Cybercrime – Page 9

Blizzard Games Vulnerability Could Leave Gamers Open To Hacking

February 4, 2018 by Joseph Martin

Do you play Blizzard online computer games such as World of Warcraft, Diablo III, Hearthstone, Starcraft II, or Overwatch? If so, there’s a potential problem you need to be aware of.

Tavis Ormandy, a researcher on Google’s Project Zero team, recently discovered that the Blizzard Update Agent is vulnerable to hacking, via a technique known as “DNS Rebinding.”

The update agent is designed to accept commands to install, uninstall, change settings, update and perform other maintenance related options. This means it has a lot of power and access to the system you’re playing the game on.

Unfortunately, because the update agent in use (JSON-RPC, port 1120) doesn’t include a validation step to check the identity of the server issuing commands, it’s possible for a hacker to insert himself into the middle of the process. This includes possibly injecting malicious commands and using the updater to hijack your machine.

Ormandy developed a proof of concept of the attack, and contacted Blizzard when he made the discovery. The company was receptive for a time, but then suddenly and inexplicably ceased all communication. Ormandy had this to say regarding the matter:

“Blizzard was replying to emails but stopped communicating on December 22nd . Blizzard is no longer replying to any enquiries, and it looks like in version 5996, the Agent now has been silently patched with a bizarre solution. Their solution appears to be to query the client command line, get the 32-bit FNV-1a string hash of the exename and then check if it’s in a blacklist. I proposed they whitelist Hostnames, but apparently that solution was too elegant and simple. I’m not pleased that Blizzard pushed this patch without notifying me or consulting me on this.”

Since Ormandy went public with his findings, Blizzard has been in contact again, stating that a more robust fix is in the works, one that will adopt the strategy of whitelisting hostnames. Meanwhile, Ormandy is continuing to test the exploit on other online games with a user base of over 100 million to see if others are also vulnerable. If you’re an online gamer, be aware that you could be leaving the door unlocked for hackers.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

2 Million Credit Cards Stolen From Popular Sandwich Shop

February 3, 2018 by Joseph Martin

By now, we’ve seen enough large-scale Point of Sale (POS) credit card thefts that patterns are beginning to emerge. Some companies follow the general arc of the narrative better than others and deserve credit for doing so, but in the end, the story is about the same.

That’s certainly the case with Jason’s Deli. Recently, they discovered RAM-scraping malware on a number of their POS terminals. This has happened at a total of 164 of their locations, scattered across 14 states.

During the seven-month period before the malware was discovered, the company estimates that the credit card payment information of some two million customers was stolen. The data included credit and debit card numbers, expiration dates, the cardholder’s service and verification codes, and the cardholder’s name.

As is the case with most of these incidents, the company immediately contacted law enforcement and hired a third-party firm to assist with the forensic investigation, which is still ongoing.

Jason’s Deli’s handling of the aftermath of the incident has been well above average. However, the bottom line is that unless companies start paying increasing attention to data security, issues like these are going to continue to occur.

As a general rule, hackers prefer to go after the low-hanging fruit. There’s simply more money in attacking soft targets than hard ones. Your company doesn’t need bullet proof security in order to be safe from most hackers, it’s just got to be better than average. Although obviously, the better and more robust your digital security is, the safer you will be.

Unfortunately, this painfully obvious lesson seems to be falling on too many deaf ears. Until and unless that changes, we’ll continue reading about incidents like these. It’s costing business billions every year. Make sure your company isn’t next on the hackers’ hit list.

Joseph Martin

Mac Computers Battling New Malware For Hijacking DNS

February 2, 2018 by Joseph Martin

It’s official, the first macOS malware of 2018 is here. Discovered by an independent security researcher and dubbed “OSX/MaMi,” the code is functionally similar to DNSChanger malware.

