Fake picture installs a data wiper malware

/in /by

The Sonicwall Capture Labs Research team came across a malware which purports to be a picture but has the intention to wipe the hard drive thus deleting data and programs. It is a multicomponent infection which starts with a fake image which then drops several files to carry out malicious behaviors.

Infection cycle:

The malware arrives as a picture entitled “SexyPhotos.jpg”.

This is in fact a self-extracting archive that drops the following files:

  • %temp%/avtstart.bat
  • %temp%/del.exe
  • %temp%/windll.exe
  • %temp%/open.exe
  • %temp%/windowss.exe

It ensures persistence by executing avtstart.bat and adding the rest of the files into Startup.

copy dell.exe "C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
copy windowss.exe "C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
copy windll.exe "C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
copy open.exe "C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"

The other executables that were dropped are all self-extracting archive files that each would drop a bat file and a vbs file to continue the infection.

Each of the files were executed successively as follows:

Windowss.exe drops the following files:

  • windowss.bat
  • windowss.vbs
  • readme.txt (a ransom note)

The vbs file, windowss.vbs, contains a simple command which will use wscript exe (Microsoft Windows script host utility for executing scripts) to execute the batch file, windowss.bat.

This batch file then renames all target files in the victim’s machine as “Locked_!counter!.Locked_fille.”

These files will appear encrypted as if a ransomware had locked the file, but they were simply just renamed as in the screenshot below.

Windll.exe drops the following files:

  • windll.bat
  • windll.vbs
  • readme.txt (a copy of the ransom note)

These files executed similarly with the vbs calling wscript exe to execute the batch file. Windll.bat copies readme.txt into the directories where the locked files are.

Open.exe then drops the following files:

  • open.bat
  • open.vbs
  • open.txt

Again, the open.vbs script runs wscript to execute open.bat. This time the only purpose is to open a URL (that is currently down) and to open the readme.txt which contains instructions on how to unlock the seemingly locked files by paying cryptocurrency worth $300 to a bitcoin address.

However the infection cycle ends here. The original malware then looks for “dell.exe” which is unavailable since the file that was dropped was named “del.exe” with a single –L. If this was not misspelled the infection would have continued. In turn, an error message was shown instead.

Del.exe should have dropped the following files:

  • del.bat
  • del.vbs
  • del.txt

Del.vbs would have executed del.bat using wscript exe and would have wiped the victim’s machine, deleting all data in the drive.

SonicWall Capture Labs provides protection against this threat via the following signature:

  • GAV: Ransom.FK (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.

Microsoft Security Bulletin Coverage for October 2022

/in /by

SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of October 2022. A list of issues reported, along with SonicWall coverage information, is as follows:

CVE-2022-37970 Windows DWM Core Library Elevation of Privilege Vulnerability
ASPY 369: Malformed-File exe.MP_275

CVE-2022-37974 Windows Mixed Reality Developer Tools Information Disclosure Vulnerability
ASPY 370: Malformed-File exe.MP_276

CVE-2022-37987 Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
ASPY 371: Malformed-File exe.MP_277

CVE-2022-37989 Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
ASPY 377: Malformed-File exe.MP_280

CVE-2022-38050 Win32k Elevation of Privilege Vulnerability
ASPY 372: Malformed-File exe.MP_278

CVE-2022-38051 Windows Graphics Component Elevation of Privilege Vulnerability
ASPY 373: Malformed-File exe.MP_279

CVE-2022-38053 Microsoft SharePoint Server Remote Code Execution Vulnerability
IPS 15500: Microsoft SharePoint Remote Code Execution (CVE-2022-38053)

Adobe Coverage:
CVE-2022-28851 Acrobat Reader Out-of-bounds Read
ASPY 376: Malformed-File pdf.MP_560

CVE-2022-38449 Acrobat Reader Out-of-bounds Read
ASPY 375: Malformed-File pdf.MP_559

