Information Technology

The malware used to strike Ukrainian government websites has similarities to the NotPetya wiper but has more capabilities “designed to inflict additional damage,” researchers say.

Dubbed WhisperGate, the malware is a wiper that was used in cyberattacks against website domains owned by the country’s government. The spate of attacks led to the defacement of at least 70 websites and a further 10 subject to “unauthorized interference,” according to the Security Service of Ukraine, State Special Service and Cyber Police. The wave of attacks was made public on January 14. Websites impacted included the Ukrainian Foreign Ministry, the Ministry of Education and Science, and various state services.  The defacement and reported compromise of at least two government systems come at a time when there appears to be a growing threat of invasion by Russia into Ukraine, despite the country denying any such plans. The UK has recently pulled a number of UK embassy staff out of Kyiv in response. Microsoft has published an analysis of WhisperGate, which was discovered on January 13. In a follow-up, Cisco Talos said it was likely that stolen credentials provided the access point for the deployment of the wiper.  Cisco Talos says that two wipers are used in WhisperGate attacks. The first wiper attempts to destroy the master boot record (MBR) and to eradicate any recovery options.  “Similar to the notorious NotPetya wiper that masqueraded as ransomware during its 2017 campaign, WhisperGate is not intended to be an actual ransom attempt, since the MBR is completely overwritten,” the researchers say.

However, with many modern systems now moving to GUID Partition Tables (GPTs), this executable may not be successful, so an additional wipe has been included in the attack chain.   In the second stage, a downloader pulls the code required for the third step. After a base64-encoded PowerShell command is executed twice and an endpoint is requested to enter sleep mode for 20 seconds. A Discord server URL, hardcoded into the downloader, is then pinged to grab a .DLL file.  The .DLL, written in C#, is obfuscated with the Eazfuscator, a .NET platform obfuscator and optimizer. The .DLL is a dropper that deploys and executes the main wiper payload through a VBScript. In addition, Windows Defender settings are tampered with to exclude the target drive from scans. “The fourth-stage wiper payload is probably a contingency plan if the first-stage wiper fails to clear the endpoint,” Cisco Talos says.  The wiper seeks out fixed and remote logical drives to target in the fourth stage. Enumeration then occurs, and files are wiped in drives outside of the “%HOMEDRIVE%Windows” directory. Files with one of 192 extensions, including .HTML, .PPT, .JPG, .RAR, .SQL, and .KEY is destroyed.  “The wiper will overwrite the content of each file with 1MB worth of 0xCC bytes and rename them by appending each filename with a random four-byte extension,” Talos says. “After the wiping process completes, it performs a delayed command execution using Ping to delete “InstallerUtil.exe” from the %TEMP% directory. Finally, it attempts to flush all file buffers to disk and stop all running processes (including itself) by calling ExitWindowsEx Windows API with EWX_SHUTDOWN flag.” Following the cyberattack, the European Union said it was mobilizing “all its resources” to assist Ukraine, NATO has pledged its support, and US President Biden has warned Russia of a cyber ‘response’ if Ukraine continues to be targeted.  CISA has recommended (.PDF) that organizations in general, as well as those linked to Ukraine, implement multi-factor authentication for remote systems, disable ports and access points that are not business-critical, and that strong controls be implemented for cloud services to mitigate the risk of compromise.  “We assess with medium confidence that stolen credentials were used in the attack based on our investigation thus far,” Cisco Talos says. “We have high confidence that the actors had access to some victim networks in advance of the attacks, potentially for a few months or longer. This is a common trait of sophisticated APT attacks.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Hackers are abusing misconfigurations in smart contracts to launch token rug pulls, researchers say. 

