Τα Windows 10 έρχονται με ενσωματωμένο network sniffer!

Από Teo Ehc -18 Μαΐου 2020, 17:26

Η Microsoft έχει προσθέσει ένα ενσωματωμένο packet network sniffer στην ενημέρωση των Windows 10 Οκτωβρίου 2018 που έχει περάσει απαρατήρητο.

Ένα πακέτο sniffer, ή network sniffer, είναι ένα πρόγραμμα που παρακολουθεί τη δραστηριότητα δικτύου που ρέει πάνω από έναν υπολογιστή σε ένα επίπεδο πακέτου.

Αυτό μπορεί να χρησιμοποιηθεί από τους διαχειριστές δικτύου για τη διάγνωση ζητημάτων δικτύωσης, για να δείτε ποιοι τύποι προγραμμάτων χρησιμοποιούνται σε ένα δίκτυο ή ακόμα και για ακρόαση σε συνομιλίες δικτύου που αποστέλλονται μέσω καθαρού κειμένου.

Ενώ οι χρήστες Linux είχαν πάντα το εργαλείο tcpdump για να εκτελούν sniffing στο δίκτυο, οι χρήστες των Windows έπρεπε να εγκαταστήσουν προγράμματα τρίτων, όπως το Microsoft Network Monitor και το Wireshark.

Όλα αυτά άλλαξαν όταν η Microsoft κυκλοφόρησε την ενημέρωση του Οκτωβρίου 2018, καθώς τώρα τα Windows 10 έρχονται με ένα νέο πρόγραμμα “Packet Monitor” που ονομάζεται pktmon.exe.

Το ενσωματωμένο packet sniffer έρχεται στα Windows 10

Με την κυκλοφορία της ενημερωμένης έκδοσης των Windows 10 Οκτωβρίου 2018, η Microsoft πρόσθεσε ήσυχα ένα νέο πρόγραμμα διαγνωστικού δικτύου και παρακολούθησης πακέτων που ονομάζεται C: \ Windows \ system32 \ pktmon.exe.

Αυτό το πρόγραμμα έχει μια περιγραφή “Παρακολούθηση εσωτερικής διάδοσης πακέτων και αναφορών πακέτων πτώσης”, η οποία υποδεικνύει ότι έχει σχεδιαστεί για τη διάγνωση προβλημάτων δικτύου.

Παρόμοια με την εντολή «netsh trace» των Windows, μπορεί να χρησιμοποιηθεί για την πλήρη επιθεώρηση πακέτων των δεδομένων που αποστέλλονται μέσω του υπολογιστή.

Αυτό το πρόγραμμα δεν έχει καμία αναφορά στον ιστότοπο της Microsoft που θα μπορούσαμε να βρούμε και έπρεπε να μάθουμε πώς να το χρησιμοποιούμε παίζοντας με το πρόγραμμα.

Ευτυχώς περιλαμβάνει ένα αρκετά εκτεταμένο σύστημα βοήθειας που μπορεί να χρησιμοποιηθεί πληκτρολογώντας ‘pktmon [command] help’.

Για παράδειγμα, pktmon filter help, θα σας δώσει την οθόνη βοήθειας για την εντολή φίλτρου.

Για να μάθετε πώς να χρησιμοποιείτε το Pktmon, σας προτείνω να διαβάσετε την τεκμηρίωση βοήθειας και να “παίξετε” με το πρόγραμμα. Παρέχουμε επίσης ένα παράδειγμα στην επόμενη ενότητα για να σας βοηθήσουμε να ξεκινήσετε.

Χρήση του Pktmon για παρακολούθηση της κυκλοφορίας δικτύου

Δυστυχώς, η κατάδυση στο πλήρες σύνολο λειτουργιών του Pktmon δεν εμπίπτει στο πεδίο εφαρμογής αυτού του άρθρου, αλλά θέλαμε να σας δείξουμε ένα βασικό παράδειγμα για το πώς μπορείτε να χρησιμοποιήσετε το εργαλείο.

Για παράδειγμα, θα χρησιμοποιήσουμε το Pktmon για την παρακολούθηση της κίνησης FTP από τον υπολογιστή στον οποίο εκτελείται.

Για να γίνει αυτό, πρέπει πρώτα να ξεκινήσουμε μια γραμμή εντολών με αναβαθμισμένα Windows 10, καθώς το Pktmon απαιτεί δικαιώματα διαχειριστή.

Στη συνέχεια, πρέπει να δημιουργήσουμε δύο φίλτρα πακέτων που θα λένε στην Pktmon ποια κίνηση θα παρακολουθεί, η οποία στο παράδειγμά μας θα είναι η κίνηση στις θύρες TCP 20 και 21.

Αυτά τα φίλτρα μπορούν να δημιουργηθούν χρησιμοποιώντας το pktmon filter add -p [port] εντολή για κάθε θύρα που θέλουμε να παρακολουθούμε.

Στη συνέχεια, μπορείτε να χρησιμοποιήσετε το pktmon filter list εντολή για να δείτε τα φίλτρα πακέτων που μόλις δημιουργήσαμε.

Για να ξεκινήσουμε την παρακολούθηση για πακέτα που επικοινωνούν με τις θύρες TCP 20 και 21, πρέπει να χρησιμοποιήσουμε το pktmon start –etw εντολή.

Μόλις εκτελεστεί, το pktmon θα καταγράψει όλα τα πακέτα σε όλες τις διασυνδέσεις δικτύου στη συσκευή σε ένα αρχείο που ονομάζεται PktMon.etl και θα καταγράψει μόνο τα πρώτα 128 bytes ενός πακέτου.

