In the current cybersecurity threat landscape, most botnets propagate via exploits and file-based malware. Anything that touches the disk has the ability to be blocked via access controls on the host. However, new malware techniques utilize more than just binaries to execute malicious code, demanding the need for execution control. Kurstis Armour, an Information Security Consultant at cyber security company eSentire commented below. Kurtis Armour, Information Security Consultant at eSentire: “The main techniques we see botnets attempting to grow is through malware utilizing JavaScript payloads, standard binaries, macros and PowerShell payloads, with notable delivery techniques through exploitation (exploit kits and malvertising) and…
ISBuzz Team
Researchers have uncovered a rash of ongoing attacks designed to damage routers and other Internet-connected appliances so badly that they become effectively inoperable. Mike Ahmadi, Global Director – Critical Systems Security at Synopsys commented below. Mike Ahmadi, Global Director – Critical Systems Security at Synopsys: “On multiple occasions I have witnessed devices being bricked by sending malformed traffic to the device. In multiple cases sending as few as 2 bad packets to the broadcast address of networked devices caused all of them to become bricked all at once. At the time I hoped such issues would be discovered and fixed before the hacking world…
Sathurbot: Distributed WordPress password attack This article sheds light on the current ecosystem of the Sathurbot backdoor trojan, in particular exposing its use of torrents as a delivery medium and its distributed brute-forcing of weak WordPress administrator accounts. The torrent leecher Looking to download a movie or software without paying for it? There might be associated risks. It just might happen that your favorite search engine returns links to torrents on sites that normally have nothing to do with file sharing. They may, however, run WordPress and have simply been compromised. Some examples of search results: Clicking on some of those links…
Late last year on the eve of a $4.8B sale to Verizon, Yahoo announced that its servers had been breached yet again to the tune of one billion compromised accounts, double that of the hack announced just three months earlier. The day after the announcement, Bloomberg reported that Verizon’s legal team was “working toward either killing the deal or renegotiating the Yahoo purchase at a lower price.” Months later, the deal is still on, but Yahoo faces an SEC probe. While it may be tempting to look at this story, draw the simple conclusion that weak security can affect your…
Sathurbot backdoor trojan uses torrents as a delivery medium to compromise weak WordPress administrator accounts. Looking to download a movie or software without paying for it? There might be associated risks. It just might happen that your favourite search engine returns links to torrents on sites that normally have nothing to do with file sharing and when you begin torrenting in your favourite torrent client, you will find the file is well-seeded and thus appears legitimate. If you download the movie torrent, its content will be a file with a video extension accompanied by an apparent codec pack installer, and…
Unit 42, Palo Alto Networks’ threat intelligence research arm, has uncovered evidence of links between attacks using two new malware families and two families of Google Android malware. This has been discovered as part of work on preventing and detecting targeted attacks in the Middle East. The attackers favour using URL shortening services to disguise the true links they are sending in spear phishing emails. A number of samples analysed were linked via the URL shortening service “bit.ly”. The URL shortening service then redirects users to the malicious payload hosted on attacker controlled pages. Another method favoured by the attackers…
Researchers have uncovered a rash of ongoing attacks designed to damage routers and other Internet-connected appliances so badly that they become effectively inoperable. Ilia Kolochenko, CEO of Web Security Company High-Tech Bridge commented below. Ilia Kolochenko, CEO at High-Tech Bridge: “Unfortunately, many manufacturers of IoT devices ignore even the very basic aspects of their devices’ security. Millions of devices cannot be updated if a security flaw is found, or do not allow the change of hardcoded passwords or insecure configurations, such as non-HTTPS access to admin panels. They are insecure and dangerous by design. In the near future, we will certainly see some people…
McAfee catalogues 176 new cyber threats every minute, almost three every second; ransomware grows 88%, mobile malware grows 99% in 2016 NEWS HIGHLIGHTS Threat intelligence sharing undermined by data volume, validation, quality, speed and correlation challenges McAfee Labs detected 176 new cyber-threats every minute, almost three every second in Q4 2016 Ransomware grew 88% in 2016 despite Q4 decline in Locky and CryptoWall family activity Mobile malware grew 99% in 2016; overall malware grew 24% in 2016 to 638 million samples While still a minute fraction compared to Windows threats, new Mac OS malware samples grew 245% in Q4; total…
Nine months after the launch of the No More Ransom (NMR) project, more law enforcement and private partners have joined the initiative, allowing more victims of ransomware to get their files back without paying the criminals. The platform https://www.nomoreransom.org/ is now available in 14 languages and contains 39 free decryption tools. Since our last report in December, more than 10,000 victims from all over the world have been able to decrypt their affected devices thanks to the tools made available free of charge on the platform. No More Ransom was launched in July 2016 by the Dutch National Police, Europol, Intel Security…
Forcepoint security labs has identified a form of ransomware, first documented back in September 2016 that targets healthcare organisations. ‘Philadelphia’, believed to be a new version of ‘Stampedo’ currently shows patterns that could be the beginning of a widening targeting campaign, extending beyond US perimeters. Sold for just a few hundred dollars and promoted on YouTube, it gives have-a-go criminals, on a global scale, the tools to conduct very targeted and convincing attacks. The attack is sent through a spear-phishing email containing tailored logos and staff names, adding to the deception. Once activated the variant communicates information including operating system,…