Tag: cybercrime

Posted on

How the FBI proved a remote admin tool was actually malware

On Thursday, the U.S. government announced that it had seized a website used to sell malware designed to spy on computers and cellphones.

The malware is called NetWire, and for years several cybersecurity companies, and at least one government agency, have written reports detailing how hackers were using the malware. While NetWire was also reportedly advertised on hacking forums, the malware owners marketed it on a website that made it look like it was a legitimate remote administration tool.

“NetWire is specifically designed to help businesses complete a variety of tasks connected with maintaining computer infrastructure. It is a single “command center” where you can keep a list of all your remote computers, monitor their statuses and inventory, and connect to any of them for maintenance purposes,” read an archived version of the site.

In the press release announcing the seizure of the website, which was hosted at worldwiredlabs.com, the U.S. Attorney’s Office in the Central District of California said that the FBI started an investigation into the site in 2020.

A spokesperson for the U.S. Attorney’s Office provided TechCrunch with a copy of the warrant used to seize the website, which details how the FBI determined that NetWire was, in fact, a Remote Access Trojan — or RAT — malware and not a legitimate app to administer remote computers.

The warrant contains an affidavit written by an unnamed FBI Task Force officer, who explains that a member or agent of the FBI Investigative Team purchased a NetWire license, downloaded the malware, and gave it to an FBI-LA computer scientist, who analyzed it on October 5, 2020 and January 12, 2021.

 

In order to test the capabilities of the malware the computer scientist used NetWire’s Builder Tool on a test computer to construct “a customized instance of the NetWire RAT,” which was installed on a Windows virtual machine controlled by the agent. During this process, the NetWire website “never required the FBI to confirm that it owned, operated, or had any property right to the test victim machine that the FBI attacked during its testing (as would be appropriate if the attacks were for a legitimate or authorized purpose).”

In other words, based on this experiment, the FBI concluded that the owners of NetWire never bothered to check that its customers were using it for legitimate purposes on computers they owned or controlled.

Using the virtual machine they set up, the FBI computer scientist then tested all of NetWire functionalities, including remotely accessing files, viewing and force-closing apps such as Windows Notepad, exfiltrating stored passwords, recording keystrokes, executing commands via prompt or shell, and taking screenshots.

“The FBI-LA [computer scientist] emphasized that in all the features tested above, the infected computer never displayed a notice or alert that these actions were taking place. This is contrary to legitimate remote access tools where consent from the user is typically required to perform specific action on the user’s behalf,” the Task Force officer wrote in the affidavit.

The officer also cited a complaint that the FBI received from a U.S.-based victim of NetWire in August 2021, but didn’t include the identity of the victim, nor many details of the case, other than saying the victim hired a third-party cybersecurity firm which concluded that the victim company received a malicious email that installed NetWire.

Ciaran McEvoy, a spokesperson for the U.S. Attorney’s Office of the Central District of California told TechCrunch he was not aware of any other public documents on the case, other than the warrant and attached affidavit, so information about the operation to take down the website used to sell NetWire, including the identity of its owners, is at this point limited.

In the press release, the DOJ wrote that Croatian authorities arrested a local citizen who allegedly ran the website, but did not name the suspect.

Following the announcement, the cybersecurity journalist Brian Krebs wrote an article where he used publicly accessible DNS records, WHOIS website registration data, information provided by a service that indexes data exposed in public database leaks, and even a Google+ profile, to link the worldwiredlabs.com website to a person named Mario Zanko.

How the FBI proved a remote admin tool was actually malware by Lorenzo Franceschi-Bicchierai originally published on TechCrunch

Posted on

Police arrest suspected members of prolific DoppelPaymer ransomware gang

An international law enforcement operation has led to the arrests of suspected core members of the prolific DoppelPaymer ransomware operation.

German and Ukrainian police, working with law enforcement partners including Europol and the U.S. Federal Bureau of Investigation (FBI), said they took action last month against the notorious group blamed for numerous large-scale attacks since 2019.

German police said they raided the house of a German national believed to have played a “major role” in the DoppelPaymer ransomware group. At the same time, Ukrainian police officers interrogated a Ukrainian national who is also believed to be a core member of the Russia-linked ransomware operation. The authorities say they are analyzing the equipment seized during the raids to determine the suspects’ exact role and links to other accomplices.

A police raid in Germany involving a suspected member of the DoppelPaymer ransomware gang.

A police raid in Germany involving a suspected member of the DoppelPaymer ransomware gang. Image Credits: Europol

Europol said in a press release on Monday that the gang was behind at least 37 cyberattacks in Germany, adding that victims in the United States — the exact number of which was not shared — paid out at least €40 million (about $42.5M) to the gang between May 2019 and March 2021.

One of the most serious attacks DoppelPaymer carried out by the gang targeted University Hospital in Düsseldorf. The subsequent failure of critical systems caused delays in emergency treatment, including the death of a 78-year-old patient, possibly the first death caused by ransomware.

Other DoppelPaymer victims include Visser, a parts manufacturer for Tesla and SpaceX; Kimchuk, a medical and military electronics maker; and manufacturing giant Foxconn.

