Information Technology

Security expert Dan Kaminsky has passed away at the age of 42. 

The news was made public over the weekend. In a statement issued by Kaminsky’s niece, Sarah, it was said that the prominent security researcher died due to diabetic ketoacidosis, a serious diabetic complication.  Kaminsky’s passing was not related to COVID-19 or vaccination efforts. On April 12, the researcher tweeted that he had received his vaccination, and on news of his death, some individuals on Twitter speculated there was a link.  To directly dismiss these claims, the family said that “while his passing was sudden and unexpected for us, Dan struggled for years with diabetes and was even recently hospitalized because of it.”  “I think Dan would laugh at the idea of conspiracy theorists promoting anti-vax propaganda through his death, but as his family, it hurts us to see his death being used to spread lies about a vaccine that he had full faith in,” the statement reads.  In 2008, Kaminsky revealed a fundamental flaw in the Domain Name System (DNS) at the Black Hat security conference in Las Vegas, leading to a multi-vendor, coordinated patch release.  While well-known for his work on DNS, Kaminsky has worked in the cybersecurity field for decades and also acted as an advisor for a number of Fortune 500 companies.  

The infosec community has responded on social media, describing him as generous, kind, and both a “hero” and a “force of nature” in the cybersecurity field.  A video of Kaminsky and Sarah explaining DNS — “Sarah on DNS” — has been uploaded to Twitter.  “My family and I appreciate your kind words, stories and memories of Dan,” Sarah said in a tweet dated April 25. “It has been remarkable to see the number of people he has impacted. He was such a light in this world.” The family has asked for privacy at this time. 

Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

A specially crafted update created by law enforcement has triggered the process of removing the Emotet botnet malware from 1.6 million infected computers around the world. Emotet was thought to be the world’s largest botnet, known for spewing millions of malware-laden spam emails each day. Law enforcement in the US, Canada and Europe conducted a coordinated takedown of Emotet infrastructure in January to rid the web of one of its worst menaces, which was used to spread banking trojans, remote access tools, and ransomware.  

Part of the action involved law enforcement commandeering Emotet’s command and control (C2) infrastructure to prevent its operators from using the botnet to spread more malware. As reported by ZDNet in January, law enforcement in the Netherlands took control of two of Emotet’s three-tier C2 servers.  SEE: Network security policy (TechRepublic Premium) Law enforcement that month delivered an Emotet update that was set to remove the malware from all infected computers on April 25. According to BleepingComputer, Germany’s Bundeskriminalamt (BKA) federal police agency created and pushed the uninstall update.   “Law enforcement officials will deliver an Emotet update, “EmotetLoader.dll” file, which will remove the malware from all infected devices. The run key in the Windows registry of infected devices will be removed to ensure that Emotet modules are no longer started automatically and all servers running Emotet processes are terminated,” said security company Redscan. “However, it is important to note that the switch-off does not remove other malware installed on infected devices via Emotet, nor malware from other sources,” it added.

And cybersecurity firm Malwarebytes has now analyzed the law enforcement Emotet uninstaller. Essentially, law enforcement used Emotet’s botnet infrastructure to dismantle the malware.  “The uninstall routine itself is very simple. It deletes the service associated with Emotet, deletes the run key, attempts (but fails) to move the file to %temp% and then exits the process,” note the researchers.  Despite the error in the law enforcement code, they add that the Emotet malware “has been neutered and is harmless since it won’t run as its persistence mechanisms have been removed.” According to an FBI press release in January, an FBI investigator’s affidavit stated that: “foreign law enforcement agents, working in coordination with the FBI, gained lawful access to Emotet servers located overseas and identified the Internet Protocol addresses of approximately 1.6 million computers worldwide that appear to have been infected with Emotet malware between April 1, 2020, and Jan. 17, 2021.”  Over 45,000 of the infected computers appeared to have been located in the United States. “Foreign law enforcement, working in collaboration with the FBI, replaced Emotet malware on servers located in their jurisdiction with a file created by law enforcement,” the FBI said.  SEE: Remote work makes cybersecurity a top worry for CEOs “This was done with the intent that computers in the United States and elsewhere that were infected by the Emotet malware would download the law enforcement file during an already-programmed Emotet update.  “The law enforcement file prevents the administrators of the Emotet botnet from further communicating with infected computers. The law enforcement file does not remediate other malware that was already installed on the infected computer through Emotet; instead, it is designed to prevent additional malware from being installed on the infected computer by untethering the victim computer from the botnet.” More

The founder of a Turkish cryptocurrency exchange has reportedly fled the country with billions of dollars in user assets. 

