Windows 10 KB4549951 update fails to install, causes BSODs

By Sergiu Gatlan April 23, 2020 07:11 PM 1




The Windows 10 KB4549951 cumulative update is reportedly failing to install and is causing blue screens of death (BSOD) after installation reboots, among other issues, according to user reports.

KB4549951 is a cumulative update with security fixes released as part of this April 2020 Patch Tuesday for Windows 10, version 1909 and for Windows 10, version 1903.

To install KB4549951, you can either check for updates via Windows Update or manually download it for your Windows version from the Microsoft Update Catalog. Admins can distribute the update to users in their enterprise environments via Windows Server Update Services (WSUS).

For users with automatic updates enabled, installing this cumulative update requires no additional actions.

Microsoft says that they are not currently aware of any issues with the KB4549951 update according to this Windows support entry.


KB4549951 installation failures


Even though usually there are workarounds to install problematic updates manually when encountering errors, users who had to deal with KB4549951 failing to install have reported via Microsoft's official Feedback Hub, on the Microsoft Community website, and via Reddit that none of them helped.

0x80070bc2, 0x800f0900, 0x80070003, 0x80073701, 0x800f080a, 0x800f0986, and 0x80070002 errors while attempting to install KB4549951 were spotted and reported by multiple users since the cumulative update was released by Microsoft on April 14.

"It downloads and installs. During restart, I get msg that it could not install and it restores my PC back to before the update," one user says on Microsoft's Feedback Hub. "Last failed install attempt on ‎4/‎21/‎2020 - 0x80070003 troubleshooter could not fix the problem."

"Having now spent two hours waiting for these two updates to download and install then on restart it tells me we were unable to install so resetting back to how it was," another report adds.
Some of the KB4549951 issues reported via the Feedback Hub
Also causing BSODs and networking issues


More than a fair share of the user reports we saw since KB4549951 was released more than a week ago are mentioning blue screens of death (BSODs) after the system crashes during the restart that follows the update's installation process. In most of these cases, the device will reboot and will remove the update on its own.

"Windows Update KB4549951, released in the past week, caused a "BLUE SCREEN OF DEATH" on my laptop with the error message "BOOT DRIVE INACCESSIBLE", one report says.

"I came to this conclusion after 3 system restores, uninstalling recent updates sequentially and checking update reviews online. It appears that this specific update causes a system CRITICAL issue. Unfortunately, I can't pause updates for longer than a month so this is a ticking time-bomb if it's not fixed!"

Other users have also reported problems with their Windows 10 devices being unable to boot again after installing the KB4549951 cumulative update.

"My perfectly working PC died while automatically installing KB4549951 (never rebooted). Tried automatic repair, all other repair options including uninstall latest update," one Feedback Hub report says.

"Nothing worked. It was stuck in the BSoD loop, stating 'Critical Process Died'. SrtTrail log stated, 'A recently serviced boot binary is corrupt.' So I decided to clean install the Windows again. Formatted C drive, fresh clean install. Again after automatic update installing KB4549951 the system crashed and is going into 'automatic repair' mode."
Windows 10 BSOD after CRITICAL_PROCESS_DIED error
Display issues and freezes when using streaming services


Other users have experienced combinations of multiple errors ranging from their files being deleted, WiFi networking, and display issues [1, 2] that, in some cases, made their devices unusable.

"Since installing this update I have had a variety of serious issues. BSOD, Wifi connectivity issues, Display adaptor issues and a general system slowdown," a Feedback Hub report details."Streaming has become impossible on any service from Netflix to iTunes. The nastiest one is when the display goes into hibernation, the explorer goes into recovery mode and I have to restart the whole system. Not happy. when will there be a fix?"

Similar issues caused by streaming services are reportedly leading to system freezes according to other reports, with the problems disappearing once the cumulative update is uninstalled.

"Immediately after installing KB4549951 all streaming services (netflix/stan/ect) through both Edge and Chrome caused hard freezing the instant any video began playback (even the previews)," a Feedback Hub reports reads. "This issue was only triggered through playback via browser, gaming, and videos on HDD were unaffected."

"This issue was reproduced consecutively about 10 times while trying various settings to isolate the cause. Immediately after uninstalling KB4549951, postponing updates, and restarting PC, the issue was resolved and playback via browser was normal. Event Viewer shows no critical or unexpected events outside of the PC being terminated incorrectly."

As usual, it's important to understand that these issues are most probably affecting a limited number of users and that rolling back the update will most likely fix any issues you might be experiencing.
Uninstalling KB4549951


Before uninstalling the KB4549951 Cumulative Update, you should know that you would also be removing mitigation for vulnerabilities affecting the Microsoft Scripting Engine, Windows App Platform and Frameworks, Windows Cloud Infrastructure, Windows Virtualization, Microsoft Graphics Component, Windows Kernel, Windows Media, Windows Shell, Windows Management, Windows Fundamentals, Windows Virtualization, Windows Storage and Filesystems, Windows Update Stack, and the Microsoft JET Database Engine.

If the issues you are experiencing after installing this cumulative update are making your Windows device unusable and you are willing to remove the security fixes it comes with, follow the procedure described below to roll back KB4549951.

Microsoft says in the update's details from the Microsoft Update Catalog that it can be removed "by selecting View installed updates in the Programs and Features Control Panel."

The step by step procedure requires you to open Control Panel, go to Programs > Programs and Features, and click on View installed updates in the left sidebar.

Next, right-click on KB4549951's entry in the list and confirm when asked if "Are you sure you want to uninstall this update?". Next, you'll have to click 'Yes' when asked and then restart your device.
Uninstalling the KB4549951 update

iOS Mail bug allows remote zero-click attacks

MAC


Posted: April 22, 2020 by Thomas Reed


On Monday, ZecOps released a report about a couple concerning vulnerabilities with the Mail app in iOS. These vulnerabilities would allow an attacker to execute arbitrary code in the Mail app or the maild process that assists the Mail app behind the scenes. Most concerning, though, is the fact that even the most current version of iOS, 13.4.1, is vulnerable.

The way the attack works is that the threat actor sends an email message designed to cause a buffer overflow in Mail (or maild). A buffer overflow is a bug in code that allows an attack to happen if the threat actor is able to fill a block of memory beyond its capacity. Essentially, the attacker writes garbage data that fills up the memory, then writes code that overwrites existing code in adjoining memory, which later gets executed by the vulnerable process.
The bad news

The vulnerabilities disclosed by ZecOps would allow an attacker to use such a buffer overflow to attack an iOS device remotely, on devices running iOS 6 through iOS 13.4.1. (ZecOps writes that it may work on even older versions of iOS, but they did not test that.)

On iOS 12, the attack requires nothing more than viewing a malicious email message in the Mail app. It would not require tapping a link or any other content within the message. On iOS 13, the situation is worse, as the attack can be carried out against the maild process in the background, without requiring any user interaction (ie, it is a “zero-click vulnerability”).

In the case of infection on iOS 13, there would be no significant sign of infection, other than temporary slowness of the Mail app. In some cases, evidence of a failed attack may be present in the form of messages that have no content and cannot be displayed.

The messages—shown in the image above from the ZecOps blog—may be visible for a limited time. Once an attack is successful, the attacker would presumably use access to the Mail app to delete these messages, so the user may never see them.
The good news

I know how this sounds. This is an attack that can be carried out by any threat actor who has your email address, on the latest version of iOS, and the infection happens in the background without requiring action from the user. How is there good news here?!

Fortunately, there is. The vulnerabilities revealed by ZecOps only allow an attack of the Mail app itself. Using those vulnerabilities, an attacker would be able to capture your email messages, as well as modify and delete messages. Presumably the attacker would also be able to conduct other normal Mail operations, such as sending messages from your email address, although this was not mentioned. While this isn’t exactly comforting, it falls far short of compromising the entire device.

In order to achieve a full device compromise, the attacker would need to have another vulnerability. This means that if you have version 13.4.1, it would require a publicly unknown vulnerability, which would for the most part restrict such an attack to a nation-state-level adversary.

