Online Crime Bytes

Hacking Google Voice

Recently, the Federal Bureau of Investigation released a report on how criminals are using a Google form of this type of telephone verification system to take over a victim’s gmail account and set up fraudulent Google Voice accounts in their victim’s names and phone numbers.

According to the FBI press release, the scammers target people who post things in online marketplaces, such as a couch for sale or reward for a lost dog (Fluffy).

“The scammer contacts you via text or email. He is really interested in buying that couch or thinks he found Fluffy. He says he just needs to make sure you are legitimate so he doesn’t get scammed. He says he will send you an authentication code from Google to confirm that you are a real person and not a bot. You will receive that authentication code in the form of a voice call or a text message. He asks you to repeat that number to him.

What he is really doing is setting up a Google Voice account in your name using your real phone number as verification. Once set up, he can use that Google Voice account to conduct any number of scams against other victims that won’t come back directly to him. He can also use that code to gain access to, and take over, your Gmail account.”

Google Voice allows users to set up a virtual phone number to use for calls and texts. But in this hack, the victim doesn’t need to have a Google Voice account to fall victim. The FBI offers this advice:

1. Watch out for warning signs. Most scammers use a sense of urgency to pressure you into making a snap decision. Pause ask yourself why you’re feeling this way and who’s behind it.
2. Don’t share your Google Verification code with others.
3. Don’t give your email address to anyone reaching you on the phone.

And perhaps the best advice I can offer is don’t use the same password for all your different online accounts.

Warning: Blockchain Phishing Scam

This phish almost got me. I had just opened new iPhone account and for a second, thought, hmmm, was there a blockchain in my new phone I needed to activate? I searched the email's return link and it looked legit. Then I hovered my mouse over the activation link and it is totally shady, resolving to a blockchain like name with dashes and numbers in it (a fake address):

 

"nft-blockchain-2365 ..." which is a web app that already has my name set in its URL.

 

Needless, I am warning everyone. If it looks legit, hover your cursor over sender's email address, and the links that they want you to click for a second and it will show you where it really resolves to. (Do not click the links, though.) Although in this case, the email return address does appear go to

"[email protected]," and that has me puzzled on how they could spoof that. (I'd check the DNS registrar if I had time but I don't.)

 

If an email still looks real and you think you need to respond, just go to the site the way you normally would by typing it into your browser window manually.

 

Here is the phish email that I received:

 

Your Blockchain wallet will be suspended!

Dear Blockchain customer,

 

Our system has shown that your Blockchain Wallet has not yet been KYC verified. This verification can be done easily online with the below displayed connection

Due to the recently update of NFT's, all unverified accounts will be suspended on: Friday, April 16, 2022. We're sorry for any inconvenience we might cause with this.

 

Visit our website to start the security procedure: (I removed lin but it said it went to block chain wallet identification it was really the bad link)

 

 

Please keep in mind that our intention is to keep our customers safe, secured and happy.

 

Thank you for your understanding.

The Blockchain Team

 

 

Don’t Blame the User (And Don’t Count on Them Either)

By Deb Radcliff

Security naiveté among employees was a top reason for the growth in ransomware in 2020, according to 43% of more than 1200 IT decisions makers to take the Mimecast State of Email Security.

The negative term, ‘naïve’ used to describe the users bothers me. Blaming the users has been a peeve of mine since the mid-90’s, which is the main reason I became a cybercrime reporter back in 1996.

These ‘average Joe’ users were getting royally fleeced back then, and I regularly raised the issue to IT pros and white hats. They told me over and over that, ‘If the average user can’t stand the heat, he shouldn’t be on net.’ (Mind you, these are the same pros who can’t say for sure whether their business networks they’re charged with protecting are bullet proof...)

Sheep to the Slaughter

Users can’t be expected to detect threats on their computers that are increasingly disguised as work-related communications, just as they can’t be expected to work from home and provide their own security to protect their employers. It’s important to note also that 60% of respondents acknowledge that the attacks aimed at their employees are increasing in sophistication.

Once I read the report, I pinged Mimecast with my strong opinions and asked a few questions, starting with blaming the user.

“While IT security professionals know that employees shouldn’t be held responsible for the full scope of security, they do expect that employees practice habits such as strong passwords or an awareness of how impersonation of a CEO can happen,” says Jeremy Ventura, Senior Security Engineer at Mimecast.

And that’s another peeve: passwords suck.