Για να το καταγράψετε ολόκληρο το πακέτο και μόνο από μια συγκεκριμένη συσκευή ethernet, μπορείτε να χρησιμοποιήσετε τα ορίσματα -p 0 (capture ολόκληρο το πακέτο) και -c 13 (λήψη μόνο από τον προσαρμογέα με ID 13).

Για να προσδιορίσετε ποιο αναγνωριστικό είναι οι προσαρμογείς σας, μπορείτε να εκτελέσετε την εντολή pktmon comp list εντολή

Όταν συνδυάζουμε όλα τα επιχειρήματα, παίρνουμε μια τελική εντολή:

Το Pktmon θα τρέξει τώρα αθόρυβα ενώ καταγράφει όλα τα πακέτα που ταιριάζουν με τα εισερχόμενα φίλτρα μας.

Για να σταματήσετε τη λήψη πακέτων, εισαγάγετε το pktmon stop εντολή και ένα αρχείο καταγραφής που ονομάζεται PktMon.etl θα έχει δημιουργηθεί στον ίδιο φάκελο που περιέχει τα ανεπεξέργαστα δεδομένα.

Αυτά τα δεδομένα σε αυτό το αρχείο δεν μπορούν να χρησιμοποιηθούν άμεσα, οπότε πρέπει να το μετατρέψετε σε μορφή κειμένου που είναι αναγνώσιμη από τον άνθρωπο με την ακόλουθη εντολή:

Ακόμα και μετατροπή σε κείμενο, δεν πρόκειται να σας δώσει τα πλήρη πακέτα, αλλά μόνο μια περίληψη της κίνησης δικτύου, όπως φαίνεται παρακάτω.

Για να επωφεληθείτε από τα καταγεγραμμένα δεδομένα, σας προτείνω να κάνετε λήψη και εγκατάσταση του Microsoft Network Monitor και να το χρησιμοποιήσετε για να δείτε το αρχείο ETL.

Χρησιμοποιώντας το Network Monitor, μπορείτε να δείτε το πλήρες πακέτο που στάλθηκε, συμπεριλαμβανομένων οποιωνδήποτε πληροφοριών σαφούς κειμένου.

Για παράδειγμα, παρακάτω μπορείτε να δείτε ένα πακέτο που περιέχει τον κωδικό πρόσβασης σαφούς κειμένου που εισαγάγαμε κατά τη σύνδεση σε αυτόν τον ιστότοπο δοκιμών FTP.

Όταν ολοκληρώσετε τη χρήση του προγράμματος Pktmon, μπορείτε να καταργήσετε όλα τα δημιουργημένα φίλτρα χρησιμοποιώντας την εντολή:

Σύντομα, παρακολούθηση σε πραγματικό χρόνο και υποστήριξη pcapng

Με την επερχόμενη έκδοση της ενημέρωσης των Windows 10 Μαΐου 2020 (Windows 10 2004), η Microsoft ενημέρωσε το εργαλείο Pktmon για να σας επιτρέπει να εμφανίζετε πακέτα που παρακολουθούνται σε πραγματικό χρόνο και να μετατρέψετε αρχεία ETL σε μορφή PCAPNG.

Στην έκδοση του Pktmon που έρχεται στην επόμενη ενημέρωση δυνατοτήτων, μπορείτε να ενεργοποιήσετε την παρακολούθηση σε πραγματικό χρόνο χρησιμοποιώντας το -l real-time διαφωνία.

Αυτό θα προκαλέσει την εμφάνιση των πακέτων που έχουν “τραβηχτεί απευθείας” στην οθόνη, ενώ θα τα αποθηκεύετε επίσης στο αρχείο ETL.

Η Microsoft προσθέτει επίσης τη δυνατότητα μετατροπής αρχείων ETL σε μορφή PCAPNG, έτσι ώστε να μπορούν να χρησιμοποιηθούν σε προγράμματα όπως το Wireshark.

Μόλις το αρχείο μετατραπεί σε μορφή PCAPNG, μπορεί να ανοίξει στο Wireshark, ώστε να μπορείτε να δείτε καλύτερα την επικοινωνία δικτύου.

Για άλλη μια φορά, αυτές οι δυνατότητες δεν είναι διαθέσιμες στα Windows 10 1903/1909 και θα έρθουν στα Windows 10 2004 όταν κυκλοφορήσουν στο τέλος του μήνα.

Windows 10 Defender's hidden features revealed by this free tool

By Lawrence Abrams May 18, 2020 08:10 AM 1




Windows 10's built-in Microsoft Defender antivirus solution has many advanced hidden features that allow you to customize how the security software works. Unfortunately, most people do not know these settings exist or even how to access them.

To view and configure the complete list of Microsoft Defender's settings, Windows users need to use the Get-MpPreference and Set-MpPreference PowerShell Commands.

To see what I mean, open an elevated PowerShell Admin prompt and type the Get-MpPreference command to get a list of all the different settings in Microsoft Defender.


READ MORE
The output of the Get-MpPreference command

As you can see, there are many more Microsoft Defender settings available than the Windows 10 user interface displays or that Microsoft turns on by default.

If you wanted to configure most of these options, you would need to use the Set-MpPreference command from an elevated PowerShell prompt.

For example, to turn off the Behavior Monitoring feature in Microsoft Defender, you would enter the PowerShell command:Set-MpPreference DisableBehaviorMonitoring True

Using ConfigureDefender to manage Microsoft Defender

Now that you know how many hidden advanced settings there are for Microsoft Defender let me introduce you to a utility called ConfigureDefender that allows you to manage them easily.