DopplePaymer ransomware, which was the subject of an FBI warning in December 2020, is believed to be the successor to BitPaymer, a similar variant of ransomware linked to the prolific Russia-based Evil Corp group, which has been sanctioned in the United States. According to reports, DoppelPaymer has since rebranded to “Grief.”

Police arrest suspected members of prolific DoppelPaymer ransomware gang by Carly Page originally published on TechCrunch

Posted on

Sendmarc nabs $7M to offer email protection from phishing attacks and email impersonation

Over 90% of cybercrime activities that lead to financial fraud or identity theft start with an email impersonation, commonly known as phishing and spoofing. Several platforms offer individuals and businesses email protection from such attacks and general email impersonation — and Sendmarc, based in Johannesburg but with global clients — has raised $7 million in Series A funding. 

The startup was launched by CEO Sam Hutchinson, Keith Thompson, and Sacha Matulovic in 2020 off the back of selling their former business, Everlytic, a social marketing platform that allows businesses to send, deliver and track their digital communications. With Sendmarc, they sought to solve email impersonation issues their former clients faced, thereby making the internet safer for their new customers. 

Companies have lost over $10 billion due to business email compromises globally. Sendmarc helps its customers solve this problem by locking down their email domains and monitoring for attempted abuse. According to chief strategy officer Matulovic, the company’s tech is based on email authentication methods, such as the Sender Policy Framework (SPF) and the Domain-based Message Authentication, Reporting, and Conformance (DMARC), global email security standards that protect domains against spoofing and that are used by companies such as Google, Microsoft, Meta, LinkedIn, and PayPal. Sendmarc says its subscribers have access to these same tools that implement, monitor and maintain these global email and domain security practices. 

“There’s a global standard designed by a consortium of the world’s largest tech companies. Every domain owner has to implement the standard, but it’s difficult to do so,” Matulovic told TechCrunch in an interview. “It’s not something you can switch on in your Microsoft or Google. So we’ve built software enabling businesses to access these protocols to stop their emails from being impersonated.”

DigitalOcean says customer email addresses were exposed after latest Mailchimp breach

As an African startup building a global product, Sendmarc’s main competitors are outside the continent. Matulovi asserts that though the startup is going head-to-head with mostly older companies such as Kaspersky, the market is grossly underserved because there are a million businesses whose safety needs are yet to be met. In contrast, companies serve hundreds of thousands at best. 

“What we do differently, unlike our competitors, is that we have built a product focusing on go-to-market features. Let’s use this example: say you devised a vaccine to solve a virus. Everyone agrees it works. And now there are, let’s say, ten vaccine manufacturers. The problem isn’t the vaccine manufacturing; it is the distribution to millions who need it,” said the CSO. 

“So while we focus very much on our software, which is our vaccine, we also focus very much on the distribution problem. The other half of our software is built around the sales and go-to-market tools that support all our partners worldwide who help distribute the product because it’s a volume game.” He adds that Sendmarc plans to serve up to 100,000 customers in the next five years as the company might expand its product suite to include other impersonation protection features. 

So far, it has 1,000+ paying customers. Among them are South African stock exchanges, law firms such as Bowmans, insurance companies, tech startups, banks, and law enforcement agencies across North America, Europe, Australia, South Africa, and Latin America. Eighty percent of them are based in South Africa, while the rest are spread globally, Matulovic noted. These clients pay subscription fees between $49 and $119 monthly, depending on the company size, thus generating over $2 million in ARR for the two-year-old startup since 2021. 

Atlantica Ventures led Sendmarc’s Series A round. It welcomed participation from Allan Gray, E-Squared Ventures, Fireball Capital, Endeavor Catalyst, 4Di Capital, Endeavor Harvest, Alpha Private Capital, and Kalon Venture Partners, the Johannesburg-based investor that provided Sendmarc with its seed funding in 2020. Sendmarc has raised $8.5 million since its inception. 

The South African startup, which has offices in the Netherlands, Argentina, and Canada, intends to use the investment to increase its sales team across Africa, the U.S., Europe and Latin America, according to Matulovic. And as cybercrime continues to rise, Sendmarc says it wants its dedication to email and domain security to play a critical role in protecting companies and users from the harmful effects of email impersonation across these markets. 

“Cybercrime has become a major disruptor of economic activity both in Africa and worldwide, which costs companies and governments billions of dollars annually in financial loss and reputational impact,” said Aniko Szigetvari, Atlantica principle and co-founder who now joins the Sendmarc board. “Atlantica Ventures is supporting African digital security startups and solutions that address this growing issue or pain point. The Sendmarc team is focused on a key area of cybersecurity — email and domain security protection. We are excited to back an exceptional founding team to further support the growth of their product and geographic expansion.” 

Kickstarter sent password reset emails to millions of users, but didn’t tell anyone why

Sendmarc nabs $7M to offer email protection from phishing attacks and email impersonation by Tage Kene-Okafor originally published on TechCrunch

Posted on

Meet the cybercriminals of 2022

Arrested, seized, doxed and detained. These are just some of the ways police and prosecutors around the world took down the biggest cyber-crime operations of the year, even if it meant resorting to new and unconventional eyebrow-raising methods. From stashing billions of bitcoin under the floorboards to teenage hackers gatecrashing Fortune 500 networks, this year saw some of the most jaw-dropping breaches — and the highest-profile apprehensions.

