CCleaner hack effects 2.27 million computers

A popular PC cleaning software used by over 130 million people put users at risk after hackers were able to insert malware into legitimate downloads. By any chance, if you have downloaded or updated CCleaner application on your computer between the period of August 15 and September 15' 2017 from it's official website, then kindly pay attention because of high chances that your system is at huge risk.

 

Trustworthiness is everything when it comes to antivirus software. Malware developers are changing their attacks all the time so you have to hope that the tools you’re using to fight them are keeping up. Millions of users trust the free CCleaner by Avast/Piriform, a big name in the space, to be that tool. It was found to be hosting a "multi-stage malware payload" that could install ransomware or keyloggers that steals data from infected computers and sends it to attacker's remote command-and-control servers.

In the past, attackers would create fake alternatives of popular applications and trick people into downloading them. The trend now, however, is to attack the download source directly and gain access to legitimate servers. Once they are in, it's a case of loading the trusted software with a nefarious payload, with the end-user being none the wiser. Attackers have shown that they are willing to leverage this trust to distribute malware while remaining undetected.

What does the malware do?

It gathers information like your IP address, computer name, a list of installed software on your computer, a list of active software and a list of network adapters and sends it to a third-party computer server.


Who was infected?

According to Piriform, around 3 percent - roughly 2.27 million computers - used the infected software. Specifically, computers running 32-bit Windows 10.


How do I know if I have the corrupted version?

The versions that were affected are CCleaner v5.33.6162 or CCleaner Cloud v1.07.3191 for 32-bit Windows PCs. The Android version for phones doesn't seem to be affected. If you've updated your software since September 12, you should be ok. This is when the new, uncorrupted version was released. Also, if you have the Cloud version, it should have automatically updated itself by now to the clean version.


How to Remove Malware From Your PC?

The impact of this attack could be severe given the extremely high number of systems possibly affected. Affected users are strongly recommended to update their CCleaner software to version 5.34 or higher, in order to protect their computers from being compromised. The latest version is available for download here.

This is also just a great reminder to practice safe computer security habits in general. Also be sure to regularly scan and back up your computer to prepare for the worst. In a cyber-security world where even your official antivirus can give you a virus, you can never be too safe.

OurMine Hacks Vevo After Employee Was Disrespectful to Hackers on LinkedIn

Hacking group OurMine has breached Vevo, a video hosting service, and has leaked files from the company's internal network. The hacker group, who has a reputation for defacing websites and social media accounts, said it leaked data from Vevo after one of its employees was disrespectful to an OurMine member on LinkedIn.

The leaked data was published on the hacker group's website late last night. It included links to six data troves, offering 3.12TB of data for download. Browsable from OurMine’s site, the data included Vevo’s private dossiers on 90 different artists, including Taylor Swift, Ariana Grande, One Direction and U2. Other documents included social-media strategy memos and instructions for disabling the office’s alarm system.

"We don't know how long they [the hackers] have been accessing the Vevo system or what additional data –financial, email, employee info – the attackers may have..." cautioned Terry Ray, CTO of data and application security company Imperva, in emailed comments. Attackers maximize opportunities for engagement by impersonating legitimate users or by fine-tuning profile fields and interactions to lure targets. Once socially engineered, a target's trust can be leveraged to extract personal information or deliver malicious payloads.

New York-based Vevo, which is jointly owned by Universal Music Group, Sony Music Entertainment, Warner Music Group, Abu Dhabi Media, and Google parent company Alphabet Inc., acknowledged the breach in an official statement, which revealed that OurMine's initial method of attack was a social engineering scheme perpetrated via social media.

Vevo spokesperson acknowledged the incident. "We can confirm that Vevo experienced a data breach as a result of a phishing scam via LinkedIn. We have addressed the issue and are investigating the extent of exposure," the company said. Vevo did not comment if the hacker group made any ransom demands. The mysterious disappearance of most of the leaked files might lead some people to believe Vevo might have caved in and paid, hence the reason why most of the files are gone.

Vevo joins a long string of companies compromised by OurMine, which typically uses high-profile targets to drum up interest in legitimate security products. OurMine has built quite the reputation in the past years by hacking social media accounts belonging to companies, celebrities, and CEOs. Last month, the group compromised both the WikiLeaks website and various HBO-linked social media accounts. Previous targets include Mark Zuckerberg, Sundar Pichai and Jack Dorsey.

Beware: Compromised LinkedIn accounts used to send phishing links

Phishing continues to be a criminals’ favourite for harvesting user credentials with more or less sophisticated social engineering tricks. 

