Bluetooth bugs could allow attackers to impersonate devices

 

Patches to remedy the vulnerabilities should be released over the coming weeks

Amer Owaida

Cybercriminals could exploit several vulnerabilities in Bluetooth to carry out impersonation attacks and masquerade as a legitimate device during the pairing process, according to the Bluetooth Special Interest Group (SIG).

The security flaws, which affect the Bluetooth Core and Mesh Profile specifications, were discovered by researchers at France’s national cybersecurity agency ANSSI.

“The researchers identified that it was possible for an attacker acting as a MITM [Man-in-the-Middle] in the Passkey authentication procedure to use a crafted series of responses to determine each bit of the randomly generated Passkey selected by the pairing initiator in each round of the pairing procedure, and once identified, to use these Passkey bits during the same pairing session to successfully complete the authenticated pairing procedure with the responder,” reads Bluetooth SIG’s security notice.

To successfully carry out the attack, the perpetrator would have to be in the wireless range of two vulnerable Bluetooth-enabled devices engaging in the pairing procedure. Once the authentication process is completed, the responder device will be authenticated with the attacker instead of the initiator. However, the attacker won’t be able to use this method to pair with the initiating device.

RELATED READING: Bluetooth flaw exposes countless devices to BIAS attacks 

The US CERT Coordination Center (CERT/CC) released additional details about the vulnerabilities, explaining that an attacker could exploit the flaws to complete the pairing protocol and encrypt communications using a known link key, authenticate without the AuthValue or even brute-force it.

Patches on the way

Software and firmware updates are expected to be rolled out over the coming weeks, so users should be on the lookout for fixes from affected vendors.

Speaking of which, the Android Open Source Project, Cisco, Microchip Technology, Cradlepoint, Intel, and Red Hat are among the organizations identified by CERT/CC as affected by at least some of the vulnerabilities. The first three have issued statements confirming that they are working on releasing patches or mitigations for the security flaws, while the rest have yet to speak on the issue.

There is no word on whether the bugs have been exploited in the wild.

SIG has shared its own set of recommendations addressing the vulnerabilities and it is urging vendors to release patches post-haste.

 

Attaque contre le Colonial Pipeline : piratage dans le monde physique

 

L'attaque rappelle les cyber-menaces croissantes qui pèsent sur les infrastructures essentielles tout en montrant pourquoi les fournisseurs de services essentiels sont des cibles mûres pour les cybercriminels.

 

Cameron Camp

Alors que les détracteurs ont fait valoir que les menaces contre les infrastructures physiques sont exagérées et largement théoriques, la liste croissante des organisations qui ont été attaquées avec succès suggère le contraire. Et maintenant, les médias regorgent de rapports sur les effets de l’attaque de rançongiciel lancée contre Colonial Pipeline par le groupe de cybercriminels DarkSide. En fait, beaucoup de choses se sont passées depuis – le président américain Joe Biden a signé un décret visant à améliorer les cyberdéfenses de la nation et la société a repris ses activités normales, tandis que DarkSide affirme avoir fermé boutique. Selon certaines informations, Colonial Pipeline aurait payé 5 millions de dollars de rançon aux cybercriminels.

Quoi qu’il en soit, alors que l’enquête sur l’attaque est en cours, la détection de Win32/Filecoder.DarkSide a eu lieu en octobre 2020, de sorte que les attaquants ne semblent pas utiliser un exploit zero-day particulièrement, parrainé par l’État, pour compromettre leurs cibles.

Depuis des années, nous constatons que des attaquants potentiels sondent discrètement des cibles d’infrastructures critiques, voire lancent des attaques contre des cibles spécifiques de grande valeur, comme le montrent les exemples cités ci-haut. Cette tendance ne montre aucun signe de ralentissement. Lors de ces attaques, on nous a demandé si prévoyions observer des tentatives similaires sur le marché nord-américain. Nous avons répondu par l’affirmative. Et la suite de l’histoire nous a donné raison.