The following vulnerabilities do not have exploits in the wild :
CVE-2022-22035 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-24504 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-30198 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-33634 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-33635 Windows GDI+ Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-33645 Windows TCP/IP Driver Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-34689 Windows CryptoAPI Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2022-35770 Windows NTLM Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2022-35829 Service Fabric Explorer Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2022-37965 Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-37968 Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37971 Microsoft Windows Defender Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37973 Windows Local Session Manager (LSM) Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-37975 Windows Group Policy Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37976 Active Directory Certificate Services Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37977 Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-37978 Windows Active Directory Certificate Services Security Feature Bypass
There are no known exploits in the wild.
CVE-2022-37979 Windows Hyper-V Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37980 Windows DHCP Client Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37981 Windows Event Logging Service Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-37982 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-37983 Microsoft DWM Core Library Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37984 Windows WLAN Service Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37985 Windows Graphics Component Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-37986 Windows Win32k Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37988 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37990 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37991 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37993 Windows Group Policy Preference Client Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37994 Windows Group Policy Preference Client Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37995 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37996 Windows Kernel Memory Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-37997 Windows Graphics Component Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-37998 Windows Local Session Manager (LSM) Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-37999 Windows Group Policy Preference Client Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38000 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-38001 Microsoft Office Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2022-38003 Windows Resilient File System Elevation of Privilege
There are no known exploits in the wild.
CVE-2022-38016 Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38017 StorSimple 8000 Series Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38021 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38022 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38025 Windows Distributed File System (DFS) Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-38026 Windows DHCP Client Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-38027 Windows Storage Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38028 Windows Print Spooler Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38029 Windows ALPC Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38030 Windows USB Serial Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-38031 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-38032 Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2022-38033 Windows Server Remotely Accessible Registry Keys Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-38034 Windows Workstation Service Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38036 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-38037 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38038 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38039 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38040 Microsoft ODBC Driver Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-38041 Windows Secure Channel Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-38042 Active Directory Domain Services Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38043 Windows Security Support Provider Interface Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-38044 Windows CD-ROM File System Driver Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-38045 Server Service Remote Protocol Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-38046 Web Account Manager Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-38047 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-38048 Microsoft Office Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-38049 Microsoft Office Graphics Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-41031 Microsoft Word Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-41032 NuGet Client Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-41033 Windows COM+ Event System Service Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-41034 Visual Studio Code Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-41036 Microsoft SharePoint Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-41037 Microsoft SharePoint Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-41038 Microsoft SharePoint Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-41042 Visual Studio Code Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-41043 Microsoft Office Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-41081 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
There are no known exploits in the wild.

Think Before You Click: Spotting and Stopping a Phish

/0 Comments/in , /by

It’s nearly 3 p.m. and, despite three cups of coffee, you’ve barely made a dent in the massive backlog that didn’t even exist when you got in this morning. You decide to steal a precious few seconds between meetings and messages to check your email, hoping none of the four notifications you’ve just received are more requests.

One in particular catches your attention: Someone has successfully logged into your email account from thousands of miles away. “If you don’t recognize this login,” the email warns, “change your password immediately.” Between worst-case thoughts of identity theft and ruined credit, and the promise of something quick and easy to check off your to-do list, you can’t mash that button fast enough. You enter and confirm your old password, enter and confirm your new password, then sigh with relief — your account is safe for another day.

Except it isn’t: Unbeknownst to you, the email was a phish, and your credentials have just gone from “confidential” to “commodity,” available to anyone for a few bucks on the dark web.

Hook

While phishing has been around for nearly 30 years, it’s still growing: According to IC3 data, phishing attacks have increased 182% since 2019. Today, one in every 99 emails is a phish.

Worse, your email service provider’s security measures may not be as much help as you think: A quarter of phishing emails are able to sneak by the default security measures included with Office 365, and more than 10 percent are able to bypass both Microsoft Exchange Online Protection (EOP) and Microsoft Advanced Threat Protection.

From there, the success of a phish just depends on whether they’ve used the right kind of bait: Nearly one in three phishing emails is opened, and when referring to spear-phishing, that number jumps to 70%.

The most successful hooks share two common characteristics: They appear to come from a known contact or organization, and they use a problem or issue to inspire a sense of urgency. Common examples include warnings that your payment information has expired, your account is on hold due to a billing issue, an order you never placed is set to be shipped, etc.

Line

So how do criminals get you on the line? The three most common techniques involve malicious attachments, malicious URLs and fraudulent data entry forms.