In other words, someone would have to be willing to risk burning a zero-day vulnerability, worth potentially a million dollars or more, to infect your phone. This means that you’re unlikely to be infected unless some hostile government or other powerful group is interested in spying on you.

If you are, for example, a human rights advocate working against a repressive regime, or a member of an oppressed minority in such a country, you may be a target. Similarly, if you are a journalist covering such news, you may be a target. You could also be at risk if you are an important business person, such as a CEO or CFO at a major corporation, or hold an important role in the government. The average person will not be at significant risk from this kind of attack.
Why disclose now?

It is common practice as part of “responsible disclosure” to avoid public mention of a major vulnerability until after it has been fixed, or until sufficient time has passed that it is believed the software or hardware vendor does not intend to fix the vulnerability in a timely fashion. Release of this kind of information before a fix is available can lead to increased danger to users, as hackers who learn that a vulnerability exists can find it for themselves.

Of course, this must be balanced against the risk of existing attacks that are going undetected. Disclosure can help people who are under active attack to discover the problem, and can help people who are not yet under attack learn how to prevent an attack.

With this in mind, ZecOps mentioned three reasons why they chose to disclose now:
Since the disclosed vulnerabilities can’t be used to compromise the entire device without additional vulnerabilities, the risk of disclosure is lower.
Apple has released a beta of iOS 13.4.5, which addresses the issue. Although a fix in beta is not exactly the same as a fix in a public release, the changes in the beta could be analyzed by an attacker, which would lead to discovery of the vulnerabilities. Essentially, the vulnerabilities have been disclosed to malicious hackers already, but the public was unaware.
At least six organizations were under active attack using these vulnerabilities. (The organizations were not named.)
What you should do

First, don’t panic. As mentioned, this is not a widespread attack against everyone using an iPhone. There have been other zero-click vulnerabilities used to push malware onto iPhones in the past, yet none have ever been widespread. This is because the more widespread such an attack becomes, the more likely it is to be spotted, and subsequently fixed by Apple.

To protect their investment in million-dollar iOS zero-day vulnerabilities, powerful organizations use those vulnerabilities sparingly, only against targeted individuals or groups. Thus, unless you’re someone who might be targeted by a hostile nation or other powerful organization, you’re not likely to be in danger.

However, the risk does increase following disclosure, as malicious hackers can discover and use the vulnerability to attack Mail, at least. So you shouldn’t ignore the risk, either.

As much as I’d like to say, “Install Malwarebytes, run a scan, and remove the malware,” I can’t. Unlike macOS, installing antivirus software isn’t possible on iOS, due to Apple restrictions. So there is no software that can scan an iPhone or iPad for malware.

This, plus the lack of noticeable symptoms, means that it will be difficult to determine whether you’ve been affected. As always with iOS, if you have reason to believe you’ve been infected, your only option is to reset your device to factory state and set it up again from scratch as if it were a new device.

As for precautions to avoid infection, there are a couple things you can do. One would be to install the iOS 13.4.5 beta, which contains a fix for the bug. This is not something that’s easy to do, however, as you need an Apple developer account to download the beta. Plus, using a beta version of iOS, which may have bugs, isn’t recommended for all users.

The other possible security measure would be to disable Mail until the next version of iOS is released publicly. To do so, open the Settings app and scroll down to Password & Accounts. Tap that, then look at the list of accounts.

You may have multiple accounts, as shown above, or only one. For any accounts that say “Mail” underneath, that means that you’re using Mail to download mail for that account. Tap on each account, and on the next screen, look for the Mail toggle.

The image above shows that Mail is enabled. Toggle the switch to off. Do this for each of your accounts, and do not switch Mail back on again until you’ve updated to a version of iOS newer than 13.4.1.

Stay safe, everyone!

Anonymous Global Hackers Crew: Αποκλειστική συνέντευξη στο SecNews

 By Hack Unamatata 16 Απριλίου 2020, 21:11

Η hacking ομάδα Anonymous Global Hackers Crew σε πρώτη αποκλειστική συνέντευξη στο SecNews παρουσιάζει την δική της οπτική για την (αν)ασφάλεια στο διαδίκτυο. Ο Anon, ένας από τους τέσσερις ιδρυτές του Global Hackers Crew μιλάει για την ιστορία της hacking ομάδας, τους δεσμούς που ενώνουν τα μέλη της, τον πόλεμο που δέχονται από τα Μέσα Μαζικής Ενημέρωσης και τις κυβερνήσεις, τις hacking εκστρατείες και τους στόχους τους, μείζονα θέματα επικαιρότητας όπως η πανδημία COVID-19 και πολλά άλλα.


Αυτοαποκαλούνται “cyber vigilantes” (ήρωες-τιμωροί) αλλά και hacktivists καθώς κύριος στόχος της δουλειάς τους είναι το κοινό καλό. Σύμφωνα με τον Anon «είναι υπέροχο να ξυπνάμε τους ανθρώπους και στόχος μας είναι να απελευθερώσουμε τις μάζες από την προπαγάνδα»

Η Anonymous Global Hackers Crew ομάδα αποτελείται από έμπειρους hackers, κάθε ηλικίας, με εξαιρετικές ικανότητες πάνω στον προγραμματισμό, το coding, Password guessing και cracking, session hijacking, session spoofing, network traffic sniffing, denial of Service attacks, exploiting buffer overflow vulnerabilities, SQL injection και άλλα.


Πως ξεκίνησαν οι Global Hackers Crew;

Οι Global Hackers Crew «δημιουργήθηκαν τυχαία», σύμφωνα με τον Anon.

«Ασχολούμαι με το hacking από το 93’-94’ κάνοντας παράλληλα και άλλα πράγματα γύρω από τους Η/Υ όπως το να τρέχω το δικό μου σύστημα με bots. Τότε γράφαμε κώδικα σε βάρδιες οπότε στο διάλλειμά μου έβλεπα τηλεόραση. Μια μέρα, σε κάποιο διάλειμμα μου έπεσα πάνω σε μια διαφήμιση για ένα site με webcam shows για ενήλικους. Από περιέργεια, το επισκέφτηκα χωρίς να γνωρίζω ακριβώς τι έκανα και άλλαζα συνεχώς «δωμάτια». Εκεί γνώρισα κάποια, που στην συνέχεια, έγινε η κοπέλα μου και μου έδειξε μια διαφορετική πλευρά αυτού του site», αναφέρει ο hacker. Στο συγκεκριμένο site γνωριμιών συνέβαιναν παράνομα πράγματα στο παρασκήνιο. Ο Anon θέλησε να ξεσκεπάσει τους διαχειριστές της ιστοσελίδας για τις ανήθικες δραστηριότητες τους.


«Έτσι, ξεκίνησα έναν μικρό πόλεμο με τα αφεντικά αυτής της εταιρείας και τυχαία ενώ πήγαινα να συναντήσω την κοπέλα μου, γνώρισα κάποιον στο λεωφορείο που ήταν και αυτός hacker με τον οποίον δεθήκαμε και, στη συνέχεια, έγινε ένα από τα ιδρυτικά μέλη των Global Hackers Crew,» τονίζει ο Anon. Στα ιδρυτικά μέλη προστέθηκαν και δύο ακόμη φίλοι των δύο hackers.

Με αυτόν τον τρόπο βρέθηκαν μαζί οι τέσσερις ιδρυτές των Global Hackers Crew. Με τον καιρό, η ομάδα μεγάλωνε καθώς όλο και περισσότεροι άνθρωποι ήθελαν να συμμετάσχουν στις επιχειρήσεις τους. «Δρούμε για το καλό των ανθρώπων, προειδοποιώντας τους για τους online κινδύνους όπως οι διαρροές ασφαλείας, κάτι που συνέβη πρόσφατα με το Zoom..» τονίζει ο hacker.

