Vital Infrastructure USA Attacked Via Flash Leak

Vital infrastructure in the United States has become the target of an attack in which attempts were made to infect computers via a zero-day vulnerability in Adobe Flash Player with malware. It reports the Industrial Control Systems Cyber ​​Emergency Response Team (ICS-CERT) of the US government.

It was a spear phishing campaign that focused on different sectors, including chemicals, major manufacturing, energy and government facilities. The attackers sent out customized e-mails with links to different websites. On these sites was inserted malicious code that made ​​abuse of a zero-day vulnerability in Adobe Flash Player, so the ICS-CERT says. The vulnerability was patched by Adobe on June 23 and was already attacked at that time, according to Adobe.

The same group of attackers behind this attack used beginning in 2014, social engineering and social media to carry out explorations and business personnel to attack. In one case, the attackers used a social media account and pretended to be a possible candidate for this job. They approached the employees of a critical infrastructure environment and asked about the name of the IT manager and what software versions were used.

The attackers asked for feedback on a job application and sent it file "resume.rar" via e-mail. The rar file contained three files, including a malicious version of the open source TTCalc application, which the computer company employee with a backdoor infected. The attack was quickly discovered and the attackers would have had no access to control systems. "Although the motivation of the attackers remains unknown, allows the use of social media and zero-day exploits that they undertake serious efforts to gain access to the networks of critical infrastructure", according to the ICS-CERT (pdf).

Bitcoin Exchange Bitstamp Hacked Via Word Document

Early this year knew attackers to hack the Bitcoin Exchange Bitstamp, involving some 19,000 bitcoins were stolen. Translated at the current exchange rate it was 4.3 million. A confidential document investigation into the cause of the hack is leaked and includes details about the attack.

The attacker appeared in November and December to have a targeted phishing attack against employees of the company performed. Thus, the CTO of Bitstamp was approached by Skype, which he was offered free tickets to a punk rock festival.The CTO is an avid fan of punk rock and has played in a band, something that had overtaken the attacker. The tickets were in the form of a doc document sent via Skype.

In reality, the document was found to contain a malicious VBA script that had to install malware on the system. Although the CTO opened the document, the script does not seem to have worked. The other employees had more success the attacker.He sent a resume and a questionnaire and he presented himself as a journalist. On December 9, the attacker sent a phishing email to the Gmail account of the system. This system had access to the "hot wallet" of Bitstamp, where bitcoins stored.

In the e-mail suggested the attacker that the Upsilon Pi Epsilon system administrator (UPE) society was invited. The system opened the document then successfully carried out the VBA script and malware placed on the computer. A few days later, the assailant took Skype contact to continue the talks. Eventually, the attacker logged on via the laptop's system on the servers of Bitstamp in order to access the file wallet.dat. The digital file containing the thousands of bitcoins.

In total, found that six employees were targets of phishing attacks, which were sent malicious attachments in four cases. The researchers show in the report, which appeared in February, that the investigation is still ongoing, but they may have identified one of the attackers. The plan then was to lure the attacker to Britain to arrest him, reports Business Insider . As far as is known, however, there is no one still maintained in connection with the hack of Bitstamp.

Google Finds Critical Vulnerability In Virus ESET

A researcher from Google alone in a few days a critical vulnerability in the virus scanners and security of the Slovak anti-virus company ESET discovered which allows remote attackers computers and systems can completely take over, without any user interaction is required. The vulnerability would therefore be ideal for a worm which business networks that use ESET software can be completely infected.

ESET software uses a mini-filter to intercept all input and output (I / O) to the hard disk, analyze and then emulate in case it comes to executable code. Through emulation, a file can be carried out partially before the virus signatures are used to determine whether the file is malicious or not.

Through the browser, email client, instant messaging, file sharing, network, USB and many other ways an attacker disk I / O and so cause execute the attack. The problem is in fact caused by the emulation performing ESET. The emulator does not appear to be robust and easy to compromise, says researcher Tavis Ormandy of Google. They may run malicious code with root privileges.

The problem is at all ESET products, including virus scanners for Linux, Mac OS X and Windows. As proof Ormandy developed a working exploit which systems to attack from a distance. Last Friday warned Google ESET, where the results were discussed in person with the company. Three days later, on Monday, the Slovak virus fighter came with an update to resolve the issue.

Risk

According to Ormandy, however whether users are the risks and benefits of security weigh. In the past, even though Ormandy revealed major problems in the anti-virus software from Sophos , and this week it was announced that the NSA and GCHQ to vulnerabilities have sought in anti-virus programs. Attacking users through their virus is therefore not a theoretical risk, according to Ormandy.

PowerPoint Leak Used To Spread Malware

Vulnerability in PowerPoint, which was patched by Microsoft last year is now being actively used to infect activists in Tibet and Hong Kong with malware. The attacks are part of a larger campaign that is taking place for years. Remarkably, however, the use of PowerPoint leak.

Previously used the attackers vulnerabilities in Microsoft Office respectively in 2010 and 2012. The use of the PowerPoint leak would for the first time in two years the trend. For the dissemination of the PowerPoint files as well as e-mail attachments using links to Google Drive. To warn activists against the risk of email attachments campaign "was Detach from Attachments "starts. It is just recommended to use cloud storage for sharing files, such as Google Drive.

The fact that the attackers now use Google Drive, according to the investigators as possibly an indication that the attackers adapt accordingly. When users open the PowerPoint updates from Microsoft are not installed and the presentation they can with a remote access Trojan (RAT) become infected. The malware would be recognized by a few virus scanners.

