By Deeba Ahmed
Researchers believe that the primary goal behind this campaign is espionage. 
This is a post from HackRead.com Read the original post: Iran’s Scarred Manticore Targets Middle East with LIONTAIL Malware

Scarred Manticore is targeting high-profile organizations focusing keenly on telecommunication, military, and government entities apart from financial institutions, IT service providers, and NGOs.

Check Point Research (CPR) and Sygnia’s Incident Response Team have uncovered a new Iranian espionage campaign they have tied to the notorious Scarred Manticore threat group.

In its technical report titled “From Albanian to the Middle East: The Scarred Manticore is Listening,” it is revealed that the group is using a previously undocumented malware framework called LIONTAIL. This malware uses custom loaders and memory-resident shellcode payloads to blend its malicious functionalities into legitimate network traffic.

Researchers believe that the primary goal behind this campaign is espionage. This threat actor is among the Iranian actors involved in destructive cyberattacks against the Albanian government infrastructure at the behest of MOIS (Ministry of Intelligence & Security) back in July 2022. CPR claims that this threat group has been active since at least 2019, prefers gaining covert access, and persistently pursues data extraction.

Further probing revealed that Scarred Manticore is targeting high-profile organizations in the Middle East in this ongoing espionage campaign, focusing keenly on telecommunication, military, and government entities apart from financial institutions, IT service providers, and NGOs.

Though the LIONTAIL framework appears unique with no code overlaps with any known malware family detected thus far, the other tools used in the attacks overlap with previously reported attacks. Some of these attacks are linked to the OilRig or OilRig-affiliated clusters but there’s insufficient evidence to link the Scarred Manticore group with OilRig. 

Since 2019, this group has been using a custom toolset to compromise internet-exposed Windows servers in the Middle East. In this particular campaign, CPR has uncovered, that the victims are located in Saudi Arabia, the UAE, Kuwait, Jordan, Iraq, Oman, and Israel.

The geographic regions targeted in this campaign and Scarred Manticore’s previous activities sharply align with Iranian interests and with the typical victim profile targeted by MOIS-sponsored groups in espionage operations.

Scarred Manticore’s toolset has evolved considerably over time as from open-source web-based proxies, they gradually switched to powerful tools combining open-source and custom components. The Tunna-based web shell is one of the group’s earliest tools, an open-source tool used to tunnel TCP communications over HTTP to let attackers connect to any service on the remote host, even those blocked by firewalls. 

This actor now uses a range of IIS-based backdoors to target Windows servers, including custom web shells, custom DLL backdoors, and driver-based implants. The custom malware framework LIONTAIL, which CPR dubbed ‘digital chameleon,’ can establish persistence on compromised systems and steal sensitive data without being detected. It uses custom loaders and special codes to remain in the computer’s memory and hijacks the HTTP.sys driver to become a part of the regular network activity.

The evolution in Scarred Manticore’s tools and capabilities demonstrates the progress Iranian threat actors have undergone within the past few years because the techniques used in recent campaigns are far more sophisticated than previous ones tied to Iran.

****_RELATED ARTICLES_****

1.  Iran-linked hackers hit Israeli, US and EU defence tech firm
2.  GhostSec Claim Breaching Iranian Govt Surveillance Software Tool
3.  Iranian Hackers Posed as Israelis in Targeted LinkedIn Phishing Attack
4.  Iranian Stalkerware ‘Spyhide’ Steals Data from 60,000 Android Devices
5.  Ransom fail: Iranian hackers leak trove of Israeli LGBTQ dating app data
6.  Log4Shell – Iranian Hackers Accessed Domain Controller of US Federal Network

Iran’s Scarred Manticore Targets Middle East with LIONTAIL Malware

By Deeba Ahmed
The damage from the MOVEit hack is slowly emerging.
This is a post from HackRead.com Read the original post: Massive MOVEit Hack: 630K+ US Defense Officials’ Emails Breached

The organization targeted in the incident is Westat, a data firm utilized by the Office of Personnel Management (OPM) for survey administration.

The MOVEit data breach has caused havoc across all prominent industries and organizations. This large-scale cyberattack in May 2023 (from May 28th to May 30th, 2023) has claimed countless victims.

The attackers exploited a vulnerability in a managed file transfer software called MOVEit Transfer developed by Ipswitch INC. Many organizations have become targets of this breach including government agencies, airlines, educational and financial institutions and healthcare providers, and lost sensitive data such as credit card numbers, PII, and SSNs (social security numbers).

Bloomberg reports that the US Department of Justice is amongst the government agencies targeted in the MOVEit Transfer vulnerability exploitation spree. Reportedly, the email addresses of 632,000 employees from the agencies were accessed. 

