Infrastructure Behind BadRabbit Ransomware Since 2016 Active

The infrastructure used last Tuesday to spread the BadRabbit ransomware has been active since 2016, says Dutch security researcher Yonathan Klijnsma from security company RiskIQ. During the attack the attackers used a large number of hacked websites.

These websites showed a popup to visitors that they needed to install an update for Adobe Flash Player. In fact, it was a Petya ransomware variant that encrypted files on the hard drive and overwritten the Master Boot Record from the hard drive. As a result, the operating system can no longer be started. Furthermore, BadRabbit tries to spread on SMB via a list of commonly used passwords and intercepting login credentials via SMB.

On the hacked websites, code was sent to an injection server that showed the malicious popup on the websites. One of these injection servers was first observed last September. In addition, various hacked websites have been compromised since last year. RiskIQ counted 63 hacked websites where the attackers had access. The security company claims, however, that it can go for more websites.

"The group behind the BadRabbit ransomware has been active for quite some time," said Klijnsma. The researcher speaks of a long-term campaign that could possibly be set up for something other than BadRabbit. "Although the BadRabbit ransomware is brand new, we can track the distribution industry by the beginning of 2016, which shows that victims had been compromised a lot before before the ransomware hit and the news cycle began. The campaign could originally be set up for something other than BadRabbit. " Security company Symantec claims that 86 percent of the infections occurred in Russia and it mainly concerns companies.

Ukraine And Russia Hit By Bad Rabbit Ransomware

Organizations in Ukraine and Russia have been hit by a new ransomware copy called Bad Rabbit, which would be a Petya ransomware variant that spread this summer, reports anti-virus company ESET. The malware would have infected hundreds of systems.

Among the victims are the Kiev metro, the Odessa airport and the Ukrainian ministries, according to the virus fighter. Anti-virus company Kaspersky Lab announces that most victims are in Russia. For example, the Russian press agency Interfax has been hit by the ransomware. The press office reports that the news services are not available because of the attack. "Based on our research, it is a targeted attack on corporate networks through methods similar to the ExPetr attack," said Kaspersky researcher Alex Perekalin. ExPetr is one of the names given to the Petya variant of this summer.

According to Kaspersky Lab, Bad Rabbit ransomware is spread through a number of hacked Russian media websites. ESET researcher Lukas Stefanko , Proofpoint researcher Darien Huss and the known anti-virus veteran Vesselin Vladimirov Bontchev warn that ransomware is on websites as an update for Flash Player . As soon as a user downloads and opens this so-called update, the Bad Rabbit ransomware will be activated on the system. Bad Rabbit tries to spread on the network. To do this, a list of common passwords is used, and Bad Rabbit tries to steal login data through the Mimikatz tool.

Bad Rabbit encrypts files and, like Petya, overwrites the Master Boot Record (MBR) of the hard drive. Therefore, the system becomes unusable. The ransomware claims victims 240 euros for decrypting the files. Whether victims pay the ransom to recover their files is still unknown. Organizations are advised to block executing files c: \ windows \ infpub.dat and c: \ windows \ cscc.dat and, if possible, disable Windows WMI service so that ransomware can not spread further .

Initially, ESET researcher Stefanko reported that the EternalBlue operation was also used. This does not appear to be the case at all. The article has been modified.

The attackers knew to hack several media and news sites. Then there was a malicious code that offered the so-called Flash Player update. Most infections have been observed in Russia, followed by Ukraine, Bulgaria and Turkey. According to ESET, all major companies are affected at the same time. "It is possible that the attackers already had access to the network and launched the attack through the websites at the same time as distraction," said Marc-Etienne M.Léveillé of ESET. He notes that there are no indications that employees of affected organizations have been stepped into the so-called Flash Player update. Anti malware company Malwarebytes announces that the attackers behind Bad Rabbit are likely to be responsible for the Petya / NotPetya variant of last June.

