Hackers sponsored by Russia and North Korea are targeting COVID-19 researchers

Enlarge (credit: Getty Images)

Hackers sponsored by the Russian and North Korean governments have been targeting companies directly involved in researching vaccines and treatments for COVID-19, and in some cases, the attacks have succeeded, Microsoft said on Friday.

In all, there are seven prominent companies that have been targeted, Microsoft Corporate VP for Customer Security & Trust Tom Burt said. They include vaccine makers with COVID-19 vaccines in various clinical trial stages, a clinical research organization involved in trials, and a developer of a COVID-19 test. Also targeted were organizations with contracts with or investments from governmental agencies around the world for COVID-19-related work. The targets are located in the US, Canada, France, India, and South Korea.

“Microsoft is calling on the world’s leaders to affirm that international law protects health care facilities and to take action to enforce the law,” Burt wrote in a blog post. “We believe the law should be enforced not just when attacks originate from government agencies but also when they originate from criminal groups that governments enable to operate—or even facilitate—within their borders. This is criminal activity that cannot be tolerated.”

Read 6 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/2H38aHy

Read More

Dr. Strangenet—or, how I stopped worrying and embraced the WFH IT apocalypse

Enlarge / We all work from home now. We are the cloud. (credit: Aurich Lawson / Getty Images)

We are now a solid two quarters into our new work-from-home bizarro world. Many companies found themselves in a bit of a pickle as workforces went from occasional or limited to everyone all-the-time, throwing up whatever they could provision to allow for remote access and continued productivity (or at least some semblance of it).

We're well past the emergency stage, folks. For many of us, this will be ongoing and potentially permanent. And the way we do business will have to change—including how we structure our IT operations.

Who is your daddy, and what does his computer do?

This became extremely clear to me after a conversation with a friend, a line-of-business lead who has been working from home for the past few months. His company was semi-ready for remote work, having moved many employees over to Windows Terminal for desktops a while back. But he personally hadn't transitioned, because much of his work involved a database running on his corporate desktop—on Microsoft Access.

Read 21 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/2HZRpxp

Read More

Solve coding challenges at Runcode.ninja online competition, Nov. 6-9

Enlarge / Shozoku and ninjato are encouraged, but not strictly required, in order to compete. (credit: RunCode)

Annual programming competition Runcode.ninja is back again in its fourth year, beginning Friday, November 6. RunCode is a nonprofit organization staffed by volunteers working in their spare time and focused on providing educational opportunities for coders and infosec folks. The online event allows programmers of all experience levels to tackle a wide array of challenges, using any of 14 supported programming languages.

This year, the competition theme is "all things web"—which means that most challenges will have something to do with websites; although the "something" can vary pretty drastically, from user interaction to server log analysis. The event will have more than 30 available challenges, grouped into easy, intermediate, and hard, for competitors to find and upload solutions for.

For each challenge, competitors will be given a problem description, a sample data set, and an expected output to make the desired order and formatting clear. Competitors are expected to generate more test data of their own and thoroughly verify the correctness of their code against all the corner cases they can think of; solutions tested against only the sample data provided will likely fail the challenge. Uploaded code is run in a sandboxed Docker container and its output tested for correctness.

Read 1 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/2TAMFQP

Read More

Advisories: “Brazen” Russian ransomware hackers target hundreds of US hospitals

Enlarge (credit: Getty Images)

Russian hackers are targeting hundreds of US hospitals and healthcare providers just as the Corona Virus is making a comeback and the US presidential election is in its final stretch, officials from three government agencies and the private sector are warning.

The hackers typically use the TrickBot network of infected computers to penetrate the organizations and after further burrowing into their networks deploy Ryuk, a particularly aggressive piece of ransomware, a joint advisory published by the FBI, Health and Human Services, and the Cybersecurity & Infrastructure Security agency said.

“CISA, FBI, and HHS have credible information of an increased and imminent cybercrime threat to US hospitals and healthcare providers,” Wednesday evening’s advisory stated. “CISA, FBI, and HHS are sharing this information to provide warning to healthcare providers to ensure that they take timely and reasonable precautions to protect their networks from these threats.”