According to the Office of Personnel Management’s (OPM) documents obtained through the Freedom of Information Act request, hackers obtained access to email addresses linked to government employee surveys and internal agency tracking codes by exploiting the MOVEit file transfer program used by Westat, a data firm the OPM uses for administer surveys.

Impacted employees mostly belonged to the Defense Department, including the Air Force, the Army, the Army Corps of Engineers, the Office of the Secretary of Defense and the Joint Staff officials.

Hackread.com has been following the series of cyberattacks that took place in May 2023. The Russian-speaking cybercrime group Cl0p ransomware gang is blamed for exploiting this vulnerability. The gang made the stolen data public, impacting hundreds of government entities and businesses worldwide.  

In June 2023, the National Student Clearinghouse reported that 900 US schools were impacted by the MOVEit hack, with hackers stealing sensitive student records. In October, Sony confirmed that the data breach caused by the exploitation of MOVEit vulnerability has impacted 6791 of its previous and current employees or their family members,

Progress (formally Ipswitch) released a patch for the vulnerability but many organizations haven’t yet applied the patch and remain vulnerable to cyberattacks. The full extent of damage caused by the breach in May is yet unknown but quite possibly hackers gained access to classified data.

Commenting on this latest development, security awareness advocate at KnowBe4, Eric Kron, told Hackread that the Cl0p ransomware group has continuously made headlines for its attacks exploiting the MOVEit vulnerability, and has emerged as an unconventional gang that doesn’t bother about encrypting the data or disruption of service. This is why in many cases victims of data breaches remain unaware because there aren’t any ‘evident signs.’

“This group continues to make the news due to its exploits against MOVEit and the tactics it employed. Unlike the more traditional ransomware gangs that are operating this group does not bother with the encryption of the data and subsequent disruption of services. This means that in many cases the victims may not realise they are suffering a breach because there are no extremely evident signs such as failures of service or systems going offline.”

“While the group promised to delete information related to governments, cities or police departments, it seems highly unlikely that this group is to be trusted. While they may not leak this information publicly, it could be of great interest to other nation states looking to gather intelligence on American citizens or government agencies, potentially offering them a source of income if willing to sell the information to these entities.”

“Since patches are available for the MOVEit software, organisations must ensure they’ve been applied. Any organisations that have operated the software during the times of known attacks would be wise to ensure that there is no sign of previous exploitation of these vulnerabilities, even if they have not been approached with a ransom demand yet,” Kron added.

****_RELATED ARTICLES_****

1.  IT Security firm Qualys extorted by Clop gang after data breach
2.  Clop ransomware gang leaks Jones Day law firm data on dark web
3.  Human Error: Casio ClassPad Data Breach Impacting 148 Countries
4.  UK’s Ofcom confirms cyber attack as PoC exploit for MOVEit is released
5.  Cisco Web UI Vulnerability Exploited Massly, Impacting Over 40K Devices

Massive MOVEit Hack: 630K+ US Defense Officials’ Emails Breached

By Waqas
The fate of WeChat and Kaspersky apps on civilian devices remains uncertain.
This is a post from HackRead.com Read the original post: Canada Bans WeChat and Kaspersky Due to Spying Concerns

The Government of Canada has instructed government employees to immediately uninstall WeChat and Kaspersky apps from their smartphones, tablets, and laptops.

Canada has banned the Chinese messaging app WeChat and the Russian antivirus software Kaspersky from government devices, citing privacy and security concerns. The ban, which took effect on October 30, 2023, applies to all government-issued mobile devices, including smartphones, tablets, and laptops.

The Canadian government said that its decision was based on an assessment by Canada’s chief information officer that found that WeChat and Kaspersky “present an unacceptable level of risk to privacy and security.”

The assessment found that both apps collect a wide range of data from users, including their contacts, location, and financial information. It also found that both apps could be used to plant malware on devices or to track communications.

The Chinese government has criticized Canada’s ban, calling it “unreasonable and discriminatory.” Tencent, the company that owns WeChat, has said that the app is “committed to protecting the privacy and security of its users.” Kaspersky has also denied any wrongdoing.

Canada’s ban on WeChat and Kaspersky is part of a broader trend of Western governments taking a more cautious approach to Chinese and Russian technology companies. In recent years, there have been growing concerns that these companies could be used by their governments to spy on users or to interfere in foreign elections.

In addition to Canada, the United States, Australia, and New Zealand have also banned Kaspersky and WeChat from government devices. The United States has also gone further, imposing sanctions on several Chinese technology companies, including Huawei and ZTE.

The ban is likely to have a significant impact on the Chinese and Russian technology industries. WeChat is one of the most popular messaging apps in the world, with over 1.2 billion active users. Kaspersky is also one of the most popular antivirus software companies in the world, with over 400 million active users.