ConfigureDefender was created as part of the Hard_Configurator project but was also released as a standalone project.

Using this utility, Windows 10 users will get access to a graphical user interface that allows them to view all of Microsoft Defender's settings and easily set them.

"ConfigureDefender utility is a small GUI application to view and configure important Defender settings on Windows 10. It uses PowerShell cmdlets, with a few exceptions to change the Windows Defender settings," ConfigureDefender's GitHub page explains.

Once started, ConfigureDefender will list your current configuration and allow you to change various settings.
ConfigureDefender options

ConfigureDefender also includes predefined protection level templates named 'Default', 'High', and 'Max', that when selected, will automatically reduce or increase the protection offered by Microsoft Defender.

According to the ConfigureDefender's documentation, the three templates have the following descriptions:


DEFAULT: Microsoft Windows Defender default configuration which is applied automatically when installing the Windows system. It provides basic antivirus protection and can be used to quickly revert any configuration to Windows defaults.

HIGH: Enhanced configuration which enables Network Protection and most of Exploit Guard (ASR) features. Three Exploit Guard features and Controlled Folder Access ransomware protection are disabled to avoid false positives. This is the recommended configuration that is appropriate for most users and provides significantly increased security.

MAX: This is the most secure protection level which enables all advanced Windows Defender features and hides Windows Security Center. Configuration changes can be made only with the ConfigureDefender user interface. The "MAX" settings are intended to protect children and casual users but can be also used (with some modifications) to maximize the protection. This protection level usually generates more false positives compared to the "HIGH" settings
and may require more user knowledge or skill.

When using these templates, you will be required to reboot Windows 10 before they all go into effect.

The only option ConfigureDefender does not support is the disabling of real-time monitoring as it would cause Microsoft Defender to classify the program as malware.

As you can see, Microsoft Defender is a powerful antivirus solution hampered by the fact that some of its settings are disabled by default.

To get started learning what each setting does and increase the security of Microsoft Defender, you can read Microsoft's documentation on the Set-MpPreference command.

Νέα phishing εκστρατεία μολύνει τα θύματα με info-stealer και ransomware

 ByDigital Fortress 4 Μαΐου 2020, 13:33



Μια νέα phishing εκστρατεία διανέμει το LokiBot (malware που κλέβει πληροφορίες–info-stealer) και ένα δεύτερο payload με τη μορφή του Jigsaw Ransomware.

Με αυτό το συνδυασμό malware, οι εισβολείς κλέβουν, αρχικά, ονόματα χρηστών και κωδικούς πρόσβασης που είναι αποθηκευμένα σε διάφορες εφαρμογές και στη συνέχεια εγκαθιστούν το Jigsaw Ransomware για ζητήσουν λύτρα από τα θύματα.

Κακόβουλα Υπολογιστικά φύλλα Excel


Τα ακριβή emails που αποστέλλονται στο πλαίσιο αυτής της phishing εκστρατείας δεν έχουν βρεθεί, αλλά τα συνημμένα εμφανίζονται ως τιμολόγια, τραπεζικές μεταφορές, παραγγελίες κλπ.

Η phishing εκστρατεία χρησιμοποιεί συνημμένα Excel αρχεία, με ονόματα όπως Swift.xlsx, orders.xlsx, Invoice For Payment.xlsx, Inquiry.xlsx.

Σε αντίθεση με πολλά phishing έγγραφα, τα συγκεκριμένα φαίνονται νόμιμα ή έστω προσεκτικά φτιαγμένα, ώστε να φαίνονται αξιόπιστα.



Σύμφωνα με τον ερευνητή ασφαλείας James, που ανακάλυψε αυτήν τη phishing εκστρατεία, σε αυτά τα συνημμένα έχει χρησιμοποιηθεί το LCG Kit, που τους επιτρέπει να εκμεταλλεύονται μια παλιά Microsoft Office ευπάθεια εκτέλεσης κώδικα απομακρυσμένα (CVE-2017-11882) στο Equation Editor.

Εάν η ευπάθεια χρησιμοποιηθεί επιτυχώς, θα γίνει λήψη του malware από ένα απομακρυσμένο site και θα ξεκινήσει η εκτέλεσή του.


Σύμφωνα με τον ερευνητή, το cjjjjjjjjjjjjjjjjjjj.exe είναι το LokiBot.


Το LokiBot info-stealer έχει τη δυνατότητα να κλέβει αποθηκευμένα credentials από διάφορους browsers, FTP, mail, και terminal προγράμματα. Στη συνέχεια, στέλνει τα δεδομένα στον command and control server, που ελέγχει ο επιτιθέμενος.

Πρόσθετο ransomware payload

Επιπλέον, η παραλλαγή LokiBot που διανέμεται μέσω της phishing εκστρατείας, έχει ρυθμιστεί ώστε να εγκαθιστά μια παραλλαγή του Jigsaw Ransomware που κρυπτογραφεί τα αρχεία ενός θύματος και προσθέτει την επέκταση .zemblax στα ονόματα των αρχείων.



Τα καλά νέα είναι ότι το Jigsaw αποκρυπτογραφείται εύκολα, οπότε αν μολυνθείτε μπορείτε εύκολα να βρείτε τη λύση.

Τα κακά νέα είναι ότι το Jigsaw Ransomware θα διαγράψει για λίγο τα αρχεία σας μέχρι να πληρώσετε.