Οι Global Hackers Crew εντάχθηκαν στους Anonymous επειδή εντόπισαν πολλά κοινά στις επιχειρήσεις τους.


Οι Anonymous είναι μια αποκεντρωμένη διεθνής hacktivist ομάδα που είναι ευρέως γνωστή για τις διάφορες κυβερνοεπιθέσεις εναντίον πολλών κυβερνήσεων, κυβερνητικών θεσμών και κυβερνητικών υπηρεσιών και εταιρειών.

Οι Anonymous δημιουργήθηκαν το 2003 στο imageboard 4chan που αντιπροσωπεύει την έννοια πολλών χρηστών της κοινότητας στο διαδίκτυο αλλά και στη πραγματική ζωή που ταυτόχρονα υπήρχαν ως αναρχικοί. Τα ανώνυμα μέλη μπορούν να διακριθούν δημόσια από τη χρήση μάσκας Guy Fawkes στο στυλ που απεικονίζεται στο γραφικό μυθιστόρημα και την ταινία V for Vendetta. Ωστόσο, αυτό μπορεί να μην συμβαίνει πάντα, καθώς ορισμένα από τα μέλη προτιμούν να καλύπτουν το πρόσωπό τους χωρίς να χρησιμοποιούν τη γνωστή μάσκα ως μεταμφίεση. Μερικοί Anonymous επιλέγουν επίσης να καλύψουν τις φωνές τους μέσω των προγραμμάτων αλλοίωσης φωνής.

Παρακολουθήστε όλη την συνέντευξη των Anonymous Global Hackers Crew στο Youtube channel του SecNews και αν επιθυμείτε να μάθετε ακόμα περισσότερα για την δράση των hackers επισκεφθείτε το YouTube channel τους και το Twitter account τους.

Exclusive interview with Anonymous Global Hackers Crew

https://www.youtube.com/user/AnonymousGHC Exclusive interview with Anonymous Global Hackers Crew, the prominent Hackers...

Posted by SecNews on Thursday, April 16, 2020

TikTok Users Beware: This Is How Hackers Can Send Dangerous Videos To Your iPhone Or Android

 Zak Doffman Contributor Cybersecurity
I write about security and surveillance.





With heightened awareness of misinformation and the need to turn to official sources for online advice, the risk that hackers might be able to swap out that information is serious. Well, that’s what a pair of enterprising security researchers have managed to do, exploiting a security weakness with hyper-popular TikTok to plant videos in users’ feeds that appear to come from official sources.

The hack requires access to a user’s router, ISP or VPN, but in many parts of the world that’s easily done by threat actors. And it’s in those parts of the world that a campaign to plant misinformation would be most effective. TikTok has received its fair share of criticism over alleged content censorship in the past, but it has not been accused of manipulating official feeds. This, then, is a major issue.

The issue is TikTok’s continued use of an insecure HTTP connection for the delivery of its video content—this makes it faster and simpler, but also open to interception and manipulation. That’s the reason major platforms and browsers are pushing so hard for a shift to HTTPS. TikTok uses content delivery networks to push content to a global audience now measured in the hundreds of millions. Those CDNs distribute content over HTTP connections to TikTok users. “This can be easily tracked,” the researchers warn, “and even altered by malicious actors.”


The researchers have previous form with TikTok. Talal Haj Bakry and Tommy Mysk reported Apple’s copy/paste issue, whereby any active app can “snoop” on the universal clipboard. TikTok was highlighted as a high-profile example of one such app doing exactly that. For its part, TikTok said the fault was with an outdated version of a Google SDK which is due to be replaced in its next update. If so, that vulnerability will be closed. This latest one, though, remains open.


Apple and Google want all data pushed to users’ phones to be secure. But, as explained by the researchers, the two tech giants “still provide a way for developers to opt-out of HTTPS for backwards-compatibility. However, this should be the exception rather than the rule, and most apps have made the transition to HTTPS.” They warn users that “TikTok for iOS (Version 15.5.6) and TikTok for Android (Version 15.7.4) still use unencrypted HTTP to connect to the TikTok CDN.”

This security gap enabled the team to monitor the videos being watched by specific users or IP addresses, and, with control of a user’s access point, to mount a man in the middle attack “to alter the downloaded content.”

The researchers prepared some fake videos, using the newsworthy disinformation surrounding the coronavirus pandemic as their lure. “The circulation of misleading and fake videos in a popular platform such as TikTok poses huge risks,” they said, on disclosing their POC. They then hosted those videos on a server of their own that had been set up to mimic a TikTok CDN. With control of a user’s DNS settings, mimicking what's possible with control an ISP, potentially impacting millions, “we directed the app to our fake server. Because it impersonates TikTok servers, the app cannot tell that it is communicating with a fake server. Thus, it will blindly consume any content downloaded from it.”

The message to TikTok from the research team is the same as last time—please urgently address the security risk. “As demonstrated, HTTP opens the door for server impersonation and data manipulation—this makes a perfect tool for those who relentlessly try to pollute the internet with misleading facts. TikTok, a social networking giant with around 800 million monthly active users, must adhere to industry standards in terms of data privacy and protection.”

The integrity of the information we consume has never been more critical than now. Misinformation around coronavirus and 5G, as well as the ongoing political battles between the U.S. and China, has raised the stakes considerably. And with the U.S. election due in November, it has the potential to get worse. This risk is now in the public domain, it can therefore be exploited. It needs fixing and fast.

TikTok was approached for any comments on this story.

New Wiper Malware impersonates security researchers as prank

By Lawrence Abrams April 12, 2020 11:15 AM 0




A malware distributor has decided to play a nasty prank by locking victim's computers before they can start Windows and then blaming the infection on two well-known and respected security researchers.

Over the past 24 hours, after downloading and installing software from what appears to be free software and crack sites, people suddenly find that they are locked out of their computer before Windows starts.

When locked out, the PC will display a message stating that they were infected by Vitali Kremez and MalwareHunterTeam, who are both well-known malware and security researchers and have nothing to do with this malware.
MBR locker impersonating Vitali and MalwareHunterTeam

The full text of this MBRLocker can be read below: Hello, my name is Vitali Kremez. I infected your stupid PC. you idiot. Write me in twitter @VK_intel if you want your computer back If I do not answer, write my husband twitter.com/malwrhunterteam To protect your ***ing computer in future install SentinelOne antivirus. I work here as head of labs. Vitali Kremez Inc. () 2020


MBRLockers are programs that replace the 'master boot record' of a computer so that it prevents the operating system from starting and displays a ransom note or other message instead.

This type of infection is used in ransomware attacks such as Petya or as a destructive wiper to prevent people from accessing their files.

In this particular case, it looks like a malware developer or distributor is trying to tarnish the name of Kremez and MalwareHunterTeam and released this infection as a destructive prank.

To reiterate, MalwareHunterTeam and Kremez have nothing to do with this infection.
Recovery may be possible

Recently, there has been a flurry of new MBRLockers being released that appear to be created for 'fun' or as part of 'pranks'.
Example of recent MBRLocker

Recently, a flurry of MBRLockers have been created using a publicly available tool being promoted on YouTube and Discord. BleepingComputer believes that this tool was used to create this MBRLocker to troll both Kremez and MalwareHunterTeam.

When creating MBRLockers using this tool, the malware will first make a backup of the original MBR of the computer to a safe location before replacing it.

If this wiper is using the same MBRLocker builder, then it will be possible to recover the MBR so people can gain access to their computer.

In one sample, there was also a fail-safe keyboard combination of pressing the CTRL+ALT+ESC keys at the same time to restore the MBR and boot the computer.

Unfortunately, we have not been able to get the sample of this malware as of yet to determine if its the same builder or if the keyboard combination works.

If you have been infected and know where you downloaded the file, please submit a sample here or contact us on Twitter with the site you downloaded the file.

