Information Technology

Working from home has come with problems a few of us ever considered before. Just ask well-known New Yorker writer and pundit Jeffrey Toobin who was caught, uh, amusing himself, on a Zoom call. Wouldn’t it be nice if you could be sure your webcam and microphone were off? Dell thinks so, which is why they’ve offered Linux kernel code to support its Dell Privacy controls.

Must-see offers

The Dell Privacy Drivers support its newest laptops; hardware-based privacy buttons. These key combinations stop any application from accessing its laptops’ built-in microphone and camera. To ensure that the microphone can’t be used to listen in on you, you’ll press ctrl+F4. To lock down the webcam you’ll press  ctrl+F9.
Once this new code is incorporated into the Linux kernel, no program can access the audio or video streams. Since this works at the operating system level, besides making accidents harder to do, it should block spyware or other kinds of malware that try to sneak a peek at you.
Of course, this isn’t the first time privacy has been built into a Linux-powered laptop. The specialist Linux PC vendor Purism, for example, has long made both privacy and strict support for open-source software its trademark. Its machines already come with hardware to block video and audio streams.
That said, it’s still noteworthy that one of the world’s largest PC vendors now thinks Linux is so important to its audience that it’s supporting its new privacy hardware from the start. All too often in the past, companies made Linux support for less common PC hardware features such as fingerprint readers and security mechanisms an afterthought.
Related Stories: More

Image: ZDNet
GitHub has denied rumors today of getting hacked after a mysterious entity shared what they claimed to be the source code of the GitHub.com and GitHub Enterprise portals.
The “supposed” source code was leaked via a commit to GitHub’s DMCA section.
The commit was also faked to look like it originated from GitHub CEO Nat Friedman.
But in a message posted on YCombinator’s Hacker News portal, Friedman denied that it was him and that GitHub got hacked in any way.
Friedman said the “leaked source code” didn’t cover all of GitHub’s code but only the GitHub Enterprise Server product. This is a version of GitHub Enterprise that companies can run on their own on-premise servers in case they need to store source code locally for security reasons but still want to benefit from GitHub Enterprise features.
Friedman said this source code had already leaked months before due to its own error when GitHub engineers accidentally “shipped an un-stripped/obfuscated tarball of our GitHub Enterprise Server source code to some customers.”

Image: ZDNet
Friedman promised that GitHub was going to fix the two bugs exploited by the leaker and prevent unauthorized parties from attaching their code to other people’s projects via faked identities.

“In summary: everything is fine, situation normal, the lark is on the wing, the snail is on the thorn, and all’s right with the world,” Friedman said.
Not the first time
But this is not the first time that this happened on GitHub.
One of the two bugs was used just days earlier when a security researcher attached the source code of the youtube-dl library to GitHub’s DMCA section.
The security researcher’s gesture came as a form of protest after GitHub decided to honor a suspicious DMCA takedown request against the youtube-dl library from music recording industry group RIAA.

Image: ZDNet
While the mystery leaker never explained their actions, it is believed that the person who leak the GitHub Enterprise Server code was also protesting against GitHub’s decision to honor RIAA’s DMCA request and take down youtube-dl, a project that lets users download raw audio and video files from YouTube and other services — which RIAA argued was heavily used to pirate its songs catalog.
For the past week, hundreds of other users have been re-uploading the youtube-dl code on their own accounts and daring RIAA to send them a DMCA request too. GitHub has warned users not to do so, as they risk getting banned by its automated systems. More

Cisco has found a security bug that impacts remote workers using its Webex Meetings Virtual Desktop App for Windows. 
With the company’s Webex Meetings one of the main enterprise options for online video meetings with teammates, the product is probably getting even higher use due to remote working as the COVID-19 pandemic rolls on across the world. 

Networking

Cisco has warned that the bug in Webex Meetings Desktop App for Windows is a high-severity security flaw. 
However, it can only be exploited when Webex Meetings Desktop App is in a virtual desktop environment on a hosted virtual desktop (HVD) and configured to use the Cisco Webex Meetings virtual desktop plug-in for thin clients. 
The plug-in is designed to support HVD users, such as remote workers who are connecting to a corporate network from a personal computer.
The flaw may allow an attacker to execute arbitrary code on a targeted system with the targeted user’s privileges. 
“A successful exploit could allow the attacker to modify the underlying operating system configuration, which could allow the attacker to execute arbitrary code with the privileges of a targeted user,” Cisco explains in an advisory. 