Even with password managers and vaults, managing complex, system-issued passwords is nearly impossible across our many computers, pads, phones, Siri’s, security systems, tv’s and entertainment devices, etc. Until security is as ubiquitous as seatbelts as easy as checking the oil indicator gauge in a car dash, average users will be incapable of protecting the front line in email-based attacks.

Trust No One

This speaks not only to zero trust security models (trust nobody, not even authorized users), but also to precious user data that organizations are wasting—data that would help them protect the business environment from their own users. According to the Mimecast report:

• 55% of employers are not using employee data and reports to tune their security to user behaviors
• 45% don’t take feedback from employees
• 33% aren’t using metrics

Since they aren’t taking employee feedback or using their behavior data, it’s hard to believe that the majority of respondents utilizes metrics in a useful way.

Most Common Payload: Ransomware

With a 64% increase in email-based threats detected in the Mimecast threat center, the report also reveals that employees who work from home are being directly targeted, Ventura continues. And the payloads are most often in the form of ransomware, which has, in recent months, become more diabolical.

In the Mimecast survey, 34% of companies were unable to recover their data after paying ransoms. Does that mean the decrypt keys didn’t come through or that, with ransomware now also exfiltrating data, that the data wasn’t returned? Ventura says it’s a combination both “failing to recover their data, and also because their data was already exfiltrated to the dark web.”

“Once the hacker sees that the organization is willing to pay, instead of releasing the decryption key, the hacker will come back requesting a larger amount in hopes that the organization will pay again,” he continues. “In addition, double extortion has spiked in the last several months where hackers will charge one ransom for the decryption key and then another ransom not to sell the encrypted data.”

There we have it. Workers at home exposed to increasingly sophisticated attack methods are not equipped to hold the front line against ransomware gangs and other cyber attackers. And still, the consensus is that the end users just need more training.

“Reinforcing best practices and awareness will hopefully drive the 43% [of naïve users selected as the top security risk] to a lower number in 2021,” Ventura continues. However, he adds, “Security must lead by example and then end users should follow.” 

UPDATE! LabMD CEO Tells the Story of FTC Bullying Relying on Stolen Data

June 20, 2018 - Today Michael Daugherty told the whole  sordid story about how a private security firm stole data from one of their internal servers and used it to blackmail his company into paying $450-an-hour for said firms' services to remediate the issue. Ongoing lawsuits are in the works but last week, one of the litigations led to the FTC backing down on demanding security controls that they cannot enforce. Link to his webcast here: https://www.sans.org/webcasts/labmd-phony-data-breach-108400.  

See below for original report: 

Atlanta and Washington DC, June 6, 2018 – Today, the 11^th Circuit U.S. Court of Appeals ruled that the Federal Trade Commission does not have the authority, or the capability, to dictate a sophisticated, on-going process of security controls.

This comes as good news to the petitioner, LabMD, Inc., CEO and Founder Michael Daugherty who wrote a book “The Devil Inside the Beltway,” about his experiences with unreasonable FTC demands. The book sells at Amazon right now.

“The court concludes that the Federal Trade Commission does not possess the legal authority to force companies to implement comprehensive data-security programs,” explains Benjamin Wright, senior instructor for the SANS training institute and practicing technology attorney who has also worked as counsel for LabMD.  “The court held that Congress has not provided the Federal Trade Commission the legal tools it needs in order to force companies to implement effective programs.”

(Full disclosure: Benjamin Wright and I work for the same company, SANS Institute, and have in past worked together on content in my capacity of editor-in-chief of the SANS Analyst Program.)

Unfortunately, the appeals judgment comes too late to save the plaintiff company, LabMD. In 2014, Daugherty shuttered his 30-employee, $4-million, Atlanta-based diagnostics testing business. LabMD was, as he says, crushed under all the litigation and vague demands from the FTC.

“It’s a bittersweet day when a 700,000 patient cancer detection center gets destroyed at the hands of innuendo and overreach by a rogue government agency,” Daugherty says. “I am very gratified by what happens when an Article III court finally gets a case. It needs to happen sooner so agencies win on the merits rather than intimidation.”

Background

The FTC relied on an outside security company’s assessment – a company that alleged it pulled files off a Limewire file sharing service that came from a LabMD accounting computer (while Daugherty claims the file was stolen off the accounting computer by the outside security company).  In 2008, the security firm informed LabMD of the alleged problem. LabMD demanded that the security firm fully explain what had happened, but the explanation never came.

Daugherty, in several court documents and his book, claims that the security firm acted more as an extortionist and when he declined employing this firm (for nearly $40,000) to ‘update LabMD security and fix the problem,’ the firm took the file (with 9,000 patient names and data) to the FTC.