Despite the current volatility in the cryptocurrency market, with prices for many popular coins including Bitcoin (BTC) plunging, interest in the crypto, token, and NFT spaces remains stable. 2021 was a record-breaking year for cryptocurrency-related theft and fraud. Cybercriminals netted an estimated $14 billion in cryptocurrency and fraudulent schemes involving digital assets continue to evolve. On Monday, Check Point Research (CPR) said that scammers are now turning their attention to smart contracts, with misconfigurations utilized to launch new crypto tokens — before an inevitable “rug pull” takes place.  Rug pulls occur when developers of a crypto or virtual asset project manipulate a token’s perceived worth and then abandon the project – taking investor funds with them. A recent example is the SQUID token which, at its peak, saw the token reach $2,850 in value. Once the developers rug pulled and prevented traders from selling, the coin crashed by over 99.99%, rendering it basically worthless while netting the developers millions of dollars.  There are some indicators of a potential token scam, including 99% buy fees and mechanisms that prevent investors from reselling. According to the researchers, flaws in smart contract code and vulnerabilities can also be harnessed by external attackers to increase the risk of a project losing investor money.

Fraudsters employ a range of tactics to conduct a rug pull including the use of scam services to create smart contracts which are then issued a new token name and symbol before becoming public. The manipulation of functions to create hidden triggers to launch a rug pull may also be included. Social media networks are then used to hype up a token — and its perceived value — before an exit scam occurs. In addition, timelocks are not usually imposed.  “Timelocks are mostly used to delay administrative actions and are generally considered a strong indicator that a project is legitimate,” the researchers noted.  Buy and sell fees are a common technique for rug pulls. In a smart contract examined by CPR, the firm discovered both “approve” and “aprove” functions. The former was a legitimate, standard function for contract transactions, whereas “aprove” was hidden and designed to allow the developers to impose 99% fees after a project took off.  “A legitimate token will not charge fees or will charge hardcoded values that can’t be adjusted by the developer,” CPR says.  Another example of potential scam mechanisms is a hidden function that allows developers to create more coins or control who can sell tokens. In the source code of a basketball-themed smart contract, the team found a transfer function that prevented reselling by average traders — a similar element used by SQUID.  A function found in a separate contract that allowed coin minting was exploited by an attacker after the contract’s private key was accidentally leaked online. A threat actor was able to use the key to fraudulently mint millions of virtual coins before withdrawing them. In the same contract, an error in emergency withdrawal functions was also exploited. Attackers may also burn tokens to ramp up the price of existing pools. A failure to limit external burns in the Zenon Network was exploited in 2021, leading to a pool drain and the theft of over $814,000 from the project.  “It’s hard to ignore the appeal of crypto,” CPR says. “It’s a shiny new thing that promises to change the world, and if prices continue on their upward trajectory, people have an opportunity to win a significant amount of money. However, cryptocurrency is a volatile market. Scammers will always find new ways to steal your money using cryptocurrency.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Image: Getty Images
A Liberal member of parliament has accused the Chinese government of foreign interference after Prime Minister Scott Morrison’s account on WeChat was hijacked. “It is a matter of record that the platform has stopped the Prime Minister’s access, while Anthony Albanese’s account is still active featuring posts criticising the government,” Liberal representative Gladys Liu said. “In an election year especially, this sort of interference in our political processes is unacceptable, and this matter should be taken extremely seriously by all Australian politicians.” As part of the accusations against the Chinese government, Liu said she would boycott using her official and personal WeChat accounts until an explanation was provided by the platform about the incident. Various Coalition members have also backed Liu’s accusations and boycott, with Parliamentary Joint Committee on Intelligence and Security chair and Liberal Senator James Paterson calling for Opposition Leader Anthony Albanese to follow suit in boycotting WeChat. Stuart Robert, the Minister responsible for digital transformation, told The Today Show on Monday morning that the Prime Minister’s office was seeking to contact the Chinese government about the account hijacking. “It is odd, and of course, the Prime Minister’s office is seeking to connect through to them to work out and get it resolved,” Robert said.  

