New Malware Lets Hackers Log in to Windows as Anyone

ADFS secure, APT29, MagicWeb, Network, Ophtek, Security, The Cloud, , , , , ,
07
Sep 2022

Microsoft has announced that Windows login credentials can now be bypassed by a new strain of malware, one which is being used by Russian hackers APT29.

Logging onto Windows is the first thing we do after turning a PC on, and we do this by entering a combination of username/password credentials to gain access. This first step in security is crucial for protecting the integrity of your PC. If your credentials are highly secure, and known to no one else, it’s going to be difficult for anyone else to log on to your PC. And you certainly don’t want anyone gaining unauthorized access to your desktop. Accordingly, this has made login credentials a major target for threat actors.

This latest piece of malware, known as MagicWeb, doesn’t, however, steal your username/password combination. Instead, it’s much cleverer.

MagicWeb’s Deceptive Power

Windows passwords are hashed, and this means that although they are stored on your PC and associated servers, they are encrypted and translated into a series of unintelligible characters. So, for example, your password of PASSWORD (please don’t ever use this!) may be hashed into %fG1a:: – and these hashed passwords are completely useless. However, by entering PASSWORD into a login system, it will be translated into a hash and then matched against the stored hash to determine if it’s the correct password.

As it’s incredibly difficult to decrypt hashed passwords, threat actors must find different methods to bypass login credentials. MagicWeb does this by obtaining unauthorized access to login credentials for Active Directory Federation Services (ADFS) servers. It’s within these ADFS servers that access to systems within an organization can be processed. This access is validated by a token generated within ADFS. MagicWeb compromises this token by manipulating the claims process used to authorize any logon requests. Therefore, it can validate any Windows logon request.

Protecting Your PCs from MagicWeb

Once MagicWeb has a foothold within your ADFS servers, it can allow anyone to log on to your network with ease. Both identifying and preventing this is important for you IT infrastructure’s security. As such, you need to make sure you do the following:

  • Make ADFS secure: one of the most effective ways to protect your ADFS is by designing it to be secure. This is far from straightforward, but it will pay dividends down the road when it comes face-to-face with threats such as MagicWeb. Luckily, Microsoft have provided advice on the best practices for achieving this.
  • Isolate admin access: malware threats such as MagicWeb have the opportunity to gain unauthorized admin access, and this gives them free rein to make major changes to your IT network. It makes sense, therefore, to isolate any admin infrastructures and restrict access to as few people as possible. Also, make sure your admin infrastructure is regularly monitored for any changes, as this may indicate an attack is taking place.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Latest Chrome Update Highlights Numerous Vulnerabilities

Chrome, Ophtek, Updates, zero-day, , ,
30
Aug 2022

Chrome is the most popular web browser on the market by far, but its success is no guarantee of being free from vulnerabilities as a new update shows.

No piece of software is created perfectly, so there’s always a need to update and refine applications. In particular, security vulnerabilities are one of the most common issues which software designers find themselves needing to go back and solve. And this is because threat actors will use all their resources to discover even the tiniest chink in an application’s armor. Once this has been discovered, they’re presented with the opportunity to bypass security and exploit the software.

Chrome’s latest update comes packed full of functionality upgrades, but also 11 security fixes. As it’s likely your organization regularly works with Chrome, we’re going to look at what this patch offers you.

What is Chrome’s Latest Update?

The latest update from Chrome – details of how to install it are here – delivers a variety of fixes which include:

  • A zero-day vulnerability – tagged as CVE-2022-2856 – which has allowed hackers to take advantage of a flaw in Web Intents, a process which allows web apps to connect with web services.
  • Several ‘use-after-free’ vulnerabilities, these are flaws that are usually opened when an application fails to clear its memory when used. This scenario provides a foothold to threat actors looking to breach security.
  • A heap buffer overload vulnerability relating to downloads made through Chrome, a vulnerability which allows memory corruption to open a backdoor for threat actors.

t only takes one vulnerability to compromise a PC, so the need to patch 11 vulnerabilities strikes a major blow to Chrome’s reputation. To make matters worse, this is the fifth zero-day vulnerability Chrome have had to issue in 2022. Digging deeper into the contents of the update, it also becomes apparent that ‘use-after-free’ errors are a significant problem within Chrome at present.

