Category: Securityexploits

Current Attacks Massive 1.6Mil unique addresses found hacked by “GoldBrute”

Internet Storm Center discusses an attack by the ‘GoldBrute’ botnet

They found 1.5mil servers being used by the botnet.

This means that a weakness in Microsoft (CVE-2019-0708)  May 14 Customer Guidance page:

Specifically:  CVE-2019-0708

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.

So it seems GoldBrute is taking advantage of this Microsoft weakness to infect machines that have not been patched.  especially the older systems (with Windows7 and Windows Server 2008) You can solve this by downloading the patch and updating as soon as possible.

The other solution is to Disable Remote  Desktop Services  (as per https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708)

A workaround is also possible:

The following workarounds may be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as possible even if you plan to leave these workarounds in place:

1. Enable Network Level Authentication (NLA) on systems running supported editions of Windows 7, Windows Server 2008, and Windows Server 2008 R2

You can enable Network Level Authentication to block unauthenticated attackers from exploiting this vulnerability. With NLA turned on, an attacker would first need to authenticate to Remote Desktop Services using a valid account on the target system before the attacker could exploit the vulnerability.

2. Block TCP port 3389 at the enterprise perimeter firewall.

 

Contact Us to discuss this latest possible attack and re-mediate your #cybersecurity risks

Internet Cameras Vulnerable to Attacks With No Fix

If there is no way to fix a vulnerability what do you do if you have a camera with a vulnerability?

Here is the quote on Threatpost (from the engineer that found the flaw):

“Over 2 million vulnerable devices have been identified on the internet, including those distributed by HiChip, TENVIS, SV3C, VStarcam, Wanscam, NEO Coolcam, Sricam, Eye Sight and HVCAM,” said Paul Marrapese, a security engineer who discovered the flaws  setup the hacked.camera website

So the key from Paul’s website is the following two CVE’s:

What is CVE-2019-11219?

CVE-2019-11219 refers to an enumeration vulnerability in iLnkP2P that allows attackers to rapidly discover devices that are online. Due to the nature of P2P, attackers are then able to directly connect to arbitrary devices while bypassing firewall restrictions.

What is CVE-2019-11220?

CVE-2019-11220 refers to an authentication vulnerability in iLnkP2P that allows attackers to intercept connections to devices and perform man-in-the-middle attacks. Attackers may use this vulnerability to steal the password to a device and take control of it.

So mostly iLnkP2P  with many companies potentially affected.

This problem has just been relesed to the public, with initial advisories to vendors by Mr. Marrapese  1/15/19.

 

so in theory the vendor should have been working on this issue, but they did not respond. So vulnerability sent to CERT/CC and then the 2 official CVEs were setup by MITRE:

CVE-2019-11219 and CVE-2019-11220

Devices that use the following Android apps may be vulnerable:

  • HiChip: CamHi, P2PWIFICAM, iMega Cam, WEBVISION, P2PIPCamHi, IPCAM P
  • VStarcam: Eye4, EyeCloud, VSCAM, PnPCam
  • Wanscam: E View7
  • NEO: P2PIPCAM, COOLCAMOP
  • Sricam: APCamera
  • Various: P2PCam_HD

Time to start to make people aware and get their vendors on fixing these problems, because some vendors are foot draggers on security.

So real bad news is that the hackers now definitely  know the problems so attacks coming soon???

Coming back to original question… How can you protect cameras with this flaw? Have to put a New NGFW system in front of it to protect it.  Kind of like how one protects a WindowsXP machine, or a system that is no longer getting updates.

Here is my old post on NGFW : https://oversitesentry.com/what-is-an-advanced-firewall-utm-ngfw/

 

Contact us to discus this with you.

Phishing #1 Attack – Includes Email Scams

Have you received an email saying your password has been stolen in broken English?

Subject: "Security Notice. Someone have access to you system"

As you may have noticed, I sent you an email from your account.

This means that I have full access to your acc: On moment of crack (youremail@youremaildomain.com)  password: jfwqu6qoizxahofj0qkw

You say: this is my, but old password!
Or: I will change my password at any time!
Of course! You will be right,
but the fact is that when you change the password, my malicious code every time saved a new one!
I've been watching you for a few months now.
But the fact is that you were infected with malware through an adult site that you visited.
If you are not familiar with this, I will explain.
Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.
I also have access to all your contacts and all your correspondence from e-mail and messangers.
Why your antivirus did not detect my malware?
Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.
I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks. I can also post access to all your e-mail correspondence and messengers that you use.
If you want to prevent this, transfer the amount of $770 to my bitcoin address (if you do not know how to do this, write to Google: "Buy Bitcoin").
My bitcoin address (BTC Wallet) is: 1MrUDSrZiqD3ijxsBUPt2SukoFy534orP2
After receiving the payment, I will delete the video and you will never hear me again.
I give you 48 hours to pay.
I have a notice reading this letter, and the timer will work when you see this letter.

Filing a complaint somewhere does not make sense because this email cannot be tracked like my bitcoin address.
I do not make any mistakes.

—————————————————–

So this trickster extortionist  actually makes several mistakes (besides the spelling errors).

First of all the email says ” As you may have noticed, I sent you an email from your account.”  there is a basic issue with this statement.  All email can be ‘spoofed’ thus making it a form of spam. Spoofed means all text in the ‘From:’ means nothing it can be changed to whatever the spammer wants to make it look like.   (In fact you can change your From field yourself if you choose as an experiment)

So if your email is “youremail@emaildomain.com” then the spammer can make it look that way.