 

LinkedIn has been in the news for all the bad reasons. Previously, it was the data of 117 million of its users stolen back in 2012, leaked in 2016 and sold on the darknet afterwards. In the latest, cyber criminals are targeting LinkedIn users with a sophisticated phishing scam in which the idea is to trick the user into believing that their LinkedIn account has a security issue which can be solved only by providing their personal details. This Phishing Link Widely Spreading Champaign that Mimics as Legitimate Gmail and other Email Provides Login Page.

The campaign was identified by researchers at Heimdal Security who pointed out that the brain behind this scam is looking for users’ financial details, driving license and or passport copy. The purpose of collecting this information is to not only hijacking their account but also conduct further scams by stealing their identity.

Most appear as if the LinkedIn user is sharing a Google Drive file with the victim and contain a malicious link, obscured by a URL shortener to hide its true destination. The link then redirects to a phishing site for Gmail and other email providers which require potential victims to log in. Those who proceed will have their username, password, and phone number stolen but won’t realize they were duped right away. Indeed, this phishing scam ends on a tricky note with a decoy document on wealth management from Wells Fargo. URL shorteners are a well-known vehicle for spreading malware and phishing scams but they are also used for legitimate purposes, especially on social media where long URLs tend to be too cumbersome.

Furthermore, the email content also contains two links. One is a Dropbox link and other is what researchers have identified as a password reset link which leads users to the original LinkedIn password reset page. Apparently, the reason behind this is to trick users into believing that the email is legitimate and their account is in danger for real.

This is not the first time when LinkedIn users have been targeted with such scam. In the past, the users have been under target by Blackhole malware, trojans developed to steal login credentials of job seekers and even fake profiles pretending as job recruitment officials.

Beware of the malicious phishing links and don’t provide any credential information to untrusted website!!!

You can actually hack a computer with DNA

Hackers have used all sorts of attack vectors to gain control of someone else’s computer, from USB drives to phishy emails. In what appears to be the first successful hack of a software program using DNA, researchers say malware they incorporated into a genetic molecule allowed them to take control of a computer used to analyse it.

Akin to something from the pages of science fiction, the researchers used the life-encoding molecule to attack and take over a computer, using strands of DNA to transmit a computer virus from the biological to the digital realm.

The researchers used the four bases in DNA, adenine, cytosine, guanine and thymine – A, C, G and T – to encode their malware, which when read by a piece of DNA sequencing equipment converted the molecular code into computer code capable of taking over the computer connected to the DNA sequencer.

“When this physical strand was sequenced and processed by the vulnerable program it gave remote control of the computer doing the processing. That is, we were able to remotely exploit and gain full control over a computer using adversarial synthetic DNA.” said the researchers.

The researchers say that there is no reason for concern: “Note that there is not present cause for alarm about present-day threats. We have no evidence to believe that the security of DNA sequencing or DNA data in general is currently under attack.” They argue the attack could be leveled against any facility that accepts DNA samples for computer-based gene sequencing and processing. For example, if an attacker knew DNA samples will be sequenced on a computer they contaminate blood and saliva samples with a specially crafted synthetic gene.

The results show that it is technically possible to use DNA as a way to transfer malware and attack vulnerabilities in the sequencing compute program.

Microsoft Attempts To Fix Stuxnet For The Third Time Nearly Five Years Later

One of the patches released by Microsoft as part of its June 2017 security updates represents the company’s third attempt at patching an old vulnerability exploited by the notorious Stuxnet worm in 2010. The initial vulnerability, tracked as CVE-2010-2568, allows a remote attacker to execute arbitrary code on a system using specially crafted shortcut files with the LNK or PIF extension.

CVE-2010-2568 was one of the four zero-day vulnerabilities exploited in the 2010 Stuxnet attacks targeting Iran’s nuclear program. It's arguably the first, and most famous example of government-developed malware. Its creation is said to have been a joint operation between Israel and the United States.

In 2015, researchers discovered that Microsoft’s initial fix could be bypassed and the tech giant released another patch. The flaw, tracked as CVE-2015-0096, was treated by Microsoft as a completely new issue.

The flaw leveraged by Stuxnet allowed .LNK files, which are what define shortcuts to other files or directories, to use custom icons from .CPL (Control Panel) files.

