Hello world,
A fake microsoft app somehow sneaked past Google moderators, pilfered user data and
mined crypto,
The FBI issues a flash alert regarding the Conti ransomware gang,
Phones are getting better at thwarting WiFi based tracking, but they’re not quite perfect
And opportunistic attackers are taking advantage of vulnerabilities just minutes after they’re
announced
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news. A fake Google Chrome extension purporting
to be made by Microsoft has somehow managed to sneak past moderators, unbeknownst to users
it contained a few hidden surprises.
Going undiscovered in the store for a month and downloaded roughly 400 times the extension
masqueraded as “Microsoft Authenticator”, it looked somewhat legit on the surface, though
a quick check shows the Developer name to be “Extensions” rather than Microsoft.
It only had a 3 star rating, which might be a red flag to some - however the legit Microsoft
extension also only has about 3 stars, so that doesn’t help.
It’s also not much help that Microsoft calls their actual password manager Microsoft Authenticator
on every other platform other than Chrome, on which they call it “Autofill” - for
some reason, creating ripe ground for social engineering tricks.
In the now deleted reviews, users complained the extension used a bunch of CPU resources,
making some postulate that there was a sneaky crypto miner hidden within it. The extension
also sent users to a malicious URL which tried to phish login details.
Obviously people are confused as to how something so obviously fake to a trained eye managed
to sneak into the store - especially when it’s impersonating Microsoft - does Google
not check these things? Though, it would be useful if there was an easy way to verify
an extension’s developer. Sure, for a genuine extension here, it says “Offered by: Microsoft
Corporation”, but is this string unique? Why can’t I click it to see other apps made
by this dev? That might provide some reassurance. Also, a lot of these “seemingly” genuine
Microsoft extensions have their developer contact email set as some fake-o looking gmail
address - why? The only thing that makes this particular app look genuine is that it has
over a million users, surely an app with that many downloads can’t be fake - or maybe
I’m giving them too much credit? Also, some of the reviews for this genuine Microsoft
extension are duplicates, y’know I simply don’t know what to believe anymore.
The FBI’s cyber division has issued a flash alert on the Conti ransomware gang. I’ve
talked about this cybercrime group quite a bit on this channel - they’re the ones responsible
for that Irish hospital hack.
And, just a side note I can’t seem to find any evidence showing that Conti has released
that 700GB hospital database dump, they said they’d start making it public on Monday
and today’s Tuesday - so by all accounts it looks like they may have been bluffing
when they were threatening to drop it. Though if only because actually releasing the data
would enrage authorities even more than they already are.
Anyway, out of all ransomware attacks worldwide, Conti is responsible for 10% of them. This
table, made by Coveware shows all the popular ransomware variants sorted by market share
- weird way to put it. Conti is only beaten by the ‘sodinokibi’ ransomware, authored
by the ‘REvil’, group edging ahead with 14%.
The FBI have identified 16 ransomware attacks by Conti which targeted US healthcare providers
and first responder networks - this includes law enforcement agencies, nine one one dispatch
centers among others. 400 organisations worldwide have fallen victim to the group, which was
only founded in July last year.
This FBI Flash update doesn’t seem to say much other than provide some statistics and
remind you to back up your data.
In fairness, they do provide some useful advice. Though one thing I’ve only just come across
- and I realise I may be completely late to the party on this one, but FYI, ‘controlled
folder access’ on windows only takes 10 seconds to set up, once done - no programs
will have access to certain folders such as documents or pictures, apart from those you
manually specify.
This seems to be a decent defense against ransomware, which for obvious reasons needs
access to your files.
It is a little annoying because you’ll forget you’ve enabled it, and be confused why Premiere
Pro can’t access Documents… but it does provide a layer of protection. “The PC security
Channel” on youtube demoed this defence against various ransomware strains - and it
did a pretty good job of preventing encryption of the protected folders.
