Tag: OODA | SpinSafe

OODA Loop – Ransomware Group Takes Credit for Attack on Boat Dealer MarineMax

March 22, 2024/in Internet Security

The Rhysida ransomware group has claimed responsibility for a recent cyberattack on boat dealer MarineMax and is offering to sell allegedly stolen data from the company for a significant sum, starting at 15 bitcoin ($950,000). MarineMax, one of the largest retailers of recreational boats and yachts globally, reported being targeted in a cyberattack that caused some disruption, as disclosed in an SEC filing. Although MarineMax has not provided extensive details about the incident, screenshots of financial documents and spreadsheets have been published by the cybercriminals to demonstrate the theft of valuable data. However, MarineMax stated in its regulatory filing that sensitive data is not stored in the compromised environment. The Rhysida ransomware group, known for targeting various sectors including government, IT, manufacturing, healthcare, and education, encrypts files on compromised systems and demands ransom. Despite researchers developing a decryption tool for Rhysida in February 2024, it is uncertain if the cybercriminals have since updated the malware to render the tool ineffective. The extent of file encryption or data theft in the MarineMax attack remains unclear, and further information from the company is awaited.

Source…

OODA Loop – North Korean Hackers Caught Using Malware With Microphone Wiretapping Capabilities

June 23, 2023/in Computer Security

Read more: https://www.securityweek.com/north-korean-hackers-caught-malware-with-microphone-wiretapping-capabilities/Cybersecurity firm AhnLab has reported that a hacking group, identified as APT37 and linked to the North Korean government, has been using new wiretapping malware in recent surveillance attacks. The group employed a Go-based backdoor exploiting the Ably messaging platform, as well as an information stealer with microphone wiretapping capabilities. Spear phishing emails delivering a password-protected document and a disguised CHM payload were used to lure victims into executing the malicious script. The malware exfiltrates files, takes screenshots, steals data from removable devices, logs keystrokes, and conducts unauthorized wiretapping. APT37 has targeted North Korean defectors, human rights activists, journalists, and policymakers for surveillance purposes.

Source…

OODA Loop – Joseph Menn: Observations From Two Decades Of Tech Journalism

October 1, 2022/in Computer Security

Covering technology issues, and specifically cybersecurity as a journalist is a tough endeavor. Some of these technologies are complex as are the security vulnerabilities often inherent in their deployment and making these topics broadly accessible can be a challenge. Many of the underlying issues touch upon national security and civil liberties creating an interesting nexus that must be highlighted in the proper context. Lastly, it can be a challenge to create trusted relationships with the hacker community, but they provide essential perspectives and leads.

Joseph Menn has established himself as one of the top journalists covering these issues for over two decades at organizations like the Financial Times, Los Angeles Times, Bloomberg, Reuters, and now at the Washington Post. He’s spoken at conferences like Black Hat, Def Con, and RSA. He’s written three books covering topics like Napster, cybercrime, and most recently the infamous hacker group cDC in his book “Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World”.

In the OODAcast, Joseph provides insights from his career as a journalist covering technology and cybersecurity. We explore how he first got involved with Def Con Black Hat and the value of attending the events. Joseph discusses how he first got introduced to the cDC and why he decided to write a book about the group and developed an overall positive outlook in the critical role hackers will play in saving the world.

Official Bio:

Joseph Menn joined The Washington Post in 2022 where he specializes in computer security, hacking, privacy and surveillance. He has perhaps the longest running track record among professional journalists covering cyber security and cyber conflict issues, having over two decades of experience on the topic. Prior to the Washington Post he covered cybersecurity and technology for Reuters, the Financial Times and the Los Angeles Times

His books include “Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World” (2019) and “Fatal System Error: The Hunt for the New Crime Lords who are Bringing Down the Internet” (2010).

Podcast Version:

External Links:

Cult of the Dead Cow book

Source…

OODA Loop – What You Need To Know About The Internet’s Latest Problem: Repeating Random Numbers!

January 23, 2022/in Internet Security

Digital Certificates are a foundational building block of the Internet. They are used to verify the identity of e-commerce sites, the authenticity of software and encrypt data. Not surprisingly, cyberattackers try to create fake Certificates or get the Private Keys for real ones to steal data or intercept communications. No one really worried about the Certificates themselves – until now. It seems the random numbers used to generate Certificates sometimes are the same.

To understand the problem it’s useful to take a 30 second tutorial on Digital Certificates. For those of you who might have managed to stay awake during math class you’ll remember that Asymmetric Cryptography utilizes 2 prime numbers to create a Public and Private Key for a Digital Certificate. The Public Key maps an input (that you want to keep secret) to a large number field while the Private Key reverses the transaction. The theory goes that since there’s an infinite set of prime numbers, there’s an infinite set of Public/Private key combinations. To make sure the prime numbers are different a Random Number Generator (RNG) is used. Sounds pretty secure. Infinite is a big number. What could go wrong?

Well the real world is a bit different than math class. It seems the random number generators (RNG) on computer devices really don’t generate an infinite set of primes but rather a bounded set that in turn generates a set of Public/Private Key combinations. This new analysis is a result of the dramatic cost reduction in high performance computing that now enables the simulation of a chip’s RNG function and the Certificates they generate.

From an Internet security perspective, the ability of a cyberattacker to know an organization’s Private Key has huge implications. Attackers can potentially impersonate web sites, intercept secure connections or decrypt any piece of data just by looking at the Public Key. Examples of this attack are not just seen in labs. In one case, for instance, on January 7 2019 the University of California Davis sent an advisory of all students visiting China that their “secure” What’sApp messages were being monitored.

For enterprises that rely on Digital Certificates for their…

Source…

Tag Archive for: OODA