According to local media reports, Turkey has issued an international arrest warrant for Faruk Fatih Özer, who has allegedly been spotted leaving Turkey via Istanbul airport in order to enter Albania. Özer, the CEO and founder of the Thodex cryptocurrency exchange platform, has allegedly taken approximately $2 billion in funds with him which belongs to 391,000 investors.  On Thursday, Istanbul-based Thodex posted a notice on its website informing users that the exchange would be closed for several days in order to handle a “sales” process.  However, suddenly unable to access their cryptocurrency accounts or withdraw funds, users began to voice concerns that they had been scammed.  Thousands of Turkish citizens have now filed criminal complaints against the company, alleging that they have been victims of an exit scheme. A lawyer acting for the complainants said the allegedly stolen funds were “irretrievable.” Bloomberg reports that the Justice Ministry has issued a red notice for the former CEO, which are used by Interpol to warn “police in all our member countries about internationally wanted fugitives,” although it is up to each country whether or not to act on them and potentially launch extradition proceedings. 

Last week, law enforcement issued arrest warrants for 80 individuals suspected of being linked to the platform and 68 suspects have, so far, been apprehended, according to the Anadolu Agency (AA).  The local media outlet says Özer is being sought for alleged fraud and “founding a criminal organization.” However, in a statement on its website (translated), Thodex called the claims “baseless” and a “smear campaign.” The organization claims that an “abnormality” was found in company accounts and Thodex temporarily closed to get to the bottom of the matter — and at the same time, Özer left Turkey to meet with “foreign investors.”  Thodex added that a previously undisclosed “cyberattack” impacted roughly 30,000 users causing a “suspicious situation.” According to the statement, Özer will be returning to Turkey in order to cooperate with local authorities. “As a result of the perception of victimization created in the public [space], our company is prevented from continuing its commercial life,” the statement reads. Özer’s original Twitter profile has since been closed down. A new profile, apparently belonging to the executive, shared the latest Thodex statement on April 22 and has since claimed the company is creating an “interface” to allow users to request their funds. Furthermore, Thodex says that no user will be “victimized.”  Turkey intends to impose a ban on the use of cryptocurrency to purchase goods and to make payments by the end of April. While this does not mean there is an outright ban on holding cryptocurrency as an asset, Turkey’s central bank says the payment restrictions are necessary due to a lack of a regulatory, “central” authority.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Image: Getty Images
An investigation into stolen subscription service credentials by the Australian Federal Police (AFP) has resulted in a two years and two months’ sentence for a man from Sydney.The 23-year-old was handed the sentence, to be served by way of an intensive corrections order, for his involvement as the creator, administrator, and primary financial beneficiary of a number of online subscription services which relied on stolen credentials. He has also been ordered by the court to serve 200 hours of community service.The sentencing follows the execution of a search warrant in March at a Dee Why residence, which resulted in the seizure of a laptop that was used to run the operation and around AU$35,000 in cryptocurrency.The combined assets of the restrained property has a current value of approximately AU$1.65 million.The investigation began after the Federal Bureau of Investigation (FBI) referred information to the AFP in May 2018.The information, AFP said, was regarding an account generator website called WickedGen.com. WickedGen operated for approximately two years selling stolen account details for online subscription services, including Netflix, Spotify, and Hulu.

The AFP said it further identified the Sydney man to be the creator, administrator, and primary financial beneficiary of a further three “account generator” websites: HyperGen, Autoflix, and AccountBot.The account details of users in Australia and abroad were confirmed through credential stuffing — which allows a list of previously stolen or leaked usernames, email addresses, and corresponding passwords to be re-used — and sold for unauthorised access.According to the AFP, across the four subscription services, the offender had at least 152,863 registered users and provided at least 85,925 subscriptions to illegally access legitimate streaming services.The man received at least AU$680,000 through PayPal, the AFP said, by selling subscriptions through these sites. “The harvesting and selling of personal details online was not a ‘victimless crime’ — these were the personal details of everyday people being used for someone’s greed,” AFP cybercrime operations commander Chris Goldsmid said.”These types of offences can often be a precursor to more insidious forms of data theft and manipulation, which can have greater consequences for the victims involved.”The operation was undertaken by the AFP-led Criminal Assets Confiscation Taskforce (CACT).The CACT was formed in 2011 as part of a multi-agency crackdown on criminal assets, and comprises of the AFP, Australian Criminal Intelligence Commission, Australian Taxation Office, Australian Transaction Reports and Analysis Centre, and Australian Border Force.The man was charged with “unauthorised access to (or modification of) restricted data, dealing in proceeds of crime etc.” — money or property worth $100,000 or more, providing a circumvention service for a technological protection measure, and dealing in identification information and false or misleading information.MORE FROM THE AFP More