Επομένως, εάν μολυνθείτε, φροντίστε να τερματίσετε τη διαδικασία drpbx.exe χρησιμοποιώντας το Task Manager. Αν το κάνετε, το Jigsaw Ransomware θα σταματήσει και δεν θα διαγράψει τα αρχεία σας.

Καθώς αυτή η phishing εκστρατεία χρησιμοποιεί κακόβουλα υπολογιστικά φύλλα Excel, βεβαιωθείτε ότι χρησιμοποιείτε τις πιο πρόσφατες ενημερώσεις ασφαλείας για τις εγκατεστημένες εφαρμογές του Office, ώστε να παραμείνετε προστατευμένοι.

New phishing campaign packs an info-stealer, ransomware punch!!

By Lawrence Abrams May 1, 2020 01:00 PM 0



A new phishing campaign is distributing a double-punch of a LokiBot information-stealing malware along with a second payload in the form of the Jigsaw Ransomware.

By using this malware combo, the attackers first steal saved user names and passwords stored in a variety of applications and then deploy the Jigsaw Ransomware to try and get a small ransom to sweeten the attack.
Weaponized Excel spreadsheets

The exact emails sent as part of this campaign have not been found, but the attachments impersonate invoices, bank transfers, orders, and business inquiries.

Top ArticlesShade Ransomware Decryptor can now decrypt over 750K victims

This campaign is using Excel attachments with names such as Swift.xlsx, orders.xlsx, Invoice For Payment.xlsx, Inquiry.xlsx.

Unlike many phishing attachments, the actors appear to be utilizing legitimate or carefully crafted spreadsheets that have been weaponized to seem believable, as shown below.
Click to see a larger version

According to security researcher James, who discovered this campaign, these attachments have been weaponized using LCG Kit so that they exploit an old Microsoft Office CVE-2017-11882 remote code execution vulnerability in Equation Editor.
Weaponized attachment

If successfully exploited, malware will be downloaded from a remote site and executed.
The vulnerability being exploited to download malware

While this malware has since been removed from the site, James told BleepingComputer that the cjjjjjjjjjjjjjjjjjjj.exe file is LokiBot.

LokiBot has the ability to steal saved login credentials from a variety of browsers, FTP, mail, and terminal programs and then sends it back to the command and control server to be collected by the attacker.
Additional ransomware payload

In addition, this LokiBot variant has been configured to download and install a Jigsaw Ransomware variant that uses a Salvadore Dali mask from the popular Money Heist show as its background.
Jigsaw Ransomware

This Jigsaw Ransomware variant will encrypt a victim's files and append the .zemblax extension to encrypted file's names.
Encrypted Files

The good news is that Jigsaw is easily decrypted, so if you become infected with this variant, be sure to let us know so we can help.

The bad news is that the Jigsaw Ransomware will periodically delete your files until you pay.

Therefore, if you become infected, be sure to terminate the drpbx.exe process using Task Manager so that the Jigsaw Ransomware will be shut down and not delete your files.

As this phishing campaign utilizes malicious spreadsheets that exploit an old Excel vulnerability, simply making sure you are using the latest security updates for your installed Office applications will protect you.

New Android malware steals financial information, bypasses 2FA

By Sergiu Gatlan April 30, 2020 02:21 PM 0



A new banking Trojan can steal financial information from Android users across the United States and several European countries, including the UK, Germany, Italy, Spain, Switzerland, and France.

Dubbed EventBot by researchers at Cybereason Nocturnus who discovered it in March 2020, the malware is a mobile banking trojan and infostealer designed to abuse the Android operating system's accessibility features to steal sensitive financial data.

"EventBot targets users of over 200 different financial applications, including banking, money transfer services, and crypto-currency wallets," the Cybereason Nocturnus researchers found.

Top ArticlesBugs in WordPress plugins for online courses let students cheat

READ MORE

"Those targeted include applications like Paypal Business, Revolut, Barclays, UniCredit, CapitalOne UK, HSBC UK, Santander UK, TransferWise, Coinbase, Paysafecard, and many more." — the full list of targeted Android apps is available here.

At the moment, the malware is not being distributed via the Google Play Store, with its creators most likely using shady APK hosting websites and rogue APK marketplace for distribution to potential victims' devices.
Apps targeted by EventBot (Cybereason Nocturnus)
Permissions for everything

Once the targets download EventBot on their devices and start the installation process, the malware will ask to be granted a large set of permissions including the capability to run in the background, to ignore battery optimizations, and to prevent the processor from sleeping or the device from dimming the screen.

EventBot also asks to get access to Android's accessibility services which allows it to "operate as a keylogger and can retrieve notifications about other installed applications and content of open windows" once the permissions are granted.

The banking trojan also asks for permission to launch itself after system boot as a simple way to gain persistence on infected devices and run in the background as a service.

It will also request permission to read and receive SMS messages malware, thus gaining the ability to read text messages and steal one-time passcodes (OTPs) it later uses to bypass two-factor authentication (2FA) for accounts using SMS-based 2FA — EventBot also uses webinjects to circumvent 2FA.

EventBot collects the list of installed apps on the Android devices it infects, together with device info like OS and model, data that gets sent to its command-and-control server to be later harvested by its operators.
EventBot requesting permissions (Cybereason Nocturnus)
Still in development but already a threat

Although it is currently in its early stages of development, EventBot can become a major Android malware threat since it is already capable of targeting hundreds of financial apps and the developers add more new feature in each version like encryption, dynamic library loading, and automatic adjustment to device models and locales.

Because the threat actor behind this malware updates it every few days, it's just a matter of time until it catches up to other highly dangerous Android trojans like Cerberus, Anubis, and xHelper.