Despite the dubious methods and motivations of the security firm, the FTC ordered LabMD to implement and maintain a comprehensive data security program for many years into the future.

But the court today ruled FTC is not legally constituted to enforce such a complex, nuanced regulatory order.

Wright continues, “A comprehensive data security program is a constant process of striving to be secure. The process is inherently imperfect, and different experts can disagree about what should be done to achieve an effective program. If the FTC orders such a program, it would have to enforce it over the years by way of awkward injunctions from a federal district court.”

Or as the 11^th Circuit Court ruling (in case number 16-16270) puts it:

“The practical effect of repeatedly modifying the injunction at show cause hearings is that the district court is put in the position of managing LabMD’s business in accordance with the Commission’s wishes. It would be as if the Commission was LabMD’s chief executive officer and the court was its operating officer. It is self-evident that this micromanaging is beyond the scope of court oversight contemplated by injunction law."

Wright added: “This case does not bring an end to efforts by the Federal Trade Commission to require information security. But it does change the methods available to the FTC. And it will cause the commission to pause and carefully rethink its direction in this field.”

iCloud Didn't Get Hacked: Yahoo Did

iCloud did not get hacked, says John Pesctore, whom I'm lucky enough to work with at SANS Institute (where he is director of emerging trends and I am chief of the SANS Analyst Program). He also reminds us NOT to use the same passwords across our many online accounts in the below message he sent around to our team: 

    "There's been press coverage about a hacker group threatening to release "hacked" iCloud/Apple ID username/passwords. Neither Apple or iCloud has been hacked, but previously Yahoo and LinkedIn have had all of their user accounts hacked - and the attackers are finding LinkedIn/Yahoo accounts that use the same username/password on iCloud.

    So, if you had a LinkedIn or Yahoo account that was hacked, and use the same password on iCloud, you should change your iCloud password. In general, you should change any account where you used the same password that you were using on LinkedIn and/or Yahoo.

    Apple is being very careful about password resets right now, so you might run into a lengthy verification process, but if you were using the same password as on LinkedIn/Yahoo, better to go through it."

The Weaponization of Smart Dust and Other Internet of Things – RSA 2017

SAN FRANCISCO, FEB 16 2017 – Imagine billions of sand-sized computing devices tossed into municipal waste, still alive by battery and calling out to one another. Imagine them joining a billions-strong botnet stretched out across the land sending short signals to deny service and pass along small bytes of malware to anything within proximity.

Think this is something from the future? Think again.

Late last year, smart things such as cameras were conscripted into botnets under the Marai Malware family, disrupting more than 900,000 Deutsch Telecom users, as well as 2,400 routers in England, and continues to morph and prey on new vulnerabilities found in other types of smart devices.

Meanwhile, smart dust or MEMS – Micro Electric Mechanical Systems – in the form of used RFID packaging, micro sensors (the size of salt grains) and other smart waste are already being tossed into dumps without end-of-life kill processes or even a means to turn them off, says Michael Patterson, CEO of Plixer, during the RSA Security Conference exhibition. 

“These are purpose-built smart devices with unique protocols, communications to their servers, and access to their administrative community,” he says.  “Without governance and oversight – like Underwriter Laboratories that we have for other electrical devices – these miniature smart chips have the potential to become a real risk to cyber security.”

So concerning are these smart devices that Adi Shamir (who’s last name represents the ‘S’ in RSA encryption technology) will soon release a paper he titled “IOT Going Nuclear.” In it, he says he demonstrates how someone could sit in a hotel room, plug one infected smart light into a socket, and then spread malware from one smart light to others.

Based on density of the smart light fixtures, you could infect a whole city in minutes, turn off all the lights and hold the city ransom until the city pays to have the lights turned on, continues Shamir, a professor of computer science at the Weizmann Institute in Israel.

Ransomware holdups have already happened with other smart devices, for example in late 2016, LG television systems were hijacked by ransomware and turned into bricks until TV owners ponied up money to get them working again. 

“The government should NOT allow devices that are not sufficiently secure to connect to the public internet,“ Ramir says, which drew loud applause from the crowd attending the RSA cryptographer’s panel keynote session on Tuesday.

Whitfield Diffie, co-inventor of the Diffie Hellman Key exchange back in the 70’s (who was also on the panel), says that throwing more layers of security on top of this problem is not the answer. Instead, he urges everyone to reset their strategies and improve their products with secure engineering and software coding in the first place.