In the meantime, several technical analyzes of Bad Rabbit have appeared online. :

- Bitdefender

- Cisco

- ESET

- Kaspersky Lab

- Malwarebytes

- McAfee

- Qualys

According to Costin Raiu of Kaspersky Lab, the attackers behind Bad Rabbit would have been working on setting up the network of hacked websites since July. The attackers had access to, inter alia, Russian, Turkish, German and Bulgarian websites.

Anti-Virus Neural Network Should Catch More Malware

A small adjustment to malware can cause the virus threat is no longer detected, but an Israeli company claims to have found the solution: artificial neural networks. The neural networks to analyze the properties of millions of malware instances and clean files, and so learned to recognize the characteristics of malware.

The approach should ensure that the virus scanner of the company is better able to detect modified versions of malware that is missed by traditional anti-virus software. Deep learning, such as the approach is called, consists of training of a large network that consists of simulated neurons and synapses to get as complex patterns from the data provided. The intention is that the network can recognize the end of itself completely new ones.

The Israeli Deep Instinct says to train their own neural network with a large number of files and settings. A time- and computing-intensive process, which runs on a cluster of GPUs. According to founder and CTO Eli David can own the solution 20% more malware detection than existing solutions. So it can tell whether a file appears sufficient to existing malware makes it suspicious, says MIT Technology Review.

A small adjustment or particular string in the code is therefore no longer enough to deceive the virus. According to Professor George Cybenko the British Dartmouth College is the idea of ​​neural networks to find malware is not new, but gives the appearance of deep learning possible for renewed interest. He argues that the promised results must first be tested. In addition, malware authors are very persistent. "If there is a breakthrough, they will do research and come with a new approach," he warns.

Dozens Of Fake Apps In Windows Phone Store Discovered

In the Windows Phone Store Microsoft researchers have discovered dozens of fake Apps posing as popular apps like Facebook Messenger, CNN, BBC and WhatsApp. Reported anti-virus company Avast. A total of 58 different apps from its two developers coming.

The purpose of the apps is to maximize revenue. The developers use two tactics, namely, ad-clicks and misleading advertisements. The apps include several ad kits, where both users and app itself is clicked. Misleading ads try to lure users to certain malicious Websites, for example, claim that the device is infected or has other problems. How many people have downloaded the apps is unknown. At the time of writing were still finding the apps in the Windows Phone Store.

Russian Manufacturer Delivers Android Tablet With Malware

Every now and then discover investigators Android devices come standard with malware. In most cases, these changes to the operating system that have been implemented by the parties. The Russian anti-virus company Doctor Web reported now to have discovered a Russian manufacturer that an Android tablet from the factory provides all of malware.

It is Oysters, which is primarily active in the Russian market. The T104 HVI 3G tablet from the company's researchers at Doctor Web a Trojan horse. The malware can send all kinds of information about the device to its creators, as well as install all kinds of additional applications. In addition, the malware can turn on the option to install applications from untrusted sources. The Russian manufacturer has been informed about the problem, but the firmware that offers it's own website still contains the malware.

Avira Tool For Lost iPhone Logins Sent Over HTTP

A free tool from antivirus company Avira for finding stolen or lost iPhones appeared to send unencrypted passwords over HTTP. This would allow an attacker who get the network traffic could eavesdrop usernames, passwords and other sensitive information.

It discovered security researcher David Coomber. According Coomber were the passwords that the Avira Mobile Security iOS app sent well protected by the weak MD5 algorithm, but would offer no protection against an attacker could sniff network traffic. Mobile Security is an app that allows users to trace five lost or stolen iPhones. Also, users can check via the tool or their e-mail was hacked, the address book or safe and iOS is up to date. Avira was informed on July 17 and published on September 3 version 1.5.11 in which the issue is resolved.

New Company John McAfee Will Offer SSL Certificates

Anti-virus pioneer John McAfee has started a new company which will offer SSL certificates. SSL certificates are used among other things to encrypt traffic between visitors and websites and helps in identifying websites.