Copycat criminals abuse Malwarebytes brand in malvertising campaign

EXPLOITS AND VULNERABILITIES

Posted: April 7, 2020 by Threat Intelligence Team

While exploit kit activity has been fairly quiet for some time now, we recently discovered a threat actor creating a copycat—fake—Malwarebytes website that was used as a gate to the Fallout EK, which distributes the Raccoon stealer.

The few malvertising campaigns that remain are often found on second- and third-tier adult sites, leading to the Fallout or RIG exploit kits, as a majority of threat actors have moved on to other distribution vectors. However, we believe this faux Malwarebytes malvertising campaign could be payback for our continued work with ad networks to track, report, and dismantle such attacks.

In this blog, we break down the attack and possible motives.
Stolen template includes malicious code

A few days ago, we were alerted about a copycat domain name that abused our brand. The domain malwarebytes-free[.]com was registered on March 29 via REGISTRAR OF DOMAIN NAMES REG.RU LLC and is currently hosted in Russia at 173.192.139[.]27.

Examining the source code, we can confirm that someone stole the content from our original site but added something extra.

A JavaScript snippet checks which kind of browser you are running, and if it happens to be Internet Explorer, you are redirected to a malicious URL belonging to the Fallout exploit kit.
Infection chain for copycat campaign

This fake Malwarebytes site is actively used as a gate in a malvertising campaign via the PopCash ad network, which we contacted to report the malicious advertiser.

Fallout EK is one of the newer (or perhaps last) exploit kits that is still active in the wild. In this sequence, it is used to launch the Raccoon stealer onto victim machines.
A motive behind decoy pages

The threat actor behind this campaign may be tied to others we’ve been tracking for a few months. They have used similar fake copycat templates before that act as gates. For example, this fake Cloudflare domain (popcashexhange[.]xyz) also plays on the PopCash name:

There is no question that security companies working with providers and ad networks are hindering efforts and money spent by cybercriminals. We’re not sure if we should take this plagiarism as a compliment or not.

If you are an existing Malwarebytes user, you were already safe from this malvertising campaign, thanks to our anti-exploit protection.

Copycat tactics have long been used by scammers and other criminals to dupe online and offline victims. As always, it is better to double-check the identity of the website you are visiting and, if in doubt, access it directly either by punching in the URL or via bookmarked page/tab.
Indicators of compromise

Fake Malwarebytes sitemalwarebytes-free[.]com
31.31.198[.]161


Fallout EK134.209.86[.]129


Raccoon Stealer78a90f2efa2fdd54e3e1ed54ee9a18f1b91d4ad9faedabd50ec3a8bb7aa5e330
34.89.159[.]33

Firefox 75 released today with Windows 10 performance improvements

By Sergiu Gatlan April 7, 2020 01:27 PM 0



Mozilla has released Firefox 75 today, April 7th, 2020, to the Stable desktop channel for Windows, macOS, and Linux with bug fixes, new features, and security fixes.

Included with today's release are performance improvements for Windows 10 users, improved search from the address bar, and improved HTTPS compatibility by local caching some trusted certificates.

Windows, Mac, and Linux desktop users can upgrade to Firefox 75 by going to Options -> Help -> About Firefox and the browser will automatically check for the new update and install it when available.



With the release of Firefox 75, all other Firefox development branches have also moved up a version bringing Firefox Beta to version 76 and the Nightly builds to version 77.

You can download Firefox 75 from the following links:
Firefox 75 for Windows 64-bit
Firefox 75 for Windows 32-bit
Firefox 75 for macOS
Firefox 75 for Linux 64-bit
Firefox 75 for Linux 32-bit

If the above links haven't yet been updated for Firefox 75, you can also manually download it from Mozilla's FTP release directory.

Below you can find the major changes in Firefox 75, but for those who wish to read the full release notes, you can do so here.
Improved Windows 10 performance, flatpaks, more

Firefox 75 promises better performance on devices running Windows 10 due to the integration of DirectComposition that further improves rendering on laptops with built-in Intel graphics cards with the help of the WebRender GPU-based 2D rendering engine.

"Direct Composition is being integrated for our users on Windows to help improve performance and enable our ongoing work to ship WebRender on Windows 10 laptops with Intel graphics cards," Mozilla says.

Starting with this release, Firefox is also available in the Flatpak application distribution format that makes it a lot easier and more secure to install the web browser on Linux-powered systems.

Firefox 75 will also locally cache all trusted Web PKI Certificate Authority certificates that Mozilla knows, improving security and HTTPS compatibility with misconfigured web servers as a direct result.
Faster search via a revamped address bar

Mozilla has also refreshed the look of the address bar in Firefox 75 by enlarging it every time you start a search, as well as "simplified it in a single view with larger font, shorter URLs, adjusts to multiple sizes and a shortcut to the most popular sites to search."

The built-in search engine is also smarter now as it will provide you with bolded search suggestions and autocomplete based on websites you have in your bookmarks, history, or popular websites.

Firefox 75's address bar will also display your top sites — most recently and frequently visited sites, or sites that you’ve pinned — right under the address bar for quick and easy access.
Revamped Firefox search bar (Mozilla)

This is the full list of changes related to the improved search and address bar:

Focused, clean search experience that's optimized for smaller laptop screens
Top sites now appear when you select the address
Improved readability of search suggestions with a focus on new search terms
Suggestions include solutions to common Firefox issues
On Linux, the behavior when clicking on the Address Bar and the Search Bar now matches other desktop platforms: a single click selects all without primary selection, a double click selects a word, and a triple-click selects all with primary selection
Security vulnerabilities fixed

Mozilla has also fixed six security vulnerabilities in Firefox 75, three of them rated as high severity and the other three as having a moderate security impact.

The full list of security issues patched by Mozilla in Firefox 75.0:


• CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method
• CVE-2020-6825: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7
• CVE-2020-6826: Memory safety bugs fixed in Firefox 75
• CVE-2020-6822: Out of bounds write in GMPDecodeData when processing large images
• CVE-2020-6823: Malicious Extension could obtain auth codes from OAuth login flows
• CVE-2020-6824: Generated passwords may be identical on the same site between separate private browsing sessions

Last week, Mozilla also released Firefox 74.0.1 to address two critical zero-day vulnerabilities that were actively exploited by threat actors in the wild that could lead to remote code execution on machines running unpatched Firefox versions.
Other bug fixes, improvements, and developer changes
Enterprise:


Experimental support for using client certificates from the OS certificate store can be enabled on macOS by setting the preference security.osclientcerts.autoload to true.


Enterprise policies may be used to exclude domains from being resolved via TRR (Trusted Recursive Resolver) using DNS over HTTPS.
Developer:
Save bandwidth and reduce browser memory by using the loading attribute on the element. The default "eager" value loads images immediately, and the "lazy" value delays loading until the image is within range of the viewport.


Instant evaluation for Console expressions lets developers identify and fix errors more rapidly than before. As long as expressions typed into the Web Console is side-effect free, their results will be previewed while you type.

Νέα malware εκστρατεία με θέμα τον COVID-19 διαδίδει το LokiBot trojan

 By Pohackontas 6 Απριλίου 2020, 15:31

Οι ερευνητές ασφαλείας της FortiGuard Labs ανακάλυψαν μια νέα εκστρατεία που εκμεταλλεύεται το ξέσπασμα του Κορωνοϊού COVID-19, αποστέλλοντας emails που υποτίθεται ότι προέρχονται από τον Παγκόσμιο Οργανισμό Υγείας (ΠΟΥ) με στόχο να διαδώσει ένα malware, το LokiBot trojan. Η malware εκστρατεία με θέμα τον COVID-19 αποκαλύφθηκε στις 27 Μαρτίου, όταν οι ερευνητές ανακάλυψαν emails που υποτίθεται ότι προέρχονταν από τον ΠΟΥ με στόχο να ανακοινώσουν τρόπους αντιμετώπισης της παραπληροφόρησης που σχετίζεται με το ξέσπασμα του COVID-19. Τα εν λόγω emails χρησιμοποιούν ένα συνημμένο με τίτλο “COVID_19- WORLD ORGANIZATION HEALTH CDC_DOC.zip.arj”, το οποίο διαδίδει το LokiBot trojan.