Malicious Attachments
These attachments may look like ordinary PDFs, Word docs or Excel sheets, and may even include legitimate-sounding data to help maintain the ruse, such as an invoice or a receipt. But in the case of a phish, they’re infected with malware that can infect your device and spread throughout the network — to servers, external hard drives/backups, and even cloud systems.

Malicious URLs
That link you may think is taking you to Amazon.com to clear up an account issue may instead be taking you to Amazom.com — an imposter homepage designed to launch malware. If you notice that the URL looks a little odd once you get to the page, however, it may already be too late: In the case of a drive-by download attack, simply visiting a site is enough to begin download of malicious code to your device. These sites are a moving target for the IT admins attempting to block them: 84% of them are live for less than 24 hours, with some up for as little as 15 minutes.

Fraudulent Forms
Not all phishing sites deploy malware, however. Some are just seeking information, often in the form of fake data-entry forms. Often this takes the form of a phony login page, such as a popup window imitating the login prompts for Office 365 and other services. Another common scam is an email alerting you that your payment information has expired. After clicking on the link in the phishing email, you’re taken to a fraudulent URL asking you to reenter your credit card information or other data such as your social security number, full name, address and more. The goal of these attacks is to collect credentials to launch further attacks, often spearphishing or Business Email Compromise (BEC) attacks, or to collect personal information that can be exploited or sold for a profit.

… And sinker.

If you’ve fallen for a phish, you and others on your network could be sunk. 91% of cyberattacks start with a phish, and 66% of malware is installed via malicious email attachments.

Unfortunately, despite being alarmingly common (83% of organizations reported suffering successful phishing attacks in 2021), phishing is the second most-expensive attack vector to remediate, costing organizations an average of $4.65 million.

More than half of organizations that experienced a successful phishing attempt reported experiencing data loss or compromised accounts/credentials, and over 40% experienced subsequent ransomware infections.

Don’t Take the Bait!

But despite an increase in prevalence and sophistication, you can still avoid falling for a phish. Here are a few ways to stay safe:

  1. Implement Dedicated and Regular Security Awareness Training: Training employees on security awareness significantly decreases the odds that someone will fall for a phishing attack, and can reduce the cost of a successful phishing attack by over half.
  2. Learn the Hallmarks of a Phishing Email: Poor spelling and grammar in an otherwise professional-looking email, logos that are low-resolution or look a bit “off,” a sender address that is similar to but different from one you’re accustomed to seeing and a sense of urgency are all reliable indicators of a phishing email.
  3. Be Leery of Links: Don’t ever click on embedded links in an email, even from a trusted contact, and avoid clicking on any link in an email from a sender you don’t recognize. Ensure the URL of any site you visit begins with https, not http. And watch out for subdomains — hulu.iscamyou.com is not a part of Hulu’s website just because Hulu is in the URL.
  4. Upgrade Your Browser and OS Regularly: Most modern browsers are equipped with phishing protection, which is upgraded as attackers introduce new techniques.
  5. If You’ve Been Caught, Act Quickly: Report the incident to your IT department immediately, and find out whether you’ll need to notify other departments, such as Finance or Legal. In the case of malware infections, a service like SonicWall’s Capture Advanced Threat Protection (ATP) should protect you — otherwise, disconnect the endpoint from the internet and network immediately until a scan can be run. If your personal information has been compromised, set up a credit freeze and fraud alerts through your financial institutions to ensure no new accounts are opened in your name.

Identifying a phish will go a long way toward keeping your organization safe — but if you aren’t regularly updating and patching, your network could still be vulnerable to cyberattack. In next week’s Cybersecurity Awareness Month blog, we’ll offer tips on how to stay safe by staying up to date.

Cybersecurity News & Trends – 10-07-22

/0 Comments/in /by

Each week SonicWall curates the cybersecurity industry’s most compelling, trending and important interviews, media and news stories — just for you.

This week, SonicWall made another strong appearance in global industry and business news with executive interviews and mentions of our Cyber Threat reports.

