DecryptedTech

Monday03 October 2022

Sean Kalinich

Sean Kalinich

After a three-year absence from Hacker Summer Camp, I finally returned to Vegas. Two of those years were related to Covid of course. However, three years is a long time to be out of the environment and the craziness that is both Black Hat and Def Con. To say I was excited to return to Vegas and everything that both cons have to offer would be an understatement. Both cons have their place in what I do here at DecryptedTech, but it was more than just the articles and conversations about security that I enjoy, it is getting to catch up with people I only see during the con and also the prospect of meeting new people and developing new relationships.

When most people think of malware, they think of binaries that are downloaded to a drive and executed. However, that is only part of the malware world. The other side does not actually download the malicious binary directly to the drive and often injects it directly into memory though the use of scripts. The name fileless is a bit of a misnomer as there are always files to be found in different stages of the attack, it is more to the point that much of the malicious work is doe through injection of code into legitimate processes without the need to write much of it to disk.

Its seems that the efforts of Ukrainian hacktivists have decided to focus their efforts on a new and interesting target. In addition to other strategic targets, they have gone after one of the central portals for Russian alcohol distribution. The attack is currently manifested in the form of a distributed denial of service attack(s) targeting the portal to render it inaccessible. This means that distillers and distributors of alcoholic beverages are not able to get their products into consumers hands.

in the wild. The patch for this bug is one of 37 that are part of the monthly security release which covers multiple components in the popular mobile OS. This comes at a time when mobile banking malware is on the rise and there are also concerns around threat groups targeting phones to compromise them for use in MFA request responses.

The idea of DLL hijacking is a well known one and one that is used by attackers to compromise security tools and even sophisticated anti-malware solutions. DLLs (Dynamic Link Library) are not much more than static files that sit idle on a system until loaded. These libraries contain information that is important to the operation of the program calling it. If an attacker can replace a DLL with one of their own that prevents or alters the operation of the calling program, they have successfully hijacked it. Because of the flexibility and shared nature of DLL they are an easy target.

Ransomware is a huge shadow over many businesses and individuals’ heads. It has loomed as a significant threat since the first stains hit the internet inside malicious zip files masquerading as “Xerox” documents. Since that time ransomware and the groups behind it have evolved significantly. At the top of the food chain are groups like Hive and Conti who have not only evolved their own tools but utilize strategic approaches to their organizations complete with acquisitions and, in some cases, attempted legitimate business fronts to further their activities.

Google is an odd company. They have used the personal vs corporate data ownership line like a jump rope over the years. We have watched them for a long time and all we can say is that their track record on protecting personal information and privacy has been both good and bad with them being on the bad side for most of recent history. After being a vehement opposer of bills like SOPA (Stop Online Piracy Act) and PIPA (Protect our Intellectual Property Act) they quickly dropped those stances and started facilitating blanket takedown noticed from the MPAA (now the MPA) and RIAA. The blanket notices often came from law firms that provided little more than links to Google which Google then removed from their search engine and YouTube.

It Cloud services are exceptionally popular as a cost effective and simple method to maintain common operational needs. Everything from email to fully fledged infrastructures can be maintained in the “cloud”. All of these can be accomplished at lower overall cost than trying to maintain the same systems on prem. By shifting the general operation, maintenance and even security to the cloud service provider organizations get to reduce their total ownership cost including reducing the number of skilled employees they need to keep on staff. This reduction in the total cost of ownership and maintenance is a huge item when you are trying to ensure profitability.

April must be the month for new malware tools to be released, or at least announced as we have already heard about new forms of attack/infection from the group behind Emotet and now we hear that Conti has replaced BazarLoader with new malware tracked as Bumblebee. The newly disclosed malware is also under active development with multiple new features showing up this month.

A new flaw has been identified in the Node.js package manager, NPM. The flaw is being described as a logical flaw, but in reading over the data it seems more like a permissions flaw. The good news is that as of April 26, the flaw has been addressed by NPM, the bad is that it was in play until then. According to the researchers that discovered it, the flaw related to the way you can attach other accounts to an uploaded package.

Page 1 of 210