In a press release published on October 30th, 2023, Anita Anand, President of the Treasury Board, stated that,

> _“We are taking a risk-based approach to cyber security by removing access to these applications on government mobile devices. The Government of Canada continuously works to safeguard our information systems and networks to ensure the privacy and protection of government information. We will continue to regularly monitor potential cyber threats and take immediate action when needed.”_
> 
> Anita Anand, President of the Treasury Board

The ban is also likely to send a message to other Western governments that they should be more cautious about using technology from China and Russia. It could also lead to other Western governments imposing similar bans on Chinese and Russian technology companies.

Overall, Canada’s ban on WeChat and Kaspersky is a significant step that is likely to have a major impact on the global technology industry. It is also a sign that Western governments are becoming increasingly concerned about the potential for Chinese and Russian technology companies to be used for malicious purposes.

****_RELATED ARTICLES_****

1.  Kaspersky spots CIA malware with backdoor capabilities
2.  Kaspersky Reveals iPhones of Employees Infected with Spyware
3.  Kaspersky tipped off US about the contractor who stole NSA data
4.  Israel hacked Kaspersky to inform US about Russia stealing NSA exploits
5.  Passwords by Kaspersky Password Manager exposed to brute-force attack

Canada Bans WeChat and Kaspersky Due to Spying Concerns

By Owais Sultan
Delve into the mesmerizing world of 3D printing, from its historical roots to its revolutionary impact across industries.…
This is a post from HackRead.com Read the original post: 3D Printing: Unpacking Facts and Safeguarding from Cybersecurity Threats

Delve into the mesmerizing world of 3D printing, from its historical roots to its revolutionary impact across industries. While its wonders captivate, it’s essential to understand the lurking cybersecurity threats.

Like our universe, technology has always been dynamic, shifting, and adapting to the demands and curiosities of humanity. Among these advancements, 3D printing stands out as a beacon of modern innovation. As we delve into some of the most captivating 3D printing facts, we must also understand the potential risks this technology poses when falling prey to hackers. Here’s a deep dive into the awe-inspiring world of 3D printing and the necessary steps to secure it.

****Historical Context****

When discussing facts about 3D printing, it’s pivotal to recognize its roots. While today’s generation might perceive it as a recent breakthrough, the foundation of 3D printing was laid in the 1980s by Chuck Hull. Over the decades, what started as an experimental concept has metamorphosed into a technological marvel, revolutionizing sectors from automotive design to healthcare.

****The Materials Beyond the Expected****

A prevalent 3D printer fact that many are familiar with is the use of plastic in 3D printing. However, the scope of 3D printing materials extends beyond just plastic. Today, sophisticated printers have the capability to print using metals, ceramics, and even organic materials like human tissues. This versatility underscores the technology’s potential in diverse applications – be it constructing a building or crafting a piece of jewellery.

****The Economics of 3D Printing****

One of the more enlightening industrial-quality resin 3D printer facts pertains to its cost-efficiency. Traditional manufacturing methods often involve mass production, which can lead to excess waste and unused products.

In contrast, 3D printing follows a ‘make as needed’ model. This not only minimizes waste but can also substantially reduce production costs, making it a favoured choice for businesses and hobbyists alike.

****A World of Customization****

Among the interesting facts about 3D printing is its unparalleled potential for personalization. Unlike conventional production lines that churn out identical items, 3D printers cater to individualized designs. This has profound implications, from creating bespoke jewellery pieces to developing prosthetics tailored for individual patients, ensuring comfort and functionality.

****Eco-friendly Manufacturing****

While discussing 3D printing fun facts, it’s hard to overlook its environmental implications. As a method that inherently reduces waste by design, 3D printing promises a greener approach to production. With increasing global concerns about the environment, this manufacturing process offers a beacon of hope for sustainability.

However, technological marvels often attract unsolicited attention. In the case of 3D printing, hackers see potential opportunities to exploit. What are these vulnerabilities, and how do they manifest?

****How Hackers Engage with 3D Printers****

**Blueprint Tampering**: A hacker with malicious intent can infiltrate the system and modify the design blueprints. This compromise can lead to defective outputs, which, depending on the application, can range from minor nuisances to catastrophic failures, especially in industries like aviation or healthcare.

**Unauthorized Prints:** With unauthorized access to a 3D printer, hackers might produce items for their benefit, leading to undue wear and tear, and the depletion of printing resources.

**Intellectual Property Theft**: One of the most significant risks involves hackers stealing proprietary design templates. With access to these blueprints, counterfeit items can flood the market, causing immense financial and reputational harm to the original creators.

****Safeguarding Your 3D Printing World****

Robust Password Protection: It’s fundamental to protect your 3D printing info with strong and frequently changed passwords. This primary step can deter a significant portion of potential breaches.

****Timely Software Updates****

Manufacturers often roll out software patches to address known vulnerabilities. Ensuring your 3D printer is running the latest software version can be the first line of defence against hackers.