In Industry News, the big read is an old story that is growing more urgent. Bloomberg reports hackers have found the cruelest twist in the growing use of business email compromises to target homebuyers, with contributions from the FBI’s IC3, and SonicWall. According to Cyberscoop, US intelligence officials revealed that hackers maintained deep access inside the US military organizational network. The Register reports that the US Department of Energy believes utility security is so bad that they’re offering rate cuts and free services to help improve it. Hacker News reports that hackers have found a way to leverage a weakness in the App Mode in Chromium browsers to enact stealth phishing attacks. Binance blockchain hit by $570 million crypto hack, according to Reuters and Bleeping Computer. From HackRead, researchers discovered that Iranian state hackers are spreading Android spyware disguised as a VPN app. And from DarkReading, there are seven IoT devices that make our security professionals cringe. Can you guess what they are?

Remember especially during Cybersecurity Awareness Month, that cybersecurity is everyone’s business. Be safe out there!

SonicWall News

Can MSPs get cyber security ‘right’ for SMEs?

Microscope, SonicWall in the News: Terry Greer-King, vice-president for EMEA and APJ at SonicWall, says the biggest thing MSPs can do for SME customers is to simplify it. “Most people in security see the complexity of it, but an SME needs to be protected from the complexity,” he says. The main point is to ensure the SME is protected “at all levels”, says Greer-King, but MSPs “can typically get too into the weeds, particularly towards the trend of increasingly complex breaches and growing expertise from bad actors.”

New cryptojacking campaign exploits OneDrive vulnerability

CSO Online. SonicWall in the News: Cryptojacking cases rose by 30% to 66.7 million in the first half of 2022, up 30% over the first half of 2021, according to the 2022 SonicWall Cyber Threat Report. The financial sector witnessed a 269% increase in cryptojacking attacks, according to the report.

Study Shows 91% Of Organizations Fear Ransomware Attacks

Technology Magazine, SonicWall in the News: Amid an economic downturn, staffing shortages and endless cyberattacks, financially motivated attacks are the top concern among IT professionals.

SonicWall Backs Cybersecurity Awareness Month, Places Emphasis on Empowering People

M2, SonicWall in the News: This year’s theme – ‘See Yourself in Cyber’ – demonstrates that while cybersecurity may seem like a complex subject, ultimately, it’s really all about people.

Lapsus$ Hit Uber

Cyber Security Intelligence, SonicWall in the News: SonicWall’s mid-year threat report found that malware rose by 2.8 billion globally in the last year. Other findings include encrypted threats has 132% increase to 4.8 billion; finance sector experiences the highest IoT malware attempts up 151%; and IoT Malware is up 134% in the UK and 228% in the US.

The Growing Cybersecurity Threats Facing Retailers

TechMonitor, James Musk Interview: Tech Monitor news editor Matthew Gooding spoke to James Musk, UK sales director at SonicWall, about the company’s research into the types of attacks being used against retailers. They also discuss what businesses can do to protect themselves, and how they can ensure staff are vigilant when it comes to spotting potential cyber breaches.

Why retail stores are more vulnerable than ever to cybercrime

IFSEC Global, SonicWall Threat Report Mention: Figures from SonicWall’s Biannual Report revealed that ecommerce and online retail businesses saw a 264% surge in the past 12 months in ransomware attacks alone. These kinds of statistics are extremely worrying for retail businesses, so it is unsurprising that websites and digital security are at the forefront of retailers’ minds.

These steps can help keep colleges from being easy targets for cyberattacks

HigherEd Dive, SonicWall Byline from Immanuel Chavoya, and SonicWall mention: A cybersecurity strategist outlines cultural and technical changes to help institutions stave off attacks like malware or business email compromise. Recent data from SonicWall revealed surging attacks across the board in the first half of the year, with the overall education industry seeing a 110% spike in IoT malware attacks and a 51% increase in ransomware — despite a global decline in ransomware attacks.

SonicWall’s Matt Brennan Talks New Leadership and Taking ‘Outside-In’ Approach

CRNtv, SonicWall Interview with Matt Brennan: With a New CEO and Matt Brennan taking on the role as channel chief at SonicWall, Brennan discusses some of the changes partners can expect from the new leadership and winning a CRN 2022 Annual Report Card Award.

