Ethical Hacking

Wade Mackey

Ethical Hacking

MIS 5211.001 ■ Fall 2019 ■ Wade Mackey

Main Content

“OceanLotus” targets BMW and Hyundai networks

By Leave a Comment

APT hacker group “OceanLotus” apparently compromised network systems of automaker BMW and Hyundai by installing some hacking tool which would control and spy their systems. What they did was nothing new but it was sophisticated.

According to the article

“Created Fake Websites

To get access to other computers, the hackers created a fake website that gave the impression of belonging to the BMW branch in Thailand, as they can monitor networks and find out which folders and files that users logged in.

Hackers Observed for Months

The security team at BMW allowed hackers to stay active with an intention to know more details like, who they were, how many systems they managed to compromise, and what kind of data they were after.

Based on sources, no sensitive information was accessed by hackers during the incident and no primary computers were compromised.

BMW declined to provide additional information on the attack.

“We have implemented structures and processes that minimize the risk of unauthorized external access to our systems and allow us to quickly detect, reconstruct, and recover in the event of an incident,” BMW said in a statement.”

Source Article: https://www.cisomag.com/apt-hacker-group-targets-bmw-and-hyundai-networks/

 

Pinterest says AI reduced reported self-harm content by 88%

by Leave a Comment

“Pinterest says it’s using machine learning techniques to identify and hide content that displays, rationalizes, or encourages self-injury. The company says it has achieved an 88% reduction in reports of self-harm content by users and that it’s now able to remove such content 3 times faster.”

Social media plays a big role in raising awareness of mental health. It is important to make use of it to prevent cyber bullying and personal attack instead of encouraging negative influence.

VentureBeat Article 

Adobe Suspends Accounts for All Venezuela Users Citing U.S. Sanctions

by Leave a Comment

Adobe announced to ban accounts and cancel the subscriptions for all its customers in Venezuela in order to comply with economic sanctions that the United States imposed on the Latin American country. (The Presidential Executive Order 13884 has been designed to block American companies and individuals from conducting virtually all trade with Venezuela). As a result, Adobe decided to deactivate all accounts in the country, leaving thousands of users and companies without access to the company’s graphics and multimedia software. Also, Adobe is refusing to refund its Venezuelan customers, because the presidential order also barred any transactions with the entities, “including no sales, service, support, refunds, credits, etc.” Therefore, we can see how policy can effect a business.

https://thehackernews.com/2019/10/adobe-venezuela-sanctions.html

Hospital Pays to Restore Systems After Ransomware Attack

by Leave a Comment

This article from the Healthcare IT News highlighted a few topics we touched in this class.

According to the article the attacks were “carried out on Oct. 1 and involved Ryuk ransomware code, a malware that contains several bugs, resulting in damage about one in every eight files that it encrypts.”

According to a report released by Emsisoft, in the first nine months of 2019, at least 621 “government entities, healthcare service providers and school districts, colleges and universities” have been subject to ransomware attacks. Emsisoft also found that 491 of the attacks were on healthcare providers, the security firm warned that attacks on managed services providers (MSPs), are on the rise and that average ransom demands are climbing, encouraged by payouts similar to this one.

The FBI issued a warning on Oct. 2 highlights the ransomware attacks are “becoming more targeted, sophisticated, and costly, even as the overall frequency of attacks remains consistent,” the warning also points out that in some cases, even when victims who paid the ransoms were never given a decryption key.

 

SIM Port Attack

by Leave a Comment

I was listening to this guy’s podcast on YouTube who I follow (I recommend following him) talk about SIM Port attack and the what’s and how’s of the entire thing. The podcast is based upon this guy who lost over $100k from this crypto account over night because his SIM card got attacked and was taken over by the attacker. I have included the 30 min podcast link as well as the original piece which lists how it happened step by step with images (check it out check it out)

YouTube Podcast Link: https://www.youtube.com/watch?v=qCWmpHHHXis

Article Link: https://medium.com/coinmonks/the-most-expensive-lesson-of-my-life-details-of-sim-port-hack-35de11517124

 

Microsoft releases required security updates for all versions of Windows 10

by Leave a Comment

We’re just five days away from Patch Tuesday, the day that Microsoft will release new updates for all supported versions of Windows. Apparently, the company just couldn’t wait, as it released a whole round of updates today.

Unlike most non-Patch Tuesday updates, these are actually mandatory. That means that your PC will install it automatically at some point. The updates are billed as security updates, fixing an issue where print jobs might fail. Here’s the highlight:

  • Updates an intermittent issue with the print spooler service that may cause print jobs to fail.

Here’s the full list of fixes:

  • Addresses an intermittent issue with the print spooler service that may cause print jobs to fail. Some apps may close or generate errors, such as the remote procedure call (RPC) error.
  • Addresses an issue that may result in an error when you install Features On Demand (FOD), such as .Net 3.5. The error is, “The changes couldn’t be complete. Please reboot your computer and try again. Error code: 0x800f0950.”

