| GeekyHarsha.in |: 2017

Home Archives for 2017

Apple Investigating Reports Of ‘Serious Battery Failure’ On iPhone 8 Plus

Apple has admitted it’s looking into multiple reports of swelling batteries in its new flagship iPhone 8 Plus smartphones.

Pictures on social media and growing reports from tech websites and mainstream news media have shown a number of the high end iPhone 8 Plus handsets that appeared to have split alongside the side, forcing the screen to come away from the main body of the phone.

The issue seems to appear during charging. The issue also appears to be global, with several similar faults being reported in Europe, Asia, and North America, suggesting that the fault may be more than just a single bad batch, although how many are original reports are authentic is still unknown.

An Apple spokesperson said the company was currently looking into the issue, but the company has not elaborated further at the time of writing. Several devices have however, allegedly been collected by Apple partners and returned for investigation by the tech giant.

Fire in the disco?
While reports of swelling batteries is a serious concern, there have been no reports of any of them catching fire. The chemical makeup of lithium-ion batteries and the energy they store can however make them a potential hazard with any kind of fault.

Didn’t this happen last year?
Yes. Except the fault last year was with the Samsung GaIaxy Note 7, which Samsung were forced to recall after several incidents of the battery catching fire while charging. There were only around 100 confirmed incidents of the Note 7 actually catching fire.

Google Cloud announced today that it has acquired Bitium, a company that focused on offering enterprise-grade identity management and access tools, such as single-sign on, for cloud-based applications. This will basically help Google better manage enterprise cloud customer implementation across an organization, including doing things like setting security levels and access policies for applications working across their Cloud and G Suite offerings.

Bitium was founded in 2012, and targets both mid market and larger enterprise customers,. It’s been offering a single-stop solution for managing Google Apps, Office 365, social network, CRM, collaboration and marketing tools, while ensuring organizations remain compliant with security standards.

The goal of Bitium is to simplify the process of administrating and using popular cloud-based applications so that users aren’t tempted to enter the nefarious realm of “shadow IT,” where they fall back to their own personal accounts across these services because the enterprise alternative is sub-standard or difficult to access.

It sounds like Google wants to continue the work that Bitium was doing on its own, and extend it to additional application partners, while also keeping the platform open to other third-party identity management providers that integrate with enterprise customers on the one side, and Google Cloud and G Suite on the other.

WPS Office 2016 Personal Edition – The MS Office Alternative

Previously known as Kingsoft Office, WPS is a lightweight yet very practical and powerful office suite, which includes full word-processing, spreadsheet and presentation functionality.

There are ads that can become annoying, but it’s a small price to pay when you consider the fact you’re not paying anything for the product.

And don’t let that fool you into thinking that WPS Office 2016 isn’t fully formed or that it’s some half functional basic suite. There’s some real depth behind the interface and it works.

It comes bundled with three applications:

WPS Writer (more than capable word processor)
WPS Spreadsheets (a very good spreadsheet feature)
WPS Presentations (which is pretty much PowerPoint)
All three work very well, and if you’ve used any recent version of MS Office, or indeed any other Office suite, you should find yourself instantly at home. All three of the above also use the same style of interface as MS Office and all the usual tools and options are placed in a similar fashion and have intuitive positioning.

Works with MS Office files
Compatibility with MS Office document formats comes as standard, and WPS does a good job opening and converting them without formatting errors such as suddenly finding paragraphs with five lines between them or spreadsheet calculations with formulas that have stopped working.

Each program opens and saves all Microsoft Office document formats (doc, docx, xls, xlsx etc), as well as HTML, RTF, XML, even PDF.

Language support
WPS Office 2016 Personal Edition currently supports English, French, German, Spanish, Portuguese, Russian and Polish, and has all the standard features you could hope and want for from your office suite, including spell check and word-count feature.

Fuel efficient
WPS is also incredibly easy on systems and its low requirements mean it can be installed on even old PCs running Windows.

WPS also comes with 1 GB of free cloud storage. It isn’t huge admittedly, but it’s there, it’s free, and it’s designed to store your documents and spreadsheets rather than 10 years’ worth of photos and videos.

There are also iOS and Android versions of the software available which is a really nice touch. As well as this, there’s also a Linux version available.

This Bluetooth Vulnerability A Open Door to Hacking!

This time, it’s a Bluetooth flaw that lets outsiders access your phone and any other connected devices.

New BlueBorne attack can access computers, phones, and IoT devices, in seconds.

Armis researchers discovered the potential attack portal that can affect everything from a phone to an IoT connected device – hacking them in as little as 10 seconds. Using BlueBorne, a hacker can not only conduct remote functions, but can also use the affected device to launch a variety of other forms of attacks.