First reported by NewsCorp Australia, the WeChat account was reportedly renamed and Morrison faced accessibility problems months ago, with the Prime Minister now unable to access the account at all. According to Australian Strategic Policy Institute senior analyst Fergus Ryan, Morrison’s account is registered to a Chinese national as WeChat’s policies at the time required for accounts to either be linked to the ID of a Chinese national or business registered in China. In China, WeChat has faced growing regulation, having been put on notice last year for collecting more user data than deemed necessary when offering services. Tencent, the company running WeChat, last year also implemented further restrictions for how much minors could play its flagship game Honour of Kings as part of efforts to appease government concerns. In that restriction, Honour of Kings gamers under the age of 18 are limited to playing time of one hour on regular days and two hours on public holidays.Related Coverage More

Image: Getty Images
The federal government has reappointed Julie Inman Grant as the country’s eSafety commissioner. The reappointment comes simultaneously with the Online Safety Act, which passed last year, officially coming into effect. “The Online Safety Act commences operation [on Sunday] and Ms Inman Grant’s reappointment provides certainty, particularly to community organisations and industry who have been working with the office of the eSafety Commissioner for some time,” said Paul Fletcher, the Minister for Communications, Urban Infrastructure, Cities and the Arts. Inman Grant was first put into the role in 2016, months after the Office of the eSafety Commissioner was established under the Australian Communications and Media Authority (ACMA). During her tenure, the eSafety commissioner has steadily expanded from initially only protecting children to a remit of providing supporting mechanisms for all Australians online. With the Online Safety Act now in effect, Inman Grant has even more substantial powers, such as being able to order social media platforms and other websites popular among children to remove cyberbullying content within 24 hours.If these entities fail to remove the content, the commissioner can issue fines of up to 500 penalty units, which equates to a maximum of AU$111,000 for individuals and AU$555,000 for companies. While Inman Grant could already order the removal of cyberbullying content aimed at children, the key change to the commissioner’s powers is that she can also issue orders for cyberbullying content targeted at adults too. In addition, the time allowed for online service providers to take down this type of content has also been cut in half, from 48 hours to 24 hours.

Beyond being able to order the removal of cyberbullying content, the eSafety commissioner can also order the takedown of intimate images of someone that was shared without their consent, abhorrent violent material, as well as restricted online content.Online safety has been high on the federal government’s agenda as late, with initiatives such as the Online Safety Youth Advisory Council, the proposal of anti-trolling and online privacy laws, and a federal probe into practices of major technology companies all coming in the past few months.RELATED COVERAGE More

C. Osborne | ZDNet
Apple’s AirTags are getting some of a bad (brand) name.It’s “a perfect tool for stalking,” as Eva Galperin, Director of Cyber-Security at the Electronic Frontier Foundation, put it to the BBC.

She’s right, of course.That’s the problem with technology, isn’t it? For every potential good use, there are at least several pain-inducing, criminal-pleasing, world-ending uses. Too often, the bad outweighs the good, especially in the public eyes and ears.Here, though, is a tale of a woman who’s glad she used an AirTag for her own surveillance purposes.Valerie McNulty has moved around a few times. She’s an army spouse and she knows the drill.As she told the Military Times, McNulty also knows that moving companies aren’t universally reliable. It’s not just that they can break things or lose things. It’s that, well, they may not always deliver the facts in a way that’s actually factual.

So McNulty slid an AirTag into one of her family’s moving boxes containing her son’s toys. They had a long way to go, from Fort Carson, Colorado to Fort Drum, New York.You’ll be stunned when I tell you the boxes didn’t turn up on time. They were a month late. A promise of a Friday delivery became the promise of a Sunday delivery. You know how these things go. Also: How tech is a weapon in modern domestic abuse — and how to protect yourselfThe driver finally called McNulty and told her that he was just picking up her family’s boxes in Colorado.The call didn’t go well. You see, McNulty had already checked the location of her AirTag. She knew it was in Elizabeth, New Jersey, not far from her new home.”I made him aware that I knew he was only four hours away from us,” she told the Military Times. “He called back several minutes later trying to bargain with me to see if he could deliver it on Sunday or Monday.””Where was the driver?,” you might ask. Allegedly seeing a lady friend, said McNulty.And, of course, all of her family’s boxes didn’t arrive. You can completely understand why McNulty used the AirTag in the way she did. This whole tale makes me wonder, though, what we’ve come to and where we’re going.Employers don’t trust remote employees, for example, so they garland them with surveillance technology.Too many humans don’t like or trust each other. So they use technology to abuse each other, stalk each other, hack each other, and even break into their lovers’ gadgets.At the same time, they use technology to stay in touch with each other and work together in ways that were never previously possible.Perhaps we were always as two-sided as this.Ultimately, though, because of the immediacy and ubiquity of technology, the result is an exponentially heightened collective paranoia. If our default is that we can trust no one and fear everyone, how can we ever really get along?How can we ever be at peace?