In total, the researchers saw the Canadian CitizenLab five campaigns where the PowerPoint leak was deployed. To let users do not suspect they get to see a real presentation, while the malware is installed in the background. "The recycled content, low detection scanners and that users do not know that these files are malicious, ensure that these attacks are worrying," the researchers said.

Criminals Steal $ 1.5 Million Over Hacked E-mail Account

Criminals have managed to steal last month $ 1.5 million from the Swedish publisher Bonnier Publications and media group, after they had hacked the email account of then-CEO, as the new CEO in front of the New York Post announced.

It is the well-known e-mail scam that allows companies worldwide last year for 226 million dollars were scammed.Scammers send out whether accounts hacked e-mails to the finance department with payment instructions from the CEO or CFO seem to originate. In the case of Bonnier Publications e-mail account of the CEO was hacked, but exactly how this occurred was not disclosed. Then the criminals sent payment instructions to an employee of the publishing house to make about $ 3 million.

The payment was made through two transactions of $ 1.5 million. The second tans action could be stopped before the money had ended up in a Chinese bank. The employee decided to call the CEO to confirm the transaction. The first transaction however, could not be reversed and according to the publisher the Chinese banking authorities are not very helpful in identifying the account holder.

Leak in iOS Mail App Allows Remote Attacker HTML Charge

A researcher has revealed a leak in the iOS Mail app which allows an attacker to load external HTML e-mail messages, which it is then possible to perform very convincing phishing attacks. The vulnerability was in January this year by researcher Jan Soucek discovered.

The iOS mail client shows a particular HTML tag in email messages can not be ignored. As a result, HTML content can be loaded which replaces the contents of the original e-mail message. Sourcek reported the problem to Apple in January, but because there is still no solution has appeared Soucek decided now a proof-of-concept to publish his attack. Thus, it is possible to display a pop-up to the user through the e-mail that looks like a legitimate logon window. In reality it is a malicious pop-up completed the password sends to the attacker, according to a demonstration video below.

Criticism Of Assange And Appelbaum Because Sony-Mails

Both WikiLeaks founder Julian Assange as Tor developer Jacob Appelbaum said to be in favor of privacy and internet freedom, but this does not seem to hold true for the employees of Sony. WikiLeaks recently published an archive of e-mails and documents that were stolen by Sony.

Appelbaum, who in addition to his role as a developer of the Tor software also volunteered with WikiLeaks is involved , was recently interviewed by Fusion . There he lets first know that any form of surveillance is illegal. "Everyone has the right to privacy and should know that his emails are not read, even if the horrible people like the police in Ferguson."

For large enterprises has Appelbaum less understanding. He thinks it is right that WikiLeaks published the stolen Sony emails. As Appelbaum puts the Sony summit as "racist bastards" who have been "negligent". The statements of the Tor developer as the actions of Julian Assange to put the stolen Sony-mails online can count on criticism of the media. Both columnists Business Insider as The Guardian denounced the double standard that seem to handle the two privacy activists

WikiLeaks Publishes, Thousands Of Stolen Sony-Mails

Whistleblower site Wikileaks has once again thousands of e-mails late last year at Sony Pictures Entertainment were stolen published. The e-mails have been added to an online archive that WikiLeaks last month put online and that all 30,000 documents and more than 173,000 e-mails to and from more than 2,200 Sony email addresses contained. That made ​​the whistleblower site known via Twitter .

According to WikiLeaks, the stolen e-mails and documents newsworthy and the online archive offers a special glimpse into the workings of a large "mystery" multinational ties with both the White House and the US military-industrial complex would have. After the online publication of the " Sony Archive "Sony responded furiously condemning WikiLeaks.

Companies Attacked Through CVs On Job Sites

Several companies who were looking for staff on the job site CareerBuilder became the target of a sophisticated attack. Through CareerBuilder job seekers can respond to available vacancies by uploading a resume. Companies gain when the resume is uploaded an e-mail that they can download it.

Proofpoint security firm says it has detected an attack where cyber criminals upload malicious CVs. These are files named "RESUME.DOC" and "cv.doc". The documents are abuse of two vulnerabilities in Microsoft Office that were patched by Microsoft in 2012 and 2014. In case the documents are opened malware can be installed on unpatched computers. The malware thereby poses as an image to blend in.

It is a backdoor that contains the TeamViewer application. This, according to Proofpoint legitimate cloud service that allows computers to be controlled remotely. Not only TeamViewer used by some companies and would therefore not stand, also helps the application in circumventing NAT limitations. Both the server and client make beginning with a connection to an endpoint in the cloud before they connect to each other.

While the attack requires more time and effort of the attackers, the chance that the file is opened greater than in any documents sent, according to Proofpoint . The attackers namely make use of the services of an existing website. It is also legitimate emails that remind recipients of the uploaded documents. Documents expect the receivers and just want to open.The observed attacks were directed against energy companies, television companies, credit unions and electricity suppliers.Whether they are successful and who is behind it is unknown.

New Ransomware Avoids US Computers

Researchers have discovered a new ransomware variant that strikes because the US does not infect computers intentional. Crypt0L0cker such as ransomware called, according to researchers from Bleeping Computer a version of the famous Torrent Locker ransomware.

Crypt0L0cker appears to use the same communication methods as Torrent Locker and encrypts all kinds of files, which then users hundreds of dollars can be decrypt. If victims do not ransom doubling pay on time.

Why Crypt0L0cker US avoids computers is unknown. In the past happened that Russian cyber criminals infecting computers no Russian, so as not to attract the attention of the Russian authorities. The new ransomware is now in Europe, Asia and Australia surfaced and spreads via emails posing as traffic violations or government posts.