Η FortiGuard Labs ανακάλυψε πρόσφατα ένα νέο email με θέμα τον COVID-19 που αποστέλλεται από το [159.69.16 [.] 177], το οποίο χρησιμοποιεί το εμπορικό σήμα του Παγκόσμιου Οργανισμού Υγείας, σε μια προσπάθεια να πείσει τους παραλήπτες για την αυθεντικότητά του. Το email έχει ως τίτλο θέματος “Ασθένεια Κορωνοϊού (COVID-19) Σημαντική ανακοίνωση [.] . 

Περιλαμβάνει επίσης ένα συνημμένο με τίτλο “COVID_19- WORLD ORGANIZATION HEALTH CDC_DOC.zip.arj” που φαίνεται να περιέχει πρόσθετες πληροφορίες, αλλά στην πραγματικότητα είναι παγίδα για να λάβουν οι παραλήπτες το malware. 

Επιπλέον, το email περιέχει πληροφορίες σχετικά με την πανδημία μαζί με προτάσεις και συμβουλές αντιμετώπισης. Είναι γραμμένο στα Αγγλικά, αλλά οι ερευνητές πιστεύουν ότι οι χάκερς που κρύβονται πίσω από αυτή την εκστρατεία δεν είναι αγγλόφωνοι, λαμβάνοντας υπόψη την ορθογραφία, την γραμματική και τα σημεία στίξης που χρησιμοποιούν. Το μήνυμα υποτίθεται ότι προέρχεται από ένα Κέντρο Ελέγχου Ασθενειών του ΠΟΥ. 

Φαίνεται ότι οι χάκερς συνδέουν το όνομα του ΠΟΥ με το Αμερικανικό Κέντρο Ελέγχου Ασθενειών (CDC), παρά το γεγονός ότι οι δύο οργανισμοί είναι ξεχωριστοί. Το συνημμένο “COVID_19- WORLD ORGANIZATION HEALTH ORGANIZATION CDC_DOC.zip.arj” είναι ένα συμπιεσμένο αρχείο σε μορφή ARJ, μία μορφή που πιθανότατα 

χρησιμοποιήθηκε για να αποφευχθεί η ανίχνευση. Κάνοντας κλικ στο συνημμένο και αποσυμπιέζοντας το αρχείο, οι χρήστες θα δουν μια επέκταση “DOC.pdf.exe” αντί για το “Doc.zip.arj”, που τους παροτρύνει  να ανοίξουν το αρχείο.

 .

Μόλις ανοίξει το αρχείο, ξεκινά η έγχυση του LokiBot trojan. Τότε, το malware κλέβει ευαίσθητες πληροφορίες, όπως διάφορα credentials, συμπεριλαμβανομένων των FTP credentials, των αποθηκευμένων κωδικών πρόσβασης email, των κωδικών πρόσβασης που αποθηκεύονται στο πρόγραμμα περιήγησης και άλλα. URL: hxxp: / / bslines [.] Xyz / copy / five / fre.php.


Το LokiBot είναι γνωστό από το 2015. Πρόκειται για ένα malware που έχει χρησιμοποιηθεί σε πολλές malspam εκστρατείες με στόχο να κλέψει credentials από προγράμματα περιήγησης, emails πελατών, εργαλεία διαχείρισης, ενώ έχει χρησιμοποιηθεί επίσης με στόχο κατόχους κρυπτονομισμάτων. Το αρχικό malware LokiBot αναπτύχθηκε και πωλήθηκε μέσω email από έναν χάκερ που εμφανίζεται στο διαδίκτυο με το ψευδώνυμο “lokistov” (γνωστός και ως Carter). Διαφημίστηκε αρχικά σε πολλά hacking φόρουμ, στα οποία πωλούταν έως και 300 δολάρια, ενώ αργότερα άλλοι χάκερς άρχισαν να το προσφέρουν κάτω από 80 δολάρια σε “υποχθόνια” κυβερνοεγκλήματα.

Οι ερευνητές της FortiGuard αποκάλυψαν ότι χρήστες από όλο τον κόσμο έχουν μολυνθεί από την συγκεκριμένη malware εκστρατεία που εκμεταλλεύεται τον COVID-19, οι περισσότεροι εκ των οποίων βρίσκονται στην Τουρκία (29%), την Πορτογαλία (19%), τη Γερμανία (12%), την Αυστρία (10%) και τις ΗΠΑ (10%). Μολύνσεις που σχετίζονται με αυτήν την εκστρατεία εντοπίστηκαν επίσης στο Βέλγιο, το Πουέρτο Ρίκο, την Ιταλία, τον Καναδά και την Ισπανία.

Online banking: Επιθέσεις λόγω κορωνοϊού- Πως να προστατευτείτε;

 By Hack Unamatata 6 Απριλίου 2020, 14:21

Το online banking φαίνεται να έχει μπει στο στόχαστρο των χάκερς, οι οποίοι ψάχνουν τα επόμενα θύματα τους κατά την κρίση του κορωνοϊού.

Η πανδημία του κορωνοϊού, παρόλο που βρίσκεται ακόμα στους πρώτους μήνες της, αναδιαμορφώνει γρήγορα τον τρόπο που οι άνθρωποι σε όλο τον κόσμο ζουν την καθημερινή τους ζωή. Τόσο η κοινωνική απομάκρυνση όσο και οι επικλήσεις να παραμείνετε στο σπίτι για να αποφύγετε περιττές αλληλεπιδράσεις σημαίνουν επανεξέταση του τρόπου προσέγγισης των καθημερινών σας διαδράσεων, συμπεριλαμβανομένης της διαχείρισης των χρημάτων σας.


Εν μέσω της τρέχουσας αβεβαιότητας, οι τράπεζες ενθαρρύνουν τους πελάτες να επωφεληθούν από τις υπηρεσίες online, κινητής τηλεφωνίας και τηλεφωνικής εξυπηρέτησης, αντί για επισκέψεις σε υποκαταστήματα. Μαζί με την υψηλότερη ζήτηση του online banking, αυξάνεται και ο κίνδυνος εγκλημάτων στον κυβερνοχώρο.

Η Ομοσπονδιακή Επιτροπή Εμπορίου έχει εντείνει τις προσπάθειές της για να προειδοποιήσει τους Αμερικανούς για τις απάτες γύρω από τον COVID-19 που αφορούν προσφορές για εμβόλια, ψεύτικες φιλανθρωπικές οργανώσεις, αλλά και παραδοσιακές απάτες ηλεκτρονικού ταχυδρομείου.

Δυστυχώς, σε περιόδους πραγματικής κρίσης αναδεικνύονται τόσο οι άνθρωποι που θέλουν να βοηθούν, όσο και εκείνοι που θα προσπαθήσουν να εκμεταλλευτούν τους ανυποψίαστους. Αν ανησυχείτε για το τι σημαίνει αυτό για την ασφάλεια των online τραπεζικών συναλλαγών σας, υπάρχουν διάφορα βήματα που μπορείτε να ακολουθήσετε για να προστατέψετε τις πληροφορίες σας.

Γνωρίστε τις διαδικασίες ασφαλείας της τράπεζας σας

Το πρώτο βήμα για τη διαφύλαξη του τραπεζικού σας λογαριασμού είναι να μάθετε τι μέτρα διαθέτει η τράπεζα σας για να σας προστατεύσει.

