CyberChannel: Week of 9/29/24

CUPS Vulnerability Could Amplify DDoS Attacks by 600 Times

A recently patched vulnerability in the Common Unix Printing System (CUPS) has emerged as a potential tool for cyber criminals. This flaw can be exploited to launch Distributed Denial-of-Service (DDoS) attacks with a significant amplification factor of 600 times. This means attackers can use a small amount of traffic to overwhelm a targeted server with a much larger volume, making it inaccessible to legitimate users.

Researchers discovered that chaining this CUPS flaw with three other vulnerabilities could potentially allow remote code execution on Unix-like systems. However, the primary concern lies in its DDoS amplification capabilities. Thankfully, patches are available to address this issue. System administrators are urged to update their CUPS installations to mitigate the risk and prevent their servers from being used in DDoS attacks.

"Pig Butchering" Apps Preying on App Store Users

"Pig butchering" scams have been discovered on both the Google Play Store and Apple's App Store. These fraudulent trading apps lure victims with promises of high returns on fake cryptocurrencies. Once users invest, their funds are stolen by the scammers. It's important to be cautious when downloading investment apps and to research the developer and user reviews before investing any money.

To avoid falling victim to these scams, users should be wary of unsolicited investment offers. It's also important to verify the legitimacy of the trading platform and the cryptocurrency before investing. Additionally, users should never share their personal or financial information with strangers.

Cloudflare Blocks 3.8 Tbps DDoS Attack, Setting New Record

Cloudflare, a web security company, recently thwarted a record-breaking distributed denial-of-service (DDoS) attack. The attack peaked at a staggering 3.8 terabits per second (Tbps) and lasted for 65 seconds. The attackers launched the attack by exploiting a network of vulnerable devices, including Asus routers and Mikrotik systems. This attack is the largest publicly recorded DDoS attack ever observed.

In comparison to previous large-scale DDoS attacks, this attack stands out due to its volume and duration. DDoS attacks work by overwhelming a target server with traffic, making it unavailable to legitimate users.

Evasive Linux Malware Enables Widespread Cryptomining

A stealthy malware campaign targeting Linux servers for years has finally come to light. The malware, dubbed "perfctl," has likely infected millions of servers and caused significant disruption. Researchers believe perfctl has been active for at least three years, exploiting vulnerabilities in Polkit (CVE-2021-4043) to escalate privileges and install cryptomining software.

Perfctl is particularly dangerous due to its evasive tactics. It avoids detection by stopping its activities when a new user logs in, only resuming once the user becomes idle again. Additionally, it deletes its own binary after execution, further enhancing its stealth. This highlights the importance of keeping systems updated and implementing strong security measures to protect against evolving cyber threats like perfctl.

FIN7 Targets Users with Deepfake Nude Generators to Spread Malware

There is a new tactic used by FIN7 hackers to spread malware. FIN7 is a cybercrime group known for sophisticated phishing and social engineering attacks. In this new campaign, FIN7 is creating fake AI-powered deepnude generator sites. These sites are designed to lure people interested in generating nude images using deepfakes. When users try to download the generated images, they are unknowingly downloading malware instead.

This is not the first time FIN7 has used social engineering to spread malware. FIN7 has been distributing NetSupport RAT and other malware through similar tactics. NetSupport RAT is a remote access trojan that allows attackers to take control of infected devices.

UMC Health System Impacted by Ransomware, Patients Diverted

The UMC Health System in Texas was recently impacted by a ransomware attack. This disrupted their IT infrastructure, forcing them to take critical measures to contain the incident. While their facilities remained open, some emergency and non-emergency patients had to be diverted to other locations.

UMC took immediate action to disconnect their systems and launched an investigation. As of now, no major ransomware group has claimed responsibility for the attack. This incident highlights the potential consequences of cyberattacks on critical infrastructure like healthcare systems. The disruption caused by the attack emphasizes the importance of robust cybersecurity measures in protecting patient care and hospital operations.

LockBit Ransomware Gang Hit with Global Crackdown

In a global effort to crack down on the LockBit ransomware gang, law enforcement from twelve countries have joined forces. This resulted in the arrest of four individuals connected to the cyber criminal group. These arrests included a developer, a bulletproof hosting service administrator, and two others associated with LockBit activity.

The operation not only involved arrests but also the seizure of LockBit infrastructure and the release of a decryption tool. This tool allows victims to recover their encrypted files for free. Additionally, authorities issued indictments targeting other LockBit affiliates and offered a substantial reward for information leading to the capture of the gang's leadership. These actions demonstrate international cooperation in combating ransomware threats and potentially offer relief to victims of LockBit attacks.

Hacker Steals Confidential Data for Profit

A British citizen, Robert B. Westbrook, has been charged by the U.S. Securities and Exchange Commission (SEC) for hacking into the computer systems of five public American companies. His goal was to access confidential earnings information before it was made public.

Westbrook allegedly used this stolen information to make profitable stock trades ahead of earnings announcements. Over a period of 18 months, between January 2019 and August 2020, he made an estimated $3.75 million in illegal profits through insider trading. The SEC alleges that Westbrook reset the passwords of senior executives to gain access to documents and emails containing financial reports. He then used anonymous email accounts, VPN services, and Bitcoin to conceal his identity while making the illicit investments. However, the SEC was eventually able to track him down using data analytics.