As we close out 2022, we look back at the cybercriminals we lost this year… to the law.

Sanctions and seizures hit the crypto scene

U.S. officials scored some major wins against crypto-laundering in 2022. At the beginning of the year, the Justice Department said it had seized more than $3.6 billion worth of bitcoins allegedly stolen in the 2016 hack of crypto exchange Bitfinex, and that it had arrested a married couple suspected of laundering the money.

The couple — Ilya Lichtenstein, 34, and Heather Morgan, 31 — face up to 25 years in prison if convicted on charges of conspiring to launder money and defrauding the U.S. government.

Later in the year, the Office of Foreign Asset Control (OFAC), a watchdog within the U.S. Treasury tasked with enforcing sanctions violations, announced that it had sanctioned decentralized cryptocurrency mixing service Tornado Cash for its role in enabling billions of dollars’ worth of cryptocurrency to be laundered through its platform.

Tornado Cash, along with other mixers such as AlphaBay, allows customers to conceal the source of their crypto funds when participating in a transaction in exchange for a fee. It blends potentially identifiable or tainted cryptocurrency funds with others to obfuscate the source and destination of crypto assets. More than $1.5 billion in proceeds of crime, like ransomware and fraud, has been laundered through Tornado Cash to date, experts estimate.

U.S. doxes alleged Conti ransomware member

In August, the U.S government shared an image of a suspected Conti ransomware operator known as “Target,” the first time it has outed a major ransomware actor. The program also offered up to $10 million for information leading to the identification and location of Target, along with four other alleged Conti members known as “Tramp,” “Dandis,” “Professor” and “Reshaev.”

The State Department said Conti has carried out more than 1,000 ransomware operations targeting U.S. and international critical infrastructure. Most recently, the gang infiltrated 27 government institutions in Costa Rica and demanded a $20 million ransom.

Image Credits: State Department (handout)

Another gang dealt a devastating hit in 2022 was Netwalker, a ransomware gang that has been linked to numerous high-profile incidents including an attack on the University of California San Francisco, which paid a ransom demand of more than $1 million, and an attack targeting cyberthreat startup Cygilant. Between August 2019 and January 2021, ransomware attacks involving NetWalker pulled $46 million in ransom payments, according to cryptocurrency analysis firm Chainalysis.

In October, Sebastien Vachon-Desjardins, a 34-year-old from Quebec, was sentenced in a Florida court in October after pleading guilty to charges related to his involvement with NetWalker. Vachon-Desjardins, who worked as an IT consultant for Public Works and Government Services in Canada, was previously arrested by Canadian police in January 2021 and sentenced to seven years in prison. During a search of his home, law enforcement officials discovered and seized 719 bitcoin and $790,000 in Canadian currency.

James Zhong, the hacker who stole billions of Silk Road’s bitcoin

In a surprising yet anticlimactic conclusion to one of the government’s longest running cyber cases, the mystery of the notorious dark web drugs marketplace Silk Road’s missing billions was solved. In November, U.S. federal agents said it found $3.36 billion worth of bitcoin that had been stashed in a popcorn can under the bathroom closet floorboards in the home of the hacker nearly a decade earlier. Prosecutors brought charges against the hacker, a Georgia resident named James Zhong, whose plea agreement with the feds saw him forfeit the huge cache of cryptocurrency, along with $600,000 in cash and other precious metals.

Somewhat confusingly, Zhong is the second hacker to have ultimately turned over Silk Road’s stolen billions — albeit at a lower exchange rate than today. In 2020, a hacker who went by the alias Individual X forfeited another huge cache of Silk Road’s bitcoin that they had stolen years earlier during a hacking spree over 2012 and 2013. The Justice Department’s latest forfeiture closed the door on another billion-dollar mystery, even if the feds kept secret how the funds were stolen or how they came to find the hacker, long after Silk Road’s founder Ross Ulbricht was jailed.

The partial contents of the popcorn can, containing memory cards with billions of cryptocurrency and other precious metals. Image Credits: Justice Dept. (handout)

Raccoon Stealer operator charged over mass password theft

U.S. officials in October charged a Ukrainian national over his alleged role in the Raccoon Infostealer malware-as-a-service operation that infected millions of computers worldwide. Mark Sokolovsky, who goes by the online handle “raccoonstealer,” is accused of having a major role as a key administrator of the malware, which prosecutors says was used to steal more than 50 million unique credentials and forms of identification from victims around the world since February 2019.

Sokolovsky is charged with computer fraud, wire fraud, money laundering and identity theft and faces up to 20 years in prison if found guilty. Sokolovsky is in Amsterdam awaiting extradition to the United States.

Sokolvsky’s arrest led to an uptick in new Mars Stealer campaigns, including the mass-targeting of Ukraine in the weeks following Russia’s invasion, and a large-scale effort to infect victims by malicious ads. However, in November, a security research and hacking startup told TechCrunch that it had found a coding flaw that allows it to lock out operators of the Mars Stealer malware from their own servers and release their victims.

