Ethical Hacking

Wade Mackey

Ethical Hacking

MIS 5211.001 ■ Fall 2019 ■ Wade Mackey

Main Content

“OceanLotus” targets BMW and Hyundai networks

By Leave a Comment

APT hacker group “OceanLotus” apparently compromised network systems of automaker BMW and Hyundai by installing some hacking tool which would control and spy their systems. What they did was nothing new but it was sophisticated.

According to the article

“Created Fake Websites

To get access to other computers, the hackers created a fake website that gave the impression of belonging to the BMW branch in Thailand, as they can monitor networks and find out which folders and files that users logged in.

Hackers Observed for Months

The security team at BMW allowed hackers to stay active with an intention to know more details like, who they were, how many systems they managed to compromise, and what kind of data they were after.

Based on sources, no sensitive information was accessed by hackers during the incident and no primary computers were compromised.

BMW declined to provide additional information on the attack.

“We have implemented structures and processes that minimize the risk of unauthorized external access to our systems and allow us to quickly detect, reconstruct, and recover in the event of an incident,” BMW said in a statement.”

Source Article: https://www.cisomag.com/apt-hacker-group-targets-bmw-and-hyundai-networks/

 

The Windows 10 security guide: How to safeguard your business

by Leave a Comment

This article interprets some approaches to make your Windows 10 more secure. For a big company, they should have an IT security specialist to manage their system. For a small company, it is better to outsource the responsibilities to the third party. Also, it provides some suggestions for all businesses.
MANAGING UPDATES
The absolute most significant security setting for any Windows 10 PC is guaranteeing that updates are being introduced on a normal, unsurprising timetable. That is valid for each advanced processing gadget, obviously, yet the “Windows as an administration” model that Microsoft presented with Windows 10 changes how you oversee refreshes.
IDENTITY AND USER ACCOUNT MANAGEMENT
Each window 10 PC requires at any rate one user account, which is thus ensured by a secret password and optional validation components. How you set up that account goes far toward guaranteeing the security of the device. Physical security is significant as issues identified with software or networks. For a business or a government agency, the effect can be shocking, and the results are surprisingly more terrible in controlled enterprises or where information break laws require open revelation. On a Windows 10 device, the absolute most significant setup changes you can make is to enable BitLocker device encryption.
BLOCKING MALICIOUS CODE
As the world has turned out to be increasingly associated and online aggressors have turned out to be progressively complex, the job of conventional antivirus software has changed. Rather than being the essential device for hindering the establishment of malicious code, security software is currently simply one more layer in a guarded methodology. Each establishment of Windows 10 incorporates built-in antivirus, anti-malware software called Windows Defender, which updates itself utilizing a similar instrument as Windows Update. Windows Defender is intended to be a set-it-and-forget-it feature and doesn’t require any manual design. If you install an outside security bundle, Windows Defender moves to one side and enables that product to distinguish and evacuate potential dangers. Large organizations that utilization Windows Enterprise edition can send Windows Defender Advanced Threat Protection, a security platform that monitors endpoints, for example, Windows 10 PCs using behavioral sensors. Using cloud-based investigation, Windows Defender ATP can identify suspicious behavior and alert administrators to potential dangers.
NETWORKING
Each version of Windows in the previous 15 years has incorporated a stateful investigation firewall. In Windows 10, this firewall is empowered by default and need not bother with any tweaking to be effective. Similarly, as with its predecessors, the Windows 10 firewall supports three distinctive network configurations: Domain, Private, and Public. Applications that need access to arrange assets can by and large design themselves as a part of starting arrangement.
To modify fundamental Windows firewall settings, utilize the Firewall and Network Protection tab in the Windows Security application. For an increasingly exhaustive, expert-only arrangement of setup tools, click Advanced Settings to open the legacy Windows Defender Firewall with Advanced Security console. On managed networks, these settings can be controlled through a combination of Group Policy and server-side settings.

https://www.zdnet.com/article/the-windows-10-security-guide-how-to-safeguard-your-business/

SimJacker – Hacking phones via SMS!

by 1 Comment

We vaguely talked about a vulnerability or vulnerabilities at this point in sim card which allows attackers to compromise cell phones. From thehackernwes.com I was able to track down the article which talks about it. Known as “SimJacker” the threat lies in the SIM toolkit which can be exploited no matter what type of cellphone users have. This particular type of SIM card is used in over 30 countries and more than a few dozen big operators use that. The freaky part is according to the article – “What’s worrisome? A specific private company that works with governments is actively exploiting the SimJacker vulnerability from at least the last two years to conduct targeted surveillance on mobile phone users across several countries.” The article explains what exactly the SimJacker does and how it works.