In the age of remote work, it’s easier than ever to blur the lines between our personal and professional tech. Maybe it’s sending personal texts or emails from your work phone, editing personal documents or photos on your work laptop, or joining a virtual happy hour with friends from your work tablet. None of these actions may sound like a particularly risky activity, but as a former “IT guy” I’m asking, nay pleading, with you to stop doing them. At least the potentially more hazardous activities, such as storing personal data on your work machine or storying sensitive company data on your personal devices. Do it for the security of your employer. But more importantly, for the safety, privacy and wellbeing of yourself, your family and friends. Cybersecurity incidents can have serious negative consequences for both your employer and you. And even if an actual security breach or data leak doesn’t occur, you could be reprimanded, demoted, fired, sued or even criminally prosecuted. Take the case of former CIA director John M. Deutch. An ex-CIA director, work laptops and porn sites  John Deutch, as a nominee to head the CIA, takes questions during a Senate confirmation hearing on April 16, 1995.
Image: RICHARD ELLIS/AFP via Getty Images
In 1996, as Deutch was leaving his position as Director of Central Intelligence, he asked if he could keep his government-issued computers because they contained his personal financial information, and he did not own a personal computer to which the data could be transferred. (This seems incomprehensible today, but it was very common at the time.) The government agreed to loan the computers to Deutch basically under the condition that he become an unpaid government consultant, not use the computers for personal work and buy a computer to which he could transfer his personal data. Fast forward a few years and it’s discovered that the government computers, now at Deutch’s Maryland home, had been connected to the Internet and that their hard drives contained classified information. Deutch also told government investigators that family members had access to the computers, including his wife, who “used this computer to prepare reports relating to official travel” with Deutch and another family member who used the computer “to access a university library.” It was also reported at the time, that the “other family member” was Deutch’s son, who in addition to accessing those university resources also visited several “high-risk” porn sites, one of which had placed cookies on the computer. Now, there was no evidence that Deutch was selling government secrets or that the top secret information on the machines had been compromised. But as a result of the incident, Deutch’s security clearance was revoked and he agreed to plead guilty to a misdemeanor charge of unauthorized removal and retention of classified documents or material and pay a $5,000 fine (about $8,000 today). Deutch was eventually pardoned before the plea agreement could be processed by the court, but needless to say the incident was a huge headache for Deutch and the CIA. SEE: Incident response policy (TechRepublic Premium) Over half of people are using work machines for personal stuff and vice versa

And if you think Deutch’s story is an isolated case or that fewer people are making the same mistake because personal computing devices are ubiquitous today…think again. A survey conducted in August 2020 by antivirus vendor Malwarebytes asked respondents how they used their work devices. The company found that 53% reported sending or receiving personal email, 52% read news, 38% shopped online, 25% accessed their social media and 22% downloaded or installed non-company software. And then of course there’s the flip side, using a personal device for work. A report from cybersecurity vendor Morphisec released in June 2020, found that 56% of employees reported using their personal computer as their work device. And according to a 2020 survey by antivirus software maker Kaspersky, 57% of respondents said they checked work email on their personal smartphone and 36% did work on their personal laptop or desktop. Only 30% said they never used a work device for personal activities.