The researcher posted his findings on the Malwarebytes forum and none other than Patrick Wardle (an ex-NSA hacker) analyzed it, having this to say:

“OSX/MaMi isn’t particularly advanced – but does alter infected systems in rather nasty and persistent ways. By installing a new root certificate and hijacking the DNS servers, the attackers can perform a variety of nefarious actions such as man-in-the-middle’ing traffic (perhaps to steal credentials, or inject ads) or to insert cryptocurrency mining scripts into web pages.”

In addition to that, hooks were found in the software that would eventually allow it to:

Upload and download files

Execute commands

Generate simulated mouse events

Take screenshots

And more, although at present, these features are not yet active, which points to the malware as being a piece of code still very much in development.

At present, there are no anti-malware or antivirus programs capable of detecting this new strain. That, of course, will change in short order. However, for the time being, the best way to verify whether or not your machine is infected is to go through “System Preferences” and into the terminal app to check your DNS settings.

Two values you don’t want to see there are: 82.163.143.135 or 82.163.142.137.

If you’d rather not check manually, Patrick Wardle has created a free, open-source firewall for macOS called “Lulu,” which you can download from GitHub. This program was designed to block suspicious traffic and will prevent OSX/MaMi from stealing anything from your system.

As threats go, this one is relatively minor, but it’s still early in the year, and whomever is behind this piece of code will no doubt be making improvements on it. Stay tuned.

Used with permission from Article Aggregator

Joseph Martin

Protect Yourself and Your Business Against Identity Theft

January 29, 2018 by Joseph Martin

Identity theft can happen to anyone, at any time. It is a common crime in today’s hyper-technology world. Hackers are coming up with new ways to steal your information at a rapid pace. You could be the average Joe on the street who accidentally gives your credit card information to a cloned PayPal, or someone steals your driver license’s number and applies for credit cards under your name.

Identity theft has become much more prevalent in the world than many would guess. Approximately 10 MILLION Americans become a target of some form of identity theft. If that number isn’t enough to make you uneasy then I don’t know what is. But not only does identity theft happen to individuals, it can happen to businesses that are not secure online. They can steal your business’s money, goods, information or any other assets.

Some common forms of identity theft are:

Financial Fraud: This is the most numerous fraud. Financial fraud includes stealing your identity to purchase or sell expensive items, steal your tax refunds, withhold portions of checks cashed, and simply steal your money to use in various ways. There are about 20 different financial fraud types that result in stealing your money.

Criminal Activities: This is where someone steals your identity to perform criminal activities under your name.

Cybercrimes: Many sophisticated phishing scams happen through the internet. Sometimes the perpetrator is right under your nose, such as an employee or caregiver. These hackers can access employee records, steal company mail (bank statements, tax documents, new checks), and gain authorized access to credit reports.

That’s why keeping a secure and protected office is extremely important. Hiring an IT company to make sure your files are safe is one way to help your business stays protected.

Other types of identity theft:

Organized Crime
Drug Trafficking
Alien Smuggling
Money Laundering

The main types of theft you should look out for though is financial and cybercrimes. Cybercrimes are numerous and many are designed to look identical to a regularly-used website or email from a known website.

For example, you go to a website you use to pay a monthly statement, instead of taking you to the official website, a hacker can redirect you to a malicious site that looks identical to the official one. Without knowing you make your payment on a website that is designed solely to steal your money and credit card number.

So, now that you have a better understanding of the different ways your identity can be stolen, what measures can you use to prevent fraud?

For starters, make sure you recognize a real website from a fraudulent one. Look to the URL link. If it has an “https” at the beginning that usually means it is a safe site. If it has just “http” at the beginning, that is deemed as an unprotected website.

For a business, many criminals prey on small businesses who do not have secure servers or protected files. But even protected businesses can be affected by cybercrime. As mentioned previously, insider computer crime can happen. Disgruntled employees who think they may be laid-off, or are not financially stable may commit identity theft to protect themselves.

Phishing scams, adware, spyware and other viruses are a form of malware that can be used to access private records.

