Ransomware Spreads Via Windows Remote Desktop

Researchers have discovered a new ransomware variant that spread via Windows Remote Desktop and Terminal Services distributes. Victims were mainly located in Bulgaria and Greece, according to a thread on the forum of Bleeping Computer.

Via Remote Desktop, it is possible to log on to remote Windows computers. It is believed that the attackers have overtaken the password through a brute force attack and thus gained access to the machines. In many cases, it appears to go servers. Then, the ransomware is installed which encrypts all kinds of files and a total of four bitcoin for decrypting asks.With the current exchange rate is that an amount of approximately 960 euros.

Because the network servers can attack major consequences for companies. According to researcher Nathan Scott the ransomware does not remove the Volume Shadow Copies. The original files are not removed in a safe manner. This allows victims through a tool like ShadowExplorer trying to get their files back in case they do not have a backup. Several victims say however that having paid the ransom and then got the decryption key to decrypt their files, which also succeeded.

Increase In Brute Force Attacks Against WordPress Sites

WordPress sites get more and more to do with brute force attacks, in which it tries to log in using common passwords on the website. According to figures from security firm Sucuri that brute force attacks keep on WordPress websites.

According to Daniel Cid Sucuri his brute force attacks is still one of the main reasons why websites are hacked. "If you have you have to do with brute force attempts to make an unsecure login page", he tells. Administrators of a WordPress website can according to Cid take various measures against these types of attacks, such as setting captchas, only allowing certain IP addresses (IP whitelisting) and two-factor authentication.

Other WordPress administrators say that the attacks can be prevented simply by changing the URL of the login page and block in the .htaccess / IIS configuration. According to figures from W3Techs is WordPress by 24.4% of all websites on the Internet use. Regular security reports about large numbers of WordPress sites that have been hacked and used to spread malware.

Bug In OpenSSH Makes Brute-Force Attacks Possible

A bug in the popular OpenSSH allows attackers to try thousands of passwords, while the software actually after six failed logins should disconnect. The vulnerability was by a security researcher with the alias " Kingcope announced. "

OpenSSH, also known as OpenBSD Secure Shell, is a set of network tools based on the SSH protocol, and allows users to securely log on to servers for instance, or remotely manage machines. Servers that allow login via SSH are regularly targeted by brute force attacks. In the case of OpenSSH, this is limited by after six unsuccessful attempts to disconnect. By using the vulnerability, it is possible to try to open thousands of passwords via a log-in window, that by default a two minute open state.

The problem is in the latest version of OpenSSH present, the researcher says. Which warns it especially FreeBSD systems at risk, because that keyboard-interactive authentication is enabled by default. On Reddit let a reader know that the "Challenge Response Authentication no" protects against the attack and was involved in its installation standard.

Expert: Strong Password, Better Than Two-Factor Authentication

Regular security experts advise to set two-factor authentication in online accounts, which should be introduced additional code next to the password, but according to one expert, it is better to use only a strong password in combination with a password manager.

An example of two-factor authentication is a code sent by SMS and logging in, beside the password must be entered. If the user's password is stolen, the attacker can not join login here unless he has the phone user in his possession. Yet it according to security expert and researcher Egor Homakov not a panacea and its users better off with just a strong password.

Entering a second code when logging according Homakov namely waste of time. In addition, most codes are limited to six numbers, so that the second factor is too Brute Force. The measure does not stop malware and viruses, such as Bruce Schneier several years ago already announced. Furthermore, the expert that no plausible attack scenario is where a simple password, two-factor authentication is better than a strong password. An attacker who for example has the user's computer infected with malware can wait a few days until the user enters his second code somewhere.

In case an attacker to access a user's mailbox has, he can then reset the password. According Homakov it is therefore wiser to use a password manager that generates strong passwords, two-factor authentication. In addition, users should not have to ask or websites they are going to support two-factor authentication, but that option is added which allows the "forgot my password" option off.

Qualcomm Develops Smartphone Kill Switch At The Chip Level

Chip manufacturer Qualcomm has developed a kill switch for smartphones that can lock the device at the chip level and will be applied by the software of the Czech anti-virus company AVG. The measure to protect consumers and their data in the event of a lost or stolen smartphone.

Safe Switch, as the technology is called, the device locks on the chip level. In addition, it protects users by encrypting data on the device. Any attempt to replace the SIM card, perform a factory reset or PIN to brute force makes the device temporarily unusable. After locking only the owner via a "master" PIN to unlock the device.

The technology will now be used in the applications of AVG and works on a select number of smartphones with Snapdragon chipsets. This week both companies demonstrated their solution. The cooperation should ensure that later this year an "end-to-end" business solution can be offered, says AVG .

IP Box Can Lock Screen iPhones Brute forcing

Researchers have discovered a device that makes it possible to brute forcing the lock screen of iPhones and iPads. IP Box, as the device is called, would be used by telephone repairmen to bypass the screen lock of iOS. "This obviously has major implications for the safety and of course was something that we wanted to investigate and validate" said researchers MDSec .

They did eventually get to 200 pounds one of the devices. The IP Box appears to simulate via the USB connection to enter the PIN and also tries all possible pin combinations. According to the researchers, this has been known, but the device also works if the option is enabled to delete the data after 10 attempts.

"Our initial analysis indicates that the IP Box to circumvent the restrictions by making direct with the power of the iPhone connection and aggressively to break the flow after each unsuccessful PIN, but before the attempt is synchronized in the Flash memory." Entering a PIN would therefore take about 40 seconds. A four-digit PIN can therefore be outdated in some 111 hours.

The attack has been tested on iOS 8.1. An attack on iOS 8.2 will follow. The research would show that it is possible to have a leak was discovered last year, but this has yet to be confirmed. The researchers made ​​the following video on YouTube in which the device and the attack will be demonstrated.