​​Seller of WhatsApp-hacking tech pleads guilty

Signal jammers, Wi-Fi interception tools, and WhatsApp hacking tools. These are some of the things that one Mexican businessman admitted in federal court to selling for both commercial and personal reasons. The Justice Department accused Carlos Guerrero of, among other things, arranging the sale of hacking tools to Mexican politicians, and using other equipment he sold to intercept the phone calls of a U.S. rival. It goes to show that it’s not just nation states and governments with powerful phone spying technology at their disposal.

Lapsus$ rounded up once, twice

The Lapsus$ gang rose to notoriety in 2022. The data extortion group, which first emerged a year earlier, quickly claimed a number of high-profile victims, including Okta, Microsoft, Nvidia and Samsung.

While the gang once seemed invincible, a number of its members were arrested in March this year. In a statement given to TechCrunch at the time, City of London Police confirmed that seven people between the ages of 16 and 21 had been arrested in connection with Lapsus$.

News of the arrests came just hours after a Bloomberg report revealed a teenager based in Oxfordshire, U.K. is suspected of being the mastermind of the Lapsus$ group. Researchers investigating the gang’s recent hacks said they believed the 16-year-old, who uses the online moniker “White” or “Breachbase,” was a leading figure in Lapsus$, and Bloomberg was able to track down the suspected hacker after his personal information was published online by rival hackers. Weeks later, U.K. police said they had charged two of the teenagers with multiple cyber offenses.

SSNDOB, a marketplace for stolen Social Security numbers, is no more

U.S. officials in June announced the takedown of SSNDOB, a notorious marketplace used for trading the personal information — including Social Security numbers, or SSNs — of millions of Americans.

The landmark operation was carried out by the FBI, IRS and the DOJ, with help from the Cyprus Police, and saw authorities seize four domains hosting the SSNDOB marketplace.

SSNDOB listed the personal information for approximately 24 million individuals in the United States, including names, dates of birth, SSNs and credit card numbers and generated more than $19 million in revenue, according to prosecutors. Chainalysis reported separately that the marketplace has received nearly $22 million worth of bitcoin across over 100,000 transactions since April 2015, though the marketplace is believed to have been active for several years prior to its eventual seizure.

The FBI’s seizure notice on SSNDOB, shortly after the site was taken down by federal authorities. Image Credits: TechCrunch (screenshot)

Ex-Amazon engineer convicted of Capital One data heist

Also in June, Paige Thompson, a former engineer in Amazon’s cloud division, was convicted of a breach that compromised the personal and financial information of 100 million CapitalOne customers in 2019. The breach was one of the biggest bank heists in U.S. history, which included the theft of credit scores, limits and balances, and also affected a million Canadians. Thompson was accused of using her knowledge as an Amazon software engineer to breach CapitalOne’s online cloud storage, hosted on Amazon’s servers, and compromising the cloud storage of several other companies, including Vodafone, Ford, and Ohio’s state motor vehicle agency. Prosecutors said the former Amazon engineer was “one bad day away from sharing the data she stole.” As such, Thompson was sentenced to time served, allowing her to avoid prison.

A major REvil operator was extradited to the United States

With a $10 million bounty on their heads after a brazen ransomware attack on Kaseya that spread to hundreds of its downstream customers, it was only a matter of time before the REvil ransomware group’s luck would run out. That’s what happened with Yaroslav Vasinskyi, a 22-year-old Ukrainian national, who was arrested in Poland in October and later arraigned and extradited to Dallas, Texas to face accusations of computer hacking and fraud by way of his alleged involvement with REvil. Vasinskyi is one of two other alleged REvil members charged by U.S. prosecutors in relation to the attack on Kaseya. It was only after the FBI recovered the decryption key that victims were able to gain access back to their encrypted files.

U.K. arrest teenagers linked to Uber and GTA hacks

In September, police in London confirmed that a 17-year-old teenager suspected of involvement in high-profile breaches at ride-hailing giant Uber and Rockstar Games had been charged with multiple counts of computer misuse and breaches of bail.

These hacks were two of the most high-profile of 2022. Uber, which said it believed a hacker affiliated with Lapsus$ was responsible for the attack, was forced to take several of its internal tools offline while it expelled the hacker from its network. Shortly before Uber’s Slack system was taken offline, Uber employees received a message that read, “I announce I am a hacker and Uber has suffered a data breach.” The hacker also reportedly said that Uber drivers should receive higher pay.

In the case of Rockstar Games, the attacker — who also goes by the alias “TeaPot” — claimed to have gained access to Rockstar Games’ internal messages on Slack and early code for an unannounced Grand Theft Auto sequel by gaining access to an employee’s login credentials.

It’s all in the (lack of) details: 2022’s badly handled data breaches

Meet the cybercriminals of 2022 by Zack Whittaker originally published on TechCrunch

Posted on

What the CHIPS and Science Act means for the future of the semiconductor industry

Simon Butler Contributor
Simon Butler was founder and CEO of Methodics Inc, acquired by Perforce in 2020. He is currently the general manager of Perforce’s Methodics Business unit.

This year is proving to be momentous for U.S. semiconductor manufacturing. During a global chip shortage and record inflation, U.S. President Biden signed into effect the CHIPS and Science Act, the greatest boon to U.S. semiconductor manufacturing in history, with $52 billion in subsidies for chip manufacturers to build fabrication plants in the U.S.