Il est intéressant de noter que dans le cas de NotPetya (aka Diskcoder.C), les éléments spécifiques de l’attaque n’étaient pas non plus des jours zéro super fous. Dans l’environnement actuel, la réalité est que les attaquants n’ont pas besoin d’utiliser (et donc de brûler) les exploits zero-day; ils peuvent s’introduire sans eux.

 

La suite de l’article sur https://www.welivesecurity.com/fr/2021/05/19/colonial-pipeline-attaque-physique-infrastructures/

Take action now – FluBot malware may be on its way

 Why Flubot is a major threat for Androis users, how to avoid falling victim and how to get rid of the malware if your device has already been compromised

 

By Tony Anscombe

Android malware known as FluBot is continuing to cause mayhem across some European countries, and there is speculation that the threat actors behind it may decide to target other geographies, including the United States. Here’s why you should be vigilant, how FluBot operates, and how you can remove this Android nasty from your device.

It’s also worth noting that this advice will help you stay safe from other Android malware strains. In recent days, cybercriminals have begun to target Europeans with TeaBot (also known as Anatsa or Toddler), an Android malware family that uses exactly the same technique as FluBot to spread and to lure users into giving up their sensitive data. FluBot and TeaBot are detected by ESET products as variants of the Android/TrojanDropper.Agent family.

How FluBot operates

If a victim is lured by the attacker into the malicious campaign, their entire Android device becomes accessible to the scammer. This includes the potential to steal credit card numbers and access credentials to online banking accounts. To avoid removal, the attacker implements mechanisms to stop the built-in protection offered by the Android OS and stops many third-party security software packages from being installed, an action many users would take to remove malicious software.

The victim first receives an SMS message that impersonates a popular delivery logistics brand, such as FedEx, DHL, and Correos (in Spain). The call to action of the message is for the user to click a link in order to download and install an app that has the same familiar branding as the SMS message but is actually malicious and has the FluBot malware embedded within it. An example of the SMS message (in German) and the subsequent prompt to install the app can be seen below:

Take action now – FluBot malware may be on its way | WeLiveSecurity

European police bust major online investment fraud ring

The operation was carried out against an organized group that used online trading platforms to swindle victims out of US$36 million

Europol and several national law enforcement agencies have teamed up to take down an investment fraud and money laundering ring that caused losses of approximately €30 million (US$36 million) to hundreds of victims, according to a press release by the European Union’s law enforcement agency.

The investigation led to the arrest of 11 suspects and involved the search of dozens of locations across Europe and Israel with law enforcement officers seizing a range of ill-gotten gains including jewels, real estate, high-end vehicles and some €2 million (US$2.4 million) in cash. The effort was spearheaded by German law enforcement authorities and supported by their peers from Bulgaria, Israel, Latvia, North-Macedonia, Poland, Spain, and Sweden.

How the fraud ring operated

To dupe victims out of their money, the group set up an operation that consisted of at least four online trading platforms that promised significant profits from investments in cryptocurrencies and high-risk options to potential investors. Victims were lured to participate in these investments through advertisements posted on various social media platforms and search engines.

“The members of the criminal group were posing as experienced brokers when contacting the victims via the call centre they had set-up. The suspects were using manipulated software to show the gains from the investments and to motivate the victims to invest even more,” said Europol describing the scheme. The call centers operated by the criminal network worked out of Bulgaria and North-Macedonia.

The group preyed on people from all around Europe; however, victims from Germany alone claimed losses of at least €7 million. Meanwhile, Spain recorded 300 complaints about the scheme. To launder their illicit profits, the criminals used bank accounts operated by various shell companies located in European countries.

Investment fraud remains one of the most common scams that various criminal groups use to convince unsuspecting victims into parting with their money. Per the FBI’s 2020 Internet Crime Report, losses reported from investment fraud topped US$336 million and were the third costliest cybercrime on the list. Only BEC schemes and dating scams caused higher losses last year.

Meanwhile, online trading platforms that have become ever more popular over the past few years also present a certain amount of risk, and not just that involving picking the wrong stocks or commodities. Online traders have to be wary of threats such as phishing attacks and impostor apps preying on their login credentials. Vulnerabilities that could be lying undetected in their platform of choice could also ultimately put their money at risk.