The Soaring Threat Going Undetected

Blockchain Tribune, SonicWall Byline from Immanuel Chavoya: The popularity of cryptocurrencies has increased, not only in their overall market value but also in the number of people looking to digital currencies to generate totally independent revenue. While some do this through investing and selling cryptocurrency directly, others are turning to transaction processing (cryptomining) to turn a profit.

3 Cybersecurity Solutions Likely to Gain Traction In 2022 And Beyond

Cyber Defense Magazine, SonicWall Threat Report Mention: In June 2021, there were nearly 78.4 million ransomware attacks worldwide. This implies that about 9.7 ransomware attempts per consumer were made for every business day.

Industry News

Big Read: Hackers Target Eager Homebuyers with a Scam That Keeps Working

This week’s big read comes mostly from Bloomberg, reporting that hackers have found the cruelest twist in the growing use of BEC (business email compromises): they’re targeting homebuyers.

BEC scams target every industry, but hackers are focusing on eager homebuyers eager to close a purchase on their dream home. Overwhelmed with paperwork and emails, the buyer believes they are transferring funds for a down payment but mistakenly hands thousands of dollars to hackers. The hack, say investigators, is cunning if not vicious. Hackers take advantage of the flurry of activity between buyers and sellers and inject themselves into the middle of the transaction at the most critical moment by omitting a tiny detail in an email (e.g., a spelling error or extra character) that could flag someone that it is a fake. As a result, this form of wire fraud is proliferating, often intercepting wire transfers of tens of thousands of dollars for down payments on homes and wiping out potential buyers’ nest eggs.

In March this year, a cybercrime branch of the FBI known as the Internet Crime Complaint Center (IC3) reported that they receive an average of more than 2,300 crime complaints per day (about one complaint every 37 seconds), with BECs schemes averaging 552,000 per year over the last five years. In 2021, victims of BECs reported losses of nearly $7 billion, a 7% increase over 2020.

Bloomberg’s report features stories from individuals who lost up to $150,000 in one transfer by a couple trying to buy a condo in Boston. In one case, hackers tried to steal $30,000 by sending fake statement claims to a construction company in Long Island, NY. An investigator followed the trail of similar scams and uncovered more than $9 million in stolen funds affecting more than 50 victims spanning several business sectors.

October is National Cybersecurity Awareness Month, and SonicWall is using this opportunity to spotlight the role of individuals in stopping attacks. Also, as part of our campaign, we’re offering tips on how everyone can be more aware and protect themselves from the bad guys – because cybersecurity is everyone’s business.

Hackers Had Deep Access Inside US Military Organizational Networks

Cyberscoop reports that law enforcement and intelligence officials revealed on Tuesday that sophisticated hackers infiltrated a likely US military contractor and maintained “persistent, long-term” access to their system.

The National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI released a detailed, joint advisory containing the notification, explaining that in November 2021, CISA responded to a report of malicious activity on an anonymous “Defense Industrial Base (DIB) Sector organization’s enterprise network.”

CISA uncovered the compromise and reported that some intruders had “long-term access to the environment.” After breaking in, officials said, hackers leveraged an open-source toolkit known as Impacket to “programmatically” construct and manipulate network protocols.

Binance Blockchain Hit by a $570 million Crypto Hack

Reuters reports that a blockchain linked to Binance, the world’s largest crypto exchange, has been hit by a $570 million hack, a Binance spokesperson said on Friday, the latest in a series of hacks to hit the crypto sector this year.

A report from Bleeping Computer adds that hackers stole tokens from a blockchain “bridge” used in the BNB Chain, known until February as Binance Smart Chain. Blockchain bridges are tools used to transfer cryptocurrencies between different applications. Criminals have increasingly targeted them, with about $2 billion stolen in 13 various hacks, mostly this year. Zhao said that the hackers stole around $100 million worth of crypto in his tweet. The BNB Chain blog claims that the hacker withdrew a total of 2 million of the BNB cryptocurrency worth around $570 million.