****Secured Networks****

Connecting your 3D printer to a secure, encrypted network can substantially reduce intrusion risks. Using VPNs or dedicated isolated networks can further fortify this security.

****Access Limitation****

Restricting access to the 3D printer and its associated facts about 3D printing to a handful of trusted individuals can drastically reduce vulnerabilities.

****Constant Monitoring****

Keeping a vigilant eye on the printer’s logs can help identify and address any unauthorized or suspicious activities in their nascent stages.

****To Sum Up****

To conclude, 3D printing, with its vast potential and transformative capabilities, holds a promising future. But with great power comes the necessity for great responsibility. As we marvel at the wonders of 3D printing, it’s equally crucial to be proactive and knowledgeable about its vulnerabilities. By adopting a vigilant approach, we can enjoy the myriad benefits of this technology while safeguarding it from potential threats.

1.  Injured Turtle Gets 1st 3D Printed Titanium Jaw Implant
2.  Miracle Miracle! A woman’s kidney tumor cured by 3D printing
3.  Crashing a $1,000 Drone by Hacking the 3D Manufacturing System
4.  Here’s a 3D Printed Remaking of ‘Ear of Hell’ Classic Audio Speakers
5.  3D printed fingerprints can unlock your device with 80% success rate

3D Printing: Unpacking Facts and Safeguarding from Cybersecurity Threats

By Waqas
The Security Joes Incident Response team of cybersecurity researchers recently discovered the new BiBi-Linux Wiper malware.
This is a post from HackRead.com Read the original post: Hamas Hackers Targeting Israelis with New BiBi-Linux Wiper Malware

The BiBi-Linux Wiper malware damages files and operating systems by overwriting data with useless information, rendering the affected files unusable.

Cybersecurity experts from Security Joes’ Incident Response team recently stepped forward to aid Israeli companies amid the **conflict between Israel and Hamas**. During their investigations, they uncovered a concerning discovery: a new type of malware known as the BiBi-Linux Wiper.

This malicious software, designed for Linux systems, poses a significant threat. It is a powerful executable file that, if granted root access, can potentially wipe out an entire operating system. What sets it apart is its ability to target specific folders, overwrite files, and concurrently corrupt data using multiple threads, significantly amplifying its impact and speed.

Unlike other malware types that aim to steal data or demand ransom payments, the BiBi-Linux Wiper takes a different approach. It damages files and operating systems by overwriting data with useless information, rendering the affected files unusable. This kind of destructive software, often termed a “**Wiper**,” is not entirely new but remains a menacing cybersecurity threat against companies, businesses and unsuspecting users.

According to the company’s **blog post**, one noteworthy detail is the naming convention used in the malware—each infected file is titled bibi-linux.out. This name, seemingly random, actually holds a political undertone, as “bibi” is a common nickname for the current Israeli Prime Minister, Benjamin Netanyahu. Further exploration into the malware’s inner workings revealed this string hardcoded within its structure, used to generate identifiers for corrupted files.

The researchers noted the rarity of this malware; at the time of their investigation, it had only received two detections on VirusTotal, suggesting its newness and limited distribution.

The malware, upon execution, produces an excessive amount of output, revealing details about its progress and actions. To address this, threat actors use the “nohup” command, redirecting output to a file and preventing the wiping process from halting even if the console is closed.

Its use of multiple threads and system calls enables it to corrupt files rapidly and efficiently. The malware follows a pattern, overwriting files with random data, renaming them with a ‘BiBi’ extension, and excluding certain file types crucial for the operating system’s function.

****Sophisticated Cyber Attacks Linked to Hamas and Pro-Palestinian Groups Target Israel****

Hamas has displayed a surprising level of sophistication in its cyber warfare tactics, as demonstrated by several incidents in recent years. **In 2014**, Hamas not only breached the live transmission of Israel’s Channel 10 TV station but also defaced the broadcast by displaying distressing images of Palestinian civilians affected by Israeli airstrikes in Gaza.

**In July 2018**, Israel accused Hamas of spying on IDF soldiers using malicious World Cup and dating apps. The group reportedly exploited hundreds of IDF Android devices by luring users with images of attractive women.

**By February 2020**, reports surfaced that Hamas hackers masqueraded as women to deceive IDF personnel into downloading malware. These hackers, posing as women, sent out malware to gather critical information and gain control over the soldiers’ phone functions.

Despite these cyberattacks attributed to Hamas, other groups have also targeted **Israel’s critical infrastructure**. AnonGhost, a pro-Palestinian group, not only **hacked the Red Alert App**, an Israeli rocket alert app but also sent fabricated missile, rocket, and nuclear bomb alerts to Israeli citizens.