 

RSA 2021 : ESET y présente ses recherches sur les stalkerwares Android et exploits XP

 

ESET présentera ses recherches les plus récentes et non encore publiées à la conférence RSA 2021 (https://www.rsaconference.com/) qui aura lieu virtuellement du 17 au 20 mai. Les chercheurs d'ESET, Jean-Ian Boutin, Zuzana Hromcová et Lukáš Štefanko, analyseront en profondeur les exploits de Windows XP et les Stalkerwares Android.

 

Les deux présentations seront faites le 17 mai, jour de l'ouverture de la conférence. Lukáš Štefanko parlera de «Sécurité: le coût caché d'Android Stalkerware», de 11h20 à 12h00 PDT (20h20 à 21h00 CEST). Le stalkerware est utilisé pour espionner les utilisateurs en collectant, transmettant et stockant leurs informations personnelles. ESET Research a découvert de sérieuses vulnérabilités dans les applications Android Stalkerware et leurs serveurs de surveillance. Celles-ci pourraient avoir un impact négatif sur les utilisateurs en cas d'exploitation.

 

«Mobile stalkerware est une menace populaire, vendue légalement sur divers sites Web», explique Stefanko. «Sur base de la télémétrie ESET, le nombre de détections de stalkerware en 2020 a augmenté de 48% par rapport à 2019. Ma présentation couvre plus de 80 familles différentes d'Android Stalkerware et je me concentre sur les problèmes de sécurité et les failles de confidentialité dans leur code.»

 

Ensuite, ce sont Jean-Ian Boutin, responsable Recherche Menaces et Zuzana Hromcová, chercheuse chez ESET, qui présenteront «Beyond Living-Off-the-Land: Why XP Exploits Still Matter» de 12h05 à 12h45 PDT (21h05 à 21h45 CEST). Living-Off-the-Land fait référence à une technique selon laquelle les attaquants utilisent des outils légitimes préinstallés pour mener à bien leurs opérations malveillantes.

 

 «Il s’agit d’une présentation sur l'évolution de cette technique et nous expliquerons comment les binaires vulnérables peuvent être exploités pour remplacer les binaires bien connus et bien mis en carte », explique Hromcová.

 

«Une DLL Windows XP vulnérable peut rapidement transformer en cauchemar la réponse aux incidents, même sur des machines non XP», ajoute Boutin.

 

Pour suivre les présentations en direct, inscrivez-vous sur RSA Conference 2021 website. Consultez l'agenda complet (full agenda) pour trouver ce qui vous intéresse.

 

Si vous ne pouvez pas suivre l'événement en direct, lisez le livre blanc qu'ESET publiera pendant la conférence :  Android stalkerware par Lukáš Štefanko. Suivez WeLiveSecurity, où l’article sera publié. Suivez aussi ESET Research sur Twitter (ESET Research on Twitter) pour les dernières nouvelles d'ESET Research.

Verizon’s 2021 DBIR: Phishing and ransomware threats looming ever larger

 

The report provides unique insights into how the COVID-19 pandemic affected the data breach landscape

 Amer Owaida

 Verizon has released the 14^th installment of its annual Data Breach Investigations Report (DBIR) that analyzed 5,258 confirmed data breaches, an increase from 3,950 in the report’s previous issue. As might be expected, the 2021 edition, which used input from 83 contributing organizations from around the world, also sheds unique light on the impact that the COVID-19 pandemic has had on the data breach landscape.

With a sizeable part of the workforce forced to work remotely, the pandemic-powered transition has been mirrored by the increase in certain types of cyberattacks. Phishing attacks, a persistent and most acute threat for years, saw an increase by 11%; meanwhile, the number of ransomware attacks grew by 6% compared to the year prior. A total of 85% of breaches involved a human element.

“This increase correlates with our expectations given the initial rush in phishing and COVID-19-related phishing lures as the worldwide stay-at-home orders went into effect,” reads the Verizon 2021 Data Breach Investigations Report.