CyberChannel: Week of 9/22/24

Telegram's Privacy Policy Shift Raises Concerns

Telegram has updated its privacy policy to share user IP addresses and phone numbers with law enforcement upon receiving a valid court order. This change marks a significant departure from Telegram's previous stance, which only allowed for the disclosure of such information in cases involving terrorism suspects. This comes a month after the arrest and indictment of Pavel Durov, Telegram's co-founder.

The new policy expands the scope of data sharing to include situations where users are suspected of violating Telegram's Terms of Service. This could potentially include activities such as spreading hate speech, promoting illegal content, or engaging in other harmful behaviors. Telegram has emphasized that it will continue to fight for user privacy and only disclose information when legally required.

However, the new policy has raised concerns among privacy advocates. Some argue that it could lead to increased surveillance of users and make it easier for governments to track their activities. Others worry that the change could make Telegram less attractive to users who value privacy.

Kaspersky's Forced Removal and Replacement Raises Questions

In response to a US government ban, Kaspersky has taken the drastic step of deleting its antivirus software from US customers' computers. This unexpected move has left many users confused and concerned about their security.

Instead of simply removing its software, Kaspersky has replaced it with UltraAV, another antivirus product. The move is likely a direct consequence of the US government's decision to ban Kaspersky products from federal government networks due to concerns about potential ties to the Russian government. While Kaspersky has repeatedly denied any such connections, the ban has had a significant impact on the company's business.

Kia Dealer Portal Flaw Poses Serious Security Risk

A serious vulnerability has been discovered in Kia's dealer portal, which could potentially allow attackers to remotely exploit millions of Kia vehicles. The flaw could provide unauthorized access to critical car functions, posing a significant safety risk. The flaw also exposed sensitive personal information of car owners, including their name, phone number, email address, and physical address, potentially enabling attackers to register themselves as secondary users on the affected vehicles.

The vulnerability could be exploited to remotely unlock doors, start engines, or even control other vehicle systems. This could have serious consequences for both car owners and the general public. Kia has acknowledged the issue and is working on a patch to address the vulnerability.

Cyberattack Forces Kansas Water Plant to Manual Operations

A cyberattack on a Kansas water treatment facility has forced them to switch to manual operations, highlighting the growing concern about cyber threats targeting critical infrastructure.

The attack disrupted the facility's computer systems, making it impossible for operators to monitor and control the water treatment process. As a result, the facility was forced to revert to manual procedures, which are more time-consuming and prone to errors.

This incident underscores the importance of protecting critical infrastructure from cyberattacks. A successful attack on a water treatment facility could have serious consequences for public health and safety.

Islamophobic Cyberattack Disrupts UK Railway Stations

A cyber security incident targeting passengers at several key railway stations in the UK has resulted in an arrest. The incident involved displaying Islamophobic messages on the Wi-Fi login pages of stations like Manchester Piccadilly, Birmingham New Street, and several London terminals.

The culprit, identified as an employee of Global Reach Technology, a company providing Wi-Fi services to Network Rail, was apprehended based on suspicion of offenses under the Computer Misuse Act 1990 and the Malicious Communications Act 1988. Thankfully, no passenger data was compromised during the attack.

Android Malware Necro Infects Millions of Devices

A new Android malware called Necro has infected over 11 million devices through the Google Play Store via malicious advertising SDKs used by seemingly legitimate apps, Android game mods, and altered versions of popular software such as Spotify, WhatsApp, and Minecraft. Necro can steal sensitive information, such as login credentials and credit card details. It can also install other malware on infected devices. The malware was able to bypass Google Play's security measures and infect a large number of devices.

This incident serves as a reminder that users should be cautious about downloading apps from the Google Play Store. It is important to only download apps from trusted developers and to be aware of the potential risks associated with installing apps from unknown sources.

Romcom Malware Resurfaces with New Variant

A resurgence of "Romcom" malware has been observed, using a variant of the Snipbot banking trojan. This highlights the ongoing threat of malware targeting online banking credentials and the need for robust security measures when conducting financial transactions online.

"Romcom" malware is a family of malicious software that targets online banking customers. The malware is designed to steal login credentials and other sensitive information. It can also be used to transfer funds to unauthorized accounts.

The Snipbot banking trojan is known for its ability to evade detection by security software. The malware is being distributed through email attachments and malicious websites.

P. Diddy Gossip Used to Spread Malicious Software

A sophisticated remote access trojan (RAT) named "PdiddySploit" has been targeting victims using the celebrity gossip surrounding the arrest of P. Diddy. The RAT is designed to give attackers complete control over infected devices. It can be used to steal sensitive information, spy on victims, and launch further attacks. The attackers behind "PdiddySploit" are using a variety of social engineering tactics to lure victims into clicking on malicious links or downloading infected files.

These tactics include sending emails that appear to be from celebrities or news organizations. The emails often contain sensational headlines or offers of exclusive content. Once victims click on the malicious link or download the infected file, their devices are compromised.