Online Crime Bytes

Warning: Blockchain Phishing Scam

This phish almost got me. I had just opened new iPhone account and for a second, thought, hmmm, was there a blockchain in my new phone I needed to activate? I searched the email's return link and it looked legit. Then I hovered my mouse over the activation link and it is totally shady, resolving to a blockchain like name with dashes and numbers in it (a fake address):

 

"nft-blockchain-2365 ..." which is a web app that already has my name set in its URL.

 

Needless, I am warning everyone. If it looks legit, hover your cursor over sender's email address, and the links that they want you to click for a second and it will show you where it really resolves to. (Do not click the links, though.) Although in this case, the email return address does appear go to

"[email protected]," and that has me puzzled on how they could spoof that. (I'd check the DNS registrar if I had time but I don't.)

 

If an email still looks real and you think you need to respond, just go to the site the way you normally would by typing it into your browser window manually.

 

Here is the phish email that I received:

 

Your Blockchain wallet will be suspended!

Dear Blockchain customer,

 

Our system has shown that your Blockchain Wallet has not yet been KYC verified. This verification can be done easily online with the below displayed connection

Due to the recently update of NFT's, all unverified accounts will be suspended on: Friday, April 16, 2022. We're sorry for any inconvenience we might cause with this.

 

Visit our website to start the security procedure: (I removed lin but it said it went to block chain wallet identification it was really the bad link)

 

 

Please keep in mind that our intention is to keep our customers safe, secured and happy.

 

Thank you for your understanding.

The Blockchain Team

 

 

Cyberwar is Real and Happening Now

There's a lot going in in cyber right now as it relates to books 2 and 3 of my cyber thriller series. Supply chain attacks on the software infrastructure, misinformation campaigns over social media, ransomware gangs halting critical infrastructure operations, and other state-sanctioned subterfuge coning from China, Russia, Iran and other countries and criminal gangs that want to cause disruption and gain world dominance.

Think, for a moment, how interconnected we are with countries that want to harm us. Chinese tech is ubiquitous and even if it's a US based product, their components are made or assembled in China. For example, Cisco routers sends parts development to China. I know: I've been in the fraud department at Cisco and have seen the red pins all over their maps of China. That was fifteen years ago and things are much worse today. The new laptop I just opened up said "assembled in China," and so on. 

We are also letting strangers on social media dictate what we think and division has never been worse in our country. The Russian trolls are doing their jobs expertly, posting fake news that people believe is patriotic enough to fight over, and even influencing our election cycles. 

Can we rip out our infrastructure and start over? No way, says everyone in the tech industry who laughs me out of the room (as usual, when I ask tough questions, they just laugh at me). But these questions need to be raised and addressed before it's too late to change anything.

It's probably already too late because the cost of replacing all forms of tech developed in countries that want to do us harm, is unfathomable. Where will be in 40 years? That's what I address in my cyber thriller series, Breaking Backbones.

The first book, Breaking Backbones: Information is Power, is available on Amazon and all book outlets. You can buy it here: https://www.amazon.com/Breaking-Backbones-Information-Hacker-Trilogy/dp/1665701080/

 

Breaking Backbones: My new cyber thriller book

The first two books in Deb Radcliff's Breaking Backbones hacker trilogy are available at Amazon, Archway Publishing, Barns and Noble, and every other bookseller. Book 1 placed as a top finalist in the Writer's Digest Indie Writers Excellence Awards for Action and Adventure, 2022. An Amazon reviewer wrote of book 1, "In her novel, Breaking Backbones: Information is Power, Deb Radcliff builds on her extensive experience as a cybercrime journalist to imagine a practical dystopian society that may represent a natural progression of existing trends - while also, building an intricate fiction of how a future society may fight back. As such, I put Breaking Backbones in a must-read category."