Good news! A new study shows phones are getting a hell of a lot better at thwarting WiFi based
tracking. This tracking method works on the basis that phones have a unique MAC Address,
which is an identifier used to identify each WiFi device. By keeping tabs on where this
MAC address pops up throughout different networks you can effectively track the location of
a user.
In fact, as of 2019 this method is used on the London underground - it’s used to decipher
the journey you’ve taken, which stations you’ve visited and how long it takes you
to get from place to place, all in the name of analytics. In person stores can also use
this method of tracking to determine how often you visit and for how long.
Attempts to defeat this tracking technique were first made a few years back when MAC
randomisation was introduced, however a report in 2017 by US Navy researchers discovered
widespread implementation flaws that largely made the whole system useless, as many devices
were occasionally using their real static MAC addresses. Not only that, by exploiting
a flaw in the way chipsets handle control frames, the researchers were able to defeat
all devices which used randomisation, regardless of manufacturer.
Anyway, fast forward to 2021 and those same researchers have found that things have improved
quite a bit. Both android and iPhone devices now readily use pre-association MAC randomisation,
which means when a device isn’t connected to a network, but rather hunting around to
find something to connect to, it’ll randomise it’s address so it can’t be tracked.
Devices also now employ per-network MAC randomisation, meaning phones will create a unique MAC address
for each network they connect to. This does mean a device can still be tracked across
the same network though, like in a university for example, but not between multiple networks.
Researchers aren’t completely thrilled with these solutions and would prefer per-connection
addresses, meaning a phone would create a brand new MAC address each time it connects
to a network, regardless of whether it has connected to it before. Manufacturers haven’t
implemented this, probably because networks kinda work on the assumption that each device
has a static MAC address, if the same device’s MAC started randomly changing it could confuse
networks depending on their implementation.
The researchers are a little frustrated that there’s no consistent technique to solving
this issue, different manufacturers seem to be tackling the problem in different ways,
leading to a fragmented approach.
However, to their delight, the researchers did make a positive discovery. You see, in
the past many phones used WiFi for location tracking even when you had WiFi manually turned
off. However, thankfully this is no longer the case, for the most part. There are some
exceptions to this, like the Sony Xperia X Compact which used WiFi even when WiFi was
allegedly off. I’m going to count this as a non issue, I would imagine, Sony Xperia
X Compact users are an endangered species, if not extinct.
A new report from Palo Alto Networks details just how determined bad actors can be at attacking
vulnerable systems. The research team monitored scans of 50 million ip addresses associated
with 50 large businesses, they found that adversaries were scanning for vulnerabilities
just 15 minutes after those vulnerabilities had been announced, and in some cases for
more lucrative exploits, hackers were on the case within just 5 minutes.
These days computing is so inexpensive that an attacker would only need to spend $10 to
rent cloud computing power to do an imprecise scan of the entire internet.
Remote desktop servers were most targeted, remote desktop is ripe ground for attack because
it provides direct access to systems - obviously, often with admin level privileges. Luckily
these vulnerabilities are often quite easy to patch, a software update usually does the
trick. However these attack vectors are low hanging fruit for criminals, why bother sending
specially crafted spear phishing emails, when you can mass scan for severe vulnerabilities,
if you get lucky then you’re in, with relative ease.
As the report explains, attackers have a significant edge as they can perform scans every hour
or more frequently if needs be. Whereas it can take a large business 12 hours on average
to find vulnerable systems. With penetration tests only taking place every quarter or so
and even those often not being particularly comprehensive, large enterprises are predictably
vulnerable.
I’ll link the report in the description if you want a detailed read.
Maltronics is a website, run by myself where you can find an array of super cool pentesting
products, our gear is used in over 100 countries and you can get 10% off with code seytonic.
Trusted by hobbyists, pentesters and educational institutions you can learn more at maltronics.com
If you want to see more of this kind of video make sure to let me know in the comments and
turn those sub notifications so you don’t miss any hacking news.
For behind the scenes footage do follow me on instagram. As always sources will be linked
in the description, stay tuned for more hacking videos, have a good one.