For instance, EventBot's developers added a layer of obfuscation in the latest version, "perhaps taking the malware one step closer to being fully operational," according to the researchers.

To defend against an EventBot infection you should avoid third-party marketplaces if possible and always install apps only from the Google Play Store as they go through a vetting process that makes sure that most potentially malicious apps are rejected.

"Cybereason believes EventBot could be the next influential mobile malware because of the time the developer has already invested into creating the code and the level of sophistication and capabilities is really high," Cybereason Head of Threat Research Assaf Dahan said.

"By accessing and stealing this data, Eventbot has the potential to access key business data, including financial data. Mobile malware is no laughing matter and it is a significant risk for organizations and consumers alike."

EventBot indicators of compromise (IOCs) including malware sample hashes, and IP addresses and domains of its command and control servers, are available at the end of Cybereason Nocturnus' report.

Starting last month, the TrickBot​​​​​ gang has also begun using a malicious Android app dubbed TrickMo that steals transaction authentication numbers (TANs) — including one-time passwords (OTP), mobile TAN (mTAN), and pushTAN authentication codes — to bypass the 2FA protection used by various banks

Threat actors release Troldesh decryption keys

RANSOMWARE


Posted: April 28, 2020 by Pieter Arntz


A GitHub user claiming to represent the authors of the Troldesh Ransomware calling themselves the “Shade team” published this statement last Sunday:


“We are the team which created a trojan-encryptor mostly known as Shade, Troldesh or Encoder.858. In fact, we stopped its distribution in the end of 2019. Now we made a decision to put the last point in this story and to publish all the decryption keys we have (over 750 thousands at all). We are also publishing our decryption soft; we also hope that, having the keys, antivirus companies will issue their own more user-friendly decryption tools. All other data related to our activity (including the source codes of the trojan) was irrevocably destroyed. We apologize to all the victims of the trojan and hope that the keys we published will help them to recover their data.”
Are these the real Troldesh decryption keys?

Yes. Since the statement and the keys were published the keys have been verified as our friends at Kaspersky have confirmed the validity of the keys and are working on a decryption tool. That tool will be added to the No More Ransom project. The “No More Ransom” website is an initiative by the National High Tech Crime Unit of the Dutch police, Europol’s European Cybercrime Centre, Kaspersky and McAfee with the goal to help victims of ransomware retrieve their encrypted data without having to pay the criminals.

In the past, a few decryption tools for some of the Troldesh variants have already been published on the “No More Ransom” website. We will update this post when the Kaspersky decryptor is released and would like to warn against following the instructions on GitHub unless you are a very skilled user. The few extra days of waiting shouldn’t hurt that much and a failed attempt may render the files completely useless.
When is it useful to use the Troldesh decryption tool?

Before you go off and run this expected tool on your victimized computer as soon as it comes out, check if your encrypted files have one of these extensions:
xtbl
ytbl
breaking_bad
heisenberg
better_call_saul
los_pollos
da_vinci_code
magic_software_syndicate
windows10
windows8
no_more_ransom
tyson
crypted000007
crypted000078
rsa3072
decrypt_it
dexter
miami_california

If the file extensions from your affected system(s) do not match one on the list above, then your files are outside of the scope of this decryption tool. If you do find a match you should wait for the decryption tool to be published.
Why would this gang publish the Troldesh decryption keys?

The reason for all this is unknown and subject to speculation. We can imagine a few different reasons. From not very likely to credible.
Maybe their conscience caught up with them. After all they do apologize to the victims. But these are only the victims that didn’t pay or were unable to recover their files despite paying the ransom.
The Shade team may suspect that someone has breached their key vault and they were forced or decided on their own accord to publish the keys for that reason. But we have seen no claims to support that possibility.
The profitability of the ransomware had reached its limit. Ransom.Troldesh has been around since 2014 and we saw a steep detection spike once the threat actors ventured outside of Russian targets in February of 2019. But after that initial spike the number of detections gradually faded out. It was still active and generating money though.Number of Malwarebytes detections of Ransom.Troldesh from July 2018 till April 2020
The development of this ransomware has reached its technical limit and the team will focus on a new software project. The team stated to have stopped distribution in the end of 2019, but failed to let on what they are currently working on.
What we know

All we know for sure is that the keys have been verified and a decryption tool is in the works. All the rest are speculations based on a statement made on GitHub by an account by the name of “shade-team” that joined GitHub on April 25th, just prior to the statement.

Victims can keep their eyes peeled for the release of the decryption tool. We’ll keep you posted.

Stay safe!

Windows 10 KB4549951 update fails to install, causes BSODs

By Sergiu Gatlan April 23, 2020 07:11 PM 1




The Windows 10 KB4549951 cumulative update is reportedly failing to install and is causing blue screens of death (BSOD) after installation reboots, among other issues, according to user reports.

KB4549951 is a cumulative update with security fixes released as part of this April 2020 Patch Tuesday for Windows 10, version 1909 and for Windows 10, version 1903.

To install KB4549951, you can either check for updates via Windows Update or manually download it for your Windows version from the Microsoft Update Catalog. Admins can distribute the update to users in their enterprise environments via Windows Server Update Services (WSUS).

For users with automatic updates enabled, installing this cumulative update requires no additional actions.

Microsoft says that they are not currently aware of any issues with the KB4549951 update according to this Windows support entry.


KB4549951 installation failures


Even though usually there are workarounds to install problematic updates manually when encountering errors, users who had to deal with KB4549951 failing to install have reported via Microsoft's official Feedback Hub, on the Microsoft Community website, and via Reddit that none of them helped.