**On October 16th, 2023**, researchers identified a fraudulent rocket alert app hosted on a malicious website, distributing malware onto the smartphones of unsuspecting Israeli citizens.

Nonetheless, cybersecurity experts persist in monitoring and analyzing these threats. The readiness of companies to defend against evolving cyber risks remains of utmost importance.

1.  Gaza Cybergang targeting Palestinian authority figures
2.  US seizes official website of Iranian state-owned Press TV
3.  Israeli Spyware Vendor Uses Chrome 0day to Target Journalists
4.  Israel claims to bomb Hamas’s cyber Ops HQ amidst uncertainties
5.  Android malware on Play Store targeting Palestinians on Facebook

Hamas Hackers Targeting Israelis with New BiBi-Linux Wiper Malware

By Waqas
The infamous RansomedVC Ransomware Group is calling it quits and selling its entire cyber infrastructure due to "personal reasons."
This is a post from HackRead.com Read the original post: RansomedVC Ransomware Group Quitting and Selling its Entire Infrastructure

The announcement came on Telegram just a week after the RansomedVC ransomware claimed responsibility for hacking the Colonial Pipeline in the United States.

The infamous RansomedVC ransomware group, responsible for a string of high-profile ransomware attacks, has abruptly announced its dissolution. The group, known for its sophisticated hacking tactics and exploitation of the European Union’s GDPR laws, has decided to sell its entire infrastructure.

RansomedVC, which first emerged in August 2023, targeted a wide array of entities, from major corporations to government bodies and educational institutions. Their modus operandi involved infiltrating networks, exfiltrating sensitive data, and subsequently threatening victims with publication of the stolen information unless a substantial ransom was paid. Notably, they also exploited the threat of reporting victims to GDPR authorities, potentially resulting in severe penalties.

The group’s most prominent alleged victims included well-known names such as Sony Corporation and the Colonial Pipeline, victims of the group’s extortion tactics in September and October 2023, respectively.

However, RansomedVC has taken an unexpected and unprecedented step by putting their entire toolkit up for sale. As seen by Hackread.com, the sale includes a staggering array of assets, such as various domains and forums, a ransomware builder with promised 100% undetectability by antivirus software, access to affiliate groups, social media accounts, Telegram channels, VPN access to multiple companies with a jaw-dropping revenue of $3 billion, databases worth over $10 million each, and more.

The group’s admin, while announcing the sale, mentioned “personal reasons” for the decision but categorically stated that these reasons would not be disclosed to journalists or the public.

> _I do not want to continue running the project due to personal reasons, none will be disclosed to journalist, dont even ask. We are selling everything._
> 
> RansomedVC

For now, one could only speculate the reasons of the group’s sudden sale. It could be pressure from law enforcement agencies, or even the possibility of a new and more sophisticated cyber operation in the making.

RansomedVC’s announcment on Telegram (Image credit: Hackread.com)

It’s worth noting that on May 6th, 2021, the Colonial Pipeline fell victim to a successful hack by the ransomware group DarkSide. Just days later, on May 9th, the group was compelled to disband after the FBI seized and recovered the Bitcoin ransom paid by the pipeline, leading to their disappearance.”

Nevertheless, depending on who purchases the infrastructure, there is concern about a potential surge in cyber threats and attacks. If you run a business with an online presence, it’s essential to protect it from ransomware attacks by following these simple yet vital steps:

1.  **Regular Data Backup and Recovery:** Ensure you frequently back up all your important data and systems to an external device or a cloud-based service. Having a robust backup system in place enables you to restore your data without having to pay the ransom demanded by attackers.
2.  **Use Reliable Security Software:** Implement and maintain strong, updated antivirus and anti-malware software on all devices. These tools can help detect and block potential ransomware threats before they can cause harm. Regularly update this software to ensure it’s equipped to handle new threats.
3.  **Employee Training and Awareness:** Educate and train employees about the risks of ransomware attacks. Emphasize the importance of not clicking on suspicious links, downloading unknown attachments, or visiting unverified websites. Create protocols for handling emails and files from unknown sources.
4.  **Keep Software Updated:** Regularly update all operating systems, software, and applications on your devices. Updates often contain security patches that fix vulnerabilities that cybercriminals could exploit to launch ransomware attacks.
5.  **Network Segmentation and Access Controls:** Segment your network and limit access rights. This means restricting user permissions so that each user only has access to the information and resources necessary for their job. This reduces the chances of a ransomware attack spreading throughout the entire network if one device is compromised.