Read 9 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/34AZnp1

Read More

Trickbot—the for-hire botnet Microsoft attacked—is scrambling to stay alive

Enlarge (credit: Aurich Lawson / Ars Technica)

Operators of Trickbot—a for-hire botnet that has infected more than 1 million devices since 2016—are looking for new ways to stay afloat after Microsoft and a host of industry partners took coordinated action to disrupt it last week.

In an update published on Tuesday, Microsoft Corporate VP for Security & Trust Tom Burt said the operation initially managed to take down 62 of the 69 servers Trickbot was known to be using to control its vast network of infected devices. Trickbot operators responded by quickly spinning up 59 new servers, and Microsoft was able to eliminate all of them except for one.

In all, the industrywide operation has taken down 120 of 128 servers identified as belonging to Trickbot. Now, Trickbot is responding by using a competing criminal group to distribute the Trickbot malware.

Read 10 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/3dNE2vQ

Read More

The Internet is full of business cats: Dealing with the breakdown of the work/home divide

Enlarge / Artist's impression of how little your cat cares about your video call. (credit: Aurich Lawson / Getty Images)

The Friday "beer-thirty" Zoom conferences began for me not too long into the lockdown. A co-worker scheduled them as a form of stress release and socialization as we all prepared for what we already knew was going to be at least a year of not seeing each other in person—and for someone who had just started with the company a few weeks prior, I needed it.

Working from home has always been isolating, but it has become even more so in 2020. And for those of us who've worked from home full-time in the past—well, at least for those of us who have done that and have loud families and kids with no concept of personal space—it has also become a lot harder to maintain a division between home life and work life. Our spouses and kids (and in some cases, adult kids) are all home at the same time, working or studying or playing or just breathing too loudly in the same space as us.

Meow mix

For those of you who've never enjoyed the solitude of a home office when everyone else is out of the house, trust me: what we have right now is not what working at home has been like for the past 25 years for me. To adjust to this, organizations must figure out how to keep teams cohesive in the absence of regular social contact. They also must find a balance between being communicative and being intrusive into the home life of employees, all while still keeping some kind of coherent work environment going so people can talk to each other and get work done.

Read 15 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/31mEKef

Read More

Fancy Bear imposters are on a hacking extortion spree

Enlarge

Ransomware attacks that tear through corporate networks can bring massive organizations to their knees. But even as these hacks reach new popularity highs—and new ethical lows—among attackers, it's not the only technique criminals are using to shake down corporate victims. A new wave of attacks relies instead on digital extortion—with a side of impersonation.

On Wednesday, the Web security firm Radware published extortion notes that had been sent to a variety of companies around the world. In each of them, the senders purport to be from the North Korean government hackers Lazarus Group, or APT38, and Russian state-backed hackers Fancy Bear, or APT28. The communications threaten that if the target doesn’t send a set number of bitcoin—typically equivalent to tens or even hundreds of thousands of dollars—the group will launch powerful distributed denial of service attacks against the victim, walloping the organization with a fire hose of junk traffic strategically directed to knock it offline.

Read 12 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/2T16AIm

Read More

Thousands of infected IoT devices used in for-profit anonymity service

Enlarge (credit: Aurich Lawson / Ars Technica)

Some 9,000 devices—mostly running Android, but also the Linux and Darwin operating Systems—have been corralled into the Interplanetary Storm, the name given to a botnet whose chief purpose is creating a for-profit proxy service, likely for anonymous Internet use.

The finding is based on several pieces of evidence collected by researchers from security provider Bitdefender. The core piece of evidence is a series of six specialized nodes that are part of the management infrastructure. They include a:

• proxy backend that pings other nodes to prove its availability
• proxy checker that connects to a bot proxy
• manager that issues scanning and brute-forcing commands
• backend interface responsible for hosting a Web API
• node that uses cryptography keys to authenticate other devices and sign authorized messages
• development node used for development purposes

Keeping it on the down-low

Together, these nodes “are responsible for checking for node availability, connecting to proxy nodes, hosting the web API service, signing authorized messages, and even testing the malware in its development phase,” Bitdefender researchers wrote in a report published on Thursday. “Along with other development choices, this leads us to believe that the botnet is used as a proxy network, potentially offered as an anonymization service.”