"The problem is that in Windows, icons are loaded from modules (either executable or dynamic link-libraries). In fact, .CPL files are actually DLLs. Because an attacker could define which executable module would be loaded, by convincing a user to display a specially-crafted shortcut file, an attacker may be able to execute arbitrary code with the privileges of the user. Depending on the operating system and AutoRun/AutoPlay configuration, this can happen automatically by connecting a USB device.

Microsoft has gone to a great deal of effort to make exploitation of memory corruption bugs more difficult. This is a classic example of the Defender’s Dilemma -- the defender must be strong everywhere, while the attacker needs to find only one mistake.

CERT/CC pointed out that Microsoft patched the new vulnerability, tracked as CVE-2017-8464, with its June security updates. Microsoft informed customers at the time that this flaw had been exploited in the wild. Exploits for the security hole are now publicly available, including a Metasploit module made by Securify's Yorick Koster.

The organization pointed out that in addition to applying Microsoft’s patches, users can prevent potential attacks by blocking outgoing connections on TCP and UDP ports 139 and 445. This prevents machines from accessing a remote SMB server, which is typically needed to exploit the vulnerability.

Former Bupa employee offered 1 million customer records for sale on dark web

Current advancements to the internet and all of its capacities bring about a sense of urgency when it comes to safeguarding online security, especially in situations where crucial information can be stolen and exploited.

A Bupa employee managed to copy and steal data regarding more than 108,000 customers, then exposing a majority of that information on the dark web. Data Breaches found the breach on the dark web on June 23, posted by a vendor called MoZeal. The listing contained insurance information from 122 countries and included information like member and registration IDs, names, birthdates, all contact information and information about intermediaries.

It would appear that “MoZeal” is likely the rogue employee that Kenton referred to in his videotaped statement. Also of note: while Bupa reports that 108,000 were affected, MoZeal’s listing and thread indicated that there were over 130,000 in the U.K. alone, and that overall there were about 500,000 – 1 million records for sale.

Bupa has reportedly taken legal action, so this post will be updated as more information becomes available. The breach has had an intense effect primarily on the international health insurance industry as a whole.

Bupa responded to the reported discrepancy between their numbers and the AlphaBay vendor’s claims with a statement to Insurance Business reconciling some of the differences by noting that they referred to “policies” while the vendor referred to number of individuals. Ever since the breach was spotted, the company has already taken the necessary measures to notify each and every customer whose information has been stolen.

Company representatives also say the security of customer information has been made a paramount priority by the health insurer to prevent such breaches in the future. The employee responsible for the breach has already been terminated from his position, and Bupa is also pursuing legal action against the employee.

This attack is the latest in a series of data breaches taking place this year. There have been several such hacks so far that deliberately target entities in the health sector, and the number continues to increase with each passing period of time.

Google Blocks Spyware Family From Android App Store

Google this week released details of a sophisticated new family of spyware tools that the company recently blocked from its Play mobile app store after discovering the malware being used against some Android users.

Dubbed Lipizzan, the Android spyware appears to be developed by Equus Technologies, an Israeli startup that Google referred to as a 'cyber arms' seller in a blog post published Wednesday. In total, with the help of Google Play Protect, the Android security team has found Lipizzan spyware on 20 apps distributed in a targeted fashion to less than 100 Android devices. 

Google has quickly blocked and removed all of those Lipizzan apps and the developers from its Android ecosystem, and Google Play Protect has notified all affected victims. Google has also enhanced its Google Play Protect app scanning features to detect and prevent Lipizzan and similar targeted spyware from being uploaded to the mobile app store.

Sophisticated Multi-Stage Spyware

Google described Lipizzan as a two-stage spyware tool designed to monitor and steal a victim's email and SMS messages, intercept voice calls and media and steal location data.

In the first stage, attackers distribute Lipizzan by typically impersonating it as an innocuous-looking legitimate app such as "Backup" or "Cleaner" through various Android app stores, including the official Play store. When a victim installed the software, the first stage Lipizzan components would then download a second separate data monitoring and theft component. The second component was designed to work only if it determined the device was safe for it to do so.

If given the all-clear, the second stage would then root the device with known exploits and begin to ex-filtrate device data to a command and control server

Gathers Data from Other Popular Apps

Lipizzan's second application component was capable of a wide range of malicious activities such as to record voice calls, record from a phone's microphone, monitor the victim's location, take screenshots and take photos from the device's camera.

It can also gather data from specific apps, undermining their encryption, which includes WhatsApp, Snapchat, Viber, Telegram, Facebook Messenger, LinkedIn, Gmail, Skype, Hangouts, and KakaoTalk.