****_RELATED ARTICLES_****

1.  Dark Web Genesis Market for Sale
2.  Dark Web Domain of Genesis Market and Infrastructure Sold
3.  Military Satellite Access Sold on Russian Hacker Forum for $15,000

RansomedVC Ransomware Group Quitting and Selling its Entire Infrastructure

By Deeba Ahmed
Explore insights into the rise of Quishing attacks, the risks associated with QR code exploitation, and crucial preventive…
This is a post from HackRead.com Read the original post: Surge in QR Code Quishing: Check Point Records 587% Attack Spike

Explore insights into the rise of Quishing attacks, the risks associated with QR code exploitation, and crucial preventive measures to protect against this growing cybersecurity threat.

Check Point’s Harmony Email team has reported a startling increase of 587% in QR code phishing or Quishing attacks. This shocking rise was observed between August and September 2023. Researchers noted thousands of QR code-related attacks each month.

 In the company’s blog post, authored by Check Point’s cybersecurity researcher/analyst Jeremy Fuchs, explained that hackers lure users with QR codes, redirecting them to credential-harvesting websites. In the UK and Europe, around 86.66% of smartphone users have scanned one QR code at least in their lifetime, and 36.40% scanned a code at least once a week.

It isn’t surprising though because in October, Hackread.com reported the findings of SaaS-base cloud messaging security firm SlashNext, according to which a sudden spike was witnessed in QR code-based phishing attacks.

QR codes are easier to exploit because these encode complex data and a compromised code can quickly redirect users to malicious websites. SlashNext researchers noted that attackers prefer two prominent attack methods to exploit QR codes: Quishing and QRLJacking. Now, Check Point has reported that a massive rise in Quishign attacks has been noticed.

Quishing is a type of phishing attack. Unsuspecting users are tricked into accessing malicious websites or downloading malware after scanning a QR code. There are several reasons why Quishing attacks are on the rise, such as their widespread nature, as millions use them to make payments, scan menus, and access information, which makes them an attractive target for threat actors.

Moreover, QR codes can be exploited to hide malicious links, which can lead users to any website the attacker wants them to without alerting them about suspicious activity. 

Harmony Email’s team found that lately, attackers are redirecting users to credential-harvesting sites through QR code lures using social engineering to target end-users with emails that can look like this:

Image credit: Check Point

The lure used in the email is that Microsoft multi-factor authentication is expiring, and the users must re-authenticate. It is worth noting that the email’s body content claims to be sent by Microsoft, but the sender’s address is different.

To combat Quishing, you must add the OCR (Optical Character Recognition) feature in security solutions to detect malicious QR codes. OCR can help you translate the codes into the URL behind the code, and then you can run the URL through a URL analysis tool. However, suspicion should be raised right when you observe that a QR code is present in the email message body.

Since Quishing attacks are becoming a solid threat, it is essential to exercise caution. Never scan without checking the sender’s source, and avoid scanning codes provided with emails unless you have verified the sender. Security professionals must implement email security that leverages OCR for all attacks. They must implement AL, ML, and NLP-based security to understand the real intentions of a message.

****_RELATED ARTICLES_****

1.  Barcode Reader Apps on Play Store Infected with Adware
2.  Stream-Jacking: Malicious YouTube Livestreams Aid Malware
3.  How to make a QR code to accept Bitcoin while keeping it secure
4.  “Picture in Picture” Technique Exploited in Deceptive Phishing Attack
5.  Fake ROBLOX and Nintendo game cracks drop ChromeLoader malware

Surge in QR Code Quishing: Check Point Records 587% Attack Spike

By Deeba Ahmed
What happens in iLeakage attacks is that the CPU is tricked into executing speculative code that reads sensitive data from memory. 
This is a post from HackRead.com Read the original post: iLeakage Attack: Theft of Sensitive Data from Apple’s Safari Browser

A team of researchers comprising Georgia Tech’s cybersecurity professors, Daniel Genkin and Jason Kim, University of Michigan’s Stephan van Schaik, and Ruhr University Bochum’s Yuval Yarom have published a research paper explaining a vulnerability they discovered in Apple devices that affects Macs and iPhones.

Researchers explained in the paper titled “iLeakage: Browser-based Timerless Speculative Execution Attacks on Apple Devices,” that the vulnerability, dubbed iLeakage, has been affecting Macs and iPhones since 2020. The attack mainly affects those devices that were built with Apple’s Arm-based A-series and M-series chips.

Researchers devised an attack that forced Apple’s Safari browser to divulge passwords, Gmail content, and other sensitive data by exploiting a side channel vulnerability in the CPUs. 

This vulnerability is built off an existing attack technique used on CPUs for over six years. Back in 2018, security researchers reported that all modern CPUs can be exploited to leak sensitive data by exploiting an integral feature on the processor called Speculative Execution. 

In this technique, modern CPUs try to improve performance by executing instructions before they know it is needed. iLeakage is a browser-based attack exploiting a timerless speculative execution flaw in Apple devices. Timerless speculative execution lets the CPU execute instructions even without any time running. The attackers can exploit this to perform malicious operations without getting detected.