Read 9 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/3lQqfY2

Read More

Apple’s T2 security chip has an unfixable flaw

Enlarge / The 2014 Mac mini is pictured here alongside the 2012 Mac mini. They looked the same, but the insides were different in some key—and disappointing—ways. (credit: Andrew Cunningham)

A recently released tool is letting anyone exploit an unusual Mac vulnerability to bypass Apple's trusted T2 security chip and gain deep system access. The flaw is one researchers have also been using for more than a year to jailbreak older models of iPhones. But the fact that the T2 chip is vulnerable in the same way creates a new host of potential threats. Worst of all, while Apple may be able to slow down potential hackers, the flaw is ultimately unfixable in every Mac that has a T2 inside.

In general, the jailbreak community hasn't paid as much attention to macOS and OS X as it has iOS, because they don't have the same restrictions and walled gardens that are built into Apple's mobile ecosystem. But the T2 chip, launched in 2017, created some limitations and mysteries. Apple added the chip as a trusted mechanism for securing high-value features like encrypted data storage, Touch ID, and Activation Lock, which works with Apple's "Find My" services. But the T2 also contains a vulnerability, known as Checkm8, that jailbreakers have already been exploiting in Apple's A5 through A11 (2011 to 2017) mobile chipsets. Now Checkra1n, the same group that developed the tool for iOS, has released support for T2 bypass.

On Macs, the jailbreak allows researchers to probe the T2 chip and explore its security features. It can even be used to run Linux on the T2 or play Doom on a MacBook Pro's Touch Bar. The jailbreak could also be weaponized by malicious hackers, though, to disable macOS security features like System Integrity Protection and Secure Boot and install malware. Combined with another T2 vulnerability that was publicly disclosed in July by the Chinese security research and jailbreaking group Pangu Team, the jailbreak could also potentially be used to obtain FileVault encryption keys and to decrypt user data. The vulnerability is unpatchable, because the flaw is in low-level, unchangeable code for hardware.

Read 13 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/34G1ZAU

Read More

Android ransomware has picked up some ominous new tricks

Enlarge (credit: Milana Romazanova | Getty Images)

Though ransomware has been around for years, it poses an ever-increasing threat to hospitals, municipal governments, and basically any institution that can't tolerate downtime. But along with the various types of PC malware that are typically used in these attacks, there's another burgeoning platform for ransomware as well: Android phones. And new research from Microsoft shows that criminal hackers are investing time and resources in refining their mobile ransomware tools—a sign that their attacks are generating payouts.

Released on Thursday, the findings, which were detected using Microsoft Defender on mobile, look at a variant of a known Android ransomware family that has added some clever tricks. That includes a new ransom note delivery mechanism, improved techniques to avoid detection, and even a machine learning component that could be used to fine-tune the attack for different victims' devices. While mobile ransomware has been around since at least 2014 and still isn't a ubiquitous threat, it could be poised to take a bigger leap.

Read 8 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/373QTZx

Read More

FBI/DHS: Government election systems face threat from active Zerologon exploits

Enlarge (credit: Getty Images)

The FBI and the cybersecurity arm of the Department of Homeland Security said they have detected hackers exploiting a critical Windows vulnerability against state and local governments and that in some cases the attacks are being used to breach networks used to support elections.

Members of unspecific APTs—the abbreviation for advanced persistent threats—are exploiting the Windows vulnerability dubbed Zerologon. It gives attackers who already have a toehold on a vulnerable network access to the all-powerful domain controllers that administrators use to allocate new accounts and manage existing ones.

To gain initial access, the attackers are exploiting separate vulnerabilities in firewalls, VPNs, and other products from companies including Juniper, Pulse Secure, Citrix NetScaler, and Palo Alto Networks. All of the vulnerabilities—Zerologon included—have received patches, but as evidenced by Friday’s warning from the DHS and FBI, not everyone has installed them. The inaction is putting governments and elections systems at all levels at risk.

Read 3 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/3nAWeNC

Read More

Apple pays $288,000 to white-hat hackers who had run of company’s network

Enlarge (credit: Nick Wright. Used by permission.)

For months, Apple’s corporate network was at risk of hacks that could have stolen sensitive data from potentially millions of its customers and executed malicious code on their phones and computers, a security researcher said on Thursday.