The CHIPS Act seems like a green light for domestic manufacturing. However, a presidential executive order (Improving the Nation’s Cybersecurity) published earlier in the year may be a stumbling block for semiconductor design shops eager to serve national security projects.

Rolled out several months before the CHIPS Act was signed, this executive order defines parameters that will force U.S.-based software companies to change long-established development and design processes if they want to comply with federal regulations regarding information sharing between the government and the private sector.

Let’s take a look at how these two measures relate, what they mean for semiconductor companies, and why the highs and lows of American semiconductor manufacturing boil down to one thing: Security.

With most of today’s manufacturing happening overseas, the DoD has had major challenges executing its national security-related projects.

The CHIPS Act

The CHIPS and Science Act of 2022 provides $52 billion in subsidies for chip manufacturers to build fabrication plants in the U.S. To put that into perspective, consider that currently only 12% of all semiconductor chips are made in the U.S.

This Act comes amidst a global economic downturn, with lawmakers hoping that American-made chips will solve security and supply chain issues. In short, this is something the U.S. needs to reassert its historical influence on semiconductor manufacturing.

One of the biggest considerations, and benefits, for domestic-made semiconductors is national security. Recent geopolitical instability has caused concern over potential IP leakage and theft. For the U.S. Department of Defense (DoD), it is imperative to have a secure and trusted ecosystem for the design and manufacture of semiconductors.

But with most of today’s manufacturing happening overseas, the DoD has had major challenges executing its national security-related projects.

What the CHIPS and Science Act means for the future of the semiconductor industry by Ram Iyer originally published on TechCrunch

Posted on

How do you fix a hack like Uber’s?

Ride hailing giant Uber says its services are operational following a “cybersecurity incident” last week that saw a hacker break into the company’s network and access systems that store vast troves of customer data.

Uber said little about the incident until Monday. Screenshots of inside Uber’s network posted to Twitter by security researchers in conversations with the hacker showed access to internal dashboards, the company’s Slack and its HackerOne accounts. Uber said in its Monday update that the hacker stole some internal information and Slack messages, but that no sensitive information — like credit card data and trip histories — was taken, leaving open the question if other personal user information was compromised.

The hacker, who claims to be an 18-year-old, told security researchers that they broke into Uber’s systems by stealing an employee’s password and also tricking the employee into approving the attacker’s push notification for Uber’s multi-factor authentication, or MFA.

Once they had that critical foothold on Uber’s network, the hacker claimed to find a network share containing high-privilege credentials that allowed them near-unfettered access to the rest of the company’s systems.

Uber said Monday that the hacker, who was affiliated with Lapsus$, a group that hacked Okta, Microsoft, Nvidia, Globant and Rockstar Games earlier this year, compromised an Uber contractor’s user account. Uber said it briefly took down some internal tools following the breach and that customer support operations were “minimally impacted and are now back to normal.”

Uber’s final incident post-mortem may not be known for some time, but security experts are already dissecting how the hacker got access to Uber’s systems to begin with — by defeating the company’s MFA security with apparent ease.

Not all MFA options — that extra step you have to complete after entering your username and password to verify that it’s really you logging in and not an attacker — are created equal; some are stronger than others. Codes sent by text messages, which can be intercepted or stolen, have largely been fazed out in favor of mobile authenticator apps that churn out constantly rotating random codes or send out push notifications that are near-impossible to intercept. But as attacks are getting smarter, some of the strongest MFA protections are being defeated by exploiting vulnerabilities in human behavior.

If one of the world’s biggest companies can be breached this way, how do you protect against another Uber hack?

How did the hacker defeat MFA?

According to researchers, the employee’s credentials may have been stolen by password-stealing malware like RedLine installed on an employee’s computer. Lapsus$ is also known to use Redline to steal employee passwords. Uber said the hacker may have bought the stolen passwords from a marketplaces on the dark web.

Once stolen, the hacker had to defeat Uber’s multi-factor authentication, which adds an additional barrier to prevent attackers from using stolen credentials to break into a company’s network.

In a conversation posted to Twitter, the hacker confirmed they socially engineered their way into Uber’s network by using the stolen credentials to send repeated push notifications to the employee for over an hour, then “contacted him on WhatsApp and claimed to be from Uber IT, told him if he wants it to stop he must accept it,” the hacker said. “And well, he accepted and I added my device,” the hacker wrote.

This is what some call MFA fatigue, where hackers take advantage of employees having to repeatedly log in and re-authenticate their access throughout the work day by flooding the employee with push notifications, often outside working hours, in the hopes that eventually the employee accepts a login request out of exasperation.

Rachel Tobac, an expert in social engineering and CEO of SocialProof Security, said MFA fatigue attacks are one of the “easiest ways” to get past MFA to hack an organization.

“Yes, sometimes MFA fatigue looks like repeat requests while the victim is sleeping until they accept, but oftentimes it’s as simple as sending the request 10 times in a row at the beginning of the workday or just obnoxiously spamming requests during a meeting until the victim accepts,” Tobac told TechCrunch.

After tricking the employee into accepting the push notification, the hacker could then send MFA push notifications as if they were the employee, granting them persistent access to Uber’s network.

What’s the fix?

Security experts universally agree that any level of MFA is better than none, but MFA is not a panacea on its own. Uber is not the only company to have used multi-factor authentication and still have its network compromised.