For a business, downloading an anti-virus software is the first step. Keeping your systems up-to-date and regularly checking its status can alert you to any updates your anti-virus software has made that you need to implement.

Never give your individual or business information to companies you don’t know are legitimate. Many official websites will also have a lock icon at the bottom right corner of the page letting you know the site is secure. Do not make payments to any website that do not have the “https” URL and a lock icon on the page.

Make sure you shred all paper invoices, bills, receipts, statements or other mail that contains private information.

Never open emails from domains or usernames you do not recognize. Many mail applications will alert you if the mail looks like spam. Never reply to emails that are alerting you to verify your account information because your account is being suspended, closed, or charged.

Discussing these issues with your employees. By educating everyone in your business about the different forms of fraud and how to avoid them, this can prevent many types of identity theft.

Also, check your bank accounts for any activity that seems suspicious. Use a credit card for payments online instead of a debit card, because most credit card company offer a zero liability policy, meaning you will not be charged for fraudulent spending. Regularly check your credit score too- if it drops without reason that means there can be a hacker using a credit card in you or your business’ name.

Joseph Martin

Weird Sounds Coming From Your Speakers? Could Be A Hacker

January 19, 2018 by Joseph Martin

Have you been hearing strange, otherworldly sounds on your Bose or Sonos speakers? If so, rest assured that your speakers aren’t haunted. They’ve likely been hijacked by hackers.

Researchers at Trend Micro have confirmed that some models (the Sonos Play:1, the Sonos One and the Bose SoundTouch) of both brands of speakers are vulnerable to hacking if the speaker is connected to a misconfigured network.

If the hackers find such a speaker, they can take control of the speaker and direct to play any audio file hosted at a specific URL.

It should be noted that this is an extremely exotic, fairly elaborate hack, and one that’s not likely to gain the hacker much, if anything in the way of useful information about the target network. Overwhelmingly, if and where this hack is seen at all, it will be used to play pranks on the target. About the worst thing that could happen is that the hacker would play a particularly annoying or alarming sound (a woman screaming, glass breaking, a baby crying or similar), which might lead to some sleepless nights or confusion, but not much else.

Even so, it’s worth making note of, because if a hacker is able to take control of a speaker connected to your network, it means that there’s a misconfiguration somewhere that could lead to a more serious hack down the road. If it happens to you, it’s well worth reviewing your network setup and security settings.

A spokesman for Sonos had this to say about the hack: “…looking into this more, but what you are referencing is a misconfiguration of a user’s network that impacts a very small number of customers that may have exposed their device to a public network. We do not recommend this type of set-up for our customers.”

Interestingly, this isn’t the first time such a hack has been seen. In 2014, a developer created a hack that went by the name “Ghosty” that did more or less the same thing.

Joseph Martin

Sound Waves May Be Used In Future Hard Drive Attacks

January 18, 2018 by Joseph Martin

Another week, another attack vector, and this one deserves extra points for creativity.

New research has proved the viability of using something as simple and innocuous as sound waves to disrupt the normal functioning of HDDs, which can be used to sabotage a wide range of equipment from Pcs, to CCTV systems, ATMs and more.

Researchers have toyed with, and been aware of the possibility of using sound waves to disrupt the normal functioning of an HDD for more than a decade, but the most recent research conducted by scientists from Princeton and Purdue universities have outlined exactly how such an attack could be carried out.

The attack exploits a peculiar design feature of HDDs. Because they store large amounts of data on small platters, they’re designed to shut down in the presence of excessive vibration to avoid scratching or damaging the platter, and thus, destroying information on the drive.

If a hacker can determine the optimal attack frequency against a given HDD, then he could play a sound aimed at the drive that would cause it to stop functioning. If the sound were played long enough, it would require the system to be manually restarted to get it working again.

As the researchers demonstrated, finding the optimal attack frequency is a trivial enough task, but it should be noted that this is a fairly exotic type of attack, and not likely to see widespread use.