One mitigating factor is that the vulnerability can only be exploited by a local attacker with limited privileges who had sent a malicious message to the affected software by using the virtualization channel interface. 
Nonetheless, Cisco has given the bug, tracked as CVE-2020-3588, a severity rating of 7.3 out of a possible 10. 
The bug has been fixed in the Webex Meetings Desktop App for Windows releases 40.6.9 and later and 40.8.9 and later. The issue was due to the desktop app improperly validating messages.
Cisco also notes that customers must update the affected app in the HVD in the virtual desktop environment. However, the plug-in does not need to be updated. 
Fortunately, Cisco’s Product Security Incident Response Team (PSIRT) has not observed any attacks in the wild and Cisco found the bug during internal testing. 
Cisco is also urging customers to update Webex Meetings sites and Webex Meetings Server due to vulnerabilities affecting the Webex Network Recording Player for Windows and Webex Player for Windows. 
There are three bugs that stem from the playback apps not doing enough to validate elements of Webex recordings stored in the Advanced Recording Format (ARF) – a video format for Webex – or the Webex Recording Format (WRF). 
The bugs are tracked as CVE-2020-3573, CVE-2020-3603, and CVE-2020-3604. They have a severity rating of 7.8. 
Attackers can exploit the flaws by sending target into opening a malicious ARF or WRF file through a link or email attachment, and then tricking the target into opening the file with the two Webex players. 
Webex Network Recording Player is used to play back ARF files, while Webex Player is used to play back WRF files. 
The playback applications are available from Cisco Webex Meetings and Cisco Webex Meetings Server. 
The Webex Network Recording Player is available from Cisco Webex Meetings sites and Cisco Webex Meetings Server. The Cisco Webex Player is available from Cisco Webex Meetings sites but not from the Cisco Webex Meetings Server.
While Cisco’s PSIRT has not observed any malicious activity using these flaws, they were found by security researcher Francis Provencher (PRL) who reported the issue to Cisco via Trend Micro’s Zero Day Initiative. 
Cisco notes there are no workarounds for this bug and has listed in its advisory the releases of Webex Meetings sites and Webex Meetings Server that need to be updated.  
More on Cisco and networking security More

A hacking campaign has compromised VoIP (Voice over Internet Protocol) phone systems at over 1,000 companies around the world over the past year in a campaign designed to make profit from selling compromised accounts.
While the main purpose appears to be dialling premium rate numbers owned by attackers or selling phone numbers and call plans that others can use for free, access to VoIP systems could provide cyber criminals with the ability to conduct other attacks, including listening to private calls, cryptomining, or even using compromised systems as a stepping stone towards much more intrusive campaigns.

More on privacy

Detailed by cybersecurity researchers at Check Point, one hacking group has compromised the VoIP networks of almost 1,200 organisations in over 20 countries by exploiting the vulnerability, with over half the victims in the UK. Industries including government, military, insurance, finance and manufacturing are believed to have fallen victim to the campaign.
SEE: 10 tips for new cybersecurity pros (free PDF)
Other countries where organisations fell victim to these attacks include the Netherlands, Belgium, the United States, Columbia and Germany.
The attacks exploit CVE-2019-19006, a critical vulnerability in Sangoma and Asterisk VoIP phone systems that allows outsiders to remotely gain access without any form of authentication. A security patch to fix the vulnerability was released last year, but many organisations have yet to apply it – and cyber criminals are taking advantage of this by scanning for unpatched systems.
“The vulnerability is an authentication bypass flaw, and the exploit is publicly available. Once exploited, the hackers have admin access to the VoIP system, which enables them to control its functions. This will not be detected unless an IT team is specifically looking for it,” Derek Middlemiss, security evangelist at Check Point Research, told ZDNet.

One of the most common means the hacked systems are exploited for is making outgoing calls without the VoIP system being aware, which would allow attackers to secretly dial premium rate numbers they’ve set up in order to generate money at the expense of the compromised organisation. And because businesses make so many legitimate phone calls on these systems, it’d be difficult to detect if a server is being exploited.
The attackers also make money by selling access to the systems to the highest bidder, something that could potentially be used for other cyberattacks that could be more dangerous to victims.
“It’s likely that those attacks can be leveraged for other malicious activity such as cryptomining and for eavesdropping,” said Middlemiss.
And it’s potentially possible for attackers to use a compromised VoIP system as a gateway to the rest of the network, opening up the possibility of stealing credentials or deploying malware.
“That’s depending on how the server is configured and connected to the rest of the corporate network. If it is not segmented from the rest of the network, attackers could move laterally,” he added.
SEE: Mobile security: These seven malicious apps have been downloaded by 2.4m Android and iPhone users
It’s recommended that organisations change default usernames and passwords on devices so they can’t easily be exploited and, if possible, analyse call billings on a regular basis for potentially suspicious destinations, volumes of traffic or call patterns.
And most importantly, organisations should apply the required security patches to prevent known vulnerabilities from being exploited.
“Always look for and apply new patches for everything on your network to ensure vulnerabilities like this are closed off,” said Middlemiss.
MORE ON CYBERSECURITY More