Sam Curry, a 20-year-old researcher who specializes in website security, said that, in total, he and his team found 55 vulnerabilities. He rated 11 of them critical because they allowed him to take control of core Apple infrastructure and from there steal private emails, iCloud data, and other private information.

The 11 critical bugs were:

Read 16 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/3jHHTMU

Read More

DHS warns that Emotet malware is one of the most prevalent threats today

Enlarge (credit: Getty Images)

The malware known as Emotet has emerged as “one of the most prevalent ongoing threats” as it increasingly targets state and local governments and infects them with other malware, the cybersecurity arm of the Department of Homeland Security said on Tuesday.

Emotet was first identified in 2014 as a relatively simple trojan for stealing banking account credentials. Within a year or two, it had reinvented itself as a formidable downloader or dropper that, after infecting a PC, installed other malware. The Trickbot banking trojan and the Ryuk ransomware are two of the more common follow-ons. Over the past month, Emotet has successfully burrowed into Quebec’s Department of Justice and increased its onslaught on governments in France, Japan, and New Zealand. It has also targeted the Democratic National Committee.

Not to be left out, US state and local governments are also receiving unwanted attention, according to the CISA, short for the Cybersecurity and Infrastructure Security Agency. Einstein—the agency’s intrusion-detection system for collecting, analyzing, and sharing security information across the federal civilian departments and agencies—has in recent weeks noticed a big uptick, too. In an advisory issued on Tuesday, officials wrote:

Read 5 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/2GNGMMY

Read More

Boom! Hacked page on mobile phone website is stealing customers’ card data

Enlarge / Computer hacker character stealing money online. Vector flat cartoon illustration (credit: GettyImages)

If you’re in the market for a new mobile phone plan, it’s best to avoid turning to Boom! Mobile. That is, unless you don’t mind your sensitive payment card data being sent to criminals in an attack that remained ongoing in the last few hours.

According to researchers from security firm Malwarebytes, Boom! Mobile’s boom.us website is infected with a malicious script that skims payment card data and sends it to a server under the control of a criminal group researchers have dubbed Fullz House. The malicious script is called by a single line that comprises mostly nonsense characters when viewed with the human eye.

(credit: Malwarebytes)

When decoded from Base64 format, the line translates to: paypal-debit[.]com/cdn/ga.js. The JavaScript code ga.js masquerades as a Google Analytics script at one of the many fraudulent domains operated by Fullz House members.

Read 5 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/2GCo6jx

Read More

Russia’s Fancy Bear hackers likely penetrated a federal agency

Enlarge / SONY DSC (credit: Boris SV | Getty Images)

A warning that unidentified hackers broke into an agency of the US federal government and stole its data is troubling enough. But it becomes all the more disturbing when those unidentified intruders are identified—and appear likely to be part of a notorious team of cyberspies working in the service of Russia's military intelligence agency, the GRU.

Last week the Cybersecurity and Infrastructure Security Agency published an advisory that hackers had penetrated a US federal agency. It identified neither the attackers nor the agency, but it did detail the hackers' methods and their use of a new and unique form of malware in an operation that successfully stole target data. Now, clues uncovered by a researcher at cybersecurity firm Dragos and an FBI notification to hacking victims obtained by WIRED in July suggest a likely answer to the mystery of who was behind the intrusion: They appear to be Fancy Bear, a team of hackers working for Russia's GRU. Also known as APT28, the group has been responsible for everything from hack-and-leak operations targeting the 2016 US presidential election to a broad campaign of attempted intrusions targeting political parties, consultancies, and campaigns this year.

Read 11 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/3cSGuAu

Read More

When coffee makers are demanding a ransom, you know IoT is screwed

With the name Smarter, you might expect a network-connected kitchen appliance maker to be, well, smarter than companies selling conventional appliances. But in the case of the Smarter’s Internet-of-things coffee maker, you’d be wrong.

As a thought experiment, Martin Hron, a researcher at security company Avast, reverse engineered one of the $250 devices to see what kinds of hacks he could do. After just a week of effort, the unqualified answer was: quite a lot. Specifically, he could trigger the coffee maker to turn on the burner, dispense water, spin the bean grinder, and display a ransom message, all while beeping repeatedly. Oh, and by the way, the only way to stop the chaos was to unplug the power cord. Like this:

What a hacked coffee maker looks like

“It’s possible,” Hron said in an interview. “It was done to point out that this did happen and could happen to other IoT devices. This is a good example of an out-of-the-box problem. You don't have to configure anything. Usually, the vendors don’t think about this.”

