Stealing keystrokes via sound, APT31 targets air gapped ICS, and versioning is being used
in real world android attacks!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for August 8, 2023 - this is your summary
of the threats to our security, privacy and Internet freedom!
Let’s jump right into the news this week.
There’s some concerning research from British universities this week about a new form of
cyber attack that's really unique and pretty interesting.
Picture this: you're typing away on your laptop, maybe chatting with friends, typing out passwords,
or even discussing sensitive information.
But did you know that those innocent keyboard clicks could be leaking your data to malicious
hackers?
And no, I’m not talking about keylogging.
This could happen via an air gapped machine acoustically.
A group of researchers has discovered a way to steal your keystrokes using just sound!
These folks have developed a deep learning model that can accurately predict your keyboard
strokes recorded using a microphone, with a jaw-dropping accuracy of 95%.
And it gets worse – even when they used Zoom for training, the prediction accuracy
still dropped only slightly to 93%, a record high for that platform.
Now, you might be wondering, "How on earth does this work?"
Well, it all starts with recording the sounds of your keyboard as you type.
This can be done using a nearby microphone, an infected phone's microphone, or even through
a rogue participant in a Zoom call who correlates the sounds with your typed messages.
The researchers gathered tons of training data by pressing keys on a MacBook Pro and
recording the unique sounds each key produced.
Then, they transformed these sounds into waveforms and spectrograms, which are like visual representations
of the sound waves.
These helped train their deep learning model, CoatNet, an image classifier specifically
designed for this purpose.
So, why is this so alarming?
Well, think about it – your passwords, private messages, and confidential discussions could
all be compromised.
And unlike other hacking methods, acoustic attacks don't need any special conditions
– just a device with a microphone.
With the advances in machine learning and the abundance of devices with mics, these
attacks are easier and more dangerous than ever.
There are ways to protect yourself!
The researchers suggest changing your typing style, using randomized passwords, and even
adding fake keystrokes during voice calls.
While these may help, they're not foolproof.
Another technique to evade attacks is to use biometrics or auto-filling password managers
to remove the need to type in sensitive info.
It seems that Chinese state-sponsored hackers are up to some seriously sneaky stuff.
They've been targeting industrial organizations with a brand new malware that's got experts
intrigued.
Critical systems are often air gapped – which means they're isolated from the regular internet
and network to keep them secure.
These hackers have found a way to steal data from these isolated systems using a whole
new kind of malware.
Researchers over at cybersecurity company Kaspersky recently uncovered a new kind of
malware being used by a group called APT31, also known as Zirconium (or Judgement Panda,
Bronze Vinewood, or Violet Typhoon).
They've been targeting industrial organizations in Eastern Europe.
According to reports, they’re using 15 different implants including one seen before called
FourteenHi.
The attacks happen in three stages.
First, the hackers establish persistence and access to the compromised systems, gathering
data for reconnaissance.
Then, they drop specialized malware onto the system, specifically designed to steal data
from air-gapped systems.
Finally, they use implants that upload the collected data to their command and control
servers.
The malware they're using has different modules.
One module profile removable drives, collects files, takes screenshots, and more.
Another module infects removable drives with a sneaky trick involving a legitimate McAfee
executable.
And there's even a variant that acts as a payload dropper, keylogger, screenshot tool
– you name it.
This is a big deal because these air-gapped systems are usually considered super secure.
They're often used in critical infrastructure, so any breach could have massive consequences.
And these attackers aren't just using run-of-the-mill methods – they're employing sophisticated
techniques like encrypted payloads and memory injections to stay under the radar.
The researchers also noticed that this threat actor group is getting smarter.
They've started using cloud services like Dropbox and Yandex for their command and control
operations.
This makes it even trickier to detect their activities and adds an extra layer of complexity
to the attacks.
It's a reminder that no system is truly immune to cyber threats.
Even the most isolated, supposedly secure systems can be compromised if the attackers
are determined enough.
And that's where organizations need to step up their game, staying vigilant and adopt
strong cybersecurity measures.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
THANK YOU to Michael and Josef for being a part of the Smores at Patreon.com/shannonmorse.
That’s my new Patreon page for the show, where I’ll be posting all the perks for
patrons, including early access to this video.
If you’re currently a patron on the ThreatWire page, switch over to the new page so you don’t
lose access to your perks.
Let’s finish out today’s episode with my last top story, about malicious play store
apps!!
Cybercriminals are using a technique called versioning to fool The Google Play Store system
and slide malware onto unsuspecting Android devices.
This technique is all about updates – a developer releases a seemingly harmless app,
but later, they update it with a malicious component.
They use a method called dynamic code loading, or DCL, to push updates from their servers
and inject malicious code right into our devices.
Imagine your app becoming a backdoor for cybercriminals – that's what they're aiming for.
According to Google’s Cybersecurity Action Team’s 2023 Threat Horizons Report, this
is used to steal target credentials, data, and finances.
There are a few real world examples of this attack.
For example, a screen recording app called "iRecorder - Screen Recorder."
At first, it seemed harmless, chilling on the Play Store for nearly a year.
But then, – it got updated with sneaky spyware to track users.
There's SharkBot, a financial trojan, posing as security and utility apps.
It initiates unauthorized money transfers and goes undetected by appearing harmless
at first glance.
These bad actors don't stop there.
They're even releasing apps with limited functionality on the Play Store, so they don't raise suspicions.
Once you download the app, it pulls in the full malware version, and you're left with
a compromised device.
To defend your own devices, first things first, stick to trusted sources when downloading
apps.
And enable Google Play Protect – it'll send you alerts if a potentially harmful app is
detected on your device.
And if you're in an enterprise setting, consider extra layers of protection like limiting app
sources or using mobile device management platforms.
I'm Shannon Morse, stay vigilant, stay secure, and I'll see you on the Internet!