Book 2, Breaking Backbones: Information Should be Free, was just released September 22 and is awaiting reviews. Be the first to review it, and check out both books here: 

https://www.amazon.com/Deb-Radcliff/e/B092KFMG5B/ref=aufs_dp_fta_dsk

 

Back to the Basics: Black Hat 2018

LAS VEGAS, August 7-9 2018 – As nearly 19,000 of us from the hacker and research community descended upon Vegas for Black Hat, the outside temp hit 111 degrees, a record last set in 1994.

Fortunately, the power grid held, and we were kept comfortable (sometimes too cold) for the duration of the two-day security training event at the Mandalay Bay Hotel and Casino. However, some slot machines, elevators, and other embedded systems didn’t fare so well under hacker tinkering over the weekend at Black Hat sister conference, Def Con, as covered by Jack Morse, fellow member of the press.

These hotel hacks reported by Morse were simple demonstrations of software and hardware hacking into critical infrastructure systems (hey, elevators are critical). Demonstrations of grid hacking, car hacking and voting machine hacking were also urgently covered during sessions at both Black Hat and Def Con.

Everything Cyber is Hackable   

Risks from IoT, cloud-based computing, mobility, and lack of resources were topics well-covered by Parisa Tabriz, Google’s Director of Engineering and Project Zero Manager, during her conference kick off keynote, “Optimistic Dissatisfaction with the Status Quo: Steps we Must Take to Improve Security in Complex Landscapes.”

In it, she argued convincingly about going back to the basics – secure design, fast and accurate patching of vulnerabilities - and she told her personal story of challenging the status quo.

Improvement Takes Time

Tabriz used examples of long-term infrastructure improvements, like Chrome’s enforcement of encrypted browsing (HTTPS). Internet providers that use HTTP rather than HTTPS are labeled as insecure starting this past July.

Some businesses object to this ‘Migrate or face embarrassment’ move on Google’s part. Google countered by posting comprehensive help documents for businesses to make the migration.

She also described the time (nearly 7 years) and team commitment put into this upgrade that she called a “feat of engineering.” Myriad browser program interdependencies – from plug ins to the O/S – had to be considered (and no, none of them made it easier with a common language).

 “The message that it took years to make this change is incredibly important,” said Adam Shostack (author of Threat Modelling: Designing for Security) during an impromptu hallway interview shortly after the keynote. “Changes that really matter take time.”

Tabriz also used the keynote to showcase another long-term program developed by her team at Google, Project Zero, which, she says so far has identified 1,400 critical vulnerabilities across O/S, software, cloud-based and hardware systems while speeding up vendor patch times to 90 days or less.

In Support of DevOps

While these Google projects were long in the works, they specifically support today’s demand for faster development by providing more secure foundations and libraries for developers and vulnerability managers, Tabriz explained.

Investments, industry collaboration, and buy-in to infrastructure improvements like this, Tabriz said, take us one step closer to getting ahead of criminals rather than “playing whack-a-mole with our attackers.”

The Weaponization of Smart Dust and Other Internet of Things – RSA 2017

SAN FRANCISCO, FEB 16 2017 – Imagine billions of sand-sized computing devices tossed into municipal waste, still alive by battery and calling out to one another. Imagine them joining a billions-strong botnet stretched out across the land sending short signals to deny service and pass along small bytes of malware to anything within proximity.

Think this is something from the future? Think again.

Late last year, smart things such as cameras were conscripted into botnets under the Marai Malware family, disrupting more than 900,000 Deutsch Telecom users, as well as 2,400 routers in England, and continues to morph and prey on new vulnerabilities found in other types of smart devices.

Meanwhile, smart dust or MEMS – Micro Electric Mechanical Systems – in the form of used RFID packaging, micro sensors (the size of salt grains) and other smart waste are already being tossed into dumps without end-of-life kill processes or even a means to turn them off, says Michael Patterson, CEO of Plixer, during the RSA Security Conference exhibition. 

“These are purpose-built smart devices with unique protocols, communications to their servers, and access to their administrative community,” he says.  “Without governance and oversight – like Underwriter Laboratories that we have for other electrical devices – these miniature smart chips have the potential to become a real risk to cyber security.”