Οι τράπεζες μπορούν να εφαρμόσουν πολλαπλά επίπεδα ασφάλειας για τo online banking, όπως:
Κρυπτογράφηση Secure Socket Layer (SSL)
Αυτόματη αποσύνδεση
Προγραμματισμός προστασίας από ιούς και κακόβουλο λογισμικό
Firewalls
Επαλήθευση πολλών παραγόντων
Τεχνολογία αναγνώρισης βιομετρικών στοιχείων και / ή προσώπου

Όλα αυτά μπορούν να λειτουργήσουν ως ισχυρή άμυνα εναντίον των χάκερ που μπορεί να προσπαθήσουν να σπάσουν τους λογαριασμούς σας. Αν δεν είστε βέβαιοι για το τι κάνει η τράπεζά σας για να διατηρήσει ασφαλή τα online τραπεζικά σας στοιχεία κατά των απειλών, ελέγξτε πρώτα τον ιστότοπο ή την εφαρμογή για κινητά. Αν δεν είναι άμεσα σαφές, μη διστάσετε να επικοινωνήσετε με την τράπεζά σας για να δείτε τι μέτρρα ασφαλείας υπάρχουν.

Αποφύγετε τη χρήση του δημόσιου Wi-Fi για να αποκτήσετε πρόσβαση στο online banking σας

Η απομακρυσμένη εργασία και η εκμάθηση γίνονται όλο και περισσότερο μέρος της νέας εποχής για πολλά άτομα και οικογένειες εν μέσω της κρίσης του COVID-19. Σε μια προσπάθεια να εξασφαλίσουν πως όλοι όσοι θέλουν μπορούν να έχουν πρόσβαση στο διαδίκτυο, ορισμένοι πάροχοι υπηρεσιών διαδικτύου έχουν δημιουργήσει, τουλάχιστον σε προσωρινή βάση, δωρεάν hotspot Wi-Fi.

Παρόλο που αυτό είναι βολική, η χρήση του δημόσιου Wi-Fi μπορεί να θέσει σε κίνδυνο τις τραπεζικές σας πληροφορίες, εάν η σύνδεση δεν είναι ασφαλής. Το δημόσιο Wi-Fi μπορεί εύκολα να χτυπηθεί με πολλούς τρόπους, συμπεριλαμβανομένων των επιθέσεων “man-in-the-middle“, στις οποίες ένας απατεώνας είναι σε θέση να τραβήξει ουσιαστικά τις τραπεζικές σας πληροφορίες.

Καλό είναι να αποφεύγετε τα δημόσια Wi-Fi και να βασίζεστε στην ασφαλή πρόσβαση στο διαδίκτυο από το σπίτι. Ωστόσο, εάν για οποιονδήποτε λόγο χρησιμοποιείτε δημόσιο Wi-Fi αυτές τις μέρες, βεβαιωθείτε ότι η σύνδεση είναι ασφαλής πριν συνδεθείτε σε οποιαδήποτε online τραπεζική συναλλαγή.

Ενημερώστε τους κωδικούς πρόσβασης σας στο online banking

Αυτός είναι ένας απλός τρόπος για να προστατεύσετε τα στοιχεία των τραπεζικών σας συναλλαγών σας ανά πάσα στιγμή, αλλά μπορεί να είναι ιδιαίτερα σημαντικός κατά τη διάρκεια της τρέχουσας κρίσης του κοροναϊού.

Εάν δεν έχετε ενημερώσει πρόσφατα τους κωδικούς πρόσβασής σας, προσθέστε το στη λίστα σας. Και θυμηθείτε να κάνετε τους κωδικούς σας όσο το δυνατόν πιο μοναδικούς. Αυτές οι συμβουλές μπορούν να βοηθήσουν:
Δημιουργήστε κωδικούς πρόσβασης χρησιμοποιώντας έναν συνδυασμό γραμμάτων, αριθμών και συμβόλων.
Μην υποθέτετε ότι αλλάζοντας ένα γράμμα ή ένα ψηφίο ενός παλιού κωδικού είναι αρκετό.
Κάντε χρήση μια φράσης ή ακρωνύμιου αντί για μια λέξη.

Επίσης, σκεφτείτε τη χρήση ενός διαχειριστή κωδικών πρόσβασης αν δυσκολευτείτε να θυμηθείτε τους κωδικούς πρόσβασης στους τραπεζικούς λογαριασμούς σας. Δημιουργήστε μια συνήθεια να ενημερώσετε τους κωδικούς πρόσβασης σας κάθε τρεις έως τέσσερις μήνες.

Παρακολούθηση δραστηριότητας με τραπεζικές ειδοποιήσεις

Οι τραπεζικές ειδοποιήσεις μπορούν να είναι ένα χρήσιμο εργαλείο για τη διαχείριση της ασφάλειας στο διαδίκτυο, ειδικά αν δεν έχετε χρόνο να συνδέεστε στον τραπεζικό σας λογαριασμό καθημερινά.

Με τις τραπεζικές ειδοποιήσεις του online banking, μπορείτε να λάβετε ειδοποίηση μέσω ηλεκτρονικού ταχυδρομείου ή κειμένου όταν υπάρχει νέα δραστηριότητα στους λογαριασμούς σας. Οι τύποι ειδοποιήσεων που μπορείτε να ορίσετε περιλαμβάνουν:
Ειδοποιήσεις συναλλαγών για χρεώσεις και πιστώσεις πάνω από ένα ποσό που καθορίζετε
Αποτυχημένες προσπάθειες σύνδεσης
Ενημέρωση κωδικού πρόσβασης ή προσωπικών πληροφοριών
Οικονομικές συναλλαγές
Καθημερινή παρακολούθηση λογαριασμού

Η ενεργοποίηση ειδοποιήσεων σημαίνει ότι δεν χρειάζεται να ανησυχείτε συνεχώς για το αν οι πληροφορίες σας σχετικά με τις τραπεζικές συναλλαγές σας βρίσκονται σε κίνδυνο. Αν για παράδειγμα, λάβετε ένα μήνυμα ηλεκτρονικού ταχυδρομείου που σας ειδοποιεί για μια νέα συναλλαγή, μπορείτε να συνδεθείτε για να επαληθεύσετε ότι είναι κάτι που εξουσιοδοτήσατε.

Να είστε προσεκτικοί σχετικά με τη χορήγηση πρόσβασης στον λογαριασμό σας

Οι οικονομικές εφαρμογές μπορούν να διευκολύνουν τη διαχείριση των χρημάτων κατά τη διάρκεια μιας πανδημίας. Για παράδειγμα, αντί να κάνετε ανάληψη μετρητών στο ΑΤΜ για να εξοφλήσετε έναν φίλο, μπορείτε να χρησιμοποιήσετε μια εφαρμογή πληρωμής από για να πληρώσετε ηλεκτρονικά.

Η παγίδα είναι ότι πολλές οικονομικές εφαρμογές απαιτούν πρόσβαση στις σας τραπεζικές πληροφορίες. Αυτός είναι ο τρόπος με τον οποίο λειτουργούν πολλές εφαρμογές διαχείρισης budget. Συγχρονίζετε τους τραπεζικούς λογαριασμούς σας και η εφαρμογή παρακολουθεί αυτόματα τις δαπάνες και τις καταθέσεις σας.

Αυτό μπορεί να διευκολύνει την σας ζωή κατά την κρίση του κοροναϊού, αλλά θα μπορούσε να θέσει σε κίνδυνο τις πληροφορίες σας εάν εξουσιοδοτείτε την πρόσβαση για εφαρμογές που δεν είναι ασφαλείς. Παρόλο που η τράπεζά σας μπορεί να είναι απόλυτα ασφαλής και να λαμβάνει μέτρα για την εξασφάλιση των ηλεκτρονικών σας πληροφοριών, η εφαρμογή πληρωμής ή shopping που χρησιμοποιείτε μπορεί να αποτελέσει στόχο για επίδοξους χάκερς.

Μην πέσετε θύμα σε απάτες ηλεκτρονικού “ψαρέματος”

Κατά τη διάρκεια μιας κρίσης, οι απάτες ηλεκτρονικού ταχυδρομείου, τηλεφώνου και ηλεκτρονικού ψαρέματος συχνά αφθονούν. Για παράδειγμα, έχει ήδη εντοπιστεί μία απάτη phishing που περιλαμβάνει ψεύτικα email που φαίνεται να προέρχονται από τον Παγκόσμιο Οργανισμό Υγείας.

