Blizzard Games Vulnerability Could Leave Gamers Open To Hacking

February 4, 2018 by Joseph Martin

Do you play Blizzard online computer games such as World of Warcraft, Diablo III, Hearthstone, Starcraft II, or Overwatch? If so, there’s a potential problem you need to be aware of.

Tavis Ormandy, a researcher on Google’s Project Zero team, recently discovered that the Blizzard Update Agent is vulnerable to hacking, via a technique known as “DNS Rebinding.”

The update agent is designed to accept commands to install, uninstall, change settings, update and perform other maintenance related options. This means it has a lot of power and access to the system you’re playing the game on.

Unfortunately, because the update agent in use (JSON-RPC, port 1120) doesn’t include a validation step to check the identity of the server issuing commands, it’s possible for a hacker to insert himself into the middle of the process. This includes possibly injecting malicious commands and using the updater to hijack your machine.

Ormandy developed a proof of concept of the attack, and contacted Blizzard when he made the discovery. The company was receptive for a time, but then suddenly and inexplicably ceased all communication. Ormandy had this to say regarding the matter:

“Blizzard was replying to emails but stopped communicating on December 22nd . Blizzard is no longer replying to any enquiries, and it looks like in version 5996, the Agent now has been silently patched with a bizarre solution. Their solution appears to be to query the client command line, get the 32-bit FNV-1a string hash of the exename and then check if it’s in a blacklist. I proposed they whitelist Hostnames, but apparently that solution was too elegant and simple. I’m not pleased that Blizzard pushed this patch without notifying me or consulting me on this.”

Since Ormandy went public with his findings, Blizzard has been in contact again, stating that a more robust fix is in the works, one that will adopt the strategy of whitelisting hostnames. Meanwhile, Ormandy is continuing to test the exploit on other online games with a user base of over 100 million to see if others are also vulnerable. If you’re an online gamer, be aware that you could be leaving the door unlocked for hackers.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Mac Computers Battling New Malware For Hijacking DNS

February 2, 2018 by Joseph Martin

It’s official, the first macOS malware of 2018 is here. Discovered by an independent security researcher and dubbed “OSX/MaMi,” the code is functionally similar to DNSChanger malware.

The researcher posted his findings on the Malwarebytes forum and none other than Patrick Wardle (an ex-NSA hacker) analyzed it, having this to say:

“OSX/MaMi isn’t particularly advanced – but does alter infected systems in rather nasty and persistent ways. By installing a new root certificate and hijacking the DNS servers, the attackers can perform a variety of nefarious actions such as man-in-the-middle’ing traffic (perhaps to steal credentials, or inject ads) or to insert cryptocurrency mining scripts into web pages.”

In addition to that, hooks were found in the software that would eventually allow it to:

Upload and download files

Execute commands

Generate simulated mouse events

Take screenshots

And more, although at present, these features are not yet active, which points to the malware as being a piece of code still very much in development.

At present, there are no anti-malware or antivirus programs capable of detecting this new strain. That, of course, will change in short order. However, for the time being, the best way to verify whether or not your machine is infected is to go through “System Preferences” and into the terminal app to check your DNS settings.

Two values you don’t want to see there are: 82.163.143.135 or 82.163.142.137.

If you’d rather not check manually, Patrick Wardle has created a free, open-source firewall for macOS called “Lulu,” which you can download from GitHub. This program was designed to block suspicious traffic and will prevent OSX/MaMi from stealing anything from your system.

As threats go, this one is relatively minor, but it’s still early in the year, and whomever is behind this piece of code will no doubt be making improvements on it. Stay tuned.

Used with permission from Article Aggregator

Joseph Martin

Use Of Bots Has Increased Fake Account Creations

February 1, 2018 by Joseph Martin

The ThreatMetrix Cybercrime Report 2017 is out, and is a troubling read for anyone who has anything to do with data security. As a fraud prevention company protecting nearly a billion and a half users around the world, they’re uniquely positioned to know, and their insights on the threat landscape is invaluable.

Their main finding is that hackers, scammers and fraudsters are moving away from using stolen debit and credit cards, given that these things have such a short shelf life. On the face of it, that sounds like it might be a good thing, until you understand what they’re doing instead.

They’re making use of stolen identity data to create bogus accounts, then applying for lines of credit on their own. Even worse, they’re taking full advantage of automation to speed the process along. According to the report, the volume of global fraud attacks is up a mind blowing 100 percent in just two years, with 700 million incidents reported in 2017 alone.