So concerning are these smart devices that Adi Shamir (who’s last name represents the ‘S’ in RSA encryption technology) will soon release a paper he titled “IOT Going Nuclear.” In it, he says he demonstrates how someone could sit in a hotel room, plug one infected smart light into a socket, and then spread malware from one smart light to others.

Based on density of the smart light fixtures, you could infect a whole city in minutes, turn off all the lights and hold the city ransom until the city pays to have the lights turned on, continues Shamir, a professor of computer science at the Weizmann Institute in Israel.

Ransomware holdups have already happened with other smart devices, for example in late 2016, LG television systems were hijacked by ransomware and turned into bricks until TV owners ponied up money to get them working again. 

“The government should NOT allow devices that are not sufficiently secure to connect to the public internet,“ Ramir says, which drew loud applause from the crowd attending the RSA cryptographer’s panel keynote session on Tuesday.

Whitfield Diffie, co-inventor of the Diffie Hellman Key exchange back in the 70’s (who was also on the panel), says that throwing more layers of security on top of this problem is not the answer. Instead, he urges everyone to reset their strategies and improve their products with secure engineering and software coding in the first place.

 “If anything like the resources being spent on interactive security – virus screening, fighting back, et cetera – were spent on the improvement on the logical functions of devices, we’d get much much better results,” says Diffie, currently a crypto export with Cryptomathic.

Will anybody heed such sage advice? Engineering and development have historically focused on ‘go-to-market’ first. Security, if considered at all, is usually an afterthought or the result of their products being hacked. This is why we’re in this mess in the first place!

Fighting for Our Digital Lives - RSA 2017

SAN FRANCISCO, February 14, 2017 – Cyber is the new battleground and we are losing the war, according to Michael McCaul, chairman of the Department of Homeland Security (DHS). 

“We’re trying to defend against 21^st-Century threats with 20^th-Century technology and 19^th-Century policies,” he said during an RSA keynote on Valentines Day at the San Francisco Moscone Center.

Cyber has become the newest weapon of warfare by nation-states such as Russia and China, he said, while smart criminals are stealing financial and health data to sell on the darknet, and others are using cyber to crowdsource the murder of innocent people.

“Cyber has even been used to undermine our election system and create discord in the lead up to the vote,” McCaul continued, adding that he was disappointed that the U.S. did not react fast or strongly enough back in April when he briefed government agencies on the intrusions into the DNC servers.

What we need is stronger sanctions and deterrence against nation states, along with international cooperation in prosecuting cyber criminals. McCaul urged for private sector organizations to share more threat and vulnerability data among themselves as well as with agencies. And he advocated for new cyber policies and innovation.

“The answer is right here in this room,” he said to the crowd of cyber security experts overflowing the ballroom at Moscone West.  “It’s the bleeding edge work in the private sector that will get us through. We need your innovation.”

The government also needs more experts working to protect government systems. To that end, McCaul is working to raise salaries and incentives to match that of the private sector.

In his call to action, he also proposed a stronger, more consolidated cyber security program headed by the DHS, under which we’re likely to see more recommendations and best practices on the roles we all play in protecting our homeland.

Autos are Computer Networks-DEF CON 2016

LAS VEGAS – The electronics in cars have become complex computing networks unto themselves, according to researchers at Black Hat Briefings and DEF CON security conferences in Las Vegas this past week (Aug. 3-7).

Monitoring systems, mapping and directions programs, roadside assistance apps, sensors and cameras are but a few of the independent apps and networks controlling today’s automobiles.

Consider that each of these apps uses its own signaling technology and protocols (WiFi, Bluetooth, GPS, cellular, dedicated networks, etc.) to communicate internally, or with other vehicles on the road, and to phone home for updates, and you begin to understand all the access points bad guys can take to control a moving vehicle to cause damage and loss of life.