Οι απάτες ηλεκτρονικού “ψαρέματος” μπορούν να έχουν διαφορετικούς στόχους. Κάποιοι, όπως η απάτη του Π.Ο.Υ., προσπαθούν να σας κάνουν να κάνετε κλικ σε έναν σύνδεσμο μέσα στο σώμα κειμένου του email. Όταν κάνετε κλικ στο σύνδεσμο, μπορείτε να κατεβάσετε εν αγνοία σας κακόβουλο λογισμικό ή λογισμικό παρακολούθησης της συσκευής σας, το οποίο επιτρέπει στους απατεώνες να κλέψουν τις πληροφορίες σας.

Άλλες απάτες μπορούν να έχουν μια πιο άμεση προσέγγιση για να προσπαθήσουν να πάρουν στα χρήματά σας. Για παράδειγμα, μπορείτε να λάβετε ένα μήνυμα ηλεκτρονικού ταχυδρομείου ή ένα κείμενο από μια φαινομενικά φιλανθρωπική οργάνωση που ζητάει δωρεές. Σας ζητείται να δώσετε τον αριθμό της χρεωστικής σας κάρτας ή τον αριθμό του τραπεζικού σας λογαριασμού για να κάνετε μια δωρεά.

Μια άλλη κοινή τακτική που χρησιμοποιούν οι απατεώνες για phishing, είναι η αποστολή email από μια διεύθυνση που με την πρώτη ματιά φαίνεται ότι ήρθε από την τράπεζά σας. Και ενώ υποθέτετε ότι είναι ασφαλές να κάνετε κλικ σε ένα σύνδεσμο ή να απαντήσετε με τις πληροφορίες που ζητούνται στο email, αποδεικνύεται ότι μοιραστήκατε τα στοιχεία σας με έναν scammer.

How Just Visiting A Site Could Have Hacked Your iPhone or MacBook Camera

April 02, 2020Ravie Lakshmanan
 

If you use Apple iPhone or MacBook, here we have a piece of alarming news for you.

Turns out merely visiting a website — not just malicious but also legitimate sites unknowingly loading malicious ads as well — using Safari browser could have let remote attackers secretly access your device's camera, microphone, or location, and in some cases, saved passwords as well.

Apple recently paid a $75,000 bounty reward to an ethical hacker, Ryan Pickren, who practically demonstrated the hack and helped the company patch a total of seven new vulnerabilities before any real attacker could take advantage of them.

The fixes were issued in a series of updates to Safari spanning versions 13.0.5 (released January 28, 2020) and Safari 13.1 (published March 24, 2020).


"If the malicious website wanted camera access, all it had to do was masquerade as a trusted video-conferencing website such as Skype or Zoom," Pickren said.

When chained together, three of the reported Safari flaws could have allowed malicious sites to impersonate any legit site a victim trusts and access camera or microphone by abusing the permissions that were otherwise explicitly granted by the victim to the trusted domain only.


An Exploit Chain to Abuse Safari's Per-Site Permissions
Safari browser grants access to certain permissions such as camera, microphone, location, and more on a per-website basis. This makes it easy for individual websites, say Skype, to access the camera without asking for the user's permission every time the app is launched.

But there are exceptions to this rule on iOS. While third-party apps must require user's explicit consent to access the camera, Safari can access the camera or the photo gallery without any permission prompts.

Specifically, improper access is made possible by leveraging an exploit chain that stringed together multiple flaws in the way the browser parsed URL schemes and handled the security settings on a per-website basis. This method only works with websites that are currently open.



"A more important observation was that the URL's scheme is completely ignored," Pickren noted. "This is problematic because some schemes don't contain a meaningful hostname at all, such as file:, javascript:, or data:."

Put another way, Safari failed to check if the websites adhered to the same-origin policy, thereby granting access to a different site that shouldn't have obtained permissions in the first place. As a result, a website such as "https://example.com" and its malicious counterpart "fake://example.com" could end up having the same permissions.

Thus, by taking advantage of Safari's lazy hostname parsing, it was possible to use a "file:" URI (e.g., file:///path/to/file/index.html) to fool the browser into changing the domain name using JavaScript.


"Safari thinks we are on skype.com, and I can load some evil JavaScript. Camera, Microphone, and Screen Sharing are all compromised when you open my local HTML file," Pickren said.

The research found that even plaintext passwords can be stolen this way as Safari uses the same approach to detect websites on which password auto-fill needs to be applied.

Furthermore, auto-download preventions can be bypassed by first opening a trusted site as a pop-up, and subsequently using it to download a malicious file.

Likewise, a "blob:" URI (e.g. blob://skype.com) can be exploited to run arbitrary JavaScript code, using it to directly access the victim's webcam without permission.

In all, the research uncovered seven different zero-day vulnerabilities in Safari —



CVE-2020-3852: A URL scheme may be incorrectly ignored when determining multimedia permission for a website
CVE-2020-3864: A DOM object context may not have had a unique security origin
CVE-2020-3865: A top-level DOM object context may have incorrectly been considered secure
CVE-2020-3885: A file URL may be incorrectly processed
CVE-2020-3887: A download's origin may be incorrectly associated
CVE-2020-9784: A malicious iframe may use another website's download settings
CVE-2020-9787: A URL scheme containing dash (-) and period (.) adjacent to each other is incorrectly ignored when determining multimedia permission for a website

If you are a Safari user, it's recommended that you keep the browser up-to-date and ensure websites are granted access to only those settings which are essential for them to function.

New Coronavirus-Themed Malware Locks You Out of Windows, but there's a simple fix

By Lawrence Abrams April 2, 2020 04:46 PM 2



With school closed due to the Coronavirus pandemic, some kids are creating malware to keep themselves occupied. Such is the case with a variety of new MBRLocker variants being released, including one with a Coronavirus theme.

MBRLockers are programs that replace the 'master boot record' of a computer so that it prevents the operating system from starting and displays a ransom note or other message instead.

Some MBRLockers such as Petya and GoldenEye also encrypt the table that contains the partition information for your drives, thus making it impossible to access your files or rebuild the MBR without entering a code or paying a ransom.
Petya Ransomware
First MBRLocker with a Coronavirus theme

Last week, MalwareHunterTeam discovered the installer for a new malware with the name of "Coronavirus" being distributed as the COVID-19.exe file.



When installed, the malware will extract numerous files to a folder under %Temp% and then executes a batch file named Coronavirus.bat. This batch file will move the extracted files to a C:\COVID-19 folder, configure various programs to start automatically on login, and then restart Windows.
Coronavirus.bat file

After Windows is restarted, a picture of the Coronavirus will be displayed along with a message stating "coronavirus has infected your PC!"
The Coronavirus image shown after the first reboot

Analysis by both SonicWall and Avast states that another program will also be executed that backs up the boot drive's Master Boot Record (MBR) to another location and then replaces it with a custom MBR.
MBR being backed up and overwritten
Source: SonicWall

On reboot, the custom Master Boot Record will display a message stating "Your Computer Has Been Trashed" and Windows will not start.
MBRLock lock screen

Thankfully, the analysis by Avast shows that a bypass has been added to the custom MBR code that allows you to restore your original Master Boot Record so that you can boot normally. This can be done by pressing the CTRL+ALT+ESC keys at the same time.

Further research by BleepingComputer has discovered another variant from the same developer called 'RedMist'. When installed, instead of showing the Coronavirus image, it shows an image of Squidward stating "Squidward is watching you".

Like the Coronavirus version, this variant will warn you that after rebooting you will not be able to gain access to Windows again.
Squidward/RedMist version

This variant also supports the CTRL+ALT+ESC bypass so that you can restore the original MBR.