A new, Chinese advanced persistent threat (APT) group making the rounds performs DLL side-loading attacks including the phrase “KilllSomeOne.”

According to Sophos researcher Gabor Szappanos, the group — suspected to be of Chinese origin — is targeting corporate organizations in Myanmar using poorly-written English messages relating to political subjects. 
Side-loading utilizes DLL spoofing to abuse legitimate Windows processes and execute malicious code. While nothing new, Sophos said in a blog post on Wednesday that this APT combines four separate types of side-loading attack when carrying out targeted campaigns. 
Each attack type is connected by the same program database (PDB) path, and some of the samples recorded and connected to the cybercriminals contain the folder name “KilllSomeOne.”
See also: Promethium APT attacks surge, new Trojanized installers uncovered
“Two of these delivered a payload carrying a simple shell, while the other two carried a more complex set of malware,” Sophos says. “Combinations from both of these sets were used in the same attacks.”
In the first scenario, a Microsoft antivirus component is used to load mpsvc.dll, a malicious loader for Groza_1.dat. While encryption is in play, it is nothing more than a simple XOR algorithm and the key is the string: “Hapenexx is very bad.”

The second sample leverages AUG.exe, a loader called dismcore.dll, and the same payload and key are used — but in this case, both the file name and decryption key are encrypted with a one-byte XOR algorithm.
The Groza_1.dat payload is PE shellcode which loads the final payload into memory for execution, connecting to a command-and-control (C2) server which could be used to issue commands or deploy additional malware. An unused string called “AmericanUSA” was also noted. 
The other two samples, using payload file names adobe.dat and x32bridge.dat, are more sophisticated and use a shell to establish persistence, for obfuscation, and to “prepare file space for collecting data,” the researchers say. 
CNET: Election still too close to call: How to spot misinformation while you wait for results
One notable difference is a change in the encryption key, using the string “HELLO_USA_PRISIDENT.”
The payloads will deploy an installer and additional components for another DDL side-loading set of attacks in a number of directories and will assign the files “hidden” and “system” attributes. 
“The installer then closes the executable used in the initial stage of the attack, and starts a new instance of explorer.exe to side-load the dropped DLL component,” the team says. “This is an effort to conceal the execution.”
The malware will also wipe out running processes that could interfere with side-loading attempts, creates a registry key to establish persistence, and begins to exfiltrate data.  
TechRepublic: It’s an urgent plea this Election Day: Don’t click on ransomware disguised as political ads
According to the researchers, the APT doesn’t fit in neatly with standard cyberattack group descriptives as the messages hidden in their samples and the simple implementation of much of their coding leans toward script-kiddie levels — but at the same time, the targeting and deployment strategy is more commonly associated with sophisticated APTs. 
“Based on our analysis, it’s not clear whether this group will go back to more traditional implants like PlugX or keep going with their own code,” Sophos says. “We will continue to monitor their activity to track their further evolution.”
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

US and Brazilian authorities have seized $24 million in cryptocurrency connected to an online scheme that allegedly defrauded “tens of thousands” of investors.
Upon request from the government of Brazil, US law enforcement participated in “Operation Egypto,” a Brazilian federal investigation into the suspected scam, the US Department of Justice (DoJ) said on Wednesday. 
The collaborative effort, made under the Mutual Legal Assistance in Criminal Matters treaty, tracked down suspect Marcos Antonio Fagundes, who is being charged with the operation of a financial institution without legal authorization, fraudulent management of a financial institution, misappropriation, money laundering, and the violation of securities law. 
See also: US unveils enforcement framework to combat terrorist, criminal cryptocurrency activities
Prosecutors allege that between August 2017 and May 2019, Fagundes and co-conspirators used the internet to find and solicit investors — sometimes together with communication over the phone — and convince them to invest in new financial “opportunities.”
The victims of the alleged scam would then part with funds in either Brazilian currency or cryptocurrency, believing that the investment would be poured into companies that Fagundes and his associates controlled. 
These companies, the DoJ says, were meant to then invest in virtual assets. However, only a “very small amount” of the funds were used for this purpose — while the rest went into the pockets of the alleged fraudsters. 

