of Justice report. To add to the 27-month jail sentence. The hacker will also have to pay back the $95,000 as restitution to Daybreak Games which was previously Sony Online Entertainment.

Before we move on to the next story its important to note that this attack is different from the Lizard Squad attacks that also made headlines in 2014 due to Christmas attacks.

 

src:https://thehackernews.com/2019/07/christmas-ddos-attacks.html

 

Announcement:

So guys I really am thankful for the reviews and some feedback ive received. Due to some personal life issues ill be taking a haitus from the show but i intend to return back in the future. Please feel free to send me an email at [email protected] and as always show notes are at http://13.59.166.86/podcasts/hn06

 

this is lauro logging off.

Hey, Guys welcome back for another episode of Exploit Brokers Hacking News!

I’m your host Lauro, lets login!

 

NASA’s Raspberry Pi and Hacker Problems

So I would say it’s safe to assume most of my listeners are aware of the space agency NASA. What many of you may not be aware of is that NASA’s Jet Propulsion Laboratory, or the JPL, was the target of a year-long attack back in 2018.

According to a ZDNet.com article, “NASA hacked because of unauthorized Raspberry Pi connected to its network”, hackers were able to compromise the JPL’s network by planting a compromised raspberry pi onto the JPL’s internal network.

The lack of segmentation of the JPL’s network meant the attackers could pivot throughout the entire network without issue. For my listeners who may not be aware of the practice. It is a good security practice to segment or to create smaller network segments within the larget network by using devices like a switch, router, or some other network device. The purpose of segmenting a network is that you can prevent devices in one smaller network from connecting to a device in another network. If NASA’s JPL segmented their network it would have been harder for the hacker to move around.

This information comes from the NASA Office of Inspector General’s report. There was some information stolen.

About 500 Megabytes of data was stolen, some of which contained regulated information under ITAR or the International Traffic in Arms Regulations. The fact that ITAR related information was stolen is a major security concern. ITAR regulation was created to ensure that government and military defense tech does not fall into malicious hands.

Now the data in question belonged to NASA’s Mars Science Lab which is known for their Curiosity rover. There is a bit of concern because the hacker or hackers appeared to have accessed NASA’s Deep Space Network of satellites that communicates and controls with equipment and spacecraft. The report appears to point to JPL’s dedication to upkeeping security systems and protocols in place as the main reason for this attack.

So some of you may be wondering, do they know who hacked the JPL? Well, the article goes to point out that it could be the Chinese elite hacking group APT10. This is in connection to two Chinese nationals being charged by the US Department of Justice for hacking cloud providers, the US Navy, and NASA back in 2018. The two Chinese nationals are believed to be APT10 hackers.

src: https://www.zdnet.com/article/nasa-hacked-because-of-unauthorized-raspberry-pi-connected-to-its-network/

WeTransfer just to the wrong people

So if you use WeTransfer then unfortunately private wasn’t private for 2 days. According to  bleepingcomputer.com’s article, “WeTransfer Security Incident Sent Files to the Wrong People”, there was a period from June 16th to June 17th were files were sent to a designated people or group also resulted in other people receiving the files as well.

WeTransfer did release an email to users warning about the incident but have not released why the accidental distribution happened. They did take proactive measures by logging out some accounts, resetting passwords, and blocking transfer links for those accounts involved in the incident.

I do agree with bleepingcomputer’s statement at the end of the article. They question the incident being a simple bug in the code. Now from a software developer’s perspective, I don’t think this is a simple bug if they also went to the hassle of resetting accounts. If this was a bug then it’s understandable blocking the links but logging out and resetting passwords sound suspicious of something else they are not telling users.

Only time, another email or another security release will tell.

src: https://www.bleepingcomputer.com/news/security/wetransfer-security-incident-sent-files-to-the-wrong-people/

Ransomware Alert: LooCipher on the loose

So guys Ransomware has now become a prominent part of the cybersecurity threats out in the wild. This new ransomware is another addition. According to bleepingcomputer’s article,” New LooCipher Ransomware Spreads Its Evil Through Spam” the ransomware LooCiper, I may have butchered the name, uses a malicious word document with macros to spread.

The order of infection appears to be similar to the following:

1. The victim comes across and opens a word document called Info_BSV_2019.docm
2. Once it is open word will prompt to enable macros
3. Once the victim Enables Editing and allows the macros the macro connects to a Tor Server
4. The macro downloads a malicious executable at http[:]//hcwyo5rfapkytajg[.]onion[.]pet/3agpke31mk[.]exe
5. Once downloaded the executable is renamed to LooCipher.exe
6. At this point LooCipher.exe is auto-executed

 

Once the ransomware begins executing it appears to follow similar patterns as other ransomware. The encrypting appears to follow a particular order.

1. A file called c2056.ini is made on the Windows Desktop
   1. This file contains a unique ID, time limit, and bitcoin wallet address to pay the ransom
2. The encryption process then beings creating encrypted files with the .lcphr extension appended
3. Once all files are encrypted the executable creates the @Please_Read_Me.txt file that gives the ransom amount and instructions on how to pay the ransom
4. The wallpaper is then changed with a similar message to the @Please_Read_Me.txt
5. Lastly, the LooCipher’s decryptor window shows a countdown with a payment verification button
   1. There is an unverified process to decrypt once payment has been made

As a security precaution, it is important to keep offline backups in case any ransomware hits your system and always take precautions when opening files that are not from trusted sources.