Indeed, throughout the pandemic, COVID-19 themed phishing attacks have been popping up left and right. Initially, threat actors tried to dupe victims by impersonating the World Health Organization (WHO), however, more recently, they adapted their tactics and tried to cash in on the distribution effort with various vaccine scams.

With an increasing number of businesses taking steps toward digital transformation and transitioning more of their operations to the cloud, the report also examined the challenges they face along the way and found that attacks on web applications represented 39% of all breaches.

READ NEXT: Ransomware and the enterprise: A new white paper

“As the number of companies switching business-critical functions to the cloud increases, the potential threat to their operations may become more pronounced, as malicious actors look to exploit human vulnerabilities and leverage an increased dependency on digital infrastructures,” Verizon Business CEO Tami Erwin said in a press release.

The report also carried out an analysis of 12 different industries and found that while all of them face cybersecurity challenges, these differ from industry to industry based on various aspects, ranging from their infrastructure to the type of data they handle. Personal data accounted for 83% of data compromised in the financial and insurance industries, whereas in the scientific and technical services they made up “only” 49% of all breached data.

The most significant threat to the public administration vertical is social engineering attacks, which were behind 69% of the breaches. Unsurprisingly, the retail industry is predominantly targeted by financially motivated threat actors looking to make a pretty penny by obtaining payment cards and personal information.

Popular routers found vulnerable to hacker attacks

Millions of Brits could be at risk of cyberattacks due to poor default passwords and a lack of firmware updates

 Amer Owaida

Millions of Brits use Wi-Fi routers that contain various security flaws and may put them at risk of cyberattacks, an investigation by British consumer watchdog Which? has found.

Together with Red Maple Technologies, Which? looked at 13 commonly used older router models offered by various British internet service providers (ISPs) and found that over half of them didn’t meet the security standards of today. The main issues affecting routers suplied by ISPs such as Virgin, EE, Sky, TalkTalk, and Vodafone were weak default passwords, local network vulnerabilities, and the lack of firmware updates to patch security loopholes.

“Some of these models haven’t seen an update since 2018 at the latest, and some haven’t been updated since as far back as 2016, which could affect 6 million of these users. Without firmware and security updates, there’s no guarantee that security issues will be fixed,” wrote Hollie Hennessy, Senior Researcher at Which?. Weak default passwords and a lack of firmware updates affected seven devices in total, while local network vulnerabilities were found to affect just one.

A router that has an easy-to-guess and/or default password could grant malicious actors a way into your home network and the devices connected to it. You should always replace your router’s default username and password with a strong and unique password or passphrase.

Meanwhile, routers that have out-of-date firmware oten contain easily exploitable vulnerabilities. If your router doesn’t receive firmware updates to plug such security flaws, you are best off arranging an upgrade of your device with your ISP or buy an aftermarket device.

When it comes to exploiting local network vulnerabilities, a hacker would have to be in close vicinity to exploit a device; however, if successful, they could completely take over the device, observe your browsing habits or even direct you to compromised websites.

On the bright side, some routers, namely some offered by BT and Plusnet, didn’t suffer from any of the aforementioned lapses in security. The full list of the routers tested is available on the website of the consumer wachtdog.

Which? contacted the ISPs with the findings of their investigation. While BT Group said that its older routers would receive updates if they were found to be affected by security issues, its EE Brightbox router has a vulnerability that remains unfixed. Meanwhile Virgin Media, “did not recognize or accept” the consumer watchdog’s findings, saying that nine in ten of its customers were using its latest routers.

Same old story

Overall, the study’s results bring echoes of some other studies, including the Home Router Security Report 2020 by Germany’s Fraunhofer Institute last year, a test by Independent Security Evaluators in 2019, and a review by the American Consumer Institute in 2018.

Router security has been a perennial problem, and it has become an especially important consideration since the COVID-19 pandemic forced most professionals to work from outside the generally much safer confines of the office. To mitigate the chances of your router and connected devices getting compromised by cybercriminals, you can refer to our article focusing on tips for boosting your router security. While you’re at it you might want to go over our recommendations for reviewing your router’s configuration settings.