“Disclosed by researchers at AdaptiveMobile Security in new research published today, the vulnerability can be exploited using a $10 GSM modem to perform several tasks, listed below, on a targeted device just by sending an SMS containing a specific type of spyware-like code.

Retrieving targeted device’ location and IMEI information,

  • Spreading mis-information by sending fake messages on behalf of victims,
  • Performing premium-rate scams by dialing premium-rate numbers,
  • Spying on victims’ surroundings by instructing the device to call the attacker’s phone number,
  • Spreading malware by forcing victim’s phone browser to open a malicious web page,
  • Performing denial of service attacks by disabling the SIM card, and
  • Retrieving other information like language, radio type, battery level, etc.”

Kind of a long read but worth it. Alarming imo!

Source Link: https://thehackernews.com/2019/09/simjacker-mobile-hacking.html

 

The Human Factor.

by 1 Comment

The weakest link in security are humans. Iranian hackers launch credential-stealing phishing attacks against universities resulting in the theft of intellectual property and research data.

Universities in the US, UK and Australia are being targeted by the Colbalt Dickens hacking group who are linked to the Iranian government. It is speculated these attacks are in response to recent government sanctions and Iranian academic talent leaving for countries for collaborative academic research purposes.

The phishing emails look legitimate, and appear to come from online library services at the university. The email content claims the user’s account has been deactivated, and to reactivate, they follow a spoofed URL link and provide credentials. In addition to their phishing tactics, the group uses publicly available tools and code taken from GitHub instead of using malware. This tactic allows them to remain undetected by security software.

I have found that user education in the form of anti-phishing campaigns and enabling multi-factor authentication are crucial in combating phishing attacks.

https://www.zdnet.com/article/iranian-hackers-credential-stealing-phishing-attacks-against-universities-around-the-world/

Russia’s Grid Hackers Aimed for Physical Destruction

by Leave a Comment

I remember reading about this power grid attack against Ukraine in 2016, and experts were puzzled as to why the attack just accomplished a temporary outage. Some speculated that is was just probing the power grid for a more complex attack at a later date. This article has a different theory. The malware Russia used to overload the electric transmission station, just north of the city of Kiev, was “Crash Override” (https://www.us-cert.gov/ncas/alerts/TA17-163A). The malware interacts/attacks electric industrial equipment by sending multiple commands using  four different protocols to open circuit breakers causing mass power outages.

Researches recently discovered that the malware also attacked a vulnerability in a piece of Siemens equipment (protective relay) used as an electric grid fail safe. The disabling of the protective relays would be unknown to the first responders trying to restore power to the grids. Researchers now believe that the intention was for grid engineers to quickly respond to this outage and restore power to the failed equipment manually. The danger here is while restoring power to the grid, and without the protective relay fail-safes in place, a critical overload of electrical current to  transformers and power lines could have caused catastrophic damage to the electrical grid equipment, caused physical harm to workers, and  would have caused significant downtime of the electrical grid.

https://www.wired.com/story/russia-ukraine-cyberattack-power-grid-blackout-destruction/

InnfiRAT Malware – Targets machines with cryptocurrency cred details!

by Leave a Comment

There is a new type of specific malware in the web environment today which basically “specializes” in theft of cryptocurrency. Yes, you read that right. The malware comes packed with Trojan capabilities as one of the article mentioned and will infect itself once it has identified sources of cryptocurrency wallet data. So you may wonder how does it spread? Phishing! It is developed on .net and gets sent out via phishing emails with attachments or even drive by downloads. As soon as the malware has made it entrance onto your machine, “it will make a copy of itself and hide it in the AppData directory before writing a Base64 encoded PE file in memory to execute the main functionality of the Trojan. In the quest for cryptocurrency, InnfiRAT will scan for information relating to cryptocurrency including Bitcoin (BTC) and Litecoin (LTC) wallets by checking for %AppData%\Litecoin\wallet.dat and %AppData%\Bitcoin\wallet.dat. If they are present, the malware will siphon existing data that can be used to compromise these wallets and potentially steal virtual funds.”  Check out the link to find out more about it. Looks pretty interesting and scary! (source link: https://www.zdnet.com/article/innfirat-malware-lurks-in-your-machine-to-steal-cryptocurrency-wallet-data/)