Is Chrome Safe to Use?

Computer Keyboard with symbolic padlock key

Chrome will continue to work even without the latest update. However, the protection at its disposal will be lacking any substantial strength. There’s a chance, of course, you won’t fall victim to a cyber-attack which exploits these flaws, but do you really want to take a chance? The sensible answer is: NO! And, although Chrome haven’t released any specific details about these latest vulnerabilities, you can bet your bottom dollar that hackers will now be focusing their attention on Chrome.

Therefore, it’s crucial you install this latest Chrome update as soon as possible. Even if your organization’s preference is, for example, to use the Edge browser, you need to update Chrome if it’s present on your PCs. This is the only way to ensure that security gaps are plugged. Naturally, there will be further vulnerabilities which remain unidentified, but you can only deal with threats which are known. Chrome, on the whole, is a reputable and safe browser, you just need to make sure that automatic updates are activated.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Cuba Ransomware Collects Over $40 Million in Ransom Fees

Backup, Cuba ransomware, Ophtek, Phishing, Ransomware, Updates, , , , ,
23
Aug 2022

Using a new remote access trojan, threat actors behind the Cuba ransomware have amassed ransom payments estimated to be close to $44 million.

Over the past five years, countless headlines have been generated by the damage caused by ransomware attacks. Not only do they compromise access to your organization’s data, but they also have the potential to inflict painful financial damage. To make matters worse, these attacks are evolving to become more powerful and harder to prevent. In fact, on many occasions (and as we’ll see with the Cuba ransomware) these evolutions will take place over a matter of months.

Ransomware, therefore, is a very real threat to your organization’s IT network, so it’s important that you understand exactly how the Cuba ransomware operates.

What is the Cuba Ransomware?

Cuba was first detected in late 2019 before disappearing from the frontline and returning two years later in November 2021. Evidence of the Cuba ransomware has been detected in around 60 ransomware attacks, with 40 of these victims revealed to be US-based. Cuba is delivered to PCs through the Hancitor loader, a type of malware which is used to download and execute additional malware e.g. remote access trojans. Hancitor makes its way onto PCs through a variety of means such as phishing emails, stolen login credentials and software vulnerabilities.

Since Cuba first emerged onto the digital landscape, it has undergone a series of significant changes. The most notable changes have seen it terminating more processes before it locks files, widening the range of file types it encrypts and, believe it or not, enhancing its support options for victims wanting to pay. Cuba has also been observed operating a backdoor trojan called ROMCOM RAT, a piece of malware which deletes files and logs data to a remote server.

Protecting Yourself Against the Cuba Ransomware

With Cuba collecting ransom payments of over $40 million, it’s clear to see Cuba is a dangerously effective threat. It’s also important to point out there is currently no known decryption tool available to combat Cuba’s encryption methods. Accordingly, you need to be on your guard against this threat and any similar attacks. Therefore, make sure you practice the following:

  • Install updates: Cuba has the power to exploit software vulnerabilities to gain unauthorized access to computer networks, so it’s crucial that you always install updates as soon as possible. The install process for updates can feel time consuming, but when you have the option to automate these installations, there’s no reason this shouldn’t take place.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

New Malware Spies on Gmail and AOL Inboxes

malicious browser extension, Ophtek, Phishing Email, SHARPEXT, Volexity, , , ,
16
Aug 2022

Webmail remains a crucial way in which you can keep on top of your digital communication, but what happens when people start spying on it?

While AOL email addresses are far from a popular choice in 2021, there are still significant numbers in use. Gmail, however, is much more in demand, with an estimated 1.8 billion users. So, it doesn’t take a genius to see why these platforms would turn a hacker’s head. Protecting such huge amounts of data, therefore, should be paramount. Unfortunately, both AOL and Gmail have fallen short in this respect due to a malicious browser extension. And the main impact of this is that their users have found their webmail accounts compromised.