What happens in iLeakage attacks is that the CPU is tricked into executing speculative code that reads sensitive data from memory. The attacker can exfiltrate this data without alerting the user. It is a dangerous attack because adversaries can perform them without needing the victim to click on malicious links or open infected documents/attachments.

The flaw exists in the way the Safari browser handles JavaScript timers. This allows attackers to create malicious JavaScript code and use it to steal sensitive data from the device. The stolen data may include passwords, PII (personal identification information), and credit card numbers. Using this data, attackers can commit crimes like identity theft and fraud.

Researchers noted that iLeakage attacks are currently effective on Apple devices running Safari. However, other platforms or browsers may also be vulnerable. Therefore, it is essential to exercise caution to prevent iLeakage attacks. Always keep your software up-to-date and use a security solution that can detect/block speculative execution attacks.

The findings were disclosed to Apple on 12 September 2022. The company acknowledged this issue, and Apple’s Product Security team and Safari browser development team collaborated with the researchers to develop countermeasures. As a result, Apple refactored Safari’s multi-process architecture. These changes are currently under active development and are available in Safari Technology Preview versions 173 and above.

Apple has released a new inter-process communication API to spawn new processes for pages launched with window.open(). Researchers have confirmed that the patch mitigates iLeakage attacks by preventing the consolidation of domains across security boundaries but it has limitations.

“We have empirically verified that this patch mitigates our attack by preventing the consolidation of domains across security boundaries. This means that while it is still possible to escape the speculative JavaScript sandbox, an attacker will only be able to read their own address space and therefore their own data,” researchers concluded.

The full report can be accessed here (PDF), and there is a dedicated site available to demonstrate the iLeakage attack.

Regarding this research, Lionel Litty, Chief Security Architect at Menlo Security, a Mountain View, Calif.-based provider of browser security stated that this attack shows browsers are the new OS. 

“This attack illustrates how for both attackers and defenders, the browser is the new OS, with web primitives such as origins and web workers that parallel OS primitives, such as applications and threads. Security practitioners must educate themselves on this attack surface.”

John Gallagher, Vice President of Viakoo Labs at Viakoo, a Mountain View, Calif.-based provider of automated IoT cyber hygiene noted that this attack method is not as significant as is the realization that threats are continually evolving. 

“The significance is not necessarily in this as an attack method, but more in how threats are evolving based on the tradeoff between speed and security. Prefetching of information to speed up CPU execution has been around for a while, and equally has been exploited for a while.  This is just a further “tit for tat”, and will be remediated in future CPU development.”

Gallagher, however, claims that in this attack, organizations aren’t at high risk because this attack requires a high degree of sophistication and there aren’t any reports that it has been exploited in the wild. 

“Organizations are not at high risk, given that this attack method requires a high degree of sophistication by the threat actor and has not been seen exploited yet in the wild (or at least not reported).  Organizations concerned (or high-value individual targets) should consider enabling lockdown mode, or using the MacOS (unstable) patch available,” Gallagher stated.

1.  According to Chrome, Safari and FireFox ThePirateBay is a Phishing Site
2.  Hackers Pwned Apple Safari in 20 seconds; Google Pixel in 60 seconds
3.  Bug in Safari browser leaks personal identifiers and browsing activity
4.  Apple Safari Safest, Google Chrome Riskiest Browser of 2022- Study

iLeakage Attack: Theft of Sensitive Data from Apple’s Safari Browser

By Owais Sultan
NEOBRED, a blockchain horse racing game, has announced that it is integrating with the Avalanche blockchain. The integration…
This is a post from HackRead.com Read the original post: Horse Racing Game NEOBRED Integrates with Avalanche for Elite Gaming Experience

NEOBRED, a blockchain horse racing game, has announced that it is integrating with the Avalanche blockchain. The integration will allow NEOBRED to offer players blazing fast and low cost gaming that delivers a superior web3 gaming experience.

In NEOBRED, players must breed and train their horses to create the fastest stable possible. They can then enter their horses into races and win prizes for finishing in the top ranks. By selecting horses with favorable genetic combinations, players can craft the optimum steed before subjecting it to intensive training to further enhance its attributes.

After retirement, each NEOBRED horse becomes a GENE that inherits its performance and can be paired with DNA to create new generations of offspring.While some players will seek out the full game experience, others will specialize in particular aspects such as breeding, training, or racing. This will support a vibrant in-game economy with strong demand for the best horses.

Avalanche is one of the fastest smart contract networks as measured by time-to-finality. Its scalability and throughput support a low fee environment making it one of the most cost-effective blockchains available. These characteristics make it the ideal platform for NEOBRED, which is committed to providing its players with smooth web3 gaming that doesn’t incur trade-offs.