Bots are coming to play an increasingly important role in the activity of the fraudsters, too. Once a new, fraudulent account has been created, it’s handed off to a bot to test it and make sure it’s valid, which increases its value on the Dark Web.

How big of a problem are bots on the web these days?

According to the report, ThreatMetrix blocked 1.5 billion bot attacks last year, with some retailers reporting that more than 90% of their daily traffic is comprised of bots.

At the root, what’s driving this behavior are the increasingly common, large-scale data breaches that put up to hundreds of millions of data records into the hands of fraudsters. Until and unless the flow of data can be stopped, we can expect this type of activity to continue to increase.

No matter how you slice it, 2018 is going to be a very interesting and very busy year.

Joseph Martin

Intel Chips Face Another Possible Vulnerability

January 31, 2018 by Joseph Martin

Intel’s year isn’t getting off to a very good start. Just after the discovery of a pair of critical vulnerabilities that have been in their chipsets for more than a decade comes the discovery of yet another serious flaw that could impact millions of laptops around the world.

A Finnish data security firm called “F-Secure” just reported an issue with Intel’s Active Management Technology (AMT) that could allow a hacker to completely bypass the machine’s normal login procedure and take control of the target device in under a minute.

AMT is an admin-level feature that allows organizations to control and manage large numbers of PCs and workstations quickly and efficiently via remote. To take advantage of the flaw, a hacker would need physical access to the machine, which is its one saving grace. However, if they have that, they can take complete control even if a BIOS password has been set.

While other research teams have discovered AMT vulnerabilities in the past, this one deserves special attention for three reasons:

Once in control, the hacker could gain remote access to whatever network the machine is attached to at some later point.

It affects almost all intel laptops, and odds are that if you’re a business owner, there are a number of laptops with Intel chipsets connected to your network

It’s an incredibly easy flaw to exploit, requiring no code whatsoever.

F-Security Research Harry Sintonen had this to say about it:

“The attack is almost deceptively simple to enact, but it has incredible destructive potential. In practice, it can give a local attacker complete control over an individual’s work laptop, despite even the most extensive security measures.”

It should be noted that this flaw is in no way related to the Spectre and Meltdown vulnerabilities that have been reported on earlier, giving Intel a trio of nasty problems to deal with right at the start of the new year.

Joseph Martin

Inappropriate Ads Found In Some Game Apps for Kids

January 30, 2018 by Joseph Martin

Normally, Google’s robust series of checks and audits are pretty good at catching malicious code and preventing it from making its way to the Play Store. Sometimes, however, something slips through anyway despite the company’s best efforts. This latest one is particularly bad.

Researchers from Check Point have identified a new strain of malware called “AdultSwine” lurking in more than sixty gaming apps on the Play Store. Each of these apps has been downloaded between 3 million and 7 million times, which gives us approximately 150 million infected devices.

As the name suggests, the malware primarily displays ads from the web that are of an adult nature, and often overtly pornographic. It also attempts to trick unsuspecting users into installing additional malware that masquerades as “security apps.”

An analysis of the code reveals it to be highly flexible, allowing the authors to easily begin collecting all kinds of information about the owner of any infected device. This makes identity theft a real possibility if the hackers were inclined to do so.

The most disturbing element of all this is that the malware seems heavily focused on apps and games designed for children. So if you’re a parent, it pays to check the apps that are installed on your child’s phone. What seems at first glance to be a harmless game could actually be displaying pornographic advertising while they’re playing.

The Check Point researchers had this to say about the discovery:

“Although for now this malicious app seems to be a nasty nuisance, and most certainly damaging on both an emotional and financial level, it nevertheless also has a potentially much wider range of malicious activities that it can pursue, all relying on the same common concept. Indeed, these plots continue to be effective even today, especially when they originate in apps downloaded from trusted sources such as Google Play.”

Just to be safe, double check the apps on your child’s phone!

Joseph Martin

Must Know Info For Backup, Security and Disaster Recovery

January 29, 2018 by Joseph Martin

The Importance of a Proactive, NOT Reactive Approach

With the major role information technology plays in the way business is conducted in today’s world, it’s crucial that every business owner, both large and small, be able to see the big picture of protecting client and company data from disaster. Data backup disaster comes in many forms, from hackers to employee sabotage, to viruses and natural disaster, it’s critical to your business operation that you understand the scenarios and solutions to protect your business and keep things running smoothly.