“Today’s vehicles have more than 100 million lines of code,” says Craig Hurst, who as director of Intel’s transportation division, was at DEF CON tirelessly pitching the new Automotive Security Review Board - see (see https://asrb.org),  which he is also executive director of.  “Think of today’s vehicles as systems of systems that get much more complex as vehicles get smarter.”

Since 2013, multiple reports have cited that there are more than 100 million lines of code in automotive systems, including in a 2015 NY Times article here: http://www.nytimes.com/2015/09/27/business/complex-car-software-becomes-the-weak-spot-under-the-hood.html?_r=0 .

But with autonomous driving vehicles being developed for tomorrow (think 2020 or a little beyond), the time is now for organizations like the ASRB to promote common standards and best practices across all chip makers, application makers and parts manufacturers that go into the ecosystem of autonomous driving cars.

But that’s a little tricky when the auto makers’ immediate interests conflict with the hackers’ discoveries, something Charlie Miller and Chris Valasek, who work in security at Uber ATC, lamented during their Black Hat press meeting on Thursday, August 4. Their published exploits against their own 2013 Geep Cherokee showed, among other things, the ability to remotely drive the car into a ditch.

During the press con at Black Hat, the researchers laughingly joked that they “paid for the tow truck” to get their car out of that ditch themselves, and added that their exploits have been expensive and time consuming but worth the effort. Then they grew serious and even obtuse when asked about their relationship with the automakers and their ability to affect change. The manufacturers, they said, normally don’t get back to them so they don’t know if they’re affecting change or not.

Despite the friction between manufacturers and hacker researchers, such efforts are indeed driving change, especially when you consider that Miller and Valesek’s hacks on the 2013 Jeep Cherokee led to the recall of more than 1.4 million vehicles. See my 2015 Black Hat/DEF CON blog post here: http://derad.typepad.com/onlinecrimebytes/2015/08/internet-of-interconnected-technologies-or-iit-black-hat-and-def-con-2015.html, about how they brought the same Jeep into Bally’s and demonstrated some of their ‘safer’ remote hacks (locking unlocking doors, etc.

Recalls and updates bring about another serious risk with software-laden passenger vehicles: Along with requiring layers of security within these ‘moving’ vehicle networks, security controls must also consider how to safely update and patch these auto applications when new vulnerabilities are discovered.

Manual recalls are unbearably expensive and traditionally difficult on both makers and buyers. However, updating the software in a moving vehicle could be catastrophic if it requires a system reboot or shut down, like most hardware updates call for today in our phones and hand held devices.

That’s why the National Highway Safety and Traffic Administration (http://www.nhtsa.gov/Research/Crash+Avoidance/Automotive+Cybersecurity), the Automotive ISAC (http://www.autoalliance.org/auto-issues/cybersecurity) and other new groups like the ASRB are working now to protect cars of the future, because those cars are being developed today.

Let’s hope they get it right sooner rather than later: These new vehicles will have more code and variety of apps (almost all chip-based) than some enterprise networks. The last thing we want holding up progress is conflicting standards and protocols that have led to the ages-old interoperability vs best of breed problems that have plagued enterprise security operations to this day.

Are All Endpoints Hostile? Black Hat 2016

LAS VEGAS – One consensus at the Black Hat security conference this week is that endpoints, even corporate owned and managed devices, should be considered hostile. This is in keeping with numerous SANS surveys that I’ve overseen as editor-in-chief of the SANS Analyst Program.

In the case of user endpoints (corporate and employee-owned) the real issue is users clicking phishing links and drive by downloads, based on a new survey (sponsored by Check Point) SANS is releasing August 11 during a live webcast (link here: https://www.sans.org/webcasts/2016-threat-landscape-survey-report-1021820). In it, 46% of respondents reported impactful attacks entering through email phishing links clicked by users, and 41% were able to track impactful attacks back to drive by downloads.

These trends implicate the browser as one of the top means attackers enter into networks.

