DecryptedTech

It looks like the group behind Trickbot, the Swiss Army Knife of Malware as service for Windows is shutting down the framework and infrastructure behind the “solution”. According to research groups that have been tracking the campaign the disappearance there are several factors that have led up to this. One of the most recent changes appears to be a shift in efforts to a new malware format and potentially being “acquired” by another malware operator.

ID.me, the private identification verification company, has become a popular go-to when it comes to governmental services. We have seen it put in play at the local, state, and federal level. The idea is to have a source of truth for someone’s identity that can be used across multiple platforms. The reality is very different as it seems you need to have a different ID.me account for different services depending on the email address used. It also seems to be going well beyond normal methods of verification as we have seen multiple state and federal agencies begin collecting biometric data through the service.

We have another Web3 article today. This one covers a new NFT marketplace compromise though the use of phishing emails that tricked users into singing over their digital assets to an, as of yet, unknown attacker.

It seems that there are still some MS SQL servers that are not only exposed to the open internet but are also still using weak passwords. When this is combined with vulnerabilities and the lack of other security controls and monitoring, it allows threat actors to compromise them. This is the case in a recently observed campaign where the attackers are targeting exposed MS SQL servers and injecting Cobalt Strike.

Most attacks, be they real or from a penetration test, begin with an attempt to compromise a single system, or user. The compromise of a device or user account gives the attacker a small foothold in an environment that they can use to pivot to other areas and begin their complete takeover of the targeted organization. Defenders use many techniques to try to prevent this including complex passwords, complex usernames and, of course multi-factor authentication (MFA). MFA, when done properly, reduces the risk of credential compromise from phishing and spearphshing significantly.

Google has a bit of a history (understatement) of abusing data collection and sneaking in ways to continue collecting data on its users. This type of collection is all in service to their ad business. They want to be able to send targeted ads to users and the only way to do that is to collection information about them. This pattern of behavior has led to more than one lawsuit in the past based on the way they word turning features on or off and what they collect. Even Google’s current proposed solution to excessive data collection for targeted ads is confusing and seems like nothing more than a way to maintain control of the collection process.

Recently Mark Zuckerberg had to admit that Meta not only had lost a significant amount of money but stood to lose more as changes in attitudes around personal data privacy and targeted ads are changing. In the EU privacy protection laws have impacted Meta in, to them, negative ways. Meta has made what could be interpreted as a threat to pull their services from the EU, it some agreement cannot be reached. They are also upset at Apple after Apple made the outrageous, again to Meta, decision to allow users to opt-in to cross app tracking. This means that Meta’s current data collection schemes are at risk.

Google has a bit of an issue with malware present in their Play Store as there are reports of another banking trojan targeting users of European banks. Currently, the malware called Xenomorph may have infected as many as 50,000 devices across 56 Banks, all though a malicious app located in the Google Play Store.

In mid-1999 software and hardware developers uncovered a bug of sorts that, at first glance, seemed like it would end the computer world as we know it. It was called the Y2K bug and centered around the issue that somehow developers and built their code to with the first two digits of the year input field as hard coded to 19. This mean that when everything rolled over to year 2000, computers and software would see it as 1900. Not exactly where you want to be.

There is an old saying that say, what someone can lock, someone else can unlock. This is usually used regarding attackers getting into a network or compromising protected data. It is not often applied to security researchers unlocking information encrypted by a major ransomware threat group. However, this is exactly what has happened as researchers at Kookmin University in South Korea say they have utilized a flaw in the encryption method used by Hive Ransomware to find a way to unlock it.