In 2020, hackers broke into Twitter’s network by tricking an employee into entering their credentials into a phishing page they had set up, which the hackers used to generate a push notification sent to the employee’s devices. The employee accepted a prompt, allowing the attackers in, according to an investigation by New York’s state government. More recently, SMS messaging giant Twilio was compromised by using a similar phishing attack, and Mailchimp was also hacked by a social engineering attack that tricked an employee into handing over their credentials.

All of these attacks exploit weaknesses in multi-factor authentication, often by directly targeting the individuals involved, rather than looking for security flaws in these highly audited systems.

Cloudflare is the only company targeted in a recent spate of cyberattacks that blocked a network compromise because it uses hardware security keys, which cannot be phished. In a blog post, Cloudflare admitted that while some employees “did fall for the phishing messages,” its use of hardware security keys, which require employees to physically plug in a USB device to their computers after entering their credentials, stopped the attackers from breaking into its network. Cloudflare said the attack targeted employees and systems in such a way “that we believe most organizations would be likely to be breached.”

Security keys are seen as the gold standard of MFA security but they are not without their own challenges, not least the costs of the keys and their upkeep. “We spend our time arguing about the necessity of hardware security keys for all, but in the field some organizations are still fighting for mandatory SMS two-factor authentication or MFA prompts for internal access,” said Tobac.

While MFA by randomly generated code or push notification are by no means perfect, as evidenced by Uber’s breach, “we can’t let perfect be the enemy of the good,” Tobac says. “Small improvements over time make a big difference.”

“The biggest questions I’m getting from organizations right now are about how to configure already existing MFA tools to limit the attack methods we are seeing in the Uber, Twilio and Twitter hacks,” Tobac said. “It’s a lot of helping organizations think through small improvements that can be made quickly so they don’t get stuck debating updates for months (or even years) internally.”

One important improvement making the rounds is MFA number matching, which makes social engineering attacks far more difficult by displaying a code on the screen of the person logging in and having to enter that code into an app on the person’s verified device. The idea is that the attacker would need both the target’s credentials and their verified device, similar to that of a security key.

Microsoft, Okta and Duo offer MFA number matching. But as noted by security researcher Kevin Beaumont, Microsoft’s solution is still in preview and Okta’s number matching offering is bundled in an expensive licensing tier. Uber relies on Duo for MFA, but reportedly was not using number matching at the time of its breach.

“In other news you are seeing a bunch of teens reinvent the cybersecurity industry in real time,” Beaumont tweeted.

Network defenders can also set up alerts and limits for how many push notifications a user can get, Tobac said — and noted in a Twitter thread — and start by rolling out security keys to a test group of users with the aim of growing the group each quarter.

For its part, Uber said on Monday that it was strengthening its MFA policies in response to its breach.

As for how the hacker got access to high-privilege credentials for the rest of its critical systems using just a contractor’s stolen password, Uber might still have a lot to answer for.

How two-factor authentication can protect you from account hacks

How do you fix a hack like Uber’s? by Zack Whittaker originally published on TechCrunch

Posted on

LockerGoGa ransomware victims can now recover their files for free

Victims of the LockerGoga ransomware can now recover their stolen files for free, thanks to a new decryptor released by Romanian cybersecurity firm Bitdefender and the NoMoreRansom Initiative.

The LockerGoga ransomware family, known for its attacks against industrial organizations, first emerged in 2019.The file-encrypting malware was infamously used in an attack against Norsk Hydro in March 2019, forcing the Norwegian aluminum manufacturer to stop production for almost a week at a cost of more than $50 million. It was also used in attacks against Altran Technologies, a French engineering consultancy, and U.S.-based chemical companies Hexion and Momentive.

According to the Zurich Public Prosecutor’s Office, which also participated in the development of the decryptor along with Europol, the operators of LockerGoga were involved in ransomware attacks against more than 1,800 individuals and institutions in 71 countries, causing more than $100 million in damage.

The group behind the LockerGoga ransomware has been inactive since October 2021, when U.S. and European law enforcement agencies arrested 12 alleged members. Following the arrests, police spent months examining the data collected during the raid and discovered the group’s encryption keys to unlock data from LockerGoga ransomware attacks, the Zurich Public Prosecutor’s Office said.

“Decryption of data is normally possible when we either identify a vulnerability in the ransomware code or when individual decryption keys become available,” Bogdan Botezatu, director of threat research and reporting at Bitdefender, told TechCrunch. “This decryptor relies on the keys seized in the 2021 arrests, which have been shared with us privately as per our collaboration with the involved law enforcement authorities.”

Swiss prosecutors said the perpetrators were also behind the MegaCortex ransomware, targeting enterprise organizations in the U.S. and Europe since 2019, and said a decryptor for MegaCortex victims will be released in the coming months.

The LockerGoga decryptor is available to download for free from Bitdefender, as well as NoMoreRansom, which is home to 136 free tools for 165 ransomware variants, including Babuk, DarkSide, Gandcrab, and REvil.

The NoMoreRansom initiative has so far helped over 1.5 million people successfully decrypt their devices without having to pay a ransom demand.