more Technically Incorrect More

Crypto.com CEO Kris Marszalek responded to complaints from thousands of users about issues logging back into their accounts after the company was forced to change security settings following a hack last week. On Monday, the company admitted that 483 users were affected by unauthorized cryptocurrency withdrawals on their accounts, costing a total of “4,836.26 ETH, 443.93 BTC, and approximately US$66,200 in other cryptocurrencies.” At the time of the attack, that amounted to about $31 million. Crypto.com said in a statement that it revoked all customer 2FA tokens and “added additional security hardening measures, which required all customers to re-login and set up their 2FA token to ensure only authorized activity would occur.”But thousands of people took to social media since then to complain that they could not get back into their accounts. Hundreds of people tweeted at Crypto.com begging for help, complaining that support channels were not working. When pressed for comment, Crypto.com directed ZDNet to a statement from Marszalek that was posted to Twitter on Friday evening. “If you can’t get back into our app following access reset this week, in 95/100 cases you are simply using the wrong email to login. We don’t allow duplicate accounts with the same phone number, so you will get stuck if you are using the wrong email,” Marszalek wrote. He urged customers to check their inboxes for emails from Crypto.com and said the “one which has it is the one you should use to login into the app.” 

“If you can’t find it, or no longer have access to it, please reach out to our CS. We will authenticate you again. We are helping users with these cases one by one, but it takes time given the scale of our platform. Our team is also working on a new app release that specifically communities this via UI/UX improvements,” he explained. “Finally, rest assured your funds are safe and waiting for you to log back in.. with the right email.”The statement did little to assuage angry customers demanding access to their accounts. The company initially denied reports that funds were stolen, even as PeckShield said around $15 million was being washed through a coin tumbler. By Wednesday, Marszalek was forced to appear on Bloomberg to confirm that about 400 users had been attacked and users’ ability to withdraw funds was paused.  Crypto.com created a program designed to refund users who were affected by the hack with up to $250,000. The company said terms and conditions “may vary by market according to local regulations” and that “Crypto.com will make the final determination of eligibility requirements and approval of claims.” More

Microsoft researchers have discovered a previously undisclosed vulnerability in the SolarWinds Serv-U software while monitoring threats related to Log4J vulnerabilities. Jonathan Bar Or explained on Twitter that while he was hunting for a Log4J exploit attempt, he noticed attacks coming from serv-u.exe. 

more Log4j

“Taking a closer looked revealed you could feed Ssrv-U with data and it’ll build a LDAP query with your unsanitized input! This could be used for log4j attack attempts, but also for LDAP injection,” he wrote. “Solarwinds immediately responded, investigated and fixed the #vulnerability. Their response is the quickest I’ve seen, really amazing work on their part!”Microsoft later released a blog about the issue, tracked as as CVE-2021-35247, and said it is an “input validation vulnerability that could allow attackers to build a query given some input and send that query over the network without sanitation.”In their advisory, SolarWinds said the Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized.”SolarWinds has updated the input mechanism to perform additional validation and sanitization. No downstream affect has been detected as the LDAP servers ignored improper characters,” the company said, adding that it affects 15.2.5 and previous versions. 