No download required
Even though it doesn’t require any effort on the part of the victim – meaning there’s no need to get you to download the malicious software or grab an infected app for this to work to a hacker’s benefit – it does let the user know when someone is utilizing the device. Unfortunately, once again, Android phones seem to be the hardest hit. Apple phones and tablets won’t work this way, nor will Windows phones. Google is reportedly issuing a patch very soon to remedy the situation, so be on the lookout for this important update and install it.

Shortsighted
The crisis behind BlueBorne isn’t the creativity of the cybercriminals, but rather the complete lack of foresight on the part of developers to figure out how someone might try to work around the security and use it for their gain. The industry continues to be shocked by the latest threats, as though no one in the room had ever analyzed a new software, network, or piece of technology and wondered how someone might break in. As the internet of things has taught us all too well, as a whole we have to start looking for the problems before releasing the innovation to consumers.

'Athena' CIA malware plants Gremlins’ on Microsoft machines – WikiLeaks

The latest in WikiLeaks’ series of #Vault7 leaks was released Friday detailing malware that provides remote beacon and loader capabilities on target computers using several Microsoft Windows operating systems.

‘Athena’ is the latest codename for the release which consists of five documents.

In the user guide, the operating systems which can be targeted are: Windows XP Pro SP3 32-bit, Windows 7 32-bit/64-bit, Windows 8.1 32-bit/64-bit, Windows 2008 Enterprise Server, Windows 2012 Server, and Windows 10.

Once installed on a target computer, Athena will use a listening post to receive beacons from the operator, allowing it to signal and trigger additional malware payloads undetected on the target computer.

Athena “hijacks” the DNSCACHE, a temporary database maintained by the operating system to record internet traffic on the computer, to hide its presence, according to a document contained in the leak.

The command module for Athena will only load during a signal, before being destroyed when completed.

The CIA cooperated with the private cybersecurity firm Siege Technologies to develop the Athena malware.

"I feel more comfortable working on electronic warfare… It’s a little different than bombs and nuclear weapons -- that’s a morally complex field to be in. Now instead of bombing things and having collateral damage, you can really reduce civilian casualties, which is a win for everybody," Jason Syversen, the founder of Siege Technologies, wrote in an email.

The release is the latest in WikiLeaks series of leaks, allegedly from the CIA, known as #Vault7. Previous releases showed hacking techniques used to weaponize mobile phones, conduct surveillance via Smart TVs and load and execute malware on a target machine.

A screenshot contained in the leak shows evidence of a Dell machine being used by a user named 'Justin.'

Is Blue Whale ‘Suicide Game’ A Hoax?

The truth behind the headline-grabbing app?

An app that’s making news headlines around the world for allegedly targeting children and young people has left quite a few parents shaking in fear, while authorities are still trying to connect even the slightest of dots. Blue Whale, created by Russian programmer Philipp Budeikin, supposedly lures young victims into self-harm and suicide, with a variety of humiliating, painful, and even violent steps along the way.

Fact or fiction? :
It reads like something straight out of a Hollywood cyberthriller, and it’s easy to see why some might dismiss it as nothing more than urban legend. At the same time, it’s exactly the kind of generational rumor that can strike fear in the public: much like the long-told stories of Halloween candy filled with razor blades, although there has never been a single reported instance of the event.

Parents warned :
Schools across the US are warning parents about the app nonetheless, and Russian authorities are taking it very seriously – they’ve arrested Budeikin for his supposed role in multiple suicides, although the exact number is still being investigated – and different websites tell different stories on the numbers of young people who’ve already been Blue Whale’s victim. Some numbers have been speculated to be in the hundreds, while other sites insist there hasn’t been a single suicide linked to the game.

Tasks become dark :
Blue Whale reportedly assigns the “players” different tasks depending on the level they reach in the game. Some of the early tasks have included nothing more than filming themselves singing a silly song, while later on as the “game” becomes darker and darker, tasks have included committing and filming acts of violence against animals, cutting themselves, and ultimately, committing suicide.

Key takeaways :
There are a number of key takeaways for parents where this app and others like it are concerned. First, whether or not all of the rumors surrounding Blue Whale are accurate, there is no question that the creator has been charged. Also, there are valid concerns of copycat behaviors based on the headlines about this app. Finally, one of the functions of the app was reportedly to root around in the player’s phone and steal incriminating photos or messages, then extort the desired behaviors out of the victim. There have been a number of widely reported and verified incidents in which young people have been victimized by this type of tactic, and the definition of “sextortion” usually involves this kind of approach. Blue Whale may be more rumor than truth, but there are genuinely hundreds of methods a predator can use to contact a young victim and lead to sextortion.