Keep in mind however, survey respondents don’t always provide completely accurate data. They may have forgotten past events or omit information due to embarrassment or fear or potential negative consequences. As such, I suspect these figures undercount the number of folks who are actually blending their work and personal tech. SEE: Clear guidelines for remote work will boost security and control access (TechRepublic) Co-workers could be watching youAnd if Deutch’s story isn’t enough to discourage you from using a company-issued device for personal activities and vice versa, consider this…more employers are monitoring activity on corporate devices as more employees work from home due to the COVID-19 pandemic. Writing for TechRepublic, Owen Hughes cites research from Skillcast and YouGov that shows one in five companies (20%) are “using technology capable of tracking workers’ online activity, or have plans to do so in the future.” In an article for ZDNet, Hughes also references a study by the UK’s Trades Union Congress (TUC), that found “one in seven employees reported that their workplace had increased monitoring and surveillance since the start of the pandemic.” Do you want to take the chance that a co-worker, could see highly personal photos, read your texts or emails, or access your sensitive documents? Trust me, you don’t.  Cleaning off a work machine is a pain Even if nothing “bad” happens, there are still headaches from blurring the lines between your personal and professional tech. What happens when you get a new machine? What happens if you change jobs? In both cases you’ll need to clean your personal data off the work machine before you give it back to IT. And depending how much personal data has accumulated on the device and how you’ve organized it, the process can be extremely complicated and take a significant amount of time. Also, simply copying and deleting the personal data won’t completely protect your privacy. To really keep your personal information well personal, you’d need to wipe the machine’s hard drive or physically destroy the drive, something which will likely raise red flags with your company’s IT department. You also run the risk of losing access to your data permanently if you fail to copy it all and the machine’s drive is wiped or destroyed as part of your employer’s computer equipment disposal policy. Mixing personal and work tech: Just don’t do it I know it’s hard not to grab your work laptop or tablet off the kitchen table and use it to help your kids with their homework or complete that home loan application you’ve been working on. So many of us have been working from our living room couches and kitchen tables for the past year, that the line between our work and personal lives has never been more blurred. Indeed, many hardware manufactures have played to this fact by marketing their products as being able to security handle both work and play. But even with these solutions, there’s only one way to completely protect ourselves from suffering the same fate as Deutch, keep our work and personal tech separate. And, there are plenty of great laptops, smartphones and tablets out there to help us do it. ZDNET’S MONDAY MORNING OPENER  The Monday Morning Opener is our opening salvo for the week in tech. Since we run a global site, this editorial publishes on Monday at 8:00am AEST in Sydney, Australia, which is 6:00pm Eastern Time on Sunday in the US. It is written by a member of ZDNet’s global editorial board, which is comprised of our lead editors across Asia, Australia, Europe, and North America. PREVIOUSLY ON MONDAY MORNING OPENER: More

Apparently, one of the significant aftereffects of the pandemic will be the next big wave of IT outsourcing. And, of course, one of the most important responsibilities of IT is security. So there may not be a better way to train for a new high-tech career than to grab The All-In-One 2021 Super-Sized Ethical Hacking Bundle.

ZDNet Recommends

While the bundle contains 18 courses, you could conceivably start earning after finishing just one. The “Bug Bounty: Web Hacking” class shows you how to get paid for legally hacking some of the world’s biggest online apps. But there’s plenty more to learn, and you’ll get a great overview with the “All-in-One Hacking Guide: From Zero to Hero” course.Two more classes that take a comprehensive approach are the “Complete Ethical Hacking & Penetration Testing Course” and “Learn Network Attacks & Security” course. Then you can start diving deeper into specifics with the “Hack People, Systems & Mobile Devices: Advanced Social Engineering”, which will explain the techniques that are used to crack mobile devices.Next up are the classes that cover particular platforms. For instance, there are two courses that focus on the Python programming language: “Complete Python 3 Ethical Hacking Course: Zero to Mastery” and “Introduction to Python & Hacking with Python”.There are also two courses on Burp. The first is the “Learn Burp Suite for Advanced Web Penetration Testing” class, and then there is the “Mastering Burp Suite Community Edition: Bug Hunters Perspective” for more content on bug hunting.You will accumulate an enormous armory of tools after completing several more classes using different platforms. There is the “Complete NMAP: Learn Ethical Hacking with NMAP”, “Learn Server Security with BitNinja”, “PenTesting with OWASP ZAP: Mastery Course”, “Kali Linux Hacker Tools, Tricks & Techniques” and “Master in Hacking with Metasploit”.There are still more classes that cover both theory and practice in hacking: “Hacking Wireless Networks: Theory & Practice”, “Website Hacking in Practice: Hands-On Course 101” and “Hacking in Practice: Certified Ethical Hacking Mega Course”. After all of those, the only thing left is to become a certified hacker, and there is even a course to prepare you for that, the “Ethical Hacker Certification Course”.

These courses are normally priced at $3,284, but they are being offered at a 98% discount at the moment. So you can start training right away to be a master ethical hacker for only $42.99!Prices subject to change.

