Tag Archive for: multiple

Meta Expunges Multiple APT, Cybercrime Groups From Facebook, Instagram

/in


Facebook parent Meta said it thwarted the activity of three advanced persistent threat groups (APTs) in South Asia engaged in cyber espionage as well as six adversarial groups from various global regions engaged in what it deems “inauthentic behavior” on Facebook and other social networks.

The company’s takedown of these and other activities on its platforms is indicative of a sea of consistent and globally dispersed exploitative behavior from threat actors to leverage various online platforms to create elaborate social-engineering campaigns to lure and exploit Internet users, the company said.

In most of the cases, threat actors are using Facebook and other social networking and media platforms —including Twitter, Telegram, YouTube, Medium, TikTok, and Blogspot — to create various fake online accounts and personas, according to Meta. The attackers used fake identities, including job recruiters, journalists, or even military personnel, to earn credibility with users and legitimate entities so they could engage in malicious threat activity, the company said.

In its Quarterly Adversarial Threat Report released today, Meta detailed these incidents as well as actions it’s now taking to minimize security threats that leverage its platforms.

The report draws from Meta’s security monitoring of the use of its platforms, as well as monitoring of the Internet overall in order to flag malicious activity, which is increasingly becoming more dispersed across various platforms and geographies and thus harder to track, Nathaniel Gleicher, head of security policy at Meta, told journalists in a briefing on the report May 2.

“These threats are extremely persistent, and that they’re not going anywhere because the threat actors behind them are financially motivated,” he said. “That’s why we see … adversarial adaptation … including malware operators, spreading themselves across many places at once. So each phase of the campaign relies on a different service to survive.”

As part of its work to combat this activity, Meta also plans to empower businesses as well with a new tool it will release later this year to help them identify malicious activity as well as malware being used by the threat groups…

Source…

Cyber security breaches are up multiple times as Internet penetration grows

/in




With the rise in Internet penetration and use of digital banking in the country, the number of cyber attacks or cyber security incidents in India have gone up multiple times over the last few years.


 


Data accessed by IANS said that cyber security incidents related to government institutions have increased significantly, particularly in 2022.


As many as 54,314, 48,285 and 1,92,439 cyber security incidents related to government agencies, institutions and undertakings were observed during the years 2020, 2021 and 2022, respectively.


According to official data, total number of cyber security incidents tracked by Indian Computer Emergency Response Team (CERT-In) during the year 2019 was 3,94,499, which spiked to 11,58,208 in 2020 and further increased to 14,02,809 in 2021. Similarly, 13,91,457 cyber security incidents were observed in 2022.


The cyber attack, which put the All India Institute of Medical Sciences (AIIMS) in Delhi out of order on November 23 was one such example. Multiple agencies were roped in to resolve the issues.


Similarly, cyber attackers on December 1 briefly hacked the Ministry of Jal Shakti’s Twitter handle. This was the second major cyber attack on a government site after AIIMS Delhi’s server was majorly hacked.


A Parliamentary standing committee in its report observed that with the advancement of technology, cyber crimes have emerged as a major issue across the globe. The cyber crimes transcend geographical boundaries, which make it tough to track the criminals.


The Committee expressed its deep concerns over the rising trend of cyber crimes in the country. It felt that on this issue, both the Central and state governments need to get together on the same boat to tackle the growing menace of cyber crime.


“The committee observed that traditional training of the police personnel is not sufficient to deal with cyber crimes as these criminals are tech-savvy and are following new modus-operandi on a regular basis,” said the report ‘Police -Training, Modernisation and Reforms’ tabled in the Parliament this month.


The committee in the…

Source…

Hackers used legitimate remote help-desk tools to scam multiple US federal agencies

/in


TL;DR: The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) issued a joint warning that threat actors (TA) are ramping up a hacking/phishing campaign employing legitimate remote monitoring and management (RMM) software. The CISA notes that it has discovered multiple attacks within federal civilian executive branch (FCEB) networks.

In September 2022, the CISA performed audits on several FCEB networks and found them to have been victim to a “widespread, financially motivated phishing campaign.” A month later, security researchers at Silent Push reported on a “typosquatting” trojan campaign involving several trusted domains, including PayPal, Microsoft, Geek Squad, and Amazon. On Wednesday, CISA confirmed several federal staff members had fallen for the help-desk-themed phishing campaign.

“[We] assess that since at least June 2022, cyber criminal actors have sent help desk-themed phishing emails to FCEB federal staff’s personal, and government email addresses,” the alert reads.

The scams are a bit more sophisticated than the typical phishing emails most people ignore. Dubbed “callback phishing,” emails are sent out that appear legitimate, like the one above from “Geek Squad.” The emails take the form of a high-priced subscription auto-renewal notice and list a number to call to cancel the automatic charge or a link to a “first-stage malicious domain.” These are pages that mimic legitimate businesses like PayPal. The URLs are also disguised, for example, paypalsec.com.

When targets call the number or visit the domain, they are convinced to download legitimate RMM help-desk software form a second stage domain, the CISA specifically named ScreenConnect and AnyDesk. The bad actors use portable executables to bypass security protections preventing employees from installing software. Portable executables are .exe files that will run without being installed on the computer, and most desktop-sharing software have these.

Once the TAs have access to the target through the RMM software, they attempt to execute a refund scam. This attack involves convincing the…

Source…

Security Researchers Discover Multiple Samsung Galaxy App Store Exploits, What You Need To Know

/in


S22 series 02

The key to any malware campaign is getting malicious code onto a target device, and often, attackers will use a legitimate app store as a vector. Samsung’s Android smartphones ship with the Google Play Store, which has hosted its fair share of malware over the years, as well as the less popular Galaxy App Store. Security researchers from NCC Group have detected a pair of flaws in Samsung’s app store that opened up devices to malware infection. The exploits have been patched, but outdated devices are still at risk.

Like the Play Store, Samsung’s Galaxy App Store has privileged access to the system, allowing it to install and update apps without forcing the user to jump through hoops. Samsung distributes many of its own apps and services via this store, and there are third-party apps listed. The first exploit (CVE-2023-21433) leverages installation intents, which were not handled in a safe way. With physical access to the device, an attacker could tell a device to download an app from the store and open it with no security checks. NCC released a proof-of-concept consisting of an ADB (Android Debug Bridge) command.

The second vulnerability (CVE-2023-21434) goes a step further, allowing the attacker to run arbitrary JavaScript code on the device. Again, this happens because the Samsung app store has special access to the system. The proof-of-concept provided by NCC is simply a hyperlink that loads malicious JavaScript. As it turns out, the only security on webviews in the Galaxy App Store is a filter that looks for the “player.glb.samsung-gamelauncher.com” domain. However, an attacker can simply add that as a subdomain to any site, and the phone will happily run the code.

Samsung CVE example
Replacing <host> with an attacker-controlled domain causes an unpatched Samsung to run any JavaScript present.

So, that’s not great, but there’s good news (and some bad news). NCC Group reported the issue to Samsung, and a new version of the Galaxy App Store (4.5.49.8) has been deployed this month to fix both flaws. In addition, new Google security measures in Android 13 will block these exploits. Unfortunately, only newer Samsung devices will ever see Android 13, so they could remain vulnerable at the system…

Source…