The biggest threat one would potentially face from such an attack would be the disruption of the functioning of security cameras to create a blind spot at a facility, which could then be physically breached. But given that the tones are within the range of human hearing, anyone in the vicinity could come and investigate.

Nonetheless, it’s an intriguing bit of research with potentially damaging implications.

Joseph Martin

Virus Spread Through Facebook Messenger Mines For Cryptocurrency

January 13, 2018 by Joseph Martin

Facebook scams are fairly common occurrences, owing to the sheer size of the platform’s user base. It’s no surprise that there’s a new one making the rounds that you should be aware of.

This latest threat was discovered by researchers at Trend Micro, and makes use of Facebook Messenger. If you get a message containing an embedded video file saved as a zip (the file name usually appears as “video_xxxx.zip”), don’t click on it, even if it’s from someone you know.

This file is a modified form of a legitimate piece of software called “XMRig”, an open source project that allows users to mine the cryptocurrency called Monero.

When the user clicks on this poisoned version, it will direct them to a website controlled by the hackers, in addition to quietly installing the corrupted software in the background. Once installed, the hackers put the infected PC’s processor to work for them, creating a distributed network of hash power to solve advanced cryptographic puzzles and generate new Monero “coins” for themselves.

The hackers have gone to some lengths to mask their true intentions. The site appears to be a video streaming service, and users who click on the embedded file will actually see a video playing. Of course, the website is also part of the C&C structure.

There are several intriguing things to note about this new threat:

It only affects people who use the Google Chrome web browser

It only affects PCs and Laptops. Smartphones are not impacted in any way

The miner software is actually controlled via the C&C server, meaning that the hackers can upgrade their malware, adding new functionality in the blink of an eye

So far, the virus has been spreading mostly in south east Asia, but has also begun appearing in the Ukraine and Venezuela. Given the global nature of Facebook’s user base, this is wholly unsurprising, so be on the lookout for it. Don’t click embedded files in Messenger, even if you think you know the sender.

Joseph Martin

Major Security Flaw Discovered In Intel Processors

January 12, 2018 by Joseph Martin

There’s some bad news if you own a computer driven by an Intel processor. Recently, a dangerous, catastrophic security flaw has been discovered in Intel’s X86-64 architecture that allows hackers to access the kernel, which sits at the heart of your OS. By accessing the kernel, a hacker can gain access to virtually everything on the targeted machine.

This is accomplished by way of a little-known feature called “speculative execution” which allows the processor to perform operations before it’s received definitive instructions that they need to be done. It’s a way of milking more speed out of the system.

Unfortunately, any such system runs the risk of giving programs permission to execute that, under normal circumstances, would not get permission. For example, a hacker could exploit this time-saving trick to force a piece of malware that Windows Defender (or related programs designed to safeguard your system) would otherwise catch and keep from running.

The truly terrifying part about this newly discovered exploit is its scope and scale. Intel chips are found in the majority of PCs and laptops being sold today, and this exploit has been sitting undiscovered until now, in every chip the company has made over the last ten years.

So far, Google researchers have identified two distinct attacks that could be used to exploit the flaw, dubbed “Meltdown” and “Spectre,” both being every bit as bad as they sound, and both capable of giving a hacker complete control over a target system. Fortunately, there have been no reported instances of either being used in the wild…yet.

The company is aware of the problem, and although they are playing things close to the vest, a fix is already in the works. Unfortunately, there’s a drawback. In order to implement the fix, it’s going to require a huge restructuring. This will likely eliminate the “speculative execution” feature, which is going to notably slow systems down. Early estimates are that when the fix is rolled out, you’ll see your system’s performance degraded by between 17-23%.

If there’s a silver lining in all this, if you happen to own a machine built around an AMD processor, give yourself a pat on the back. They don’t contain the flaw.

