redline Archives

In a highly embarrassing incident for Acemagic, a Chinese PC manufacturer, a number of its products have been shipped with numerous vulnerabilities.

When setting up a brand-new PC out of the box, you would expect it to be highly secure and as protected against current threats as it could be. However, this isn’t always the case. PCs are complex pieces of machinery, packed full of processes, apps and coding to provide the full PC experience. And all of this leaves room for mistakes. Acemagic has learned this the hard way, as have their customers, who have now found their brand-new PCs are vulnerable to countless malware threats.

It’s a nightmare scenario for all involved, so we’re going to look at what’s happened.

The Dangers of Tinkering with Windows Source Code

In a bid to improve the performance of their PCs, Acemagic’s software developers decided to adjust Microsoft’s source code for Windows. This involved altering network settings, but inadvertently resulted in the process of digital signature verification being skipped. Digital signatures are used to verify the authenticity of data passing through PCs, so, without these in place, applications are at risk of being compromised with malware. Acemagic’s aim was to reduce boot times for its customers, but it resulted in the PCs becoming infected with malware.

From bootup, security researchers have been able to discover malware such as Bladabindi and Redline on Acemagic PCs. Both these strains of malware are designated as info stealers, so they have the potential to steal login credentials, financial data, and also download further malware. Additionally, Redline is capable of stealing cryptocurrency.

Acemagic has announced that the software adjustments were stopped on November 18^th 2023, but this still leaves a large number of compromised PCs in use by unsuspecting users. Going forwards, Acemagic has pledged to put more focus on digital certificates, a move they claim will be able to stop unauthorized modifications in the future. But the damage to Acemagic’s reputation has been done, and it’s not been helped by the fact that Acemagic has been unable to pinpoint exactly when the malware was downloaded onto their machines.

Staying Safe with New PCs

A new PC should be as safe as you can get, but the Acemagic fiasco has demonstrated how they can be just as dangerous as a PC which is several years old. Therefore, it’s crucial you take precautions when setting up a new PC:

Set it up offline: to protect your existing network, it’s a good idea to fully set up your PC before connecting it to your network. Not only does this ensure the PC is correctly configured to join your network, but it also allows you to secure the device and limit the spread of any pre-installed malware.
Scan for malware: one of the first things you should do with a new PC is scan it for malware. As we’ve seen with Acemagic, even brand-new PCs can be compromised with malware, so it makes sense to eliminate this threat before it can become active on your network. Running a quick scan with apps such as AVG or McAfee will identify any threats and quickly remove them.

For more ways to secure and optimize your business technology, contact your local IT professionals.

YouTube Channels Are Being Used to Spread Malware

Cryptominer, malicious videos, malware, NirCmd, Ophtek, redline stealer, YouTubeCryptominer, malicious videos, malware, NirCmd, Ophtek, redline, youtubeOphtek, LLC

Oct 2022

Following the discovering of a malware campaign spreading through YouTube channels, it appears that no corner of the internet is immune from hackers.

It’s increasingly common for businesses to run a YouTube channel as part of their marketing efforts, with over 60% of businesses regularly uploading videos. And with YouTube regularly attracting 5 billion daily video views, you can see why it’s an attractive target for threat actors. Thankfully, you can’t be hacked simply by watching a video on YouTube. However, you do need to consider the legitimacy of each video’s content and, more importantly, how safe the embedded links within these videos are.

How Does YouTube Spread Malware?

This latest threat to online safety appears, at present, to be concentrating on YouTube gaming channels, with a specific focus on those which cover games including Final Fantasy, FIFA and Spider-Man. The malware involved is what’s known as a malware bundle i.e. it contains several different strains of malware, with RedLine being the most dominant piece of malware.

The malware spreads through YouTube by uploading malicious videos to infected channels. These malicious videos may appear to be on-brand with the channel e.g. links to cheats for FIFA, but the payload will actually be the same malware which has infected the channel. Therefore, this malware bundle can spread through numerous niche-specific channels by using the same content.

What Does the Malware Bundle Do?

The malware contained within this attack comprises several different attack methods:

RedLine: the most substantial piece of malware found in the attack, RedLine harvests confidential data from those it infects e.g. downloading login credentials, accessing cryptocurrency wallets and extracting data entered into web browsers.

NirCmd: this application is, in fact, a genuine piece of software, but it’s one which provides the threat actors with a layer of stealth. Once activated, NirCmd conceals the activities of the malware it’s bundled with and makes the attack difficult to identify.

Cryptominer: interestingly, a cryptominer which hijacks the resources of the victim’s graphics card is also included. This is considered interesting as the attack targets gamers, a demographic who are likely to possess powerful graphics cards.

Staying Safe on YouTube

YouTube is a crucial asset in the business world, but this recent attack demonstrates it also carries security risks. Your organization may not run a gaming channel, but it’s likely this template will soon be replicated in other niches. Accordingly, it’s essential that you follow these two important practices:

Doublecheck links: when viewing videos on YouTube, it’s vital that you treat their links in the same way you would in an email. Always hover your mouse over any links (and that includes those in the video description) to reveal the true destination, copy and paste links into Google to highlight any existing concerns and, finally, ask an IT professional to verify them before clicking.
Regularly check your video library: if your organization hosts a YouTube channel, it’s recommended you keep an eye on the videos uploaded to it. The sudden appearance of videos you have no record of uploading may be the only indicator you have that your channel has been hacked.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Tag Archives: redline