 “If anything like the resources being spent on interactive security – virus screening, fighting back, et cetera – were spent on the improvement on the logical functions of devices, we’d get much much better results,” says Diffie, currently a crypto export with Cryptomathic.

Will anybody heed such sage advice? Engineering and development have historically focused on ‘go-to-market’ first. Security, if considered at all, is usually an afterthought or the result of their products being hacked. This is why we’re in this mess in the first place!

Are All Endpoints Hostile? Black Hat 2016

LAS VEGAS – One consensus at the Black Hat security conference this week is that endpoints, even corporate owned and managed devices, should be considered hostile. This is in keeping with numerous SANS surveys that I’ve overseen as editor-in-chief of the SANS Analyst Program.

In the case of user endpoints (corporate and employee-owned) the real issue is users clicking phishing links and drive by downloads, based on a new survey (sponsored by Check Point) SANS is releasing August 11 during a live webcast (link here: https://www.sans.org/webcasts/2016-threat-landscape-survey-report-1021820). In it, 46% of respondents reported impactful attacks entering through email phishing links clicked by users, and 41% were able to track impactful attacks back to drive by downloads.

These trends implicate the browser as one of the top means attackers enter into networks.

Numerous browser exploits, particularly against Safari and Chrome, were demonstrated to go from breach to kernel access in a matter of minutes at the $hell on Earth’s Pwn2Own contest. On Wednesday $hell on Earth judges announced the eight most innovative browser to kernel exploits out of 21 seriously considered entries. (See: https://www.blackhat.com/us-16/briefings.html#$hell-on-earth-from-browser-to-system-compromise.)

 The Safari exploits were able to gain kernel control through graphics interfaces using Java controls and heap overflows, as well as other means such as through attestation exploits and spoofing diagnostics binaries.

 But the 360 Vulcan team exploit demonstrated against Chrome, which relies on out of bounds vulnerabilities in Flash to spoof system tokens and execute kernel level code on the machine, was identified as the “most dramatic” by the $hell on Earth judges.

With so much of this happening in memory, memory forensics techniques and technologies are becoming more important.  Multiple other technologies were presented at Black Hat as part of the solution: Numerous networking, antimalware and intelligence vendors were positioning themselves as next gen endpoint protection companies. Some are simply monitoring packets, while others are attempting to redefine endpoint security starting with Antivirus.

“Just like firewalls and IDS moved to next generation a few years ago, we need to redefine what next generation antivirus looks like on the endpoint,” says Brian Gladstein, product marketing manager at Carbon Black, an endpoint security company that just acquired Confer, a next gen AV company.

My guess? There’s going to be a lot of confusion over security of the endpoints – particularly as new types of devices (aka the Internet of Things) demand access to company networks and resources.

So before going on any buying spree for “next gen endpoint and AV,” first assess your risk, along with the efficacy of existing tools and practices. When you do start shopping, ask to see what’s under the hood of these “next gen” technologies, and in particular how they would integrate with your current environment and expand or flex to meet future needs.

Press Members Beware of Malicious Shared Files

Recently, a number of legitimate PR firms have been hacked and their media contacts stolen.

The criminals attach a Google drive share file or other shared file for you to click on. DON'T click it. It is a whaling attempt at the least, and a malicious payload more likely.

I've xxx'd out the personal information on the victim at the pr firm that was hacked in this message below: 

>
> From: Sammy Txxx <[email protected]>
> Sent: Tuesday, June 28, 2016 10:36 AM
> Subject: IMPORTANT - [email protected] shared a file
>
> I've shared items with you below for (President/CEO)
>
> File(Via google drive)
>
> Google Drive:Have all your files download with anywhere
>

Note that the return email actually resolved to a dummy site registered in Jakarta. The criminals simply used the real email address in the subject header and didn't even try to get their English right.

I've contacted the real PR company and they know that their press email addresses have been hijacked and are working to alert everyone to the problem.   I've also had the fake domain name, "exodigitalagency.com" blocked. 

Meanwhile, other reputable PR firms tell me they are also falling victim to account hijacking and their email addresses stolen and used to send such files to us members of the press.

So press members, please beware of anything coming from what looks like a legit PR firm with attachments or links, particularly if you weren't expecting them. Don't respond or the criminals will know you are a real target to go after.  And block the criminal domains the emails actually resolve to.

Otherwise the bad guys will keep coming at us with better crafted messages because no matter what the PR firm does now to stop this, the criminals have all of our email addresses.