Black Cert , as the company is called, allows users to use an SSL certificate for 30 days. It is in this case to a fully functional SSL certificate which is designed according to the SSL provider to test the installation and compatibility with browsers. The certificate would try if exercise can be used to learn about SSL, before deciding to install an SSL certificate on a production system.

The certificates of Black Cert are also to be used indefinitely. Users do not need to pay for each server on which the certificate is installed. The website of the SSL provider is now online. Soon the official launch site, reports Silicon Angle .

Kaspersky: Not Very Smart To Hack Us

It was not very wise of the nationally sponsored attackers to break into anti-virus firm Kaspersky Lab, so late founder Eugene Kaspersky know. Yesterday the company announced that through an advanced espionage virus access to internal systems was obtained.

According to the Russian virus fighter was no doubt to the public burglary. "It would be like failing to report a traffic accident to the police because your no-claim can harm you." In addition, there would be no shame to confess to the attack, given the way the attackers. "There are two types of businesses, who know they are attacked and who do not know they are attacked," said Kaspersky.

By disclosing the assault would deliver the anti-virus company a signal to the public and the validity and morality of such a country pulling sponsored attacks against commercial enterprises in doubt. Further, the information may help in the protection of other companies. "Even if our" reputation "harms I do not care. It is our mission to save the world without compromise," as late Kaspersky on his own blog know.

Source code

The investigation into the burglary is still ongoing, but the anti-virus company has checked the source code of the anti-malware products and claims that it is intact. The malware databases are not adjusted, the attackers had no access to customer data. In a column for Forbes , Kaspersky it is clearly a case of industrial espionage. "But the more I think about it, the less it makes sense." Thus, some of the technology through licensing agreements simply accessible and possesses anti-virus company no hidden "holy grail".

"Perhaps the attackers had the idea to steal our technology, source code, knowledge and ideas to help their own software," Kaspersky says. That might help in the short term, but in the long run little use. Modern software as virus fighter is always evolving. "You have to really run to keep up, otherwise the copied software is rapidly obsolete." In addition to steal source code or blueprints can help, but people need to be "stolen" that have developed it to understand every detail.

Attribution

Kaspersky says that a country is behind the attack, but would not name names. "We are security experts and we do not weaken our core competency by us to have a political process." Yet there is reported to investigating authorities in several countries to launch an investigation. Furthermore, Kaspersky takes the opportunity to ask countries that they are "rules, ethics and common sense" will respect in cyberspace. Yesterday, Kaspersky also held a conference on the hack. He finished with the words. "Hack me please do not, that's a bad idea."

DNS Changing Malware Worldwide Institutions Routers

Recently, a well-known security researcher showed that vulnerabilities in popular routers actively attacked by malware, but also weak and default passwords appear to be a way through which attackers take control of the devices. Anti-virus company Trend Micro warns of DNS changer malware. The malware executes from the internal network user brute force attacks on the administrator interface of the router.

Then, the DNS settings are adjusted. The Domain Name System (DNS) is similar to the directory and translates among other domain names into IP addresses. By adjusting the DNS of the router can fit criminals traffic from users via their server run.Most operating systems are configured to use the DNS settings of the router. Once a computer or other device connected to the router, the custom DNS settings will be used. This allows users of the assailants attacked router forwarding to as phishing sites or into downloading malware.

"Keep Custom DNS settings that users do not know if they navigate to reliable or fake websites," says Fernando Merces. He notes that users who have not changed the default password of the router particular risk. The attack begins via a phishing attack, which points to a page with a script. This script then runs from the internal network brute-force attack on the router.Because the browser is running the script, the traffic is sent to the router as an internal request.

The script use the assailants attempting to both the IP address and password of the router councils. The script supports different models and manufacturers, among others TP-Link and D-Link. The attacks seem focused on Brazil, where 88.3% of the attacked device was observed, followed by the US (2.9%) and Japan (1.3%). Users are advised to use secure passwords for all accounts on the router, change the default IP address and disable the remote management features. In addition, Firefox NoScript is recommended that the execution of scripts can block in the browser.