Department of Energy Offers Helping Hand to Bolster Utility Cybersecurity

The Register reports that the US Department of Energy is proposing regulations to financially reward cybersecurity modernization at power plants by offering rate deals for everything from buying new hardware to paying for outside help. In a notice of proposed rulemaking posted Oct 6, the DoE said the time was right “to establish rules for incentive-based rate treatments” for utilities making investments in cybersecurity technology. The DoE said these included products and services and information like plans, policies, procedures, and other information related to cybersecurity tech. For example, industrial systems used in power plants are known as soft spots due to older software. Much of the equipment used in operational technology (OT) environments are not designed to connect securely to the internet and can’t be configured safely.

Hackers Use’ App Mode’ in Chromium Browsers for Stealth Phishing Attacks

Hackers are always looking for new ways to take advantage of weaknesses in our internet use. According to Hacker News, the latest is using the Application Mode feature in Chromium-based web browsers can be abused to create “realistic desktop phishing applications.” Application Mode is designed to offer native-like experiences in a manner that causes the website to be launched in a separate browser window while also displaying the website’s favicon and hiding the address bar. Hackers can leverage this behavior to resort to some HTML/CSS trickery, display a fake address bar on top of the window, and fool users into giving up their credentials on rogue login forms. If that wasn’t bad enough, an attacker-controlled phishing site could use JavaScript to take more actions, such as closing the window immediately after the user enters the credentials or resizing and positioning it to achieve the desired effect.

It’s worth noting that the mechanism works on other operating systems, such as macOS and Linux, making it a potential cross-platform threat. However, the attack’s success is predicated on the attacker already having access to the target’s machine.

Iranian State Hackers are Spreading RatMilad Android Spyware Disguised as a VPN App

An Iranian hacking group is using new Android spyware in an extensive campaign primarily targeting enterprise users, according to HackRead. The group involved in this campaign goes by “AppMilad,” while the spyware being used is dubbed “RatMilad.” It can perform a wide range of malicious actions after it is installed on a victim’s device, including functionalities like file manipulation, audio recording, and application permission modification. In addition, AppMilad has devised a campaign to get the malicious app sideloaded onto unsuspecting users’ devices. Zimperium examined a spyware sample using the VPN and phone number spoofing app, which was identified as Text Me.

Another live RatMilad sample was distributed through a Text Me variant called NumRent. Moreover, scammers have developed a product website to distribute the app and socially engineer targets to believe that it is a legit app.

7 IoT Devices That Make Us Cringe

Researchers at DarkReading honored Cybersecurity Awareness Month, noting that in cybersecurity if it isn’t one thing, it’s another 14.4 billion things that’ll get you. That’s about how many Internet of Things (IoT) devices will increase globally by the end of the year, according to some analyst estimates. The Dark Reading crew thought it was only fitting to roast the types of IoT devices that are most likely to make security and privacy people cringe. Our read on the story is that it offers a bit of levity along with some serious insight into why these devices are insecure, bizarrely impractical, or just downright creepy in the kind of data they collect about our lives and our businesses. The IoT devices they included in their list: WiFi connected surveillance cameras, smart toilets, digital license plates, smart speakers, smart kitchen appliances, robotic vacuum cleaners, and smart locks. Enjoy the full story for a complete description of the vulnerabilities to help shore up security at work and at home.

In Case You Missed It

National Cybersecurity Awareness Month Spotlights the Role of Individuals in Stopping Attacks – Amber Wolff

Seamless Security: How SonicWall Solutions Work Together to Safeguard Your Organization – Sarah Choi

SonicWall’s Nicola Scheibe Recognized by CRN as One of 2022’s 100 People You Don’t Know But Should – Bret Fitzgerald

SonicWall NSM 2.3.4 Uplevels Central Management Capabilities – Amber Wolff

Cybersecurity and the Metaverse: Virtual and Real Threats – Ray Wyman

Why 5G Needs to Start with Secure Network Access – Rishabh Parmar

Security Platform Vendors vs. Best-of-Breed Approach to Security Architecture – Rajesh Agnihotri