0x80070bc2, 0x800f0900, 0x80070003, 0x80073701, 0x800f080a, 0x800f0986, and 0x80070002 errors while attempting to install KB4549951 were spotted and reported by multiple users since the cumulative update was released by Microsoft on April 14.

"It downloads and installs. During restart, I get msg that it could not install and it restores my PC back to before the update," one user says on Microsoft's Feedback Hub. "Last failed install attempt on ‎4/‎21/‎2020 - 0x80070003 troubleshooter could not fix the problem."

"Having now spent two hours waiting for these two updates to download and install then on restart it tells me we were unable to install so resetting back to how it was," another report adds.
Some of the KB4549951 issues reported via the Feedback Hub
Also causing BSODs and networking issues


More than a fair share of the user reports we saw since KB4549951 was released more than a week ago are mentioning blue screens of death (BSODs) after the system crashes during the restart that follows the update's installation process. In most of these cases, the device will reboot and will remove the update on its own.

"Windows Update KB4549951, released in the past week, caused a "BLUE SCREEN OF DEATH" on my laptop with the error message "BOOT DRIVE INACCESSIBLE", one report says.

"I came to this conclusion after 3 system restores, uninstalling recent updates sequentially and checking update reviews online. It appears that this specific update causes a system CRITICAL issue. Unfortunately, I can't pause updates for longer than a month so this is a ticking time-bomb if it's not fixed!"

Other users have also reported problems with their Windows 10 devices being unable to boot again after installing the KB4549951 cumulative update.

"My perfectly working PC died while automatically installing KB4549951 (never rebooted). Tried automatic repair, all other repair options including uninstall latest update," one Feedback Hub report says.

"Nothing worked. It was stuck in the BSoD loop, stating 'Critical Process Died'. SrtTrail log stated, 'A recently serviced boot binary is corrupt.' So I decided to clean install the Windows again. Formatted C drive, fresh clean install. Again after automatic update installing KB4549951 the system crashed and is going into 'automatic repair' mode."
Windows 10 BSOD after CRITICAL_PROCESS_DIED error
Display issues and freezes when using streaming services


Other users have experienced combinations of multiple errors ranging from their files being deleted, WiFi networking, and display issues [1, 2] that, in some cases, made their devices unusable.

"Since installing this update I have had a variety of serious issues. BSOD, Wifi connectivity issues, Display adaptor issues and a general system slowdown," a Feedback Hub report details."Streaming has become impossible on any service from Netflix to iTunes. The nastiest one is when the display goes into hibernation, the explorer goes into recovery mode and I have to restart the whole system. Not happy. when will there be a fix?"

Similar issues caused by streaming services are reportedly leading to system freezes according to other reports, with the problems disappearing once the cumulative update is uninstalled.

"Immediately after installing KB4549951 all streaming services (netflix/stan/ect) through both Edge and Chrome caused hard freezing the instant any video began playback (even the previews)," a Feedback Hub reports reads. "This issue was only triggered through playback via browser, gaming, and videos on HDD were unaffected."

"This issue was reproduced consecutively about 10 times while trying various settings to isolate the cause. Immediately after uninstalling KB4549951, postponing updates, and restarting PC, the issue was resolved and playback via browser was normal. Event Viewer shows no critical or unexpected events outside of the PC being terminated incorrectly."

As usual, it's important to understand that these issues are most probably affecting a limited number of users and that rolling back the update will most likely fix any issues you might be experiencing.
Uninstalling KB4549951


Before uninstalling the KB4549951 Cumulative Update, you should know that you would also be removing mitigation for vulnerabilities affecting the Microsoft Scripting Engine, Windows App Platform and Frameworks, Windows Cloud Infrastructure, Windows Virtualization, Microsoft Graphics Component, Windows Kernel, Windows Media, Windows Shell, Windows Management, Windows Fundamentals, Windows Virtualization, Windows Storage and Filesystems, Windows Update Stack, and the Microsoft JET Database Engine.

If the issues you are experiencing after installing this cumulative update are making your Windows device unusable and you are willing to remove the security fixes it comes with, follow the procedure described below to roll back KB4549951.

Microsoft says in the update's details from the Microsoft Update Catalog that it can be removed "by selecting View installed updates in the Programs and Features Control Panel."

The step by step procedure requires you to open Control Panel, go to Programs > Programs and Features, and click on View installed updates in the left sidebar.

Next, right-click on KB4549951's entry in the list and confirm when asked if "Are you sure you want to uninstall this update?". Next, you'll have to click 'Yes' when asked and then restart your device.
Uninstalling the KB4549951 update

iOS Mail bug allows remote zero-click attacks

MAC


Posted: April 22, 2020 by Thomas Reed


On Monday, ZecOps released a report about a couple concerning vulnerabilities with the Mail app in iOS. These vulnerabilities would allow an attacker to execute arbitrary code in the Mail app or the maild process that assists the Mail app behind the scenes. Most concerning, though, is the fact that even the most current version of iOS, 13.4.1, is vulnerable.

The way the attack works is that the threat actor sends an email message designed to cause a buffer overflow in Mail (or maild). A buffer overflow is a bug in code that allows an attack to happen if the threat actor is able to fill a block of memory beyond its capacity. Essentially, the attacker writes garbage data that fills up the memory, then writes code that overwrites existing code in adjoining memory, which later gets executed by the vulnerable process.
The bad news

The vulnerabilities disclosed by ZecOps would allow an attacker to use such a buffer overflow to attack an iOS device remotely, on devices running iOS 6 through iOS 13.4.1. (ZecOps writes that it may work on even older versions of iOS, but they did not test that.)