NTT Application Security’s Ray Kelly told ZDNet that the vulnerability surprised and concerned him considering SolarWinds is fresh on the heels of their previous breach that affected thousands of customers. “Given that the Log4j disclosure was published in December, this Open Source vulnerability should have been of the utmost priority for SolarWinds. While it appears that SolarWinds was not susceptible to have the vulnerable component exploited, it’s still not something want in your software product,” Kelly said. “Most all application security products can detect the Log4j vulnerability giving developers the ability to quickly identify and fix issue.” Microsoft urged customers to apply the security updates explained in the SolarWinds advisory and said customers can use their tools to identify and remediate devices that have the vulnerability. Microsoft Defender Antivirus and Microsoft Defender for Endpoint also detect behavior related to the activity, they added. Netenrich’s John Bambenek added that Microsoft’s warning and SolarWinds’ quick response time represented a positive example of how vulnerabilities need to be dealt with.  “This is the kind of vulnerability and research cooperation we need, where a major tech company with visibility to see the attacks reaches out to the software company and a fix is rushed to production,” Bambenek said.  More

CISA released its latest update to the Known Exploited Vulnerabilities catalog, adding 13 new vulnerabilities. Nine of the vulnerabilities have a remediation date of February 1 and four of them have a remediation date of July 18. The list includes an October CMS Improper Authentication, a System Information Library for node.js Command Injection vulnerability, an Oracle Corporate Business Intelligence Enterprise Edition Path Traversal vulnerability, an Apache Airflow Experimental API Authentication Bypass vulnerability, a Drupal Core Unrestricted Upload of File vulnerability, and three Nagios XI OS Command Injection vulnerabilities.
CISA
The October CMS Improper Authentication — CVE-2021-32648 — was allegedly used during a cyberattack on Ukrainian government systems last week. A patch was released in September 2021. The Media Trust CEO Chris Olson said the vulnerability’s alleged use in the recent attack on Ukraine explains the software’s inclusion on the list but he noted that its inclusion highlights “an alarming growth in web-based cyberattacks and the role they will play in global cyber warfare.” “Little attention is paid to the Web as an attack surface. While organizations across the public and private sector are increasingly aware of cyber risk, the stack of third-party code used in Web development rarely meets the standards for AppSec that those organizations would demand from any of their IT systems,” Olson said. Jordan LaRose, director of incident response at F-Secure, told ZDNet that CISA’s guidance matches much of what they are seeing in the wild from a malicious actor standpoint. LaRose said that what stood out most to him was that these are all vulnerabilities affecting web servers or APIs. This is a trend LaRose said he has seen develop significantly in the past year among malicious actors, many of whom are turning to more than just classical methods like phishing or trojans to gain footholds in organizations with strong security postures. 

“What we’re seeing now is a wave of attacks where attackers are targeting technology rather than people, with the most recent notable example being the Log4Shell attacks. These attacks are largely done opportunistically, with attackers loading up scanning scripts with the exploits and hitting everything they can on the internet to find a potential victim,” he said. Neosec vice president Edward Roberts echoed that sentiment, adding that the volume of vulnerabilities involving APIs will continue to increase because there are more APIs being developed each day. Most organizations, he said, “don’t even know how many APIs they have, let alone which ones have vulnerabilities, let alone consider how they are being defrauded by abusive behavior.”A number of cybersecurity experts noted that several of these vulnerabilities were identified months ago. Some of the vulnerabilities on the list date back to 2012 and 2013 according to Netenrich principal threat hunter John Bambenek, who expressed concerns about the fact that they haven’t already been patched.  “That the agency doesn’t have basic patch deployment information from other units of government implies there is no central management of that information. The posture of federal IT cybersecurity seems to have remained stalled at square one,” Bambenek said. “If an exploited vulnerability can be used to execute commands on the victim machine, then CISA sets a two week due date to patch. That being said, two weeks is far too slow. The exchange vulnerability concerns me the most, however, some of this stuff is quite off the beaten path. But, this may be common in government installations so worthy to put on the list.”Vulcan Cyber CPO Tal Morgenstern noted that seven of the vulnerabilities with remediation dates of February 1 relate to systems management tools.”Systems management tools from VMware, Nagios, F5, Npm and more hold the keys to the kingdom giving the user substantial power to automate system change for good or bad. This isn’t a new concern as we’ve seen an unfortunate trend of vulnerabilities in systems management software tools this year,” Morgenstern explained. “Considering the amount of access and control these tools have, IT security teams must take immediate steps to fully mitigate known risks. Don’t wait for February. Move now.” More