Numerous browser exploits, particularly against Safari and Chrome, were demonstrated to go from breach to kernel access in a matter of minutes at the $hell on Earth’s Pwn2Own contest. On Wednesday $hell on Earth judges announced the eight most innovative browser to kernel exploits out of 21 seriously considered entries. (See: https://www.blackhat.com/us-16/briefings.html#$hell-on-earth-from-browser-to-system-compromise.)

 The Safari exploits were able to gain kernel control through graphics interfaces using Java controls and heap overflows, as well as other means such as through attestation exploits and spoofing diagnostics binaries.

 But the 360 Vulcan team exploit demonstrated against Chrome, which relies on out of bounds vulnerabilities in Flash to spoof system tokens and execute kernel level code on the machine, was identified as the “most dramatic” by the $hell on Earth judges.

With so much of this happening in memory, memory forensics techniques and technologies are becoming more important.  Multiple other technologies were presented at Black Hat as part of the solution: Numerous networking, antimalware and intelligence vendors were positioning themselves as next gen endpoint protection companies. Some are simply monitoring packets, while others are attempting to redefine endpoint security starting with Antivirus.

“Just like firewalls and IDS moved to next generation a few years ago, we need to redefine what next generation antivirus looks like on the endpoint,” says Brian Gladstein, product marketing manager at Carbon Black, an endpoint security company that just acquired Confer, a next gen AV company.

My guess? There’s going to be a lot of confusion over security of the endpoints – particularly as new types of devices (aka the Internet of Things) demand access to company networks and resources.

So before going on any buying spree for “next gen endpoint and AV,” first assess your risk, along with the efficacy of existing tools and practices. When you do start shopping, ask to see what’s under the hood of these “next gen” technologies, and in particular how they would integrate with your current environment and expand or flex to meet future needs.

Internet of Interconnected Technologies or IIT: Black Hat and DEF CON 2015

BLACK HAT and DEF CON, LAS VEGAS, August 7 2015—Things, end points and the Internet are converging into what should be given a new term to embrace them all. I suggest calling this convergence the Internet of Interconnected Technologies or IIT.

According to the SIEM, analytics and intelligence-type vendors, the end point is no longer just a laptop or mobile device with direct user interface. Now they consider severs, routers and switches, firewalls and VPNs, and anything else with a communication port hanging off of it, along with their applications, an end point.

So that means that mobile phones are now end points. Researchers at Black Hat released new methods for advancing what were only formerly lame attacks against apple iOs; while other researchers showed new methods to break into Androids.

It also means that servers are end points, such as DNS servers and their keys and certificates, which are ill managed and a gold mine for hackers to find and manipulate as demonstrated by researchers and vendors at Black Hat.

This also turns smart cars into end points. At Black Hat, researchers Charlie Miller and Chris Valasek repeated their remote control hack that led to the recall of 14 million Jeep Cherokees. Then at DEF CON (directly following Black Hat this weekend at Paris and Bally’s), the Jeep and a Tesla were both on the show floor exhibited as new end points to hack. These end points are now hosting numerous IP addresses to support multiple smart apps that can be targeted.

Then, toss in systems spinning up in the public cloud as virtual end points with rich applications that are of interest to attackers and it’s easy to get overwhelmed. How do you manage all the risk presented in this IIT ecosystem where all end points are targets and all targets are end points?

This interconnectivity between hardware, software and silicon implanted everywhere raises questions like how to holistically (connectively) monitor and apply security rules, intelligence and vulnerability management across such a global, interconnected ecosystem?

It also reinvigorates the question of who is responsible for securing these end points—the manufacturers, the users or both? And who builds that security and who pays for it?

With so many point solutions around (such as DNS key locator services, SIEM, threat or vulnerability intelligence, and so on), it’s going to be a long haul before any ‘big picture’ solutions reveal themselves.

It seems impossibly complex, but one can hope, after mingling with 16,000 brilliant hacker minds, that these and new emerging complexities will be worked out.