ZDNet Recommends More

ClickStudios has told its global customer base to start changing passwords following a breach that resulted in a supply chain attack.The Australian software company, which makes the Passwordstate password manager, suffered a breach between April 20 and April 22. CSIS Security Group, which dealt with the breach, posted the attack details. ClickStudios outlined the attack in an advisory. The company said:Initial analysis indicates that a bad actor using sophisticated techniques compromised the In-Place Upgrade functionality. The initial compromise was made to the upgrade director located on Click Studios website www.clickstudios.com.au. The upgrade director points the In-Place Upgrade to the appropriate version of software located on the Content Distribution Network. The compromise existed for approximately 28 hours before it was closed down. Only customers that performed In-Place Upgrades between the times stated above are believed to be affected. Manual Upgrades of Passwordstate are not compromised. Affected customers password records may have been harvested.  The supply chain attack was initiated via an update of the Passwordstate app.In a post, CSIS said its researchers found the attack during an investigation. “As recommended by ClickStudios, if you are using Passwordstate, please reset all the stored passwords, and especially VPNs, Firewall, Switches, local accounts or any server passwords etc,” said CSIS, which dubbed this incident/malware “Moserpass”. ClickStudios’ letter to customers was posted on Twitter via Polish news site Niebezpiecznik (via The Record).Aside from the obvious hassle of changing enterprise passwords on Friday and the weekend, Passwordstate touches multiple key areas of a company including:Auditioning and compliance reporting.Local admin accounts on your network.Active Directory.Credentials management and remote sessions.API integration.Access control.And two-factor authentication among others. Passwordstate from ClickStudiosAdd it up and Passwordstate made for a nice target because it has multiple touch points in an enterprise.

As for the remediation for Passwordstate customers, ClickStudios outlined the following:Customers have been advised to check the file size of moserware.secretsplitter.dll located in their c:inetpubpasswordstatebin directory. If the file size is 65kb then they are likely to have been affected. They are requested to contact Click Studios with a directory listing of c:inetpubpasswordstatebin output to a file called PasswordstateBin.txt and send this to Click Studios Technical Support. Affected customers are then advised by Click Studios Technical Support via email to; 1. Download the advised hotfix file2. Use PowerShell to confirm the checksum of the hotfix file matches the details supplied 3. Stop the Passwordstate Service and Internet Information Server 4. Extract the hotfix to the specified folder 5. Restart the Passwordstate Service, and Internet Information Server Once this is done it is important that customers commence resetting all Passwords contained within Passwordstate. These may have been posted to the bad actors CDN network. Click Studios recommends prioritizing resets based on the following; 1. All credentials for externally facing systems, i.e., Firewalls, VPN, external websites etc. 2. All credentials for internal infrastructure, i.e., Switches, Storage Systems, Local Accounts 3. All remaining credentials stored in Passwordstate   More

The scale and severity of ransomware is growing at an alarming rate as cyber criminals look to exploit poor cybersecurity to maximise profit, the director of GCHQ has warned.Organisations and their employees have been forced to adapt to different ways of working over the last year, with many now even more reliant on remote services and online collaboration platforms.But while the increased use of digital technology has provided people with many benefits, it is also benefiting cyber criminals who are able to exploit it for their own gain. “Our reliance on technology to stay close to loved ones, enable different ways of working and access crucial services has dramatically increased. Most of this has been to our benefit. But it’s benefited our foes too as they exploit the accelerations in connectivity and poor cybersecurity,” said Jeremy Fleming, director of GCHQ, the UK’s intelligence and cyber agency. Delivering this year’s Imperial College Vincent Briscoe Annual Security Lecture, Fleming warned how hostile nation-states are looking to exploit the digital realm to conduct cyber attacks – including attempts to steal coronavirus research and exploit supply chains with malware and phishing attacks. SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)  But cyber criminal gangs also represent a major threat and Fleming warned that ransomware in particular represents a cybersecurity danger for organisations of all kinds.

“We’ve seen ransomware become a serious threat, both in terms of scale and severity. Increasingly, it targets crucial providers of public services, as well as businesses, as criminals play on our dependence on tech,” he said. Ransomware attacks involve cyber criminal groups infiltrating networks and locking files and servers with encryption then demanding a ransom of millions of dollars – often in Bitcoin – for the decryption key to return the files.The rise in remote working has provided cyber criminals with additional avenues to gain initial access to networks as they exploit remote desktop services and VPNs, often secured with common or default passwords, while the nature of remote work means it’s more difficult for information security teams to differentiate legitimate behaviour from potentially suspicious activity.That’s led to a rise in ransomware attacks against organisations in all sectors – and the attacks remain successful because there’s a significant percentage of victims who’ll pay the ransom of millions in order to retrieve their files. “It has resulted in serious disruptions to education, health and local authorities, caused huge losses for unprepared businesses and has rapidly become a significant threat to our supply chains,” said Fleming”There’s a whole other lecture here about the need for concerted action to address this trend – but for now, all I’d say is that it’s growing at an alarming rate”.While ransomware is a growing threat to organisations, there are cybersecurity procedures which can help make networks more reliant against attacks.They include avoiding the use of default login credentials while also adding two-factor authentication to help secure user accounts. Organisations should also apply security patches and updates as soon as possible after they’re released, to stop cyber criminals being able to exploit known vulnerabilities as part of attacks.MORE ON CYBERSECURITY More