Susceptible to Sabotage

Data backup is crucial when it comes to the human impact of business security. A smart and informed business owner knows the importance of protecting your company and your clients from being hindered by hackers, viruses and even employee sabotage. This comes in the form of physical backup drives, such as personal computers, USB drives and in house servers as your primary backup solutions. While these are an acceptable “extra” backup, they should never be considered as your primary backup solution. Hackers and viruses can corrupt and compromise in-house servers, personal computers and hard drives, leaving you completely helpless to not only protect your data, but also quickly recover form a loss to ensure business continues as usual. There is also the threat of a disgruntled or disorganized employee stealing, losing or sabotaging these physical storage devices. The answer to this threat is an offsite data storage device, such as high security IT servers and cloud solutions. These off-site storage options not only provide superior security and protection, but they also allow for quick access to your data, documents, programs, software and applications to allow you to continue to operate in the event of a data attack.

Fires, Storms and Burglary..Oh My…

The other threat to your in-house data backup solutions is the threat of natural disasters and burglary. While your USB drives, office computers and portable hard drives can be stole or destroyed in the event of burglary, fire or severe storms, off-site servers and cloud solutions allow you to continue work from home computers and other temporary locations while your home office recovers. These threats are often overlooked by business owners as the common mistake of, “this won’t happen to us” thought process leaves them in a reactive state, when a proactive approach could have avoided the entire disaster. Off-site servers and cloud solutions are the security blanket every smart business owner keeps in hand so that when disaster strikes, they won’t be left devastated.

Who Holds the Keys to the Castle

Designate specific roles in the company for individuals to monitor your data, documents, applications and software to ensure that all critical materials are continually backed up and saved for the event of a recovery. These specific roles also limit the number of individuals with access to the data to allow for you to control the threat of data tampering and sabotage. These individuals will also have a clear outline of where the data is stored and be able to organize a speedy recovery for all your employees to allow them to recover their necessary materials to ensure business is up and running as quickly as possible.

Joseph Martin

Is Working on Personal Devices Risky Business?

January 29, 2018 by Joseph Martin

It’s natural and common for your employees to want to conduct some of their work at home or on the road, and often the most convenient way is to do so on their personal devices. However, this could be putting your business at risk, and thus allowing your employees to conduct their work on personal devices could be risky business.

The Risk of Not Being Regulated

Since your employees personal devices aren’t the property of the company, they aren’t being properly protected and regulated. And thus, you have no control on how they are being used. Employees are easily at risk for downloading and infecting their personal devices with malware and viruses that can quickly find their way into your network.

Lost and Not Found?

Another risk of having business and client files and information on a personal device, is the risk of losing or misplacing the device. If your employee’s personal device is lost, so are the the crucial documents and files you may need for your company. Or even worse, what if the credentials and personal files of you business and your clients fall into the wrong hands? You would have to notify your clients of the security breach and your reputation and relationship with your clients could also be lost in a hurry.

Take the Proper Precautions

This all isn’t to say you shouldn’t allow your employees to use their personal devices for work. It’s often convenient and even necessary to allow them to do so. However, there is not excuse for not have the proper security and precautions in place. Be sure their devices are being secured and backed up like every other device in your network. The type of remote security monitoring you need will depend on the device, the in formation being stored or accessed and the laws regarding the information you store for your business or clients.

Joseph Martin

Do Not Use These Chrome Extensions

January 28, 2018 by Joseph Martin

Do you use any of the following Chrome browser extensions?

Change HTTP Request Header

Nyoogle – (a custom logo for Google)

Stickies – (a Post-It note for Chrome)

Lite Bookmarks

If so, you’re not alone. These four extensions have a combined user base of more than half a million.

Recently, security researchers from ICEBRG (a US cyber-security company) have discovered malicious codes embedded in copies of these on the official Chrome Web Store. The code allows hackers to manipulate the users’ browser via JavaScript.

So far, the hackers have only contented themselves with relatively tame activities like loading and displaying ads, clicking on ads, and loading malicious web pages in the background. However, the potential exists to do much more than this.

Since ICEBRG informed Google, the company has removed three of the four plugins from the Web Store. As of this moment, only Nyoogle remains, though the expectation is that it will be removed in short order as well.

