Last week, WordPress security firm WordFence revealed it detected over 1.65 million brute-force attacks originating from an ISP in Ukraine that generated more malicious traffic than GoDaddy, OVH, and Rostelecom, put together. A week later, after news of WordFence’s findings came to light, Ukrainian users have tracked down the ISP to a company called SKS-Lugan in the city of Alchevs’k, in an area controlled by pro-Russian forces in eastern Ukraine. All clues point to the fact that the ISP’s owners are using the chaos created by the Ukrainian civil war to host cyber-crime operations on their servers. Some of the criminal activities the ISP hosts, besides servers for launching brute-force attacks, include command-and-control servers for the Locky ransomware, [email, comment, and forum] spam botnets, illegal streaming sites, DDoS stressers, carding sites, several banking trojans (Vawtrack, Tinba), and infostealers (Pony, Neurevt).
More details have surfaced regarding a recent wave of brute-force attacks (dictionary attacks to be more accurate) that have targeted WordPress sites over the past few weeks.
Update: We posted a follow-up to this post on Monday December 19th which goes into more detail about the Ukraine IP block where these attacks originate from and we discuss possible Russia involvement. At Wordfence we constantly monitor the WordPress attack landscape in real-time.
“Avalanche” refers to a large global network hosting infrastructure used by cyber criminals to conduct phishing and malware distribution campaigns and money mule schemes. The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation (FBI), is releasing this Technical Alert to provide further information about Avalanche.
Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal information stolen (e.g., user account credentials). Victims’ compromised systems may also have been used to conduct other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware variants to other victims’ computers.
In addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to commit fraud involving transporting and laundering stolen money or merchandise.
A system infected with Avalanche-associated malware may be subject to malicious activity including the theft of user credentials and other sensitive data, such as banking and credit card information. Some of the malware had the capability to encrypt user files and demand a ransom be paid by the victim to regain access to those files. In addition, the malware may have allowed criminals unauthorized remote access to the infected computer. Infected systems could have been used to conduct distributed denial-of-service (DDoS) attacks.
- December 1, 2016: Initial release
Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal information stolen (e.g., user account credentials).
Source: Yahoo! Finance
AT&T says it has developed a new technology it calls AirGig, which links up to standard power lines and uses a special transmitter to deliver super-fast gigabit internet wirelessly.
The project is only in its early test phases for now, and AT&T hasn’t announced where and when it’ll deploy it publicly. But based on the company’s blog post announcing AirGig, it sounds like AT&T will likely target rural areas at first.
Gigabit internet is several times faster than the standard broadband most people get in their home. The AirGig project attaches antennas to existing power lines and uses a millimeter wave frequency to broadcast gigabit internet to devices.
AT&T wouldn’t describe exactly how the technology works, but would only say it’s not tapping into the power of the power line.
AT&T says AirGig is several times cheaper than standard wireless internet because it’s cheaper for the company to deploy and deliver. It can also be used over open wireless spectrum.
AT&T isn’t the only company exploring wireless gigabit internet. Google, Facebook, and the startup Starry are all experimenting with ways to bathe the world in super-fast wireless internet access.
AT&T* unveiled today Project AirGig, a transformative technology from AT&T Labs that could one day deliver low-cost, multi-gigabit wireless internet speeds using power lines. We’re deep in the experimentation phase. This technology will be easier to deploy than fiber, can run over license-free spectrum and can deliver ultra-fast wireless connectivity to any home or handheld wireless device.
First, a little background. If you want to take a network off the Internet, the easiest way to do it is with a distributed denial-of-service attack (DDoS). Like the name says, this is an attack designed to prevent legitimate users from getting to the site. There are subtleties, but basically it means blasting so much data at the site that it’s overwhelmed. These attacks are not new: hackers do this to sites they don’t like, and criminals have done it as a method of extortion. There is an entire industry, with an arsenal of technologies, devoted to DDoS defense. But largely it’s a matter of bandwidth. If the attacker has a bigger fire hose of data than the defender has, the attacker wins.
Recently, some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks against them. Moreover, they have seen a certain profile of attacks. These attacks are significantly larger than the ones they’re used to seeing. They last longer. They’re more sophisticated. And they look like probing. One week, the attack would start at a particular level of attack and slowly ramp up before stopping. The next week, it would start at that higher point and continue. And so on, along those lines, as if the attacker were looking for the exact point of failure.
The attacks are also configured in such a way as to see what the company’s total defenses are. There are many different ways to launch a DDoS attacks. The more attack vectors you employ simultaneously, the more different defenses the defender has to counter with. These companies are seeing more attacks using three or four different vectors. This means that the companies have to use everything they’ve got to defend themselves. They can’t hold anything back. They’re forced to demonstrate their defense capabilities for the attacker.
Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down.
The company keeps defending data-gathering features that some people don’t want instead of just making them optional.
Microsoft has been called to task for the practice by privacy advocate the Electronic Frontier Foundation. A blog post by EFF staffer Amul Kalia criticizes the company not just for collecting information for Cortana, but also for collecting telemetry data. Kalia writes: “A significant issue is the telemetry data the company receives. While Microsoft insists that it aggregates and anonymizes this data, it hasn’t explained just how it does so. Microsoft also won’t say how long this data is retained, instead providing only general timeframes. Worse yet, unless you’re an enterprise user, no matter what, you have to share at least some of this telemetry data with Microsoft and there’s no way to opt-out of it.”
Microsoft keeps making news on the privacy front, and not in a good way. Much has been made of the way Cortana in Windows 10 may invade your privacy by collecting data such as the words you speak and the keys you strike.
The lesson here is simple enough. If a device has an exposed USB port — such as a copy machine or even an airline entertainment system — it can be used and abused, not just by a hacker or malicious actor, but also electrical attacks.
“Any public facing USB port should be considered an attack vector,” says the company. “In data security, these ports are often locked down to prevent exfiltration of data, or infiltration of malware, but are very often unprotected against electrical attack.”
For just a few bucks, you can pick up a USB stick that destroys almost anything that it’s plugged into. Laptops, PCs, televisions, photo booths — you name it. Once a proof-of-concept, the pocket-sized USB stick now fits in any security tester’s repertoire of tools and hacks, says the Hong Kong-based company that developed it.
THIS WEEK, GOOGLE security researcher Tavis Ormandy announced that he’d found numerous critical vulnerabilities in Symantec’s entire suite of anti-virus products. That’s 17 Symantec enterprise products in all, and eight Norton consumer and small-business products. The worst thing about Symantec’s woes? They’re just the latest in a long string of serious vulnerabilities uncovered in security software.
Some of these products cannot be automatically updated, and administrators must take immediate action to protect their networks. Symantec has published advisories for customers, available here.
Some of Symantec’s flaws are basic, and should have been caught by the company during code development and review. But others are far more serious, and would allow an attacker to gain remote-code execution on a machine, a hacker’s dream. One particularly devastating flaw could be exploited with a worm. Just by “emailing a file to a victim or sending them a link to an exploit … the victim does not need to open the file or interact with it in anyway,” Ormandy wrote in a blog post Tuesday, further noting that such an attack could “easily compromise an entire enterprise fleet.”
It gets worse. The flaw exists in an unpacker Symantec uses to examine compressed executable files it thinks might be malicious. So the vulnerability would let attackers subvert the unpacker to take control of a victim’s machine. Essentially, a core component Symantec uses to detect malware could be used by intruders to aid their assault.
“These vulnerabilities are as bad as it gets,” Ormandy wrote. He would know.
Read the rest at WIRED
via Transparency News
Public-sector problems with ransomware have been at a low simmer for a while, with 35 state and local governments reporting problems in 2014, according to the Multi-State Information Sharing and Analysis Center, an organization that tracks cybersecurity issues for states and localities. But in 2015, the FBI warned that the problem is on the rise — growing 114 percent in 2014 — and said that unlocking the files is so difficult that the agency often suggests just paying the ransom.
In June 2014, an officer with the Durham, N.H., Police Department opened what she thought was a digital fax attached to an email about an investigation she was working on. Instead, it was a type of malicious software that infected files throughout the entire police department’s network of computers. By the next morning, the entire system was in serious trouble.
The tactics of each type of ransomware vary, but all follow the same theme: make the victim believe there’s no option but to pay. The most common way it happens is through an email attachment that looks like an invoice, bill or delivery. Sometimes it’s just a matter of clicking on what appears to be a legitimate advertisement on a website. Once the software launches, it quickly encrypts computer files, making them inaccessible. Victims then receive a message on their computer screen, telling them their files have been encrypted and that they must buy an electronic PIN number to enter into a box on the screen. The amount varies but is usually between $300 and $700. Rather than try to extort large sums of money from only a few victims, hackers have found more success expanding the number of people and organizations they target and asking them to pay modest ransoms.
There’s also a psychological aspect to ransomware that increases its success rate. “When people see the ransomware notice on their work PC, they panic,” said Rahul Kashyap, chief security architect at Bromium Labs, a security firm. “They think it’s their fault for triggering the attack, so they pay.”