The second Lipizzan application shared a common signing certificate with the first components showing that the same authors likely developed both. When Google managed to block the first set of Lipizzan applications from Google Play, the authors managed to quickly upload a new set of apps with the same capabilities but slightly different properties. Instead of impersonating backup applications for instance, the new malware mimicked other innocuous sounding applications such as a sound recorder app and an alarm manager. Despite such changes Google managed to detect and block the malware, the three members of Google's security team said.

Earlier this year, Google found and blocked a dangerous Android spyware, called Chrysaor, allegedly developed by NSO Group, which was being used in targeted attacks against activists and journalists in Israel, Georgia, Turkey, Mexico, the UAE and other countries. Like Lipizzan, Chrysaor was also used for targeted cyber-spying. The malware was discovered on what Google described as a few dozen Android devices.

Protect your Android device

• Android users are strongly recommended to follow these simple steps in order to protect themselves.
• Ensure that you have already opted into Google Play Protect.
• Download and install apps only from the official Play Store.
• Enable 'verify apps' feature from settings.
• Protect their devices with pin or password lock.
• Keep "unknown sources" disabled while not using it.
• Keep your device always up-to-date with the latest security patches.

The Biggest CyberSecurity Incidents Of 2017 At A Glance

It's only July, and already there's been viral, state-sponsored ransomware, leaks of spy tools from intelligence agencies, and full-on campaign hacking. And that's just the beginning. The first six months of 2017 have seen an inordinate number of cyber security meltdowns. And they weren't just your standard corporate breaches. 

Let this recap of 2017's biggest cyber-incidents so far serve as a reminder of just how chaotic things have already gotten–and the year's only halfway done.

SHADOW BROKERS

The mysterious hacking group known as the Shadow Brokers, claiming to have breached the spy tools of the elite NSA-linked operation known as the Equation Group. The identity of the Shadow Brokers is still unknown, but the group's leaks have revived debates about the danger of using bugs in commercial products for intelligence-gathering. Agencies keep these flaws to themselves, instead of notifying the company that makes the software so the vendor can patch the vulnerabilities and protect its customers.

WANNACRY

WannaCry spread around the world, walloping hundreds of thousands of targets, including public utilities and large corporations. Though powerful, the ransomware also had significant flaws, including a mechanism that security experts effectively used as a kill switch to render the malware inert and stem its spread. In total, WannaCry netted almost 52 bitcoins, or about $130,000—not much for such viral ransomware. Microsoft had released the MS17-010 patch for the bug in March, but many institutions hadn't applied it and were therefore vulnerable to WannaCry infection.

PETYA

This malware, called Petya, NotPetya and a few other names, was more advanced than WannaCry in many ways, but still had some flaws, like an ineffective and inefficient payment system. Researchers suspect that the ransomware actually masked a targeted cyber-attack against Ukraine. The ransomware hit Ukrainian infrastructure particularly hard, disrupting utilities like power companies, airports, public transit and the central bank.

WIKILEAKS CIA VAULT 7

WikiLeaks published a data trove containing 8,761 documents allegedly stolen from the CIA that contained extensive documentation of alleged spying operations and hacking tools. Revelations have detailed individual tools for things like using Wi-Fi signals to track a device's location, and persistently surveilling Macs by controlling the fundamental layer of code that coordinates hardware and software. Wiki Leaks claims that Vault 7 reveals "the majority of hacking arsenal including malware, viruses, Trojans, weaponize 'zero day' exploits, malware remote control systems and associated documentation.

CLOUDBLEED

The internet infrastructure company Cloudflare announced that a bug in its platform caused random leakage of potentially sensitive customer data. Cloudflare worked with search engines ahead of and after the announcement to remove the leaked data from caches, and experts noted that it was unlikely that hackers used the data malevolently; the random leaks would have been difficult to weaponize or monetize efficiently. A bug or a damaging attack affecting a company like Cloudflare can impact, and potentially endanger, a significant portion of the web.

198 MILLION VOTERS RECORDS EXPOSED

Unfortunately, it's not uncommon to hear that a trove of voter data was breached or exposed somewhere in the world. But on June 19, researcher Chris Vickery discovered a publicly accessible database that contained personal information for 198 million US voters—possibly every American voter going back more than 10 years. The group had misconfigured it, though, such that some data on the server was protected, but more than a terabyte of voter information was publicly accessible to anyone on the web. Misconfiguration isn't a malicious hack in itself, but it is a critical and all-too-common cybersecurity risk for both institutions and individuals.

