No more ransomware payments, a linux malware framework, and a UEFI rootkit was spotted!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for August 2 2022 - this is your summary of
the threats to our security, privacy and Internet freedom.
Special announcement!!!
I will be at DEF CON next weekend for the entire convention filming a special episode
of ThreatWire… and I’m having a meetup!
I’m getting those plans set this week, so keep an eye on my social media for details
- I’m @ snubs on twitter and instagram.
Thank you for supporting my content in whichever way you do it, I seriously cannot wait to
meet yall at DEF CON.
Let’s get started with today’s news.
In July 2016, a project called No More Ransom was launched as an online portal and public
private partnership that was started by Europol, the Dutch National Police, Kaspersky, and
McAfee.
This law enforcement slash IT security partnership paved the way to help people decrypt ransomware’d
data by offering a go-to place for decryptors.
At first, they only had four decryptors available, but now they’ve hit over 100 free tools.
No More Ransom now has 188 partners worldwide, and they just announced they’ve helped over
1.5 million people with free decryption tools for recovering files.
This has saved, according to last year's numbers published by Europol, almost a billion euros
since victims wouldn’t have to pay any money to cybercriminals.
No More Ransom has this Crypto Sheriff tool which asks you to upload two encrypted files
plus the ransomware note in order to find a match.
If one exists on their database, they give you the proper decryptor and instructions
on how to accomplish the task.
If there isn’t a match, they recommend checking back since it’s constantly updated with
new decryption keys.
No More Ransom is a positive piece of news today, because they’re advocating for better
access to decryption keys, raising awareness around ransomware attacks, and offering easy
to use directions for normal folks to follow.
The project does have some recommendations for combating ransomware before it even hits
your system.
Backup regularly, practice good online security hygiene IE don’t click on weird links, don’t
open sketchy attachments, keep systems and software up to date, use 2FA, for corporations
- limit the possible threat vectors, and lastly, DO NOT PAY!
Paying ransoms for encrypted files leads to financing of future attacks, so taking precautionary
approaches can save you a lot of stress in the long term.
Frameworks are common parts of development for software, because they keep everything
clean and organized including but not limited to things like libraries, image files, logging,
and authentication.
This platform can make it easier for developers to quickly deploy apps and updates for multiple
ecosystems.
So, they’re common.
An undocumented malware framework for Linux was just discovered and revealed by security
firm Intezer last week, after they found it on VirusTotal.
The malware was submitted by a Chinese manufacturer using CentOS.
This malware framework is called Lightning Framework, and is used as a post exploit malware.
It’s installed on an infected machine after the attacker has already gained access and
is used to install rootkits and run plugins.
Since frameworks are so common for development, what makes this one unique?
According to Intezer, it’s rare to see a framework so intricate meant to target Linux
systems.
In the case of Lightning, it’s a modular framework with a lot of capabilities.
An attacker could use this to make the infected machine communicate with their own server,
open a secure shell, and submit commands.
The data compiled so far is a very small part of the framework so they are still analyzing
everything that Lightning Framework can do.
In their blog post, the researchers mention that they don’t have all of the files mentioned
in the framework but hope to obtain the full scope of the framework by publicly sharing
the information they’ve gathered so far.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patron including SSH17 haxor (I’m not pronouncing that fully because
I’m pretty sure that leetspeak cant be translated on youtube - i dont wanna get it trouble with
the youtube overlords) - but thank you for joining the alliance on Patreon.com/threatwire.
Let’s finish out today’s episode with my last top story, about UEFI rootkits.
Are UEFI rootkits rare?
Well, according to Kaspersky, maybe not.
Last week the security company posted an article about CosmicStrand which is a supposedly Chinese-based
rootkit that targets the Unified Extensible Firmware Interface - the UEFI - instead of
targeting the operating system or firmware.
Since the UEFI is the first thing to boot when a computer is turned on, it’s hard
to detect, test for, and inspect this tiny little storage chip since it also affects
what happens after it boots up - by influencing how your operating system, A/V apps, and software
and firmware run.
Kaspersky says CosmicStrand has been used in the wild since 2016, and this is backed
up by a report by Qihoo360 in 2017 which also explained the same rootkit, just an earlier
variant.
Kaspersky’s findings explain how CosmicStrand infect firmware images on Gigabyte and Asus
motherboards and in an email with Ars Technica, they explain that this may or may not be a
bootkit depending on where it is installed.
In Kaspersky’s analysis, they explain the steps involved for CosmicStrand to succeed.
It first bootstraps the whole chain, then sets up a malicious hook in the boot manager
to modify the Windows kernel loader before execution.
This allows attackers to set up another hook function in the kernel.
That function can later be called during start up of the operating system, and the malware
then deploys a shellcode in memory and contacts the C2 server to retrieve a malicious payload.
So far, Kaspersky notes they’ve seen the rootkit running on machines in China, Vietnam,
Iran and Russia, and they don’t seem to target any specific industry.
The infected machines were likely private citizens, not companies.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
I’ve got a Pixel 6a review in the works right now!
Don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!