Joseph Martin

Corporate Attacks On The Rise Through Vulnerable Printers

January 10, 2018 by Joseph Martin

Few things are more ubiquitous in an office environment than printers. Of course, these days, most printers are much more than simply that. They can also scan, copy and even send emails. As such, they’ve become an increasingly attractive option to hack, according to the latest data released by Barracuda Networks.

The reason is simple. Most printers aren’t as well protected as PCs and other devices on your network. They’re the weak point in your company’s defensive armor.

The upsurge in this type of attack seems to be focused on Cannon, HP and Epson printers, and works like this:

A printer is compromised and used to send spoofed scanned attachments, usually bearing an innocuous subject line such as “Scanned From HP,” “Scanned from Epson” or “Scanned from Cannon.”

Most employees don’t think twice about opening such attachments because they appear to be from a legitimate source inside the company, which is, of course, exactly what the hackers are counting on.

While any sort of payload can be delivered in this manner, the most common strain found installs a backdoor on the target PC, allowing the hackers to:

Monitor behavior and log keystrokes

Change computer settings

Copy files

Access other connected systems

And more.

In a clear indication that the malware could be used to launch a ransomware style attack, it also gives the hackers the ability to replace the PC’s wallpaper with any file they choose.

Employees should be more mindful of this type of attack and always double check to make sure the sender is valid. Also, it’s important to hover over the links embedded in such emails in order to be sure they’re valid before clicking on them.

If you haven’t been on the receiving end of an attack like this yet, count yourself lucky and stay vigilant.

Joseph Martin

Windows 10 Third Party Password Manager Could Have Security Issue

January 6, 2018 by Joseph Martin

Do you use “Keeper?” If you’re not sure what it is, then you probably don’t. It’s a password manager that Microsoft has been bundling with some of its Windows 10 releases. Either way, there’s a serious flaw in its design that you should be aware of.

Earlier in the year, Tavis Ormandy, a researcher on Google’s Project Zero team, discovered a bug that saw Keeper injecting privileged user information into web pages, exposing all manner of private data unnecessarily to website owners.

The potential damage comes from a user being lured onto a hacker-controlled website, whose owner could siphon up the information (including literally every password stored by Keeper) and resell it, or use it to launch a highly targeted attack against a specific user or device.

The bug was reported, and a patch was issued. Then, in a later version, Ormandy found the same bug cropping up again. He had this to say about the matter:

“I’ve heard of Keeper, I remember filing a bug a while ago about how they were injecting privileged UI into pages. I checked and, they’re doing the same thing again with this version.

I think I’m being generous considering this a new issue that qualifies for a ninety-day disclosure, as I literally just changed the selectors and the same attack works. Nevertheless, this is a complete compromise of Keeper security, allowing any website to steal any password.”

Craig Lurey, the CTO of Keeper Security, had this to say when informed of the bug:

“This potential vulnerability requires a Keeper user to be lured to a malicious website while logged into the browser extension, and then fakes user input by using a ‘clickjacking’ technique to execute privileged code within the browser extension.”

The two important takeaways here are as follows:

The company reports that so far as anyone can tell, this flaw has not actually been exploited in the wild.

Keeper Security has issued an emergency patch that has disabled the “Add to Existing” feature, which is where the problem code actually resides.

This temporary measure was implemented as a stop-gap until the bug can be properly patched.

Used with permission from Article Aggregator

Joseph Martin

« Previous Page
1
…
7
8
9
10
11
…
13
Next Page »

Blizzard Games Vulnerability Could Leave Gamers Open To Hacking

2 Million Credit Cards Stolen From Popular Sandwich Shop

Mac Computers Battling New Malware For Hijacking DNS

Protect Yourself and Your Business Against Identity Theft

Weird Sounds Coming From Your Speakers? Could Be A Hacker

Sound Waves May Be Used In Future Hard Drive Attacks

Major Security Flaw Discovered In Intel Processors

Corporate Attacks On The Rise Through Vulnerable Printers

Windows 10 Third Party Password Manager Could Have Security Issue

Contact Info

Navigation