“We are excited to integrate with Avalanche and offer our players a new level of gaming performance and efficiency,” said a spokesperson from NEOBRED. “Avalanche’s speed, scalability, and low costs have the potential to make NEOBRED one of the most enjoyable blockchain horse racing games on the market.”

“We are excited to welcome NEOBRED to the Avalanche ecosystem,” said Ed Chang, Head of Gaming at Ava Labs. “NEOBRED looks like it will take a proven on-chain game model with racing to the next level by improving gameplay.”

The NEOBRED game is set to launch later in Q4 of 2023. For more information about NEOBRED and its integration with Avalanche, please visit the NEOBRED website.

**About Avalanche**

Avalanche is a layer 1 blockchain that is known for its scalability, speed, and security. It uses a unique consensus protocol called Snow, which allows it to process transactions very quickly. Avalanche is home to a wide range of dApps, including DeFi protocols, NFT marketplaces, and gaming applications. 

**About NEOBRED**

NEOBRED is a blockchain horse racing game that is built on the Avalanche blockchain. The game allows players to own, breed, and race horses. Players can also earn rewards by participating in race. It is expected to launch in Q4 of 2023.  

Website | Twitter | Discord | Telegram | Zealy

**Media contact**

NEOBRED Media Team

\[email protected\]

Horse Racing Game NEOBRED Integrates with Avalanche for Elite Gaming Experience

By Deeba Ahmed
Yet another day, more unprotected data left in the Cloud without password or security measures.
This is a post from HackRead.com Read the original post: Database Mess Up: 7TB of Healthcare Data Leak Affects 12 Million Patients

The database was owned by Redcliffe Labs, a popular Indian medical diagnostics company located in Noida, Uttar Pradesh.

Cybersecurity researcher Jeremiah Fowler discovered a non-password-protected database containing over 12 million records. The data included sensitive patient data such as medical diagnostic scans, test results, and other medical records. Fowler reported his findings to WebsitePlanet.

While investigating, Fowler found that the medical test results contained extensive personal details of patients, including their names, doctors’ names, health-related details, and whether the patient had undergone at-home testing or got tested at the medical facility. These documents belonged to an Indian medical diagnostics firm, Redcliffe Labs. 

The database’s total size was 7TB, and it contained around 12,347,297 records. There were folders marked “Reports” that contained 1,180,000 objects (620.5GB). Documents folder marked Smart Report Storage had 1,164,000 objects (1.5GB), the folder titled Test Results had 6,090,852 objects (2.2TB), and other folders contained miscellaneous documents like internal documents, PDFs, logs, and app files. In total, these folders had 3,912,445 objects (2.7 GB).

Apart from the vast data trove, the exposed database also contained development files from the company’s mobile app. These files control the app’s functionality and data transmission.

Screenshots from the data leak (Image vi: Jeremiah Fowler)

For your information, Redcliffe Labs is among the leading diagnostic centers in India, offering over 3600 different wellness and illness tests. According to Redcliffe Labs’ website, the facility has a user base of 2.5 million. The company offers at-home testing sample collection services in 220+ Indian cities and boasts over 2000 Walk-in Wellness and Collection Centers across the country.

Endorsing the responsible disclosure practice, Fowler contacted the company, who responded swiftly. According to Folwer’s blog post, the database’s public access was restricted on the same day. However, it is unclear for how long this database remained exposed and whether any unauthorized individual had accessed it.

Such breaches can have far-reaching consequences for the patients, as they may be exposed to identity theft, medical fraud, and extortion. If mobile app-related data gets into the wrong hands, cybercriminals can exploit it to launch cyberattacks, disrupt the app’s functionality, and jeopardize mobile users’ security.

The biggest risk factor is the exposure of application code, which threat actors can manipulate to inject malicious code and compromise the app, add unauthorized features, and inject malware. The exposure can put millions at risk because the exposed code can be used to assess/reverse engineer the app to reveal vulnerabilities, leading to further exploitation.

Redcliffe Labs has not clarified if it has notified relevant authorities or the impacted individuals about the data exposure. Also, there’s no indication that the company’s mobile app is compromised or someone had already accessed patient data before it was restricted. Hackread.com will post an update once the company shares more details on this incident.

****_More Findings by Jeremiah Fowler_****

1.  Z2U Market Leak Exposes Access to Illicit Services and Malware
2.  Researcher Exposes Cryptocurrency Scam Network of 300 Domains
3.  Brazil’s Top Escort Service Exposes Millions of Escort and Client Data
4.  Database Mess Up Exposed PII and Photos of 2.3M Dating App Users
5.  Major CRM Provider Really Simple Systems Leaked 3M Customer Records
6.  Data Leak Exposes 572 GB of Student, Faculty Info from Accreditation Org
7.  Contractor Database Leak Exposes 500K Irish Police Vehicle Seizure Records

Source

HackRead