Language Selection

English French German Italian Portuguese Spanish

Security/Integrity/Proprietary: Microsoft, SWIFT, SymTCP, Emotet and CIA Leaks

Filed under
Security
  • Microsoft Patch Tuesday, February 2020 Edition

    A dozen of the vulnerabilities Microsoft patched today are rated “critical,” meaning malware or miscreants could exploit them remotely to gain complete control over an affected system with little to no help from the user.

    Last month, Microsoft released an advisory warning that attackers were exploiting a previously unknown flaw in IE. That vulnerability, assigned as CVE-2020-0674, has been patched with this month’s release. It could be used to install malware just by getting a user to browse to a malicious or hacked Web site.

    Microsoft once again fixed a critical flaw in the way Windows handles shortcut (.lnk) files (CVE-2020-0729) that affects Windows 8 and 10 systems, as well as Windows Server 2008-2012. Allan Liska, intelligence analyst at Recorded Future, says Microsoft considers exploitation of the vulnerability unlikely, but that a similar vulnerability discovered last year, CVE-2019-1280, was being actively exploited by the Astaroth trojan as recently as September.

  • Forging SWIFT MT Payment Messages for fun and pr... research!

    TLDR: With a bit of research and support we were able to demonstrate a proof of concept for introducing a fraudulent payment message to move £0.5M from one account to another, by manually forging a raw SWIFT MT103 message, and leveraging specific system trust relationships to do the hard work for us!

  • SymTCP – a new tool for circumventing deep packet inspections

    In a paper (PDF) entitled ‘SymTCP: Eluding Stateful Deep Packet Inspection with Automated Discrepancy Discovery’, academics from the University of California’s Department of Computer Science and Engineering demonstrate how to bypass DPI mechanisms, regardless of their application.

    According to the team, DPI systems often use simplified machine states of network stacks that are not exact implementation copies of end hosts. Discrepancies can then be exploited through packet fragmentation or manipulation.

    SymTCP first runs ‘symbolic execution’ on a server’s TCP implementation, and the resulting scan collects execution paths labeled as either ‘accept’ or ‘drop’ for packet inspection.

    The DPI system is then checked with generated packet sequences to ascertain which, if any, are processed in the same way by the DPI and the server.

    If discrepancies in handling are detected, the open source tool is able to create packets that can reach core elements in the code responsible for accepting or dropping requests, thereby potentially avoiding DPI middlebox checks.

  •                    

  • Emotet can spread to poorly secured Wi-Fi networks and computers on them

                         

                           

    After the malware infects a computer that has Wi-Fi capability, it uses the wlanAPI interface to discover any Wi-Fi networks in the area: a neighbor’s Wi-Fi network, a free Wi-Fi network at a café, or a Wi-Fi network of a nearby business.

  •                    

  • Emotet can now hack Wi-Fi networks

                         

                           

    This new strain utilizes wlanAPI.dll calls to discover wireless networks around a computer that is already infected with Emotet. By using the compromised machine's Wi-Fi connection, the malware tries to brute-force its way in to other password protected networks nearby.

                           

    After the compromised device has been successfully connected to another wireless network, the Emotet Trojan begins looking for other Windows devices with non-hidden shares. The malware then scans for all accounts on these devices and once again brute-forces the password for the Administrator account and all other users on the system.

  •                    

  • “What is the Root User?” Joshua Schulte Set Up the Shared “root” Password He’ll Use in his Defense

                         

                           

    In a full day of testimony yesterday, one of Joshua Schulte’s former colleagues, testifying under the name Jeremy Weber (which may be a pseudonym of a pseudonym under the protective order imposed for the trial) introduced a ton of detail about how the engineering group he and Schulte worked in was set up bureaucratically, how the servers were set up, and how relations between Schulte and the rest of the group started to go south in the months and weeks leading up to the date when, the government alleges, he stole CIA’s [cracking] tools. He also described how devastating the leak was for the CIA.