 

The other problem the spammer sextortionist has is they have to make assumptions of a video camera that is on the computer.

What if there is no video camera on the computer? then how can the video sextortion work?

So the scammer makes several assumptions:

  1. you don’t know about From spoofing
  2. ignore misspelling and bad grammar
  3. email owner used porn
  4. email owner has videocam functioning on the computer
  5. at one time there was a password that is included in email
  6. knows enough about bitcoin or can learn how to transfer money into bitcoin

Those are a lot of assumptions, and on top of that the scammer is leaving an electronic trail in Bitcoin or at least how they access bitcoin(we will not go into detail of how this is done). The scammer leaves an electronic trail as to how they access bitcoin to experienced investigators, which is why you should goto bitcoinabuse website and file a report (link below).

One thing people should do is to see how many others this has happened to and to decide what to do from here  Internet Storm Center  also had one of these (i.e. google or startpage.com a portion of the email and see what comes up).

 

What did I do you may ask?  Of course you NEVER pay the extortionist.  But one can also help the Internet denizens to reduce this type of email:  goto Bitcoin Abuse website

Go to the website and File a report by adding the bitcoin address that is included in the email so that law enforcement and other people who track and try to find these spammers can start to do something about it.

Or you can View a report with the bitcoin address to see how many others has this email gone to??  check the FAQ on bitcoinabuse.com

Above image is from Bitcoinabuse FAQ

We at oversitesentry and fixvirus.com help others with a variety  of Internet Security issues.

Update 02/02/2019 (Groundhogs Day)   Sextortion Follow the money part 3 – The Cashout begins!

So the short story is the scammers have accumulated a lot of money in hundreds(434) Bitcoin addresses which slowly started to move the money into a few addresses, as much as $21.5mil  plus $18.5mil .  Then from there the bitcoin addresses will be “mixed” so experts like in the link above will not be able to tell where the money goes (anonymity) using bestmixer.io.

So again please do not pay these scammers if you receive an email like the one included in this blog.

New Wi-Fi attack found on WPA2 using PMKID

This could make many “thought safe” Wi-Fi routers not so

Here is where paying attention to new attacks is important.

hashcat.net has the information:

This attack does not even need a full EAPOL 4-way handshake,  EAPOL stands for Extensible Authentication Protocol(EAP) over LAN. A simple 4-way handshake is shown pictorially below  (from hitchhikersguidetolearning.com)

This means that in the past an attack on Wi-Fi would would need EAPOL  4-way handshake to be captured. Capturing the 4-way handshake is sometimes difficult to achieve.

Instead in this attack: ” We receive all the data we need in the first EAPOL frame from the AP.”

First one captures a sample initial Message from the ‘Authenticator’ which includes a PMKID (run hcxdumptool)

Second (run hcxpcaptool) to convert captured data from pcapng format to a hash format accepted by hashcat

Third (run hashcat) to crack the string of data.

 

So now no 4-way handshake is needed, only expertise to run a couple of scripts and to know how to set up the Wi-Fi capture by using the Wi-Fi network card.

The comments on the hashcat webpage do mention that your Wi-Fi network card must have the capability to capture wlan traffic.

So this requires more review and investigations.

Contact us to try it on your network.

Artificial Intelligence Cybersecurity

We as Cybersecurity practitioners must use the best tools we can find. So if AI(Artificial Intelligence) can help us we need to use them.

Of course we have to use real AI tools, not old tools renamed “AI” to sell more software for a little bit of time.

What is the definition of AI ?  a machine software (i.e. no human modification) that imitates human behavior. Or a branch of computer science dealing with simulation of intelligent behavior in computers.

So a true AI Cybersecurity is a program running attack or defense for the network or computer without human interaction.

What in today’s environment shows small views of intelligence? Bots and viruses of course.

 

It is also my opinion that future AI will first come as more sophisticated “Bots” or infectious software:

SCMagazine story: “Cryptominer campaign leveraging Oracle bug spreads worldwide via multiple infection tactics”

Again this affected entities that did not patch their PeopleSoft HR and Oracle E-business Suite software.

NIST explanation of CVE-2017-10271:

What makes this vulnerability bad is that it is a remote execution vulnerability.  “Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.” (from NIST link).

So if an AI program can program itself to infect and take over other machines to both infect other machines and perform other goals (like mine crypto currencies the latest actions in this exploit for example) then it is easily done when people find ways not to patch their software.

Image example of CVE-2017-10271 as it was found

The key is to patch your machines, and we have to develop “Blue team” AI first in this  coming “AI war”

To be a bit clearer (as mud I am sure) As someone programs an attack program to do the 3 things mentioned:

  1. Find vulnerability
  2. Exploit vulnerability  and make money with cryptocurrencies on your machines.
  3. Propagate the program as much as possible

So the future in AI (the real scary part) is when a truly non-human fully automated attack program does all 3  items and improves. The danger in how it will act is still not fully realized yet. I.e. we are not sure how bad it will get.

The important piece of this puzzle is the exponential level of improvement a fully electronic AI could do.

Some people have talked about the ‘singularity’ moment when an AI will have more capabilities than a human brain(supposedly sometime in 2020s).

 

What about a Cybersecurity ‘singularity’ moment? When a improving attack program starts to improve so fast that it morphs into something that is difficult to stop.

Contact me to discuss