The Russian invasion of Ukraine represents a new type of warfare, including extensive cyber and information operations

Read More

In keeping with the hybrid nature of Russia’s invasion of Ukraine, several hacktivist groups and hackers have joined the fight in the embattled nation, including some hacktivists encouraged by the government of Ukraine itself. Although the hacktivists have been waging their version of cyber warfare mostly against Russian organizations, hacktivists sympathetic to Russia are also turning their weapons against Ukraine.

The following are notable hacktivist events that have occurred so far related to the Russian invasion of Ukraine.

IT Army of Ukraine emerges: Developers in Ukraine are joining an “IT army,” the IT Army of Ukraine, which has assigned them specific challenges. Announced on February 26, the group already has nearly 200,000 users on its main Telegram channel that it uses to hand out assignments and coordinate operations. The group was ostensibly responsible for shutting down the API for Sberbank, one of Russia’s major banks and Kremlin-aligned Belarus’s official information policy site. It’s not clear if the Ukraine government is behind the IT Army of Ukraine, even though Ukrainian officials have endorsed the effort.
Anonymous claims credit for website take-downs. Late last week, a Twitter account purporting to represent Anonymous wrote that “The #Anonymous collective has taken down the website of the #Russian propaganda station RT News.” The Russian state-run TV channel RT website said it was a victim of a hacker attack, which it attributed to Anonymous.
Cyber Partisans of Belarus claim train hacks. Activist hackers in Belarus called the Cyber Partisans allegedly breached computers that control that country’s trains and brought some to a halt in the cities of Minsk and Orsha and the town of Osipovichi. The hackers purportedly compromised the railway system’s routing and switching devices and rendered them inoperable by encrypting data stored on them.
AgainstTheWest targeted Russian interests. Another hacktivist group known as AgainstTheWest claims to have hacked a steady stream of Russian websites and corporations, including Russian Government contractor promen48.ru, Russian Railways, the State University Dubna, and the Joint Institute for Nuclear Research.
The Anon Leaks says it messed with Putin’s yacht information. The Anon Leaks, a group purportedly an offshoot of Anonymous, said it changed the callsign of Russian President Vladimir Putin’s superyacht Graceful on MarineTraffic.com to FCKPTN. The hackers also found a way to alter the yacht’s tracking data, making it look as if it had crashed into Ukraine’s Snake Island and changing its destination to “hell.”
Presumed hacktivists hacked Russian EV charging stations. Hackers, presumably activists, hacked electric vehicle charging stations along Russia’s M11 motorway to display anti-Russian messages. The hackers likely gained access through a Ukrainian parts supplier called AutoEnterprise.
“Patriotic Russian hackers” helped hit Ukraine websites with DDoS attacks: Last week, some independent Russian hackers, so-called “patriotic Russian hackers,” or vigilantes who operate in a hacktivist-like mode, claim they helped bring down Ukrainian websites during the second round of DDoS attacks that hit the country.
Russian media outlets hacked to display anti-Russian messages. The websites of several Russian media outlets were hacked to display anti-Russian messages, with some of the sites going offline. The sites affected were TASS rbc.ru, kommersant.ru, fontanka.ru, and iz.ru of the Izvestia outlet. Some Russian media sources say anonymous was the source of these hacks.
Researcher leaked Conti gang’s messages: A Ukrainian security researcher leaked over 60,000 internal messages belonging to the Conti ransomware operation after the gang publicly sided with Russia over the invasion of Ukraine. (Conti backpedaled from its robust support of Russia after its Ukrainian affiliates objected). The leaked messages were taken by a Ukrainian security researcher who reportedly had access to Conti’s backend XMPP server from a log server for the Jabber communication system used by the ransomware gang.

Hacktivism isn’t necessarily a good idea

The main question surrounding the hacktivism accompanying Russia’s invasion of Ukraine is whether this kind of hacking is a healthy development in defense of Ukraine. “It’s worth noting that the situation is really quite unprecedented,” Brett Callow, threat analyst at Emsisoft, tells CSO. “I don’t recall anything like this having happened before. We obviously have multiple activist groups operating on behalf of both sides, as well as certain cybercrime groups taking sides, as well as intelligence services invariably doing the things they normally do.”

