Tag Archive for: hijack

Security researchers successfully hijack Windows 11’s Power Automate tool

/in


In a nutshell: Windows 11 includes tools to automate repetitive tasks, saving users a lot of time. However, one security researcher says it can also save hackers a lot of time. Microsoft questions the vulnerability of its automation tools, but as usual regarding cybersecurity, human complacency may be the weakest link.

A research firm recently published methods for attackers to hijack automation tools that ship with Windows 11 to distribute malware and steal data across networks. The process comes with some caveats but marks another area of concern for IT security.

The vulnerability centers on Power Automate, a tool Microsoft packages with Windows 11 that lets users automate tedious or repetitive asks across various programs. Users can automatically backup files, convert batches of files, move data between programs, and more, optionally automating actions across groups through a cloud.

Power Automate comes with many pre-made functions, but users can create new ones by recording their actions, which the tool can later repeat. The program could gain widespread use because it requires little-to-no coding knowledge.

Michael Bargury, CTO of security company Zenity, thinks attackers can use Power Automate to more quickly spread malware payloads, explaining how in a June Defcon presentation. He released the code for the attack, called Power Pwn, in August.

Image credit: Windows Report

The biggest obstacle to hacking with Power Automate is the fact that an attacker needs to already have access to someone’s computer or have penetrated a network through other nefarious methods. Bargury told Wired that if an attacker then creates a Microsoft cloud account with administrative privileges, they can use automated processes to push ransomware or steal authentication tokens. Attacks using Power Automate could be harder to detect because it technically isn’t malware and carries an official Microsoft signature.

Microsoft wrote about a 2020 incident in which attackers used a company’s automation tools against it. Windows 11 and Power Automate weren’t around back then, but the case provides a real-world example of the same fundamental technique.

Microsoft claims any fully…

Source…

US warns hackers now have tools to hijack critical industrial systems

/in


The U.S. Department of Energy (DOE), Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) warned on Wednesday that hacking groups now have access to advanced “cyber tools” that could allow them to gain control of critical industrial control systems.

In a joint cybersecurity advisory, the U.S. agencies announced hacking groups known as advanced persistent threat (APT) actors have “exhibited the capability to gain full system access to multiple industrial control system (ICS)/supervisory control and data acquisition (SCADA) devices.”

The agencies said the cyber tools allow hackers “to scan for, compromise, and control affected devices” once they have gained initial access to a particular operational technology (OT) network.

The joint advisory warns that these hacking tools can be used against Schneider Electric programmable logic controllers (PLCs), OMRON Sysmac NEX PLCs, and Open Platform Communications Unified Architecture (OPC UA) servers.

PLCs are small computers that can be programmed to receive data inputs and send operating instructions. They can be used to control automated machinery.

Open Platform Communications Unified Architecture (OPC UA) servers oversee the exchange of data between sensors and cloud-computing applications. They are another tool that can be used for industrial automation.

The U.S. cybersecurity firm Mandiant helped discover the new hacking tools through a partnership with Schneider Electric, one of the companies whose equipment could be targeted with the hacking tools. On Wednesday, Mandiant researchers said the hacking tools, which they dubbed INCONTROLLER (aka PIPEDREAM), “represent an exceptionally rare and dangerous cyber attack capability.” Mandiant said INCONTROLLER “is very likely state sponsored and contains capabilities related to disruption, sabotage, and potentially physical destruction.”

Mandiant said INCONTROLLER bears a resemblance to a hacking tool used to disable an industrial safety system in 2017, called TRITON. The INCONTROLLER tool is also similar to INDUSTROYER. TechCrunch reported a hacking group known as “Sandworm”…

Source…

Watch a Hacker Hijack a Capsule Hotel’s Lights, Fans, and Beds

/in


Kyasupā wondered if he could hack his hotel’s iPod Touch controls after they handed it to him at check in, but he didn’t want to waste his vacation time reverse engineering the system. He says he changed his mind after a noisy neighbor kept him up for several nights. “I thought it would be nice if I could take control of his room and make him have a lovely night,” he writes. “That’s how I decided to start to analyze how everything worked.”

The iPods the hotel issued as remote controls were locked with iOS’ “guided access” setting that prevents users from leaving the Nasnos remote control app. But Kyasupā found he could simply let the iPod’s battery drain and restart it to gain full access—a hard reboot is a known guided access workaround—and the iPod didn’t have a PIN set for its lockscreen. He then saw that the iPod was connecting via Wi-Fi to a Nasnos router—each room seemed to have its own—that in turn connected via radio to the other digital devices in the room like its lights, fan, and foldout couch.

To intercept the app’s commands from the iPod to the Nasnos router, Kyasupā knew he’d have to find the password to access that router. But remarkably, he found that the Nasnos routers used WEP encryption by default, a form of Wi-Fi security known for decades to be easily crackable. “Seeing that WEP is still used in 2019, it’s crazy,” he writes. Using the program AircrackNG, he brute-forced the router’s password and connected to it from this laptop. He was then able to use his Android phone as a Wi-Fi hotspot, connect the iPod to that hot spot, and route it through his laptop. Finally, he connected the laptop to the Nasnos router via Wi-Fi and used that setup as a man-in-the-middle to eavesdrop on all the iPod’s communications to the router.

Kyasupā then tried out every function in the app—such as turning lights on and off, converting the couch to a bed, and so on—while recording the data packets sent for each one. Because the Nasnos app used no actual authentication or encryption in its communications with the router, other than the WEP Wi-Fi encryption, he could then connect to the room’s router with his laptop instead and replay those commands to trigger the…

Source…