Things you need to know about Wannacry/ WannaCrypt Ransomware

It has been reported that a new ransomware named as "Wannacry" is spreading widely. Wannacry encrypts the files on infected Windows systems. This ransomware spreads by using a vulnerability in implementations of Server Message Block (SMB) in Windows systems. This exploit is named as ETERNALBLUE.

The ransomware called WannaCrypt or WannaCry encrypts the computer's hard disk drive and then spreads laterally between computers on the same LAN. The ransomware also spreads through malicious attachments to emails.

In order to prevent infection, users and organizations are advised to apply patches to Windows systems as mentioned in Microsoft Security Bulletin MS17-010.

https://technet.microsoft.com/library/security/MS17-010

After infecting, this Wannacry ransomware displays following screen on infected system:

Source: Symantec

It also drops a file named !Please Read Me!.txt which contains the text explaining what has happened and how to pay the ransom.

Source: Symantec

WannaCry encrypts files with the following extensions, appending .WCRY to the end of the file name:
.lay6.sqlite3.sqlitedb.accdb.java.class.mpeg.djvu.tiff.backup.vmdk.sldm.sldx.potm.potx.ppam.ppsx.ppsm.pptm.xltm.xltx.xlsb.xlsm.dotx.dotm.docm.docb.jpeg.onetoc2.vsdx.pptx.xlsx.docx

The file extensions that the malware is targeting contain certain clusters of formats including:

Commonly used office file extensions (.ppt, .doc, .docx, .xlsx, .sxi).Less common and nation-specific office formats (.sxw, .odt, .hwp).Archives, media files (.zip, .rar, .tar, .bz2, .mp4, .mkv)Emails and email databases (.eml, .msg, .ost, .pst, .edb).Database files (.sql, .accdb, .mdb, .dbf, .odb, .myd).Developers' sourcecode and project files (.php, .java, .cpp, .pas, .asm).Encryption keys and certificates (.key, .pfx, .pem, .p12, .csr, .gpg, .aes).Graphic designers, artists and photographers files (.vsd, .odg, .raw, .nef, .svg, .psd).Virtual machine files (.vmx, .vmdk, .vdi).

Indicators of compromise:
Ransomware is writing itself into a random character folder in the 'ProgramData' folder with the file name of "tasksche.exe" or in 'C:\Windows\' folder with the file-name "mssecsvc.exe" and "tasksche.exe".

Ransomware is granting full access to all files by using the command:
Icacls . /grant Everyone:F /T /C /Q

Using a batch script for operations:
176641494574290.bat

hashes for WANNACRY ransomware:
5bef35496fcbdbe841c82f4d1ab8b7c2
775a0631fb8229b2aa3d7621427085ad
7bf2b57f2a205768755c07f238fb32cc
7f7ccaa16fb15eb1c7399d422f8363e8
8495400f199ac77853c53b5a3f278f3e
84c82835a5d21bbcf75a61706d8ab549
86721e64ffbd69aa6944b9672bcabb6d
8dd63adb68ef053e044a5a2f46e0d2cd
b0ad5902366f860f85b892867e5b1e87
d6114ba5f10ad67a4131ab72531f02da
db349b97c37d22f5ea1d1841e3c89eb4
e372d07207b4da75b3434584cd9f3450
f529f4556a5126bba499c26d67892240
use endpoint protection/antivirus solutions to detect these files and remove the same

Network Connections
The malware use TOR hidden services for command and control. The list of .onion domains inside is as following:

gx7ekbenv2riucmf.onion57g7spgrzlojinas.onionXxlvbrloxvriy2c5.onion76jdd2ir2embyv47.onioncwwnhwhlz52maqm7.onionsqjolphimrr7jqw6.onion

Note: For update on latest Indicators of Compromises, please see references to security vendors given in references section

Specific Countermeasures to prevent Wannacry/WannaCrypt Ransomware:
Users and administrators are advised to take the following preventive measures to protect their computer networks from ransomware infection/ attacks:
In order to prevent infection users and organizations are advised to apply patches to Windows systems as mentioned in Microsoft Security Bulletin MS17-010

Microsoft Patch for Unsupported Versions such as Windows XP,Vista,Server 2003, Server 2008 etc. http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598

To prevent data loss Users & Organisations are advised to take backup of Critical Data

Block SMB ports on Enterprise Edge/perimeter network devices [UDP 137, 138 and TCP 139, 445] or Disable SMBv1. https://support.microsoft.com/en-us/help/2696547