To read this article in full, please click here

Read More

Nice piece of research:

Abstract: Among the many types of malicious codes, ransomware poses a major threat. Ransomware encrypts data and demands a ransom in exchange for decryption. As data recovery is impossible if the encryption key is not obtained, some companies suffer from considerable damage, such as the payment of huge amounts of money or the loss of important data. In this paper, we analyzed Hive ransomware, which appeared in June 2021. Hive ransomware has caused immense harm, leading the FBI to issue an alert about it. To minimize the damage caused by Hive Ransomware and to help victims recover their files, we analyzed Hive Ransomware and studied recovery methods. By analyzing the encryption process of Hive ransomware, we confirmed that vulnerabilities exist by using their own encryption algorithm. We have recovered the master key for generating the file encryption key partially, to enable the decryption of data encrypted by Hive ransomware. We recovered 95% of the master key without the attacker’s RSA private key and decrypted the actual infected data. To the best of our knowledge, this is the first successful attempt at decrypting Hive ransomware. It is expected that our method can be used to reduce the damage caused by Hive ransomware.

Here’s the flaw:

The cryptographic vulnerability identified by the researchers concerns the mechanism by which the master keys are generated and stored, with the ransomware strain only encrypting select portions of the file as opposed to the entire contents using two keystreams derived from the master key.

The encryption keystream, which is created from an XOR operation of the two keystreams, is then XORed with the data in alternate blocks to generate the encrypted file. But this technique also makes it possible to guess the keystreams and restore the master key, in turn enabling the decode of encrypted files sans the attacker’s private key.

The researchers said that they were able to weaponize the flaw to devise a method to reliably recover more than 95% of the keys employed during encryption.

Read More

What can’t you buy on the internet? Last-minute birthday gifts. Check. A new refrigerator. Check. An engagement ring. Check. Groceries. Check. Travel to foreign lands. Check.

Internet-driven consumerism is a critical component of our economy. But it has its dark side filled with demons. And the demons—more commonly known as cybercriminals—who live in the murky, cesspit-ridden areas of the internet—more commonly known as the dark web—love to take advantage of the vulnerabilities and bugs that exist in the web application programming used to drive websites.

With their demon-torture tools in hand (called Magecart or e-skimming attacks), these demons target vulnerabilities in web application code, injecting malicious scripts designed to steal personally identifiable information (PII), which they then resell to their legions of devil-spawned minions.

Data breaches cost more than just money

Data breaches like these are expensive for companies. Recent 2020 research suggests that the global average price of a data breach is around $3.85 million. Not surprisingly, the cost more than doubles if the attack happens in the United States, with the total average around $8.64 million. And those numbers only reflect the costs associated with things like investigation, legal fees, and customer services, such as credit monitoring. What it doesn’t include is the cost to a business’s reputation because, when a business is breached, you can pretty much guarantee that the customer-victims are going to first say: “What the @#?!!. Didn’t those bleepity-bleep-bleep-bleeps running the company have any cybersecurity in place?” And the next thing the customer-victim will do is research a better, safer, competitor solution.

Traditional security just doesn’t protect the client side

In all fairness to the business, they probably did have cybersecurity in place, just not the right cybersecurity. Traditional, but only partially effective, tools that are sometimes used to prevent script attacks include things like web application firewalls (WAFs), policy controls, and threat intelligence. These cybersecurity solutions are absolutely critical and necessary to protect the ‘server-side’ of the business, but they don’t protect against malicious attacks targeting the client side.

The reasons why it is so easy for the wretched ghouls of the dark web to attack businesses via the client side, include:

Vulnerable website tools written in JavaScript.
Lack of attention to web application vulnerabilities.
Multiple, layered (but likely vulnerable) web applications and scripts designed to add website functionality.
Increasing number of third- and fourth-party sources creating and distributing vulnerable applications and scripts.
Misconfigurations and malicious code in open-source tools.

What can businesses do?