On iOS 12, the attack requires nothing more than viewing a malicious email message in the Mail app. It would not require tapping a link or any other content within the message. On iOS 13, the situation is worse, as the attack can be carried out against the maild process in the background, without requiring any user interaction (ie, it is a “zero-click vulnerability”).

In the case of infection on iOS 13, there would be no significant sign of infection, other than temporary slowness of the Mail app. In some cases, evidence of a failed attack may be present in the form of messages that have no content and cannot be displayed.

The messages—shown in the image above from the ZecOps blog—may be visible for a limited time. Once an attack is successful, the attacker would presumably use access to the Mail app to delete these messages, so the user may never see them.
The good news

I know how this sounds. This is an attack that can be carried out by any threat actor who has your email address, on the latest version of iOS, and the infection happens in the background without requiring action from the user. How is there good news here?!

Fortunately, there is. The vulnerabilities revealed by ZecOps only allow an attack of the Mail app itself. Using those vulnerabilities, an attacker would be able to capture your email messages, as well as modify and delete messages. Presumably the attacker would also be able to conduct other normal Mail operations, such as sending messages from your email address, although this was not mentioned. While this isn’t exactly comforting, it falls far short of compromising the entire device.

In order to achieve a full device compromise, the attacker would need to have another vulnerability. This means that if you have version 13.4.1, it would require a publicly unknown vulnerability, which would for the most part restrict such an attack to a nation-state-level adversary.

In other words, someone would have to be willing to risk burning a zero-day vulnerability, worth potentially a million dollars or more, to infect your phone. This means that you’re unlikely to be infected unless some hostile government or other powerful group is interested in spying on you.

If you are, for example, a human rights advocate working against a repressive regime, or a member of an oppressed minority in such a country, you may be a target. Similarly, if you are a journalist covering such news, you may be a target. You could also be at risk if you are an important business person, such as a CEO or CFO at a major corporation, or hold an important role in the government. The average person will not be at significant risk from this kind of attack.
Why disclose now?

It is common practice as part of “responsible disclosure” to avoid public mention of a major vulnerability until after it has been fixed, or until sufficient time has passed that it is believed the software or hardware vendor does not intend to fix the vulnerability in a timely fashion. Release of this kind of information before a fix is available can lead to increased danger to users, as hackers who learn that a vulnerability exists can find it for themselves.

Of course, this must be balanced against the risk of existing attacks that are going undetected. Disclosure can help people who are under active attack to discover the problem, and can help people who are not yet under attack learn how to prevent an attack.

With this in mind, ZecOps mentioned three reasons why they chose to disclose now:
Since the disclosed vulnerabilities can’t be used to compromise the entire device without additional vulnerabilities, the risk of disclosure is lower.
Apple has released a beta of iOS 13.4.5, which addresses the issue. Although a fix in beta is not exactly the same as a fix in a public release, the changes in the beta could be analyzed by an attacker, which would lead to discovery of the vulnerabilities. Essentially, the vulnerabilities have been disclosed to malicious hackers already, but the public was unaware.
At least six organizations were under active attack using these vulnerabilities. (The organizations were not named.)
What you should do

First, don’t panic. As mentioned, this is not a widespread attack against everyone using an iPhone. There have been other zero-click vulnerabilities used to push malware onto iPhones in the past, yet none have ever been widespread. This is because the more widespread such an attack becomes, the more likely it is to be spotted, and subsequently fixed by Apple.

To protect their investment in million-dollar iOS zero-day vulnerabilities, powerful organizations use those vulnerabilities sparingly, only against targeted individuals or groups. Thus, unless you’re someone who might be targeted by a hostile nation or other powerful organization, you’re not likely to be in danger.

However, the risk does increase following disclosure, as malicious hackers can discover and use the vulnerability to attack Mail, at least. So you shouldn’t ignore the risk, either.

As much as I’d like to say, “Install Malwarebytes, run a scan, and remove the malware,” I can’t. Unlike macOS, installing antivirus software isn’t possible on iOS, due to Apple restrictions. So there is no software that can scan an iPhone or iPad for malware.

This, plus the lack of noticeable symptoms, means that it will be difficult to determine whether you’ve been affected. As always with iOS, if you have reason to believe you’ve been infected, your only option is to reset your device to factory state and set it up again from scratch as if it were a new device.

As for precautions to avoid infection, there are a couple things you can do. One would be to install the iOS 13.4.5 beta, which contains a fix for the bug. This is not something that’s easy to do, however, as you need an Apple developer account to download the beta. Plus, using a beta version of iOS, which may have bugs, isn’t recommended for all users.

The other possible security measure would be to disable Mail until the next version of iOS is released publicly. To do so, open the Settings app and scroll down to Password & Accounts. Tap that, then look at the list of accounts.

You may have multiple accounts, as shown above, or only one. For any accounts that say “Mail” underneath, that means that you’re using Mail to download mail for that account. Tap on each account, and on the next screen, look for the Mail toggle.

The image above shows that Mail is enabled. Toggle the switch to off. Do this for each of your accounts, and do not switch Mail back on again until you’ve updated to a version of iOS newer than 13.4.1.

Stay safe, everyone!