                           

    In that testimony, the government began to lay out their theory of the case: When Schulte lost SysAdmin access to the servers hosting the malware they were working on — and the same day the unit announced they’d soon be moving the last server to which Schulte had administrator privileges under the official SysAdmin group — Schulte went back to the back-up file of the server from the day the fight started blowing up, March 3, 2016, and made a copy of it.

                           

    But the government also started previewing what will likely be Schulte’s defense: that some of these servers were available via a shared root password accessible to anyone in their group.

  •                    

  • State officials press Congress for more resources to fight cyberattacks [iophk: Windows TCO]

                         

                           

    Tuesday's hearing follows months of escalating attacks against government entities across the nation, with most involving ransomware, which attackers use to lock down a system and demand payment to give the user access again.

  •        

  • Trump administration wants private sector to do more to counter foreign intelligence efforts

                                 

                                   

    The Trump administration’s counterintelligence strategy, released Monday, aims for stronger collaboration between the intelligence community and the private sector on detecting and stopping foreign intelligence threats to U.S. entities.

                                   

    The plan, which President Donald Trump approved in early January, emphasizes a longstanding government argument that the private sector must do more to prevent foreign espionage. As state-sponsored hackers target more U.S. companies, corporate America should prioritize preparations to stifle similar attacks in the future, the director of the National Counterintelligence and Security Center, Bill Evanina, told reporters at a briefing Monday.

  •                            

More in Tux Machines

i.MX8M Nano based mini-PC features Wirepas mesh networking

SolidRun’s $221-and-up “SolidSense N8 IoT Compact” mini-PC runs Linux on an i.MX8M Nano Solo with GbE, WiFi/BT, USB, and a choice of LTE or PoE. You also get a choice of RS485 with CAN or BLE 5.0 with Wirepas Massive. The SolidSense N8 IoT Compact embedded system follows SolidRun’s i.MX6-based SolidSense N6 Edge Gateway, which similarly offers a bundle of the Wirepas wireless mesh software from Tampere, Finland based Wirepas. The wireless mesh software, which is now called Wirepas Massive, is pre-installed along with software defined radios (SDRs) on two of the four i.MX8M Nano based SolidSense N8 models. Applications include IoT tasks such as automation, asset tracking, security, and smart buildings. Read more

AMD Ryzen processors are getting a performance boost on Linux

Chip giant AMD has shared details about a new driver that promises to improve the performance of its Zen-based processors on Linux. According to reports, the new driver is the result of a joint collaboration between AMD and Valve, with the two companies toiling to enhance performance and power efficiency reportedly in preparation for the launch of the Steam Deck, Valve’s Zen 2-based take on portable gaming. Read more

Windowsfx is the Linux distribution Windows users have been looking for

Over the past 20 or so years, there always seems to be that one distribution everyone claims is the best to help Windows users transition to Linux. Most often those distributions are nothing more than Linux with a desktop that looks like Windows. Sometimes they do a decent job of mimicking Windows and sometimes not. But every so often something special pops up, a distribution that goes well beyond that extra mile to make Windows users feel right at home with Linux. Such is the case with Windowsfx. This Linux distribution is far from just a UI tweak to resemble another OS, it's perfectly tuned for Windows users. It looks like Windows 11, and it behaves like Windows 11... only it's Linux. For certain users, Windowsfx will be the absolute best of both worlds. Read more

The 3 Best Alternatives to Mandriva Linux

Mandriva Linux has been discontinued for a long time now. Check out these three alternatives to relive the pure Mandriva experience. Mandriva Linux is a fusion of Brazilian distribution Conectiva Linux and French distribution Mandrake Linux. It is developed by Mandriva S.A.; however, the company has not released any new version since 2011. Although the distro has not been updated for a long time and considering the features it offered, it’s a little difficult to undermine its existence. Mandriva might not exist any longer, but its memories are still functional in the form of different Linux distros, discussed below. Read more