MACRON CAMPAIGN HACK

Hackers dumped a 9GB trove of leaked emails from the party of left-leaning front-runner (now French president) Emmanuel Macron. The attack was less strategic and explosive than the WikiLeaks releases of pilfered DNC emails that dogged Hillary Clinton's presidential campaign. Researchers did find evidence that the Russian-government-linked hacker group Fancy Bear attempted to target the Macron campaign in March.

Remote Code Execution Vulnerability: Microsoft CVE-2017-8570

Description:

A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. It has been classified as critical. Affected is an unknown function of the component Object Handler. The manipulation with an unknown input leads to a privilege escalation vulnerability. CWE is classifying the issue as CWE-269. This is going to have an impact on confidentiality, integrity, and availability.

Overview of Attack:

An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. Exploitation of this vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software.

In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.

Technologies Affected:

• Microsoft Office 2007 Service Pack 3
• Microsoft Office 2010 Service Pack 2 (32-bit editions)
• Microsoft Office 2010 Service Pack 2 (64-bit editions)
• Microsoft Office 2013 RT Service Pack 1
• Microsoft Office 2013 Service Pack 1 (32-bit editions)
• Microsoft Office 2013 Service Pack 1 (64-bit editions)
• Microsoft Office 2016 (32-bit edition)
• Microsoft Office 2016 (64-bit edition)

Recommendations:

1. Run all software as a non-privileged user with minimal access rights.
2. Deploy network intrusion detection systems to monitor network traffic for malicious activity.
3. Do not accept or execute files from untrusted or unknown sources.
4. Do not follow links provided by unknown or untrusted sources.
5. Implement multiple redundant layers of security.

References:

• CVE-2017-8570
• Microsoft - Microsoft Homepage
• Microsoft - Microsoft Office Product Homepage

Part 2: Android SpyDealer Trojan (Detailed Technical Analysis)

In our previous post we were looking at the newly detected Trojan SpyDealer which is able to spy on more than 40 communication apps in your Android device. Let's have a look at the detailed technical analysis of this case today. (Credits: Palo Alto)

• Service Launching and Configuration:

After installed on an Android device, SpyDealer shows no application icon. However, it registers two broadcast receivers to listen for events related to the device booting up and network connection status. At the first launch, it retrieves configuration information from the local asset file named readme.txt. The first line of this file indicates the IP address of a remote C2 server, the second line configures what actions the malware can take on mobile networks, and the third line specifies what actions are allowed under a Wi-Fi network.

Fig 1. Content of the readme.txt

• Rooting and Persistence

SpyDealer uses two different rooting procedures to gain root (superuser) privilege. Rooting applications like this one are created for users who want to gain low-level access to their phone which wouldn’t be possible without removing some security protections. This is not the first time that Android malware has stolen root exploits from existing commercial rooting tools. SpyDealer 1.9.1 and 1.9.2 gain root privilege by abusing “Baidu Easy Root”.

The downloaded file “raw.zip” contains the exploits from “Baidu Easy Root” version 2.8.3. For example, 022d251cf509c2f0 is an executable binary file observed in the “raw.zip”, and the original file in “Baidu Easy Root” is actually in gzip format. It’s interesting that we can recover its original file name which is fb_mem_root.

Fig 2. Files in the downloaded raw.zip and Baidu Easy Root v2.8.3

• Command & Control

SpyDealer is capable of receiving commands from remote servers via a number of different channels by either actively initiating connections to C2 servers or passively receiving instructions from C2 servers. These channels include via SMS, UDP and TCP connections. This section details how the malware utilizes each of these channels to communicate with the remote C2 servers.

• SMS

SpyDealer registers a broadcast receiver with a higher priority than the default messaging app to listen for the commands via incoming SMS messages. The commands received through SMS are first decoded for further parsing and processing. Each SMS command contains a command index and arguments split by a newline. The command index ranges from 1 to 5 and each command is detailed in below table.

Fig 3. SMS Command List

To get the geographical location based on the GSM cell information, SpyDealer takes advantage of the interface of Baidu map service. It first collects the GSM cell identity, area code and network operator and then posts the encoded data to the Baidu map service to retrieve the geographical location. With this tactic, a compromised device’s location is exposed to the attacker even there is no GPS available.