Anonymous Global Hackers Crew: Αποκλειστική συνέντευξη στο SecNews

 By Hack Unamatata 16 Απριλίου 2020, 21:11

Η hacking ομάδα Anonymous Global Hackers Crew σε πρώτη αποκλειστική συνέντευξη στο SecNews παρουσιάζει την δική της οπτική για την (αν)ασφάλεια στο διαδίκτυο. Ο Anon, ένας από τους τέσσερις ιδρυτές του Global Hackers Crew μιλάει για την ιστορία της hacking ομάδας, τους δεσμούς που ενώνουν τα μέλη της, τον πόλεμο που δέχονται από τα Μέσα Μαζικής Ενημέρωσης και τις κυβερνήσεις, τις hacking εκστρατείες και τους στόχους τους, μείζονα θέματα επικαιρότητας όπως η πανδημία COVID-19 και πολλά άλλα.


Αυτοαποκαλούνται “cyber vigilantes” (ήρωες-τιμωροί) αλλά και hacktivists καθώς κύριος στόχος της δουλειάς τους είναι το κοινό καλό. Σύμφωνα με τον Anon «είναι υπέροχο να ξυπνάμε τους ανθρώπους και στόχος μας είναι να απελευθερώσουμε τις μάζες από την προπαγάνδα»

Η Anonymous Global Hackers Crew ομάδα αποτελείται από έμπειρους hackers, κάθε ηλικίας, με εξαιρετικές ικανότητες πάνω στον προγραμματισμό, το coding, Password guessing και cracking, session hijacking, session spoofing, network traffic sniffing, denial of Service attacks, exploiting buffer overflow vulnerabilities, SQL injection και άλλα.


Πως ξεκίνησαν οι Global Hackers Crew;

Οι Global Hackers Crew «δημιουργήθηκαν τυχαία», σύμφωνα με τον Anon.

«Ασχολούμαι με το hacking από το 93’-94’ κάνοντας παράλληλα και άλλα πράγματα γύρω από τους Η/Υ όπως το να τρέχω το δικό μου σύστημα με bots. Τότε γράφαμε κώδικα σε βάρδιες οπότε στο διάλλειμά μου έβλεπα τηλεόραση. Μια μέρα, σε κάποιο διάλειμμα μου έπεσα πάνω σε μια διαφήμιση για ένα site με webcam shows για ενήλικους. Από περιέργεια, το επισκέφτηκα χωρίς να γνωρίζω ακριβώς τι έκανα και άλλαζα συνεχώς «δωμάτια». Εκεί γνώρισα κάποια, που στην συνέχεια, έγινε η κοπέλα μου και μου έδειξε μια διαφορετική πλευρά αυτού του site», αναφέρει ο hacker. Στο συγκεκριμένο site γνωριμιών συνέβαιναν παράνομα πράγματα στο παρασκήνιο. Ο Anon θέλησε να ξεσκεπάσει τους διαχειριστές της ιστοσελίδας για τις ανήθικες δραστηριότητες τους.


«Έτσι, ξεκίνησα έναν μικρό πόλεμο με τα αφεντικά αυτής της εταιρείας και τυχαία ενώ πήγαινα να συναντήσω την κοπέλα μου, γνώρισα κάποιον στο λεωφορείο που ήταν και αυτός hacker με τον οποίον δεθήκαμε και, στη συνέχεια, έγινε ένα από τα ιδρυτικά μέλη των Global Hackers Crew,» τονίζει ο Anon. Στα ιδρυτικά μέλη προστέθηκαν και δύο ακόμη φίλοι των δύο hackers.

Με αυτόν τον τρόπο βρέθηκαν μαζί οι τέσσερις ιδρυτές των Global Hackers Crew. Με τον καιρό, η ομάδα μεγάλωνε καθώς όλο και περισσότεροι άνθρωποι ήθελαν να συμμετάσχουν στις επιχειρήσεις τους. «Δρούμε για το καλό των ανθρώπων, προειδοποιώντας τους για τους online κινδύνους όπως οι διαρροές ασφαλείας, κάτι που συνέβη πρόσφατα με το Zoom..» τονίζει ο hacker.

Οι Global Hackers Crew εντάχθηκαν στους Anonymous επειδή εντόπισαν πολλά κοινά στις επιχειρήσεις τους.


Οι Anonymous είναι μια αποκεντρωμένη διεθνής hacktivist ομάδα που είναι ευρέως γνωστή για τις διάφορες κυβερνοεπιθέσεις εναντίον πολλών κυβερνήσεων, κυβερνητικών θεσμών και κυβερνητικών υπηρεσιών και εταιρειών.

Οι Anonymous δημιουργήθηκαν το 2003 στο imageboard 4chan που αντιπροσωπεύει την έννοια πολλών χρηστών της κοινότητας στο διαδίκτυο αλλά και στη πραγματική ζωή που ταυτόχρονα υπήρχαν ως αναρχικοί. Τα ανώνυμα μέλη μπορούν να διακριθούν δημόσια από τη χρήση μάσκας Guy Fawkes στο στυλ που απεικονίζεται στο γραφικό μυθιστόρημα και την ταινία V for Vendetta. Ωστόσο, αυτό μπορεί να μην συμβαίνει πάντα, καθώς ορισμένα από τα μέλη προτιμούν να καλύπτουν το πρόσωπό τους χωρίς να χρησιμοποιούν τη γνωστή μάσκα ως μεταμφίεση. Μερικοί Anonymous επιλέγουν επίσης να καλύψουν τις φωνές τους μέσω των προγραμμάτων αλλοίωσης φωνής.

Παρακολουθήστε όλη την συνέντευξη των Anonymous Global Hackers Crew στο Youtube channel του SecNews και αν επιθυμείτε να μάθετε ακόμα περισσότερα για την δράση των hackers επισκεφθείτε το YouTube channel τους και το Twitter account τους.