While all four extensions utilize the same basic techniques, and do many of the same things, it is not clear if all four were created by the same group, although this seems likely.

Since the extensions have now been (mostly) removed, the rate of infection will slow. Of course, if you’ve already downloaded and installed one of these four, then you are going to continue to be impacted.

The extensions are easy to uninstall, and if you’re using one of them, that is the recommended course of action.

In recent months, Google has taken steps to make their auditing process more robust to prevent malicious extensions and apps from finding their way onto the web properties they manage. As this latest incident proves, no matter how careful a company is, sooner or later something is going to slip through.

Joseph Martin

Backdoor In Certain Lenovo Switches Discovered

January 27, 2018 by Joseph Martin

Does your company utilize either RackSwitch or BladeCenter networking switches? Are those switches running ENOS (the Enterprise Network Operating System)? If so, there’s a backdoor in your network you weren’t aware of. Even worse, it’s been there since 2004.

Engineers at Lenovo recently discovered the backdoor in the firmware when they conducted an internal security audit. These products were added to the company’s portfolio via acquisition from Nortel, and Lenovo only just became aware of their existence.

A spokesman for the company had this to say: “The existence of mechanisms that bypass authentication or authorization are unacceptable to Lenovo and do not follow Lenovo product security or industry practices. Lenovo has removed this mechanism from the ENOS source code and has released updated firmware for affected products.”

Updates are available on Lenovo’s website, and links to the updates are available inside the company’s security advisory on this topic.

It should be noted that this backdoor would be relatively difficult for a would-be hacker to exploit, because it’s not a hidden account whose password could be guessed at or cracked via brute force, but rather an authentication bypass mechanism that requires a strict set of conditions to trigger. Lenovo describes the various configurations of security settings that activate the backdoor in their security advisory.

In any case, the presence of a backdoor into your network (even one that’s hard to trigger and access) isn’t something to be taken lightly. If you’re able, grab the firmware updates from Lenovo at your next opportunity and seal the breach. If that is impractical for some reason, Lenovo has spelled out a few mitigation strategies your company can apply as a stop gap, until you can get the firmware updates in place.

Kudos to Lenovo from their swift, deft handling of the issue!

Joseph Martin

Vulnerabilities Found In Some GPS Services

January 26, 2018 by Joseph Martin

A duo of researchers stumbled across a series of vulnerabilities in literally hundreds of GPS services that leave sensitive GPS tracking data open to hackers. Dubbed “Trackmageddon” by the researchers, the vulnerabilities span a range of weaknesses that include default or easy-to-guess passwords, IDOR (Insecure Direct Object Reference) issues, insecure API endpoints, and data collection folders that are entirely unsecured.

The reason so many different tracking services are impacted is that most of them rely on the same online software to deliver their services, and that software (believed to be designed by ThinkRace, one of the largest vendors of GPS tracking devices) itself is flawed. As more and more companies license it, the issues spread, exposing the data of an increasing number of customers who are entirely in the dark about how vulnerable their location data is.

The researchers have made attempts to contact the vendors offering GPS tracking services with vulnerabilities, but so far, have met with only limited success. According to their report:

“We tried to give the vendors enough time to fix (also respond for that matter) while we weighed this against the current immediate risk of the users.

We understand that only a vendor fix can remove a user’s location history (and any other stored user data for that matter) from the still affected services, but we (and I personally because my data is also on one of those sites) judge the risk of these vulnerabilities being exploited against live location tracking devices, much higher than the risk of historic data being exposed.”

As to the types of data being exposed, it includes: GPS coordinates, phone numbers, IMEI numbers, device information, and depending on which online service is being used, a hacker could even gain access to audio, video, and photos uploaded by the device being used.

While extremely convenient, these services do carry significant risks. Use them at your own risk.

Joseph Martin

Blizzard Games Vulnerability Could Leave Gamers Open To Hacking

Mac Computers Battling New Malware For Hijacking DNS

Use Of Bots Has Increased Fake Account Creations

Intel Chips Face Another Possible Vulnerability

Inappropriate Ads Found In Some Game Apps for Kids

Is Working on Personal Devices Risky Business?

The Risk of Not Being Regulated

Lost and Not Found?

Take the Proper Precautions

Do Not Use These Chrome Extensions

Backdoor In Certain Lenovo Switches Discovered

Vulnerabilities Found In Some GPS Services

Contact Info

Navigation