Fig 4. Utilize the interface of Baidu map service to get geographical location

Besides the commands listed above, SpyDealer can also set the remote server’s IP address under the following two conditions:

1. The length of the command index received in the SMS (Table 3) is larger than 4, then the command index is actually the remote server’s IP address
2. The incoming SMS message body starts with the string “L112 ” which is followed by the remote server’s IP address

• TCP Server

SpyDealer creates a TCP server on the compromised device listening at port 39568 and waits for incoming commands. The command format and description are listed below table:

Fig 5. Commands via TCP channel

However, there is no authentication mechanism implemented before accepting the incoming commands, which means anyone can connect to a compromised device and control it as long as one knows the target device’s IP address.

• UDP/TCP Client

SpyDealer can also actively connect to the remote server with the configured IP address to ask for commands through UDP or TCP. At first launch, the remote server’s IP address is retrieved from the local asset readme.txt, and the use of UDP or TCP protocols is determined based on another local asset named socket. The command data received by the client is encrypted by the server using Tiny Encryption Algorithm (TEA) Once the client receives a command, the malware decrypts the data.

Fig 6. TEA algorithm used to decrypt incoming comman

• Private Data Collection

As discussed in section Command & Control, we have seen this malware employ many mechanisms to collect private data. Additionally, with root privilege, SpyDealer also tries to gather data from more than 40 common apps falling in different categories including social, communication, browser, mobile mail client, etc. The targeted apps are listed in the below table:

List full of targeted apps

ID	Package Name	App Name
1	com.facebook.katana	Facebook
2	com.tencent.mm	WeChat
3	com.whatsapp	WhatsApp
4	com.skype.raider/com.skype.rover	Skype
5	jp.naver.line.android	Line
6	com.viber.voip	Viber
7	com.tencent.mobileqq	QQ
8	org.telegram.messenger	Telegram
9	com.alibaba.mobileim	Ali WangXin
10	kik.android	Kik
11	com.icq.mobile.client	icq video calls & chat
12	com.keechat.client	KeeChat Messenger
13	com.oovoo	ooVoo Video Call, Text & Voice
14	com.instanza.cocovoice	Coco
15	com.bbm	BBM
16	com.gtomato.talkbox	TalkBox Voice Messenger
17	com.rebelvox.voxer	Voxer Walkie Talkie Messenger
18	com.immomo.momo	MOMO
19	com.zing.zalo	Zalo
20	com.loudtalks	Zello PTT Walkie Talkie
21	com.duowan.mobile	手机YY
22	im.yixin	易信
23	cn.com.fetion	飞信
24	com.sgiggle.production	Tango
25	com.renren.mobile.android	人人
26	net.iaround	遇见
27	com.sina.weibo	Sina Weibo
28	com.tencent.WBlog	Tencent Weibo
29	org.mozilla.firefox	Firefox Browser
30	com.oupeng.browser	Oupeng Browser
31	com.android.browser	Android Native Browser
32	com.baidu.browser.apps	Baidu Browser
33	com.tencent.mtt	Tencent QQ Browser
34	com.lenovo.browser	Lenovo Browser
35	com.qihoo.browser	Qihoo Browser
36	com.taobao.taobao	Taobao
37	com.netease.mobimail	NetEase Mail
38	com.tencent.androidqqmail	Tencent QQ Mail
39	com.corp21cn.mail189	189 Mail
40	cn.cj.pe	139 Mail
41	com.baidu.netdisk	Baidu Net Disk
42	com.l	Smart Shopping List – Listonic
43	com.dewmobile.kuaiya	Zapya
44	com.funcity.taxi.passenger	Kuaidi Taxi

• Accessibility Service Abuse

An increasing number of apps encrypt data before storing it into databases, especially for some popular communication and social apps. App developers do this to protect user data from malicious attacks like this one. To avoid this obstacle, starting in version 1.9.3, SpyDealer implemented an extra accessibility service to steal plain messages by directly extracting texts from the screen.

Fig 7. Configuration of the accessibility service

• Surveillance

SpyDealer is capable of surveilling a compromised victim through multiple means including recording phone call and surrounding audio, recording video, taking photos, capturing screenshots, and monitoring geographical locations. It takes these actions based on commands it receives from the command and control channels described above.

• Record Phone Call and Surrounding Audio

SpyDealer registers a PhoneStateListener to monitor the phone call status. Once there is an active phone call, the audio recording procedure is triggered. The recorded audio data is finally compressed in zip format and stored to

/sdcard/.tmp/audio/<current_time_in_yyyyMMddHHmmss>_<phone_call_num><phone_call_ date>.zip

A message in the format “audio\n<IMSI>\n<IMEI>\n<zip_file_path>” will be sent to the remote server after audio is successfully recorded.