The article notes that the LooCipher ransomware is using spam techniques to spread and it is not known yet how many have been infected with the ransomware.

src: https://www.bleepingcomputer.com/news/security/new-loocipher-ransomware-spreads-its-evil-through-spam/

Steam Phishing Website

A message to my avid gamer audience who like to hack, I got a warning and news for you. Beware those bearing gifts. A new Malwarebytes Lab report, “Fresh “video games” site welcomes new users with Steam phish” discuss a recent phishing campaign aimed toward gamers.

There has been several, what appear to be compromised, accounts sending out a message gifting 1 free game. The URL does some redirection to get to the real phishing page.

1. There is a twitter shortened t.co link
2. This takes the users to steamredirect[.]fun that redirects to the true phishing page

The phishing page masks itself as a place where you can win games. The site goes by the name “Gift4Keys” and has a roulette-style game where you can “win”, and I say win sarcastically a free game. To play all you have to do is press the play button on the middle of the site.

Once you “win”, again sarcastically, you are prompted with a timer that gives you 30 minutes to log in to steam and redeem the won game. Once you click login you are given a steam login page that shows gift4keys as a third party affiliate.

Normal third-party affiliates use the sign in at steamcommunity.com but the phishing site’s URL address is simply blank.

If you have supplied credentials then your account has been hacked and it’s important to try to recover it and change your password as soon as possible. If you haven’t had your credentials hijacked then remember this story to help make sure you stay that way.

src: https://blog.malwarebytes.com/social-engineering/2019/06/fresh-video-games-site-welcomes-new-users-with-steam-phish/

 

Conclusion

So guys to conclude this episode and a quick review. We have data being stolen from NASA by a malicious raspberry pi. We also have a new ransomware attack by the name LooCipher that is using spam techniques to spread. If you have a steam account then beware those bearing gifts and never click suspicious links. If it is too good to be true then it may not be true.

That wraps up another episode of Exploit Brokers Hacking New. The show notes can be found at exploitbrokers.com/podcasts/hn05. This has been your host Lauro, signing off until next time.

Hey, guys welcome back for another episode of Exploit Brokers Hacking News!

Lets login.

Magecart Skimmers on Amazon

We had previously in episode HN02 gone over Magecart infecting the popular magazine Forbes’s subscription website.

Well now, according to Malwarebyte’s article, “Magecart skimmers found on Amazon CloudFront CDN”, it appears that the E-commerce giant Amazon has a similar problem. Magecart’s skimmers were found on Amazon’s CDN CloudFront.

For my listener news to the show or to the web tech, a CDN or content delivery network is a way to speed up delivering resources when you request a website. Think multiple warehouses ready to deliver something to you as soon as possible as quickly as possible when you order from an online store. The closest store to you that has the item in stock will ship it to reduce the time needed to get to you. CDNs work the same.

The article explains that JavaScript libraries hosted on Amazon CloudFront were injected with web skimmers that were added on and obfuscated. The malware is injected into various JavaScript files in an attempt to broaden the malware’s reach as far as possible. The article also shows two examples, one where the malware is injected into multiple JavaScript files within the same folder or directory and another where the malware is at the end of the actual JavaScript code and has been obfuscated to make it harder to detect and reverse engineer.

The malware is using hex and Base64 encoding to hide the payload itself or the main malware code and the exfiltration mechanism pointing to “cdn-imgcloud dot com”. The stolen info is also reportedly encoded before being sent back to the hacker group over the wire.

According to the article, the following domains are strong signs that a compromised library or malware has infected a system:

• ww1-filecloud dot com or 45.114.8 dot 159
• cdn-imgcloud dot com or 45.114.8 dot 160
• font-assets dot com or 45.114.8 dot 161
• wix-cloud dot com 45.114.8 dot 162
• js-cloudhost dot com 45.114.8 dot 163

Malwarebytes also mentions that their users are already protected against these skimmers and continue to find new threads daily.

Conclusion:

So the malware is being spread as far and as wide as possible in hopes of farming useful information, payment credentials, logins, etc. This compromise is just the latest in a series of attack by Magecart. It would be worth noting what their next target or attack vector will be once we find out more.

src: https://blog.malwarebytes.com/threat-analysis/2019/06/magecart-skimmers-found-on-amazon-cloudfront-cdn/

Goldbrute botnet

In a recent report by researchers at SANS ISC named, “GoldBrute Botnet Brute Forcing 1.5 Million RDP Servers”, a new botnet is threatening RDP servers.

So some of you may be familiar with the RDP or remote desktop protocol and some of you may use it while working. Well, a recent vulnerability, CVE-2019-0708, was patched by Microsoft but that hasn’t stopped attacks from sniffing for the vulnerability to exploit unpatched servers. This vulnerability has been given the nickname “Bluekeep” and to hopefully shed light on the severity, it appears even the NSA is urging people to apply the patch.