Read 22 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/30dWhF8

Read More

Microsoft boots apps used by China-sponsored hackers out of Azure

Enlarge / Computer chip with Chinese flag, 3d conceptual illustration. (credit: Steve McDowell / Agefotostock)

Fortune 500 companies aren’t the only ones flocking to cloud services like Microsoft Azure. Increasingly, hackers working on behalf of the Chinese government are also hosting their tools in the cloud, and that’s keeping people in Redmond busy.

Earlier this year, members of the Microsoft Threat Intelligence Center suspended 18 Azure Active Directory applications after determining they were part of a sprawling command-and-control network. Besides the cloud-hosted applications, the members of the hacking group Microsoft calls Gadolinium also stored ill-gotten data in a Microsoft OneDrive account and used the account to execute various parts of the campaign.

Microsoft, Amazon, and other cloud providers have long touted the speed, flexibility, and scale that comes from renting computing resources as needed rather than using dedicated servers in-house. Hackers seem to be realizing the same benefits. The shift to the cloud can be especially easy thanks to free trial services and one-time payment accounts, which allow hackers to quickly get up and running without having to have an established relationship or even a valid payment card on file.

Read 9 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/366lNjh

Read More

Scam apps with 2.4 million downloads found on Apple and Google shelves

Enlarge (credit: Silas Stein/picture alliance via Getty Images)

Researchers said that a tip from a child led them to discover aggressive adware and exorbitant prices lurking in iOS and Android smartphone apps with a combined 2.4 million downloads from the App Store and Google Play.

Posing as apps for entertainment, wallpaper images, or music downloads, some of the titles served intrusive ads even when an app wasn’t active. To prevent users from uninstalling them, the apps hid their icon, making it hard to identify where the ads were coming from. Other apps charged from $2 to $10 and generated revenue of more than $500,000, according to estimates from SensorTower, a smartphone-app intelligence service.

The apps came to light after a girl found a profile on TikTok that was promoting what appeared to be an abusive app and reported it to Be Safe Online, a project in the Czech Republic that educates children on online safety. Acting on the tip, researchers from security firm Avast found 11 apps, for devices running both iOS and Android, that were engaged in similar scams.

Read 10 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/3hQ5OYH

Read More

Traders set to don virtual reality headsets in their home offices

Enlarge (credit: Thomas Barwick / Getty Images)

Spare bedrooms and living rooms could soon become part of vibrant trading floors as one of the world’s biggest investment banks considers providing staff with augmented reality headsets.

UBS has experimented with issuing its London-based traders with Microsoft HoloLenses, which would allow staff to recreate the experience of working in a packed trading floor without leaving their homes.

Banks have been desperate to bring workers back to the office, especially for regulatory-sensitive roles such as trading, but surges in coronavirus infection rates have meant many staff are wary about using public transport.

Read 14 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/32J6rPE

Read More

Companies can track your phone’s movements to target ads

Enlarge (credit: Qilai Shen | Bloomberg | Getty Images)

Google and Apple have taken steps this year they say will help users shield themselves from hundreds of companies that compile profiles based on online behavior. Meanwhile, other companies are devising new ways to probe more deeply into other aspects of our lives.

In January, Google said it would phase out third-party cookies on its Chrome browser, making it harder for advertisers to track our browsing habits. Publishers and advertisers use cookies to compile our shopping, browsing, and search data into extensive user profiles. These profiles reflect our political interests, health, shopping behavior, race, gender, and more. Tellingly, Google will still collect data from its own search engine, plus sites like YouTube or Gmail.

Apple, meanwhile, says it will require apps in a forthcoming version of iOS to ask users before tracking them across services, though it delayed the effective date until next year after complaints from Facebook. A poll from June showed as many as 80 percent of respondents would not opt in to such tracking.

Read 14 remaining paragraphs | Comments

from Biz & IT – Ars Technica https://ift.tt/2FKQfEP

Read More