There are a few things that businesses can do to protect themselves from the demon spawn of the dark web, including:

Engage in ongoing monitoring & protection—Be vigilant in your ongoing and automated inspection and monitoring of your web assets and JavaScript code. Use a purpose-built solution, like AT&T’s Managed Vulnerability Program’s Client-side Security powered by Feroot, to make you aware of any unauthorized script activity.
Know your assets—Understand what web assets you own and the type of data they hold. In addition, conduct some deep-dive scans to reveal intrusions, behavioral anomalies, and unknown threats.
Practice good patch and update management—Ensure patches and updates are applied regularly.
Compartmentalize web applications—To limit exposure across the application, split your front-end applications up into smaller components, such as public, authenticated, and admin, and to deploy these parts in a separate origin (e.g., https://admin.websitename.com).
Use an SSL certificate for all websites—Certificates enable website authentication and make SSL/TSL encryption possible. They also enable the website to have an HTTPS web address. Many browsers have started tagging websites without an SSL certificate as “not secure.” While an SSL certificate and HTTPS address does not guarantee a website is secure (since SSL certificates are easy to obtain), having that HTTPS web address and encrypting any customer data, does make customers more trustworthy of your site.

What kind of purpose-built solutions are available?

There are purpose-built solutions that safeguard internet users and consumers from the demon spawn of the dark web. Two tools powered by Feroot that are a part of AT&T MVP are:

Feroot Security PageGuard—Based on the Zero Trust model, PageGuard runs continuously in the background to automatically detect unauthorized scripts and anomalous code behavior. If threats are detected, PageGuard blocks all unauthorized and unwanted behavior in real-time across the organization. PageGuard also automatically applies security configurations and permissions for continuous monitoring of and protection from malicious client-side activities and third-party scripts.
Feroot Security Inspector—In just seconds, Inspector automatically discovers all web assets a company utilizes and reports on their data access. Inspector finds all security vulnerabilities on the client-side and provides specific client-side threat remediation advice to application developers and security teams in real-time.

Next steps

Modern web applications are useful, but they can carry potentially dangerous vulnerabilities and bugs. Protect your customers and your websites and applications from client-side security threats, like Magecart and script attacks with security tools like Feroot’s Inspector and PageGuard. These services offered by AT&T’s Managed Vulnerability Program (MVP) allows the MVP team to inspect and monitor customer web applications for malicious JavaScript code that could jeopardize customer and organization security.

AT&T is helping customers strengthen their cybersecurity posture and increase their cyber resiliency by enabling organizations to align cyber risks to business goals, meet compliance and regulatory demands, achieve business outcomes, and be prepared to protect an ever-evolving IT ecosystem.

You can also contact AT&T Cybersecurity Consulting to get your 30-day free trial of MVP including Client-side Application Security powered by Feroot.

Read More

Corporate boards are asking their CISOs to inform them more often about cybersecurity risks. This gives security leaders an opportunity to help senior business stakeholders better understand security’s value and makes them more likely to support and strengthen security strategies.

However, talking to the board about cybersecurity in a way that is productive can be a significant challenge, and failing to do so effectively can result in confusion, disillusionment, and a lack of cohesion among directors, the security function, and the rest of the organization. Here are some common mistakes that CISOs make when speaking to the board, along with advice for avoiding them.

To read this article in full, please click here

Read More

Risk-based authentication (RBA), also called adaptive authentication, has come of age, and it couldn’t happen fast enough for many corporate security managers. As phishing and account takeovers have blossomed under the pandemic, RBA can become a key technology to protect corporate assets, particularly as remote work is more the rule than the exception.

What is risk-based authentication?

RBA is all about examining “signals,” as the vendors refer to the various observations they make in near-real time as a user moves through the login process or when a customer buys something online. It creates a risk profile of the person or device requesting access to the system. That profile is based on factors or signals including IP geolocation, user behavior, keystroke patterns, and connection type. These factors may change depending on specific threat factors, and this could require ongoing management of risk profiles.

To read this article in full, please click here

Read More

Two groups attacked same healthcare organization

Read More

Group was involved in disseminating counterfeit IDs, says Europol

Read More

Outage hit key supplier, forcing carmaker to pull the plug

Read More