Why Organizations Should Adopt Wi-Fi 6 Now – David Stansfield

Vote for SonicWall in Computing Security Awards 2022 – Bret Fitzgerald

SonicWall Earns 2022 CRN Annual Report Card (ARC) Honor – Bret Fitzgerald

SonicWall Capture ATP Earns 100% ICSA Threat Detection Rating for Sixth Straight Quarter – Amber Wolff

Ten Cybersecurity Books for Your Late Summer Reading List – Amber Wolff

CoinDesk TV Covers Cryptojacking with Bill Conner – Bret Fitzgerald

First-Half 2022 Threat Intelligence: Geopolitical Forces Rapidly Reshaping Cyber Frontlines – Amber Wolff

2022 CRN Rising Female Star – Bret Fitzgerald

Enhance Security and Control Access to Critical Assets with Network Segmentation – Ajay Uggirala

Three Keys to Modern Cyberdefense: Affordability, Availability, Efficacy – Amber Wolff

BEC Attacks: Can You Stop the Imposters in Your Inbox? – Ken Dang

SonicWall CEO Bill Conner Selected as SC Media Excellence Award Finalist – Bret Fitzgerald

Cybersecurity in the Fifth Industrial Revolution – Ray Wyman

Schneider Electric IGSS Vulnerability

/in /by

Overview:

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  Schneider Electric’s Interactive Graphical Supervisory Control and Data Acquisition (SCADA) System (IGSS) is used for monitoring and controlling industrial processes. According to the vendor, more than 28,000 IGSS licenses have been sold around the world and IGSS is installed in many different industries, including the Oil and Gas, Traffic Control, and Waste Water industries.

  An integer overflow vulnerability exists in Schneider Electric IGSS. The vulnerability is due to input validation error when processing ALMNOTE opcode.

  A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted packet to the target service. Successful exploitation could cause denial-of-service and potentially remote code execution.

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2022-2329.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 8.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C).

  Base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is unchanged.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 8.5 (E:U/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is unproven.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

Technical Overview:

  The vulnerability is due to the missing validation of the size field in the request sent to the server. When the data server receives a message, the function IGSSdataServer.exe+0xb30b0() is called, which calls the C library function WSARecv() to retrieve the contents of the message from the socket. Later, in the same function, the code checks that Opcode1 is equal to 1. If false the function exits. If true, the code calls a switch statement on the value of the Request Type field and enters the appropriate path of code execution.

  If the Request Type field is equal to 14, then the code execution enters the potentially vulnerable code path. The code calls function IGSSdataServer+0xf7650(). This function is called using the function pointer which is set only after the first request. Therefore, this function is only called after the second or subsequent request. Inside this function, the code calls the C library function realloc() with the size parameter in this function set to the (size field from the previous request + size field from the current request). This function does not perform validation on the computed value of the vulnerable addition operation of the size fields in the previous request and in the current request.

  Next, the code calls the C library function memcpy() to copy the “note” data field from the current request to the new buffer using the new reallocated heap buffer which maybe be smaller than intended due to integer overflow. The code keeps track of the value of the size field from the previous request in another heap buffer. Then, the code copies the “note” data in the current request to the new reallocated buffer. Since this new buffer size can be too small to fit the length of the “note” data field in the request, due to earlier integer overflow, a heap-buffer overflow can ensue.

  IGSS Data Server

Triggering the Problem:

  • The target must have the vulnerable product installed and running.
  • The attacker must have network connectivity to the server running the vulnerable product.

Triggering Conditions:

  A remote attacker sends three crafted packets with Request Type set to 14. The vulnerability is triggered when the affected product parses the malicious requests.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • 7-Technologies (7T) IGSS Protocol

  

SonicWall’s, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 3304 Schneider Electric IGSS Integer Overflow

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Apply the vendor supplied patch to eliminate the vulnerability.
    • Filter attack traffic using the signature above.
  The vendor, Schneider Electric, has released an update and advisory regarding this vulnerability:
  Vendor Advisory

National Cybersecurity Awareness Month Spotlights the Role of Individuals in Stopping Attacks

/0 Comments/in /by

If you were to poll a group of individuals at random about whether they have a role in cybersecurity, you’d probably get answers like, “No, I’m an attorney,” or “Actually, I work in education.” That’s because many people imagine cybersecurity in terms of solutions, brands or organizations.

