Category: security

Categories
security

Microsoft Defender scares admins with Emotet false positives

Got hit by this today. Was trying to open a Word doc from a colleague when I receive the following scary warning.

Submitting the same file to VirusTotal returns 0 threats detected. Hmmm.

Searching for the keyword Win32/PowEmotet.SB returns the following:

Microsoft Defender for Endpoint is currently blocking Office documents from being opened and some executables from launching due to a false positive tagging the files as potentially bundling an Emotet malware payload.

Source: Microsoft Defender scares admins with Emotet false positives

If you are hit by the same issue, just update your threat definition and it should go away:

Categories
programming security

Hoax Email Blast Abused Poor Coding in FBI Website

One of the FBI website had a web form that allowed arbitrary content to be sent from a legitimate FBI domain – passing all DMARC, DKIM, SPF. This isn’t even a hack – anyone could have done it using their web browser. But it could have serious consequences had the attacker had more nefarious motives.

The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for…

Source: Hoax Email Blast Abused Poor Coding in FBI Website

Categories
programming security

The Invisible JavaScript Backdoor – Certitude Blog

Earlier, we had a group which abuse Unicode bi-directional mechanism to deceive the reader about the actual ordering of source code, leading to clever hiding of backdoor in plain sight.

Now we have yet another novel method to include a backdoor in source codes. The attack vector makes use of Unicode characters that are invisible, but which are valid characters in variables names.

The attack requires the IDE/text editor (and the used font) to correctly render the invisible characters. At least Notepad++ and VS Code render it correctly (in VS Code the invisible character is slightly wider than ASCII characters). The script behaves as described at least with Node 14.

Source: The Invisible JavaScript Backdoor – Certitude Blog

Categories
privacy security

Malware found in coa and rc, two npm packages with 23M weekly downloads

It’s a worrying trend to see more and more hijacking of popular packages to spread malware. The threat actor apparently gained access to the packager maintainers account and inserted a post install script to download malware.

The security team of the npm JavaScript package manager has warned users that two of its most popular packages had been hijacked by a threat actor who released new versions laced with what appeared to be password-stealing malware.

Source: Malware found in coa and rc, two npm packages with 23M weekly downloads

Categories
security

O.MG Cable – * to USB-A

This is incredible. It’s essentially a covert computer inside a USB cable.

To get a cable like this, you used to need a million dollar budget or to find a guy named MG at DEFCON. But Hak5 teamed up with MG to allow more people access to this previously clandestine attack hardware. Every O.MG Cable is hand made and tailored to look and feel exactly like the cable your target already has in their possession. You won’t need a million dollar budget for this cable, but the power and capabilities are extensive.It is packed with a web server, 802.11 radio, and way more memory and processing power than the type of cable you would want for just doing demos. But the flexibility makes demos easy.The O.MG Cable is built for covert field-use, with features that enhance remote execution, stealth, forensics evasion, all while being able to quickly change your tooling on the

Source: O.MG Cable – * to USB-A

Categories
cloud IoT security

“I’m totally screwed.” WD My Book Live users wake up to find their data deleted

This is like the worse case scenario that security researchers have been warning about. Someone exploited an old vulnerability for some WD devices and wiped out all the data in those devices that are exposed in the internet.

WD advises customers to immediately unplug their My Book Live and My Book Live Duo from the internet.

“I have a WD mybook live connected to my home LAN and worked fine for years,” the person who started the thread wrote. “I have just found that somehow all the data on it is gone today, while the directories seem there but empty. Previously the 2T volume was almost full but now it shows full capacity.”

It’s too easy to blame IoT device manufacturers, but this is a very tough problem. The following comment from HN says it best.

There’s really no winning with this.

You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you’ve created a precedent that the device is still getting patches and can be used by users, only making the lifecycle issue worse.

You can release a version which severely limits the capability of the product or effectively disables it but this is just a guaranteed way of getting bad press and even more customers will be mad at you for killing a device early.

You can turn the device over to the community (if you can managed to get it through legal and 3rd party agreements) but that isn’t actually going to solve anything as it’s not a product for extremely tech savvy users, at best it buys deflection in the news report in exchange for the effort of doing this (if you can at all).

You can claim the lifecycle is over and years later and be technically correct but still get the bad press and user feedback anyways.

Source: “I’m totally screwed.” WD My Book Live users wake up to find their data deleted

Categories
internet IoT security

Whistleblower: Ubiquiti Breach “Catastrophic” — Krebs on Security

This is serious. If you have Ubiquiti equipment do change your credentials immediately and check for signs of compromise.

Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies.

Source: Whistleblower: Ubiquiti Breach “Catastrophic” — Krebs on Security

Categories
IoT security

‘This is dangerous stuff’: Hacker increased chemical level at Oldsmar’s water system, sheriff says

This is why you should secure your endpoints, especially if you are operating a critical infrastructure. This seems to be one of those supervisory interface that is exposed over the internet. Thank goodness no real harm was done.

And this time, Gualtieri says, the hacker did more than just remote in. According to the sheriff, the hacker spent up to five minutes in the system and adjusted the amount of sodium hydroxide in the water from 100 parts per million to 11,100.

“This is obviously a significant and potentially dangerous increase. Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaners,” Gualtieri added.

Source: ‘This is dangerous stuff’: Hacker increased chemical level at Oldsmar’s water system, sheriff says

Categories
security

Google discloses spearphishing targeting security researchers | SC Media

We are all familiar with spearphishing attacks against high value targets. But this is bold. A group of hackers are apparently targetting cyber security researchers, whose main job is to study them (the hackers) and their works. It’s like the thief stealing from the police. And the thief succeeded – in some cases.

Depending on how widespread the compromises were, it could potentially taint some research and defensive strategies that threat intelligence firms share with businesses and other organizations.

Source: Google discloses spearphishing targeting security researchers | SC Media

Categories
security

FireEye Shares Details of Recent Cyber Attack, Actions to Protect Community

One of the world’s leading cyber security companies was breached, likely through a state-sponsored attack. One of the side effects of this attack is that FireEye’s own red-team tools will now be effectively “useless” for pentesting.

FireEye was recently attacked by a nation-state adversary and here are the actions we are taking to protect the community.

…

Consistent with a nation-state cyber-espionage effort, the attacker primarily sought information related to certain government customers. While the attacker was able to access some of our internal systems, at this point in our investigation, we have seen no evidence that the attacker exfiltrated data from our primary systems that store customer information from our incident response or consulting engagements, or the metadata collected by our products in our dynamic threat intelligence systems. If we discover that customer information was taken, we will contact them directly.

Source: FireEye Shares Details of Recent Cyber Attack, Actions to Protect Community

Update (2020-12-10): FireEye shares (NASDAQ: FEYE) is down more than 13% after news broke.