Apply following signatures/rules at IDS/IPS

alert tcp $HOME_NET 445 -> any any (msg:"ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response"; flow:from_server,established; content:"|00 00 00 31 ff|SMB|2b 00 00 00 00 98 07 c0|"; depth:16; fast_pattern; content:"|4a 6c 4a 6d 49 68 43 6c 42 73 72 00|"; distance:0; flowbits:isset,ETPRO.ETERNALBLUE; classtype:trojan-activity; sid:2024218; rev:2;)

(http://docs.emergingthreats.net/bin/view/Main/2024218)

alert smb any any -> $HOME_NET any (msg:"ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Request (set)"; flow:to_server,established; content:"|00 00 00 31 ff|SMB|2b 00 00 00 00 18 07 c0|"; depth:16; fast_pattern; content:"|4a 6c 4a 6d 49 68 43 6c 42 73 72 00|"; distance:0; flowbits:set,ETPRO.ETERNALBLUE; flowbits:noalert; classtype:trojan-activity; sid:2024220; rev:1;)

alert smb $HOME_NET any -> any any (msg:"ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response"; flow:from_server,established; content:"|00 00 00 31 ff|SMB|2b 00 00 00 00 98 07 c0|"; depth:16; fast_pattern; content:"|4a 6c 4a 6d 49 68 43 6c 42 73 72 00|"; distance:0; flowbits:isset,ETPRO.ETERNALBLUE; classtype:trojan-activity; sid:2024218; rev:1;)

Yara:
rule wannacry_1 : ransom
{
meta:
author = "Joshua Cannell"
description = "WannaCry Ransomware strings"
weight = 100
date = "2017-05-12"

Strings:
$s1 = "Ooops, your files have been encrypted!" wide ascii nocase
$s2 = "Wanna Decryptor" wide ascii nocase
$s3 = ".wcry" wide ascii nocase
$s4 = "WANNACRY" wide ascii nocase
$s5 = "WANACRY!" wide ascii nocase
$s7 = "icacls . /grant Everyone:F /T /C /Q" wide ascii nocase

Condition:
any of them
}
rule wannacry_2{
meta:
author = "Harold Ogden"
description = "WannaCry Ransomware Strings"
date = "2017-05-12"
weight = 100
strings:
$string1 = "msg/m_bulgarian.wnry"
$string2 = "msg/m_chinese (simplified).wnry"
$string3 = "msg/m_chinese (traditional).wnry"
$string4 = "msg/m_croatian.wnry"
$string5 = "msg/m_czech.wnry"
$string6 = "msg/m_danish.wnry"
$string7 = "msg/m_dutch.wnry"
$string8 = "msg/m_english.wnry"
$string9 = "msg/m_filipino.wnry"
$string10 = "msg/m_finnish.wnry"
$string11 = "msg/m_french.wnry"
$string12 = "msg/m_german.wnry"
$string13 = "msg/m_greek.wnry"
$string14 = "msg/m_indonesian.wnry"
$string15 = "msg/m_italian.wnry"
$string16 = "msg/m_japanese.wnry"
$string17 = "msg/m_korean.wnry"
$string18 = "msg/m_latvian.wnry"
$string19 = "msg/m_norwegian.wnry"
$string20 = "msg/m_polish.wnry"
$string21 = "msg/m_portuguese.wnry"
$string22 = "msg/m_romanian.wnry"
$string23 = "msg/m_russian.wnry"
$string24 = "msg/m_slovak.wnry"
$string25 = "msg/m_spanish.wnry"
$string26 = "msg/m_swedish.wnry"
$string27 = "msg/m_turkish.wnry"
$string28 = "msg/m_vietnamese.wnry"
condition:
any of ($string*)
}

Best practices to prevent ransomware attacks:
Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.Establish a Sender Policy Framework (SPF),Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization's website directly through browserRestrict execution of powershell /WSCRIPT in enterprise environment Ensure installation and use of the latest version (currently v5.0) of PowerShell, with enhanced logging enabled. script block logging, and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis.Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA%, %PROGRAMDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations. Enforce application whitelisting on all endpoint workstations.Deploy web and email filters on the network. Configure these devices to scan for known bad domains, sources, and addresses; block these before receiving and downloading messages. Scan all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution.Disable macros in Microsoft Office products. Some Office products allow for the disabling of macros that originate from outside of an organization and can provide a hybrid approach when the organization depends on the legitimate use of macros. For Windows, specific settings can block macros originating from the Internet from running.Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares.Maintain updated Antivirus software on all systemsConsider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsfRegularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements, (backdoors /malicious scripts.)Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.Disable remote Desktop Connections, employ least-privileged accounts.Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems, Check regularly for the integrity of the information stored in the databases.Restrict users' abilities (permissions) to install and run unwanted software applications.Enable personal firewalls on workstations.Implement strict External Device (USB drive) usage policy.Employ data-at-rest and data-in-transit encryption.Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empaneled auditors. Repeat audits at regular intervals.Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies

Generic Prevention Tools:

Tool (NoMoreCry) to prevent Wannacry Ransomware by CCN-CERT:
https://loreto.ccn-cert.cni.es/index.php/s/tYxMah1T7x7FhND?path=CCN-CERT%20NoMoreCry%20

Tool Sophos: Hitman.Pro : https://www.hitmanpro.com/en-us/surfright/alert.aspx
Bitdefender Anti-Crypto Vaccine and Anti-Ransomware (discontinued) : https://labs.bitdefender.com/2016/03/combination-crypto-ransomware-vaccine-released/

Malwarebytes Anti-Ransomware(formally Crypto Monitor) : https://blog.malwarebytes.com/malwarebytes-news/2016/01/introducing-the-malwarebytes-anti-ransomware-beta/

Trendmicro Ransomware Screen Unlocker tool: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1105975.aspx

Microsoft Enhanced mitigation and experience toolkit(EMET) : https://www.microsoft.com/en-us/download/details.aspx?id=50766

References

Cisco Annual Cybersecurity breaches Report

Data breaches have been setting new records almost every year for the past decade, and as such, the numbers of compromised consumer records floating around the dark web is astronomical. But while companies of every size and in every industry work to clean up the aftermath of a breach or hacking event, one source has uncovered just how staggering this cost really is.

The latest Cisco Annual Cybersecurity Report shows that “more than a third of organizations that experienced a data breach in 2016 reported substantial customer, opportunity and revenue loss of more than 20 percent… after attacks, 90 percent of these organizations are improving threat defense technologies and processes.”

Sadly, it gets worse. According to BetaNews.com, “The effect of breaches on organizations is substantial, 22 percent of breached organizations say they lost customers – 40 percent of them losing more than 20 percent of their customer base. In addition 29 percent lost revenue, with 38 percent of that group losing more than 20 percent. Lost business opportunities were cited by 23 percent, with 42 percent of them losing more than 20 percent.”

So what’s behind all these breach events? A lot of factors. After polling more than 3,000 chief security officers from 13 different countries, Cisco determined that budget issues, lack of integrated system compatibility, and a workforce that had not been trained in even the most basic cybersecurity measures were some of the biggest corporate threats. They also cited the complex nature of trying to navigate their own companies’ IT departments, along with a bizarre mash-up of antivirus and anti-malware software within even the same company. After all, it’s not possible to maintain data security when every workstation is running a different security protocol.

Of course, it doesn’t help that hackers are just as good at their jobs as some companies are ineffective. With new innovations every day and new tactics for stealing large amounts of corporate data, there doesn’t appear to be an end in sight where data breaches are concerned. That obviously doesn’t mean anyone should throw in the towel, but it certainly means that no company or industry is safe, or has a handle on how to block every threat.

Former Mozilla engineer makes controversial antivirus claim

. Anyone who’s been around a computer for a while has probably been beaten over the head with the long-standing mantra to install and update their antivirus software regularly. AV software is an industry all on its own, and it’s long been seen as the safety net that keeps all our data from falling into the abyss of hackers and scammers. But a new report from a former Mozilla developer sheds a little light on things: not only is it supposedly not as important as the tech world would have us believe, in some cases it may be leaving us vulnerable rather than protecting us.

Robert O’Callahan wrote a blog post late last week and stated that those who run an up-to-date newer Windows OS have no need of any third-party AV installs, and that opting for one of those titles could actually be putting flawed software on your machine.

“At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google’s Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)”

O’Callahan goes on to cite a Twitter convo that highlighted a genuine problem: the people who are creating our mechanisms – like operating systems and web browsers – are actually hindered by the often-faulty code in antivirus software. When a third-party title attempts to block what it perceives as a threat, the browser developer never gets wind of it and therefore cannot strengthen the browser’s security capabilities.

The author’s recommendation? Run a Windows machine and keep its updates installed, then rely on Microsoft’s inherent security measures. You’ll be more likely to get your protection from the source rather than from what an outside company with a product-pushing agenda perceives to be harmful. That’s all well and good if you run a later Windows version or if you trust Microsoft not to meddle with your privacy, though, and that’s not something that critics of the Windows 10 forced rollout may be willing to do.