With such significant data passing through webmail accounts, it’s important that you understand any relevant threats. This slice of malware – dubbed SHARPEXT – is the perfect example of one you need to be on your guard against, so let’s take a look at it.

How Does SHARPEXT Peer Over Your Shoulder?

The infected browser extensions are believed to target three specific browsers: Chrome, Edge and Naver Whale (a South Korean browser). Judging by the evidence on offer, security researchers have determined that SHARPEXT is the work of a North Korean cybercrime group known as SharpTongue. Once the malicious browser extension is activated, it works in a novel way. Whereas similar strains of malware focus on harvesting login credentials, SHARPEXT browses its victims mail and extracts individual emails from the inbox.

You may be wondering how the SHARPEXT extension finds its way into your browser, after all, who would knowingly install a sophisticated piece of spyware on their PC? Well, as ever, it’s down to a stealthy approach by the threat actors. After sending the victim an infected document, SharpTongue use social engineering techniques to convince the recipient to open it; this installs the spyware in the background, where it remains unseen by antivirus software.

How Do You Avoid the Threat of SHARPEXT?

No one wants their email compromised and, for an organization, this can be particularly troubling due to the data at risk. And SHARPEXT is unlikely to be the last attack which uses similar techniques. Therefore, it’s vital that you know how to protect yourself and your PC against it:

  • Understand the threat of phishing emails: it’s important that your staff know how to identify a phishing email; these are one of the most common methods employed by hackers to compromise PCs. A phishing attack can be activated in seconds and, in a worst-case scenario, turn over complete control of a PC or network to a hacker.
  • Block any SHARPEXT identifiers: the coding used within SHARPEXT is innovative as it uses coding unfamiliar to security tools. Thankfully, security experts Volexity have compiled a list of identifying code which IT professionals can use to identify extensions running SHARPEXT.
  • Restrict the Installation of Extensions: in a work-based setting, there’s little reason for your employees to be installing browser extensions onto their PCs. Accordingly, it makes sense for your organization to restrict who can install extensions. If a specific extension is required, then an employee should submit a request to their IT team.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Office Macros Disabled: What the Hackers Did Next

email security, malicious websites, Office Macros, Ophtek, threatneedle, , , ,
09
Aug 2022

One of the best ways to infect a PC has, until now, been through Office macros. But, now that they’re disabled by default, what are the hackers going to do?

The numbers of hacks that have involved Office macros over the last 20 years is mindboggling. And they have involved some major attacks, such as ThreatNeedle, during this period. Accordingly, Microsoft decided that 2022 would be the year the security risk of macros was put to bed once and for all. This, as you would imagine, has put a major thorn in the side of hackers. Nonetheless, hackers are as determined as they are malicious. Therefore, they have had to refine their attack strategies and adopt new methods.

And it’s crucial that you know what they have up their sleeves.

How Have Hackers Adapted their Attacks?

Now the exploits offered by internet macros have been greatly diminished, hackers have evolved their techniques to maintain a sting in their tail.

Most notably, a significant rise in container-based attacks has been observed, but what are container-based attacks? Well, container files are any files which allow multiple data sources to be embedded in one file e.g. a .zip or .rar file can contain numerous files which are all compressed into one ‘container’ file. So, a threat actor could, for example, deliver a .zip file packed full of malware as an email attachment.

HTML smuggling has also been adopted as a popular alternative to Office macros. This form of attack involves a threat actor ‘smuggling’ infected scripts into web pages and/or associated HTML attachments. All it takes for the scripts to be activated on a victim’s PC is for the HTML to be loaded into their browser. Therefore, simply visiting a website is enough to download and activate malware, and the innocent party would have no idea an attack was unfolding in front of them.

Another increase in popularity has been noted in the form of infected .lnk files. These are files which act as shortcuts/links and, while they can be used to direct users to safe URLs, they have the potential to forward victims onto malicious websites and initiate unsafe downloads.

How Can You Keep Pace With These Techniques?

You may be able to breathe slightly easier now that macros have been disabled by default, but you need to remain alert. Make sure you counter the new threats above by practicing the following:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 21 22 23 24 25 … 57