 

The Hottest Malware Hits of the Summer 2019

by 1 Comment

This article summarizes the popular malware hits during July and August 2019. These malware hits use several and advance techniques such as Changing hashes via file obfuscation to evade AVs, Using encrypted communication with C2 servers to foil EDRs, and Using feature manipulation and tampering to trick AI, machine-learning engines, and sandboxes. The following malware and ransomware attacks are listed;
– Fileless Attacks and Living-Off-The-Land (LOTL)
– (Jack-in-the-box)2
– Astaroth Malware
– Sodinokibi Exploits
– GermanWiper Ransomware
– MegaCortex Ransomware
– Silence APT Spreads Malware
– Turla Attacks

Source: https://thehackernews.com/2019/09/its-been-summer-of-ransomware-hold-ups.html

Apple, angry at Google, hits back at hack claims

by Leave a Comment

Last week Google disclosed a large-scale hacking effort that it said targeted users of Apple devices. It was a bombshell story.

But now Apple has gone on the attack – angry in public, and absolutely incensed in private at what is being seen as something of a stitch up. Google is standing by its research.

In a statement posted on Friday, Apple took issue with Google’s characterization that this was a broad attack on all iPhone users.

“Google’s post, issued six months after iOS patches were released, creates the false impression of ‘mass exploitation’ to ‘monitor the private activities of entire populations in real time,’ stoking fear among all iPhone users that their devices had been compromised,” it reads.

“This was never the case.”

Apple’s bone of contention isn’t so much about what Google’s Project Zero team included in its report. Rather, Apple is upset about what was left out. The view from Cupertino is that Google’s business interests in China led it to pull back on describing the attack as being targeted at the persecuted Uighur community.

 

Link: https://www.bbc.com/news/technology-49617081

U.S. City Beats Greedy Cyber attackers, Saves $5.3m Ransomware Payment

by Leave a Comment

After what has been a summer of “crippling ransomware attacks,” there has now been some respite courtesy of the city of New Bedford, Massachusetts, which has proven that the playing field can be leveled. The city was hit back in July, with its data held hostage, ransomed for more than $5 million in bitcoin. But as the attackers waited for their payment, the city’s law enforcement agencies and technology teams had other ideas.

No types of organizations are immune from these types of attacks these days,” Mayor Jon Mitchell told reporters. The city government, he said, had been taking steps to strengthen our defenses—but any network is only one keyword click away from an attack. Thankfully, he acknowledged, “the attack could have been much worse.” It hit on the July 4 holiday when many systems were shut down.

“The attack was a variant of the RYUK virus,” Mitchell confirmed. “The victim needs to make a ransom payment to acquire the decryption key from the attacker.” The attack did not affect all systems or disrupt all services, and on the return to work on July 5, the city kept systems turned off as they isolated the attack.

 

Link. https://www.forbes.com/sites/zakdoffman/2019/09/07/greedy-cyberattackers-beaten-by-us-city-lose-huge-53m-ransomware-payment/

Just an SMS could let remote hackers access all your emails, experts warn!!!

by Leave a Comment

Beware! Billion of Android users can easily be tricked into changing their devices’ critical network settings with just an SMS-based phishing attack.

Whenever you insert a new SIM in your phone and connects to your cellular network for the very first time, your carrier service automatically configures or sends you a message containing network-specific settings required to connect to data services.

While manually installing it on your device, have you ever noticed what configurations these messages, technically known as OMA CP messages, include?

Well, believe me, most users never bother about it if their mobile Internet services work smoothly.

But you should worry about these settings, as installing un trusted settings can put your data privacy at risk, allowing remote attackers to spy on your data communications, a team of cyber security researchers told The Hacker News.

 

https://thehackernews.com/2019/09/just-sms-could-let-remote-attackers.html?m=1