Dozens Minecraft Apps On Google Play Prove Scareware

On Google Play, researchers from the Slovak anti-virus company ESET found dozens of apps that occur as cheats for the popular computer game Minecraft, but in reality scareware. It involves a total of 33 applications that were placed on Google Play over a period of nine months and have been downloaded between 660,000 and 2,800,000 times.

The apps do not do what they promise and show after starting only banners claiming that the Android device with a "dangerous virus" infected. Then offered to remove the virus, for which there should be a "virus" via SMS enabled. However, it is an SMS user subscription costs 4.80 euro per week. ESET recommends that Android users to still only download apps from official app stores, to check what permissions the app asks and be read reviews from users.

Anti-virus Company Provides Alarm After 22 Million Toolbars

Antivirus company Avira has sounded the alarm after the last month 22 million toolbars, plug-ins that display ads, programs that hijack search results and other "potentially unwanted software" (PUA) detected on users' computers. In most cases, the toolbars and adware are bundled with other programs. The virus fighter calls the installation procedures of this type of program is misleading.

The virus scanner from Avira will also detect all software that injects malicious content or an excessive amount of requests personal information. "We believe in free Internet and therefore accept advertising as a means to sponsor content. Downloading software does not mean that you agree to install unwanted or unknown applications on your device," says the virus fighter.

Notorious programs

The five programs Avira most encountered are iLivid, an app that results to ilivid.com forward and all browsers try to infect your computer, SeaSuite, a tool bar that displays ads and injects websites Soft Pulse, a bundle that installs toolbars, NexLive, a browser plug-in that modifies browser settings and OptimizerPro, which monitors the browsing habits and pop-up displays advertisements.

The virus fighter has recently released new guidelines for software developers who need to reduce the amount of unwanted software. It is about rules and behavior where the software should adhere to. It does not, it can be labeled as unwanted software and removed. "Nevertheless, it is extremely important that users understand the risks and protect themselves," Avira says.

Anti-virus Company Will Pay Ransomware Okay

British anti-virus firm Sophos finds it okay if victims of ransomware pay to pay their encrypted data, although it is better not to do this. Thus the virus fighter is partially against the advice of police and some experts in that just advise to never pay .

By paying criminals would continue with their practices. In addition, there is no guarantee that victims receive a decryption key or to decrypt the work files. Recently 25 Dutch companies had paid the creators of ransomware and recovering their files. There are also cases of American police agencies known to have been infected and eventually paid .

Sophos also states that it is easy to say that victims should not pay, but it's a different story if it were your own data. The anti-virus company says that it's okay to pay, but if it can be avoided. In addition, Internet users would be wise to take precautions, such as making backups. In the case of an infection can therefore be reduced and ultimately the damage is unavoidable that there is to be paid.

Cyber ​​Spies Often Pose As IT Staff

Cyber ​​Spies trying to break in organizations often pose as IT staff of the attacked organization. Also, they often send phishing emails that are security and seem related example of an anti-virus company originates. That reports the American security company Mandiant in a new report. 78% of targeted phishing mails which saw passing by the company were IT or security-related.

Social engineering, in which users are tricked into opening an email attachment or open a certain website, combined with unpatched vulnerabilities are also the principal way in which attackers to gain access to organizations know. Most phishing emails that were analyzed were found to be shipped on Saturday.

The report also shows that 69% of organizations affected an intrusion on the network through a third party comes to know, while 31% of the victims discovered it yourself. Average attackers would have had last year 205 days access to networks attacked before they were noticed. A decrease of 24 days compared to 2013. At one organization knew the attackers to hide even 8 years.

For passwords, hashes and certificates of compromised systems and networks to steal attackers would increasingly use the Mimikatz program, warns Mandiant. Mimikatz is freely downloadable from the Internet and according to the developer a tool to "experiment" with Windows security too. Using the tool, passwords, hashes and Kerberos tickets are retrieved from the memory. In almost all cases that were analyzed and Mimikatz was deployed the existing anti-virus software turned out not to stop the tool.