CNET: Election still too close to call: How to spot misinformation while you wait for results
As a result, investors saw close to nothing in return for their cash.
“To carry out the scheme, the conspirators are alleged to have made false and inconsistent promises to investors about the way the funds were invested and exaggerated the rates of return,” the DoJ added. 
Operation Egypto investigators estimate that tens of thousands of investors handed over more than $200 million. 
After the Brazilian court issued a seizure order for any cryptocurrency held by Fagundes in the US, $24 million was recovered with help from the cryptocurrency exchanges holding his wallets. 
TechRepublic: It’s an urgent plea this Election Day: Don’t click on ransomware disguised as political ads
The investigation is ongoing. However, Brazilian authorities, the FBI, and other parties intend to hold the cryptocurrency as part of future forfeiture proceedings to try and compensate the investors involved, at least, to some level. 
This week, the DoJ also announced the seizure of 27 web domains used by Iran’s Islamic Revolutionary Guard Corps (IRGC) to spread propaganda and misinformation under the guise of legitimate news outlets. 
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Capcom has disclosed a cyberattack that impacted the company’s operations over the weekend. 

The Osaka, Japan-based video game developer said in a notice dated November 4 that two days prior, beginning in the early morning, “some of the Capcom Group networks experienced issues that affected access to certain systems” due to a cyberattack. 
Email and file servers were impacted. 
See also: Marriott fined £18.4 million by UK watchdog over customer data breach
Capcom has described the attack as “unauthorized access” conducted by a third-party. As the security incident took place, the company stopped some operations on its internal networks, likely to prevent the cyberattack from spreading further and potentially compromising additional corporate resources. 
Capcom claims that there is “no indication” that customer information has been accessed or compromised; at least, at this stage. 
“This incident has not affected connections for playing the company’s games online or access to its various websites,” the company said. “Capcom expressed its deepest regret for any inconvenience this may cause to its various stakeholders.”

CNET: Election still too close to call: How to spot misinformation while you wait for results
At the time of writing, Capcom says it is “unable to reply to inquiries and/or to fulfill requests for documents” made through the investor relations contact form.
The game developer is currently working toward restoring its systems and has reported the cyberattack to law enforcement. 
TechRepublic: It’s an urgent plea this Election Day: Don’t click on ransomware disguised as political ads
Capcom has not revealed any further details relating to the attack, but the company is not the only game developer targeted this year. In October, Ubisoft and Crytek were the victims of the Egregor ransomware gang, which attempted to extort a ransomware payment from the firms on the threat of the public release of proprietary data stolen during attacks. 
Egregor is an active ransomware group believed to be responsible for cyberattacks against GEFCO and Barnes & Noble. Researchers from Malwarebytes suspect that past affiliates of the Maze ransomware group — now retired from the scene — are now turning to Egregor as an alternative. 
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

The GEO Group, a company known for running private prisons and illegal immigration detention centers in the US and other countries, says it suffered a ransomware attack over the summer.

Personal data and health information for some inmates and residents was exposed during the incident, which took place on August 19.
This includes data for inmates and employees at the South Bay Correctional and Rehabilitation Facility in Florida, a youth facility in Marienville, Pennsylvania, and a now-closed facility in California, the company told ZDNet.
“GEO implemented several containment and remediation measures to address the incident, restore its systems and reinforce the security of its networks and information technology systems,” the company said.
GEO said it recovered its data but did not say if this meant restoring from backups or paying the ransomware gang to decrypt its files.
In documents filed with the US Securities Exchange Commission on Tuesday, the GEO Group played down the security breach and said its aftermath won’t have any material impact on its business, operations, or financial results.
The company is now sending data breach notification letters to all impacted individuals.

Exposed personal details could include name, address, date of birth, Social Security number, employee ID number, driver’s license number, medical treatment information, and other health-related information.
The incident impacted only a small portion of the GEO Group’s network, which includes 123 private prisons, processing centers, and community reentry centers in the United States, Australia, South Africa, and the United Kingdom.
US government contracts amounted for more than half of the GEO Group’s 2019 revenue, according to the company’s yearly 10-K form filed with the SEC.
The company’s stock price fell 14% from $9.76 at the end of trading on Tuesday to $8.38 the next day, after GEO disclosed the incident. More