In addition to recording phone calls, SpyDealer is also capable of recording surrounding, ambient audio. It can be configured to record audio at a specific time range. The recorded audio file is stored to the following path in zip format

/sdcard/.tmp/environmentaudioaudio/<current_time_in_yyyyMMddHHmmss>.zip

Audio files recorded more than seven days ago are automatically deleted from the directory /sdcard/.tmp/environmentaudioaudio.

• Record Video

SpyDealer checks to see if the camera is available to record a video every three seconds. In the Android system, a preview surface is required to take a video, which means the user is aware of the video recording event. To avoid this, SpyDealer intentionally sets a very tiny preview surface which, in this case, is 3.0dip * 3.0dip in dimensions. Each video is recorded for 10 seconds and is finally stored to

/data/data/<package_name>/files/cameravideo/<current_time_in_yyyyMMddHHmmss>.zip

If a network connection is available, SpyDealer sends a message in the format “cameravideo\n<IMSI>\n<IMEI> \n<zip_file_path>” to the remote server.

Fig 8. A tiny surface view is defined for recording video silently

• Take Photos

Similar to recording video without a user’s awareness, this malware creates another tiny preview surface which is 0.100000024dip * 0.100000024dip in dimensions before taking a photo. Using the front or rear camera depends on the configuration which the attacker can set remotely. The taken photo is stored to

/data/data/<package_name>/files/camerapic/camera_<current_time_in_millseconds >.jpg

A message indicating a photo is taken is then sent to the remote server and the message is in the format “camerapic\n<IMSI>\n<IMEI>\n<picture_path>”.

• Monitor Geographic Location

SpyDealer dynamically registers a broadcast receiver listening for screen’s status. Whenever the screen is turned off, it tries to get the geographical location via GPS. At the same time, a location listener is registered to track the device’s location. This location listener is notified with the updated location every 10 seconds or whenever 100 meters of movement occurs between location updates. If a network connection is available, the location data will be sent to the remote server in the format

LGPS\n<IMEI>\n<IMSI>\n<longitude>\n<latitude>\n<current_time_in_yyyy-MM-dd hh:mm:ss>

However, the location data is saved locally if there is no network connection and will be uploaded later when the connection is restored.

Conclusion:

SpyDealer makes use of the commercial rooting app “Baidu Easy Root” to gain root privilege and maintain persistence on the compromised device. It employs a wide array of mechanisms to steal private information. At the same time, it accesses and exfiltrates sensitive data from more than 40 different popular apps with root privilege. With accessibility service, this malware is also capable of extracting plain text messages from target apps at real time. To remotely control the victim device, the malware implements three different C2 channels and support more than 50 commands.

Part 1: What if your android applications spy your communications?

What if you come to know that your application is able to spy on you? Steal your data from your android phone? automatically answer your incoming phone calls from a specific number? Just imagine the consequences of such a scenario we have come across recently. Yes you heard it right, your own android phone, where a malware has sneaked into all your applications gaining root privilege which enables the subsequent data theft.

Palo Alto Networks' researchers recently discovered an advanced Android malware, named 'SpyDealer' which reportedly exfiltrates private data from over 40 apps. The trojan is said to steal information from communication apps by abusing the Android accessibility service feature. SpyDealer steals messages from communication apps using the Android accessibility service feature and leverages the exploits from a commercial rooting app called Baidu Easy Root to gain rooting privileges and to maintain persistence on the target.

The 40 popular apps that the malware has sneaked into include WeChat, Facebook, WhatsApp, Skype, Line, Viber, QQ, Tango, Telegram, Sina Weibo, Tencent Weibo, Android Native Browser, Firefox Browser, Oupeng Brower, QQ Mail, NetEase Mail, Taobao and Baidu Net Disk. The mobile malware only works Android versions from 2.2 up to 4.4 releases (roughly 25% of all Android devices), that are the versions supported by the rooting tool. Once installed, the malware registers two broadcast receivers to listen for events related to the device booting up and network connection status. Even when the malware is not able to root the device, it is able to steal a significant amount of sensitive data.

According to researchers SpyDealer can harvest an exhaustive list of personal information including phone number, IMEI, IMSI, SMS, MMS, contacts, accounts, phone call history, location and connected Wi-Fi information. It can also automatically answer incoming phone calls from a specific number. The trojan can also spy on a user by recording the phone call and the surrounding audio and video. It can even take photos as well as screenshots with using device's both front and rear cameras. Attackers can remotely control the infected Android device via UDP, TCP and SMS channels. PaloAlto Networks believe the malware is under active development, the researchers already detected 1,046 samples of SpyDealer belonging to at least three differed variants.