Luta Security and Emsisoft discuss how to fight ransomware at Disrupt

LockerGoGa ransomware victims can now recover their files for free by Carly Page originally published on TechCrunch

Posted on

Cyrebro, a specialist in cloud-based security ops, locks down $40M

The cloud, and the growing number of assets that are held and used within cloud services, have become a major focus in cybersecurity over the years. Today, a startup that’s leveraging the cloud in a different way — to run a security operations center within it — is announcing a round of funding to expand its activities. Cyrebro — a startup out of Israel built around a team of cybersecurity specialists that monitor networks for enterprises, leveraging both Cyrebro’s own automation tools and whatever other security apps an organization uses to keep data and infrastructure safe — has raised $40 million.

The funding, a Series C, is being led by Koch Disruptive Technologies (KDT), with new backer Elaia and previous investors Mangrove Capital Partners, Prytek, Bank Mizrachi and InCapital Group also participating.

Cyrebro has been profitable for the last several years, and it’s seen some explosive growth in that time. Today, it helps manage security for 400 customers, up from just 38 three years ago.

“Growth like that needs support,” Nadav Arbel, the CEO and co-founder, explained as the rationale for the funding.

Today, the platform covers a number of functions for its customers — threat hunting, threat intelligence, forensic investigations, incident response, SIEM (security management) optimization, and strategic monitoring, which it provides either as a complete solution or to complement existing security operations at an organization, depending on the size (it works with small businesses as well as very large enterprises).

Cyrebro will be using the new funding both to continue expanding the functionality of the product — today, for example, Cyrebro’s customers would use a third-party remediation tool to complement the work that Cyrebro does, so that could be one area of product expansion — and also to delve deeper into more geographies. The company is based out of Israel today with operations across North and South America, EMEA and Asia. 

The company has raised $60 million to date, and it’s not disclosing its valuation.

Cyrebro’s pitch is that it can complement and consolidate what an organization may already be investing in its security operations, and it can help those organizations run their overall security operations faster, more efficiently and ultimately at a lower cost, and its arrival speaks to a specific evolutionary stage in the world of enterprise IT.

Migration to the cloud is the name of the game in enterprise IT today, and for the most part that architecture promises a lot of new features, efficiencies, and flexibility when it comes to digital work. The down side is that in many cases, across a wider organization, between on premise and cloud services, IT is grappling with a very fragmented landscape when it comes to monitoring and managing that data.

And the same goes for securing it: typically a company uses a number of different apps and systems to monitor data, devices and networks across a wider organization, but that begs the question of how all of that data is subsequently consolidated, to make it usable and actionable. And that’s before considering the strain and burnout that security teams are facing to grapple with this.

And that is essentially where Cyrebro believes it can play a role: by being the central nervous system that can read these different signals, and make concerted sense of them. “Cyrebro” is triple wordplay, Arbel said: first, on cerebrum, the Latin word for “brain”; second, on Cerebro, the headgear used by Professor Xavier in X-Men to “see the entire world”; and third, on the obvious reference to cyber (short for cybersecurity). Note: even with the different spelling, Arbel said his legal team cleared the copyright on using the term with Marvel/Disney.

In cybersecurity, a lot of the innovations these days are focused around AI and other software that automate certain tasks, and there is a very logical reason for that: malicious hackers are also building automated and AI-based tools to swarm networks, creating a mass of sophisticated activity, across a mass of data, and so the aim is to fight fire with fire.

But alongside that, there is an indisputable role still for human intervention and judgement, and that is something that anchors Cyrebro as well, which is based on a team of specialists, who in turn work with a company’s own in-house teams, with all of Cyrebro’s software assets, and those of their clients.

Arbel explained that this is also because of how the startup itself germinated. As with so many in cyber intelligence and security in Israel, his roots are in defense and working in the public sector: one of his past roles was as the Israeli police force’s cyber chief. He also worked for years in consulting, where he saw first-hand the need for a better, centralized approach to security operations.

“We are a company that grew out of red teaming, so we have an offensive mindset,” he said. “My idea for building this came from hundreds of red team exercises: yes, companies were monitoring — we have tools installed everywhere these days — but they were asking the wrong things.” Essentially they “lacked a wider understanding” of threats and how to see them off.

The company does have competitors in the area of SOC as a service, as well as managed security service providers overall, large organizations like Cybreproof, CheckPoint, Axonios and more, as well as newer players like SOC Prime — who all provide some of the same or similar services (or similar concepts, but with different approaches). Investors say that Cyrebro stands out for its comprehensiveness and track record so far.

“Cyrebro provides MSSPs the highest level of automation and lowest false-positive rate with its SOC Infrastructure offering, making it truly distinct,” says Isaac Sigron, managing director at KDT, in a statement. “We believe they are revolutionizing the industry by providing MSSPs with the foundation to build a world-class, state-level product with fewer resources and expenses. This enables MSSPs to provide better and more cost-efficient service to their customers while significantly extending their offering. CYREBRO has shown significant growth in a challenging market, and we’re confident that Nadav and his team will continue to drive the business forward.”

Longer term, as security breaches and malicious activity get more sophisticated, Arbel believes that the trend will be for specialists to manage an increasing amount of security work in an outsourced way, with companies like Cyrebro playing an ever-bigger role as a result.