It should be noted that these infections do not delete your data or destroy the partition table. Simply restoring the MBR from the backup location will allow you to start Windows and access your data again.
A steady stream of MBRLockers being made

BleepingComputer has been able to find numerous MBRLocker variants being released over the past week using different messages, memes, and inside jokes,

All of these MBRLocker variants are being made with a publicly available tool that was released on YouTube and Discord. BleepingComputer will not be publishing the name of the tool to prevent further variants from being released.

Below is a small sample of the various MBRLockers released this week and created using this utility.












BleepingComputer believes that all of these MBRLockers are being created for 'fun' or as part of 'pranks' to be played on people.

While it is not known if they are being distributed maliciously, users should still be especially careful of running any programs shared by other people, especially on Discord, without first scanning them using VirusTotal.

Microsoft: Emotet Took Down a Network by Overheating All Computers

By Sergiu Gatlan April 3, 2020 03:25 PM 0



Microsoft says that an Emotet infection was able to take down an organization's entire network by maxing out CPUs on Windows devices and bringing its Internet connection down to a crawl after one employee was tricked to open a phishing email attachment.

"After a phishing email delivered Emotet, a polymorphic virus that propagates via network shares and legacy protocols, the virus shut down the organization’s core services," DART said.

"The virus avoided detection by antivirus solutions through regular updates from an attacker-controlled command-and-control (C2) infrastructure, and spread through the company’s systems, causing network outages and shutting down essential services for nearly a week."
All systems down within a week

The Emotet payload was delivered and executed on the systems of Fabrikam — a fake name Microsoft gave the victim in their case study — five days after the employee's user credentials were exfiltrated to the attacker's command and control (C&C) server.

Before this, the threat actors used the stolen credentials to deliver phishing emails to other Fabrikam employees, as well as to their external contacts, with more and more systems getting infected and downloading additional malware payloads.

The malware further spread through the network without raising any red flags by stealing admin account credentials authenticating itself on new systems, later used as stepping stones to compromise other devices.

Within 8 days since that first booby-trapped attachment was opened, Fabrikam's entire network was brought to its knees despite the IT department's efforts, with PCs overheating, freezing, and rebooting because of blue screens, and Internet connections slowing down to a crawl because of Emotet devouring all the bandwidth.
Emotet attack flow (Microsoft DART)

"When the last of their machines overheated, Fabrikam knew the problem had officially spun out of control. 'We want to stop this hemorrhaging,' an official would later say," DART's case study report reads.

"He’d been told the organization had an extensive system to prevent cyberattacks, but this new virus evaded all their firewalls and antivirus software. Now, as they watched their computers blue-screen one by one, they didn’t have any idea what to do next."

Based on what the official said following the incident, although not officially confirmed, the attack described by Microsoft's Detection and Response Team (DART) matches a malware attack that impacted the city of Allentown, Pennsylvania in February 2018, as ZDNet first noticed.

At the time, Mayor Ed Pawlowski said that the city had to pay nearly $1 million to Microsoft to clean out their systems, with an initial $185,000 emergency-response fee to contain the malware and up to $900,000 in additional recovery costs, as first reported by The Morning Call.
Emotet infection aftermath and containment procedures

"Officials announced that the virus threatened all of Fabrikam’s systems, even its 185-surveillance camera network," DART's report says.

"Its finance department couldn’t complete any external banking transactions, and partner organizations couldn’t access any databases controlled by Fabrikam. It was chaos.

"They couldn’t tell whether an external cyberattack from a hacker caused the shutdown or if they were dealing with an internal virus. It would have helped if they could have even accessed their network accounts.

"Emotet consumed the network’s bandwidth until using it for anything became practically impossible. Even emails couldn’t wriggle through."

Microsoft's DART — a remote team and one that would deal with the attack on site — was called in eight days after the first device on Fabrikam's network was compromised.

DART contained the Emotet infection using asset controls and buffer zones designed to isolate assets with admin privileges.

They eventually were able to completely eradicate the Emotet infection after uploading new antivirus signatures and deploying Microsoft Defender ATP and Azure ATP trials to detect and remove the malware.

Microsoft recommends using email filtering tools to automatically detect and stop phishing emails that spread the Emotet infection, as well as the adoption of multi-factor authentication (MFA) to stop the attackers from taking advantage of stolen credentials.
Emotet infection chain (CISA)
Emotet infections can lead to severe outcomes

Emotet, originally spotted as a banking Trojan in 2014, has evolved into a malware loader used by threat actors to install other malware families including but not limited to the Trickbot banking Trojan (a known vector used in the delivery of Ryuk ransomware payloads).

Emotet was recently upgraded with a Wi-Fi worm module designed to help it spread to new victims via nearby insecure wireless networks.

Recently, in January 2020, the Cybersecurity and Infrastructure Security Agency (CISA) warned government and private organizations, as well as home users, of increasing activity around targeted Emotet attacks.

In November 2019, the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) also warned of the dangers behind Emotet attacks, saying at the time that the malware "provides an attacker with a foothold in a network from which additional attacks can be performed, often leading to further compromise through the deployment of ransomware."

Emotet ranked first in a 'Top 10 most prevalent threats' ranking published by interactive malware analysis platform Any.Run at the end of December 2019, with triple the number of sample uploads submitted for analysis when compared to the next malware in the top, the Agent Tesla info-stealer.

CISA provides general best practices to limit the effect of Emotet attacks and to contain network infections within an Emotet Malware alert published two years ago and updated earlier this year.

Discord Turned Into an Account Stealer by Updated Malware

By Lawrence Abrams April 3, 2020 06:07 PM



A new version of the popular AnarchyGrabber Discord malware has been released that modifies the Discord client files so that it can evade detection and steal user accounts every time someone logs into the chat service.

AnarchyGrabber is a popular malware distributed on hacking forums and in YouTube videos that steals user tokens for a logged-in Discord user when the malware is executed.

These user tokens are then uploaded back to a Discord channel under the attacker's control where they can be collected and used by the threat actor to log in as their victims.

The original version of the malware is in the form of an executable that is easily detected by security software and only steals tokens while it is running.
Modify Discord client files to evade detection

To make it harder to detect by antivirus software and to offer persistence, a threat actor has updated the AnarchyGrabber malware so it modifies the JavaScript files used by the Discord client to inject its code every time it runs.

This new version is given the very original name of AnarchyGrabber2 and when executed will modify the %AppData%\Discord\[version]\modules\discord_desktop_core\index.js file to inject JavaScript created by the malware developer.

For example, the index.js file normally looks like the following image for an unmodified Discord client.
Unmodified index.js file

When AnarchyGrabber2 is executed, the index.js file will be modified to inject additional JavaScript files from a 4n4rchy subfolder as shown below.
AnarchyGrabber2 modified index.js file

With these changes, when Discord is started the additional malicious JavaScript files will be loaded as well.

Now, when a user logs into Discord, the scripts will use a webhook to post the victim's user token to a threat actor's Discord channel with the message "Brought to you by The Anarchy Token Grabber".
Stealing a Discord user token

MalwareHunterTeam, who found this new variant and shared it with us, told BleepingComputer that "skids are sharing them everywhere."

What makes these Discord client modifications such a problem is that even if the original malware executable is detected, the client files will be modified already.

As security software does such a poor job detecting these client modifications, the code will stay resident on the machine without the user even knowing their accounts are being stolen.
Discord needs to do client integrity checks

This is not the first time a Discord malware has modified the client's JavaScript files.

In October 2019, BleepingComputer broke the news that a Discord malware was modifying the client files to turn the client into an information-stealing Trojan.

At the time, Discord had stated that they would look into ways to prevent this from happening again, but unfortunately, those plans never happened.

The proper way these modifications can be detected is for Discord to create a hash of each client file when a new version is released. If a file is modified, then the hash for that particular file will change.

Discord can then perform a file integrity check on startup and if a file has been detected, display a message like the one below that was created by BleepingComputer.
Discord File Check Mockup

Until Discord adds client integrity into their client's startup, Discord accounts will continue to be at risk from malware that modifies the client files.

BleepingComputer has contacted Discord about this malware and the file integrity checks but has not heard back as of yet.