The good news is that SpyDealer isn’t distributed through the official Google Play store, the malware experts observed Chinese users being infected compromised wireless networks. Though the trojan came to light recently, researchers have traced its activity to as far as October 2015. Also, at this point, the malware can only affect Android devices running on Android 4.4 KitKat and older. This means some 25% of the Android OS' total user base. On devices running later versions of Android, it can still significant amounts of information, but it cannot take actions that require higher privileges.

Antivirus Companies Releases Decryptor for the Dharma Ransomware

What is Dharma Ransomware

Dharma Ransomware is newer version of Crysis Ransomware, extremely dangerous file-encrypting virus. Dharma uses asymmetric cryptography to block user access to personal files. It's easy to recognize files affected by it because they will have the extension: .[email_address].dharma, where the email address is the one used by the attacker as a point of contact.

Computer users who have been affected by the Dharma ransomware and have held onto their encrypted files can now restore them for free. Researchers have created decryption tools for this ransomware strain after someone recently leaked the decryption keys. The private decryption key is stored on a remote server, and there currently impossible to break the encryption of the latest version. Kaspersky and other antivirus companies are working on it, and has decryptor for older versions.

How Dharma Ransomware infected your PC

Dharma Ransomware virus developers still use spam e-mails with malicious attachments for distribution. Usually, attachments are DOC or XLS documents. Such documents contain built-in macros, that runs in the background when user opens the document. This macros downloads and runs main executable with random name. Since that moment Dharma starts encryption process.

How to decrypt and restore .dharma, .wallet, .xtbl files

It is not recommended to remove Dharma Ransomware manually, for safer solution use Removal Tools instead. There is no purpose to pay the ransom, because there is no guarantee you will receive the key, but you will put your bank credentials at risk.

Using Windows Previous Versions option:

• Right-click on infected file and choose Properties.
• Select Previous Versions tab.
• Choose particular version of the file and click Copy.
• To restore the selected file and replace the existing one, click on the Restore button.
• In case there is no items in the list choose alternative method.

Using Shadow Explorer:

• Download Shadow Explorer program.
• Run it and you will see screen listing of all the drives and the dates that shadow copy was created.
• Select the drive and date that you want to restore from.
• Right-click on a folder name and select Export.
• In case there is other dates in the list choose alternative method.

If you are using Dropbox:

• Login to the DropBox website and go to the folder that contains encrypted files.
• Right-click on the encrypted file and select Previous Versions.
• Select the version of the file you wish to restore and click on the Restore button.

To clean up the backup encrypted files, you can use CryptoSearch to move them to another folder that can be archived or deleted.

Korea's Biggest Bitcoin Exchange "Bithumb" Hack Leads to Millions in Bitcoin Losses

The largest bitcoin and ether exchange in South Korea by volume, Bithumb, was recently hacked. Monetary losses from compromised accounts have started to surface, and are quickly reaching into the billions of won.

A cyberattack targeting Bithumb, South Korea’s largest bitcoin and ethereum exchange by trading volume, has resulted in the loss of personal data belonging to an estimated 31,000 users, or 3% of its members. Bithumb is one of the five largest bitcoin exchanges in the world and hosts over 13,000 bitcoins worth of trading volume daily, or roughly 10 percent of the global bitcoin trade.

While admitting to being hacked on their website, Bithumb maintained that there was no direct access to funds stored on the exchange. Nonetheless, many customers are reporting their digital currency wallets being emptied. The exchange further claims that the breach was made to a personal computer belonging to an employee, and not the exchange’s internal network, servers nor digital currency wallets. While victim accounts of exactly how their funds were stolen have widely differed, attackers appear to have stolen enough credentials to begin a process of “voice phishing,” where the scammers call up victims one at a time and pose as representatives of Bithumb.

One victim claims that the attacker posed as an executive at Bithumb and phoned to say that he was "suspicious of a foreign hacking transaction,” and instructed his victim to give him an “identification number written on the letter from Bithumb.” The number in question was the victim’s One-Time Password, (OTP) which granted the attacker immediate access to ten million won, worth about US$ 8,700.

Such cases organizations should emphasize the need for businesses to have clearly defined security policies and procedures around the use of personal devices for work purposes and the re-use of passwords; For e.g.: Employees should not be using their work passwords for personal use. Instead of waiting for something to happen at the extreme levels, businesses should consider investing in technical security layers, from threat intelligence solutions to two factor authentication—which would surely have helped in this matter.