“In five to ten years, companies will not build security operations centers from scratch,” he said.

Cyrebro, a specialist in cloud-based security ops, locks down $40M by Ingrid Lunden originally published on TechCrunch

Posted on

North Korea’s Lazarus hackers are exploiting Log4j flaw to hack US energy companies

Security researchers have linked a new cyber espionage campaign targeting U.S., Canadian and Japanese energy providers to the North Korean state-sponsored Lazarus hacking group.

Threat intelligence company Cisco Talos said Thursday that it has observed Lazarus — also known as APT38 — targeting unnamed energy providers in the United States, Canada and Japan between February and July this year. According to Cisco’s research, the hackers used a year-old vulnerability in Log4j, known as Log4Shell, to compromise internet-exposed VMware Horizon servers to establish an initial footholds onto a victim’s enterprise network, before deploying bespoke malware known as “VSingle” and “YamaBot” to establish long-term persistent access. YamaBot was recently attributed to the Lazarus APT by Japan’s national cyber emergency response team, known as CERT.

Details of this espionage campaign were first revealed by Symanetc in April this year, who attributed the operation to “Stonefly,” another North Korean hacking group that has some overlaps with Lazarus.

However, Cisco Talos also observed a previously unknown remote access trojan — or RAT — named “MagicRAT,” attributed to Lazarus Group, which the hackers use for reconnaissance and stealing credentials.

“The main goal of these attacks was likely to establish long-term access into victim networks to conduct espionage operations in support of North Korean government objectives,” wrote Talos researchers Jung soo An, Asheer Malhotra and Vitor Ventura. “This activity aligns with historical Lazarus intrusions targeting critical infrastructure and energy companies to establish long-term access to siphon off proprietary intellectual property.”

The Lazarus Group is a financially-motivated hacking group backed by the North Korean state that is best known for the high-profile Sony hack in 2016 and the WannaCry ransomware attack in 2017. Lazarus is also driven by efforts to support North Korea’s state objectives, including military research and development and evasion of international sanctions.

However, the group has in recent months turned its attention to blockchain and cryptocurrency organizations. It has been linked to the recent theft of $100 million in crypto assets from Harmony’s Horizon Bridge, and the theft of $625 million in cryptocurrency from the Ronin Network, an Ethereum-based sidechain made for the popular play-to-earn game Axie Infinity.

Pyongyang has long used stolen cryptocurrency and the theft of other information to fund its nuclear weapons program.

In July, the U.S. government offered a $10 million reward for information on members of state-sponsored North Korean threat groups including Lazarus, double the amount that the U.S. State Department announced in April.

The race is on to patch Log4Shell, the bug that’s breaking the internet

North Korea’s Lazarus hackers are exploiting Log4j flaw to hack US energy companies by Carly Page originally published on TechCrunch

Posted on

US issues rare security alert as Montenegro battles ongoing ransomware attack

The U.S. Embassy in Montenegro has warned Americans that an ongoing ransomware attack in the country could cause widespread disruption to key public services and government services.

The ransomware attack, first confirmed by Montenegro’s Agency for National Security (ANB) last week, targeted government systems and other critical infrastructure and utilities, including electricity, water systems and transportation. At the time of writing, the official website of the government of Montenegro is unavailable and reports suggest that several power plants have switched to manual operations as a result of the attack.

Officials in Montenegro claimed no data was stolen and claimed that no permanent damage was done as a result of the attack.

However, Montenegro’s ANB declared that the country was “under a hybrid war,” and blamed “coordinated Russian services” for the attack. Relations between the two countries have remained strained since Montenegro joined the NATO alliance of Western countries in 2017, after which Russia threatened retaliatory action.

The U.S. Embassy in Montenegro has since published its own notice, writing that the government was facing a “persistent and ongoing” cyberattack. “The attack may include disruptions to the public utility, transportation (including border crossings and airport), and telecommunication sectors,” the Embassy warned. It advised citizens residing in the Balkan state to limit travel, review personal security plans, and “be aware of your surroundings.”

According to malware research group VX-Underground, the Cuba ransomware group claimed responsibility for the attack.

On its dark web leak site, seen by TechCrunch, the Cuba ransomware group claims it obtained “financial documents, correspondence with bank employees, account movements, balance sheets, tax documents, compensation [and] source code” from Montenegro’s parliament on August 19.

Montenegro has been without a prime minister since August 20, when the country’s parliament voted to pass a no-confidence motion in the ruling government.

Cybersecurity company Profero previously linked the Cuba ransomware group to Russian-speaking hackers, which researchers observed while the group negotiated with its victims. Profero said it believes the group is “not state-sponsored.”

The ransomware gang has been around since 2019 and last year the FBI issued an alert that warned organizations that the cybercriminals had been targeting critical infrastructure. The FBI said it had observed roughly 50 targeted entities and that hackers demanded tens of millions of dollars from victims.

The attack on Montenegro comes just months after the Russia-linked Conti ransomware group attacked the Costa Rican government in a weeks-long attack starting in April. In a message posted to its dark web leaks blog, Conti urged the citizens of Costa Rica to pressure their government to pay the ransom, which the group later doubled to $20 million.

Fears grow for smaller nations after ransomware attack on Costa Rica escalates