But cybersecurity reaches far beyond what we consider the “cybersecurity industry.” It’s a goal, and the more of us who work toward it, the greater chance we all have of being successful. That’s why, this National Cybersecurity Awareness Month, SonicWall is joining the National Cybersecurity Alliance (NCA) and the Cybersecurity and Infrastructure Security Agency (CISA) to encourage you to “See Yourself in Cyber” by offering tips, best practices and more.

“We’ve all come to understand that sound protection includes people as the most important pillar of a sound cybersecurity strategy,” said SonicWall Executive Vice President and CMO Geoff Blaine. “An organization cannot be secure until the entire workforce is engaged in reducing cyber risks. Each member of the group has the power to harm or help, since each one has access to information and systems, handles sensitive data, and makes decisions every day that could maintain, erode or strengthen the human ‘attack surface’ of the organization.”

As National Cybersecurity Awareness Month Champions, SonicWall’s experts will spend the next month exploring ways to help organizations and individuals protect their information and secure their systems and devices. We’ll explore several topics in depth:

  • Think Before You Click
    If a link looks a little off, it could be an attempt to get sensitive information or install malware.
  • Update Your Software
    If you see a software update notification, act promptly. Better yet, turn on automatic updates.
  • Use Strong Passwords
    Passwords should be long, unique and randomly generated. Use password managers to generate and remember different, complex passwords for each of your accounts.
  • Enable Multi-Factor Authentication
    Protecting your online accounts requires more than just passwords. Enabling MFA makes you significantly less likely to get hacked.

For anyone who doubts one person can make a difference in securing against cyberattacks, consider this:

  • 95% of cybersecurity incidents occur due to human error[1]
  • 91% of cyberattacks start with someone opening a phishing email[2]
  • 64% of people are still using a password exposed in one breach for other accounts[3]
  • 58% of businesses reported a Business Email Compromise (BEC) attack in which an employee was successfully tricked, and sent or attempted to send funds to an attacker. [4]

Important steps can be taken to strengthen cybersecurity at the industry level, as well. By putting operational collaboration into practice, working together to share information in real time, and reducing risk and building resilience from the start, we can work together to protect our critical infrastructure and the systems we rely on every day.

And for individuals looking to play an even bigger role in the outcome of America’s security future, there is an opportunity to See Yourself as a cybersecurity employee. An estimated 714,548 cybersecurity jobs are currently unfilled, compared with 1,091,575 individuals currently employed in cybersecurity[5] — in other words, for every three people you know who work in cybersecurity, there are two positions open. As we move toward building a more cybersecurity-aware nation, we’d like to highlight the opportunities available for dedicated defenders to help build a bigger and more diverse workforce dedicated to solving the problems facing our country now and in the future.

“Moving the needle on cybersecurity awareness requires a collective approach,” said Lisa Plaggemier, the NCA’s executive director. “Businesses, nonprofits and governments all have a role to play in helping to up-level preparedness for cyber threats.”

About NCSAM

National Cybersecurity Awareness Month was launched by the National Cyber Security Alliance (NCSA) and the U.S. Department of Homeland Security (DHS) in October 2004 as a broad effort to help all Americans stay safer and more secure online. Following wide success of the ‘Our Shared Responsibility’ theme in years past, CISA and NCSA have shifted strategic focus to a message that promotes personal accountability.

To learn more about NCSAM, please visit StaySafeOnline.org.

 

[1] https://cybernews.com/editorial/world-economic-forum-finds-that-95-of-cybersecurity-incidents-occur-due-to-human-error/

[2] https://www.darkreading.com/endpoint/91-of-cyberattacks-start-with-a-phishing-email

[3] https://www.zdnet.com/article/were-all-still-using-the-same-passwords-even-after-theyve-been-breached/

[4] “How to Deal with Business Email Compromise,” Osterman Research White Paper, January 2022

[5] https://www.nist.gov/system/files/documents/2022/07/06/NICE%20FactSheet_Workforce%20Demand_Final_20211202.pdf