 

https://www.neowin.net/news/microsoft-releases-required-security-updates-for-all-versions-of-windows-10/

Hacking back, a not so dangerous game?

by Leave a Comment

Interesting read here. A recent study shows that nation retaliatory hacking may not escalate as we thought. The Obama administration had a stance to not retaliate against counties that launched cyberattacks against the US, and they would implement sanctions for fear it could lead to a military conflict. The study shows just the opposite, it is rare that a cyber conflict will go tit for tat, or escalate to a military conflict.

The article speculates that these findings may benefit the Trump administration as the US has recently launched cyberattacks against Russia, China, and Iran to retaliate or intimidate.

An additional finding of the study shows that retaliatory hacking does little to stop adversaries from launching additional attacks. I have this vision of rival nations launching cyberattacks against each other and being wary to not cross that threshold for Military escalation. I assume all nations involved know each other’s thresholds? A very dangerous game being played here.

https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2019/10/02/the-cybersecurity-202-hacking-back-may-be-less-risky-than-we-thought/5d939824602ff14beb3daacc/

Kali Linux using Windows Subsystem for Linux on Windows 10

by 1 Comment

I wanted to experiment with running Kali using Windows Subsystem for Linux on Windows 10.  This will let you run native Linux command-line tools directly on Windows.  I created this guide to get you a Kali WSL install with Metasploit running on Windows 10.  If you want to install Metasploit directly in Windows without the Windows Subsystem for Linux, read after step #13.

  1. Open and run Windows PowerShell as administrator
  2. Enter the following command:
    Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
  3. Reboot Windows
  4. Open the Microsoft Store on Windows 10 and install Kali Linux
  5. Launch Kali Linux when it is done installing and type a username and password when prompted.
  6. Type: sudo apt-get update (enter password if prompted)
  7. Type: sudo apt-get dist-upgrade
  8. Type: sudo apt-get clean
  9. Now we have to add the Kali Linux folder as an exception to the built-in Virus and threat protection so it doesn’t keep blocking/removing Metasploit:

Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection

Under Virus & threat protection settings, select Manage settings, and then under Exclusions, select Add or remove exclusions.

  1. Add your Kali folder as an exclusion:
    Located under: %LocalAppData%\Packages\KaliLinux.<Package_ID>\LocalState
    Example: C:\Users\yourname\AppData\Local\Packages\KaliLinux.random##sandletters\LocalState
  2. Now go back to your Kali Linux terminal and run this command to install Metasploit:
    sudo apt-get install metasploit-framework
  3. Finally, run Metasploit by typing: msfconsole
  4. Have fun experimenting and adding whatever else you want to Kali Linux

Also, if you just want to install Metasploit in Windows and are using the built-in virus and threat protection, you can download Metasploit Framework for Windows and add c:\metasploit-framework as an exclusion folder (like in step #9).  The msfconsole command and all related tools will be added to the system %PATH% environment variable so you can use Metasploit within Command Prompt.

These alternate methods may be helpful for someone who has limited resources on their computer (ex. RAM/CPU) and can benefit from running with the least amount of VMs as possible.  It’s also good to experiment with relatively new technology like Windows Subsystem for Linux.

I still highly recommend a full native Linux install or a Linux VM for familiarization and skill building.

From Zero to Yahoo

by Leave a Comment

A former Yahoo software engineer, Reyes Daniel Ruiz, turned hacker was charged with hacking 6,000 plus Yahoo accounts, which included his friends and colleagues. Ruiz abused his role as a reliability engineer to access internal Yahoo systems to steal passwords and hack accounts.

Ruiz admitted to making copies of images and videos of users that he compromised and stored them at his home on personal systems. He didn’t stop there, after gaining yahoo access, he compromised other accounts, like Facebook, Gmail, iCloud and DropBox for additional media. I assume that users Gmail and Facebook password reset emails were sent to their Yahoo accounts to conceal the hack. Here is a case where two factor authentication would have tipped users off to their accounts being compromised.

I question what controls Yahoo had in place to audit Ruiz’s system access and operations.

https://thehackernews.com/2019/10/yahoo-email-hacking.html

Ethical Hackers found 31 vulnerabilities for the Singapore Govt

by Leave a Comment

A bunch of ethical hackers from a program called Government Bug Bounty found more than 30 vulnerabilities in Singapore government’s network system. The article mentions “The bug bounty program was organized by the Government Technology Agency (GovTech) and Cyber Security Agency (CSA) in partnership with HackerOne, a popular bug bounty platform. HackerOne helps organizations find and fix the potential vulnerabilities before they can be exploited by cybercriminals. The new bug bounty program is part of the Singapore government’s ongoing commitment to protect its citizens and secure government network systems. The hacking challenge will offer a monetary reward to the hackers for discovering and reporting potential vulnerabilities.”

What I found really interesting was the following:

“The Government has paid out S$25,950 in bounties for discovering 31 vulnerabilities, in which four were considered as High Severity and the remaining 27 were considered as medium/low severity.”

Singapore government has this really cool program which collaborates with the cyber security community in order to build a secure nation. I think this is something every country should take into consideration

Source Link: https://www.cisomag.com/singapore-government-patches-31-vulnerabilities-found-by-ethical-hackers/