The botnet is brute-forcing around 1.5 million RDP servers that are accessible by the internet. Shodan shows about 2.4 million vulnerable servers and GoldBrute is using its own list and continues to add to it.

There is currently only one command and controller or C&C server located at IP 104.156.249 dot 231. The bots are using port 8333 to exchanged AES encrypted data. The infection also follows an infection outline as follows:

1. First, the infected server downloads the bot program. The program is around 80 MegaBytes and includes a JRE or Java Runtime Environment.
2. The Bot then starts scanning IP addresses to send back to the C&C server
3. Once the bot reaches 80 reported vulnerable machines, then it is given a list of machines to brute force

Two interesting details to note about this bot are that each bot only tries one username and password per target and the bot itself has a Java class named GoldBrute which indicates how it got its name.

The report also says that strong Indicators of Compromise are a file name bitcoin.dll and references to either 104[.]248[].167[.]114 the zip payload IP or port 8333 on 104[.]156[.]249[.]231 the Command and control server.

src: https://isc.sans.edu/forums/diary/GoldBrute+Botnet+Brute+Forcing+15+Million+RDP+Servers/25002/

 

GateHub Cryptocurrency Wallet Hacked

So if any of you guys are into Cryptocurrency I have news and if you aren’t into cryptocurrency well I still have news. According to tripwire’s article, “Cryptocurrency wallet GateHub hacked nearly $10 million worth of Ripple (XRP) stolen”.

According to the article, gatehub released a preliminary statement noting that over 100 customer’s wallets have had the funds stolen. The statement also reports beginning to monitor network activity and beginning an investigation.

The article also mentions a report that claims that about 23.2 million Ripple or about $9.7 million has been stolen from somewhere between 80 and 90 GateHub accounts.

It appears the attack did not involve brute-forcing accounts and the attacks flew mostly under the radar. The only notable thing GateHub has noted is that there has been an increase in API calls.

The valid API calls included valid access tokens and the understood theory is that the attackers were somehow able to access or steal encrypted secret keys to make valid API calls.

So for my listeners who may not understand the idea of secret keys or API calls I’m gonna explain it quick and simple.

A secret key is essentially a digital key to a digital lock that only the key can open. If an attacker steals the key they can unlock the lock.

An API stands for Application Programming Interface and it allows a program, in this case, the wallet, to ask the main system to do something. An API is just a way to accept requests from programs the same way you can browse to a website and send requests for the system to do something.

Now that we have explained that, it appears that the best course of action is to make sure your wallets are not located at the central server and always try to look into cryptocurrency best practices.

src: https://www.tripwire.com/state-of-security/featured/cryptocurrency-wallet-gatehub-hacked/

 

FIN8 Hackers Return

So some of you may be aware of a hacking group by the name FIN8 that fell off the radar about 2 years ago in 2017. Well according to a new article by ZDNet, “FIN8 hackers return after two years with attacks against hospitality sector”, the infamous group is back.

The last known report about FIN8 hacks was back in 2017. If you have seen FIN hacker group that is a separate group that only sounds similar, from what is known.

To give you a quick catch up, the FIN8 group used spear-phishing, a target phishing attack, and a zero-day in Windows to infect retailers in the US with the ShellTea backdoor. Once the backdoor was in place they later came in and installed PoSlurp malware to steal payment info from the point of sale system.

Well, a recent report by Morphisec states they detected and stopped a new FIN8 attack that was targeted toward hospitality businesses. The new attacks appear to have leveled up compared to before. FIN8’s malware has received a major upgrade in evasion and persistence functionality.

There appears to be some overlap with another similarly named hacker group FIN7 and the article mentions that there have been previous intersections between FIN6, FIN7, and FIN8 before.

The article does present the idea that the groups are different because current cybercrime has access to rentable resources, services, and hackers for hire.

Now I would like to shed some light on this.

There have been multiple forums, websites, and other avenues such as IRC that have allowed individuals to rent or buy anything from botnets to malware. So I do agree that this may be a serious of unrelated hackers with similar suppliers but I question this because of the newer and improved malware the FIN8 group is sporting. This could be a coincidence and the idea of a merchant, all be it a criminal merchant, updating their software to include newer, better, and improved functionality is actually close to reality.

src: https://www.zdnet.com/article/fin8-hackers-return-after-two-years-with-attacks-against-hospitality-sector/

 

Conclusion

So guys to conclude this episode and a quick review. We have Magecart infecting Amazon’s Cloud Delivery Network with credit card skimmers. We also have a new brute force attack by the name GoldBrute attempting to use Remote Desktop Protocol or RDP to build a botnet. If you have cryptocurrency wallets in the cloud it may be time to rethink it and if you had ripple its wise to be on the lookout over the recent GateHub breach. Lastly, if you have a point of sale be careful and look up more information because FIN8 has returned with stronger malware and is targeting Point of Sale systems in the hospitality industry.

That wraps up another episode of Exploit Brokers Hacking New. The show notes can be found at exploitbrokers.com/podcasts/hn04. This has been your host Lauro, signing off until next time.