Tag Archives: Security

Posted on Author Atlantic Computer Services Categories Blog

Cisco Email Gateway Appliance Users Should Apply Security Patch

Tech giant Cisco recently sent out a notification to its vast customer base urging them to apply a recently issued patch that addresses a critical security vulnerability. This vulnerability could allow an attacker to bypass the authentication process entirely and gain access to the web management interface of Cisco email gateway appliances with non-default configurations.

The flaw in question is being tracked as CVE-2022-20798 and is present in the external authentication routines of ESAs (Cisco’s Email Security Appliances) and Cisco Secure Email and Web Manager appliances, both virtual and hardware.

The company had this to say about the flaw:

“An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device.  A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.”

Oddly enough, this security flaw does not impact appliances with default configurations. That makes this one of the rare times where if an admin had not switched away from the default configs, he’d be safer. That is at least where this flaw is concerned.

In any case, if you have one of the Cisco appliances mentioned above on your network, be sure to apply the patch as soon as possible to minimize your risk.  If you’re unable to apply the patch for one reason or another, there is a workaround you can use in the short run, described below.

You’ll need to disable anonymous binds on the external authentication server, which should give you at least some protection and some additional time to deploy the patch.

Kudos to Cisco for their fast action here.  We can only hope that the next critical security flaw we report on is handled as adroitly by whatever company is at the helm.

0
Posted on Author Atlantic Computer Services Categories Blog

Massive Phishing Attack Scammed Millions Of Facebook Messenger Users

According to research conducted by the cybersecurity firm PIXM, there is a massive phishing campaign that peaked in April and May of this year (2022) and it is still ongoing.

The campaign has lured millions of unsuspecting users to phishing pages by abusing Facebook and Facebook Messenger and tricking users into entering their account credentials.

Worse, the hackers then used those credentials to send additional phishing messages to friends of the affected users, luring them in as well and continuing the chain.

All told, the group behind the attack has been able to generate millions of dollars in revenue using these tactics.

Worst of all is that PIXIM’s research shows that this has been a long running campaign.  Although the group has only recently discovered it, the evidence they’ve uncovered shows that the campaign has been ongoing since at least September of 2021.

The group’s research is ongoing but so far they’ve found more than four hundred Facebook accounts tied to the campaign, which contain hooks to phishing pages.  Some of these poisoned profile pages have only been viewed a few thousand times. In other cases, they boast millions of views and of course, each view represents another potential victim.

Based on what the group has been able to piece together, they determined that in 2021 a total of 2.7 million users had visited one of the phishing pages. As of today, more than 8.5 million people have been lured to the phishing pages with no clear end in sight.

While this represents a tiny fraction of the total number of Facebook users on the platform, it is nonetheless a massive campaign.  If you’re a regular Facebook user, stay vigilant.  There are groups out there right now that are actively trying to lure you in and steal your data.  Don’t let that happen to you, your family, friends, or your coworkers.

0
Posted on Author Atlantic Computer Services Categories Blog

Researchers Warn About Symbiote Malware Which Attacks Linux Machines

Are you a Linux user?  If so, be aware that there is a new kind of malware to be concerned about. The BlackBerry Threat Research and Intelligence team, in concert with Joakim Kennedy (an Intezer Analyze security researcher), have announced the discovery of a new strain of malware.

They’ve dubbed it Symbiote, and it was named because of its parasitic nature.

Actual discovery of the strain occurred a few months ago but the team has been studying it since.  It is markedly different from most of the Linux malware you see today, as it acts as a shared object library that is loaded on all running processes via LD_PRELOAD.

Once the malicious code has its hooks in a target machine, it provides the hackers controlling it with rootkit functionality.

The earliest samples of this strain date back to November 2021, and based on an analysis of its code, its primary targets were intended to be financial institutions located in Latin America.

The researchers had this to say about their recent discovery:

“When an administrator starts any packet capture tool on the infected machine, BPF bytecode is injected into the kernel that defines which packets should be captured.  In this process, Symbiote adds its bytecode first so it can filter out network traffic that it doesn’t want the packet-capturing software to see. When we first analyzed the samples with Intezer Analyze, only unique code was detected.  As no code is shared between Symbiote and Ebury/Windigo or any other known [Linux] malware, we can confidently conclude that Symbiote is a new, undiscovered Linux malware.”

The Linux ecosystem isn’t targeted as often as Apple, Windows, or Android. So the fact that this new threat has emerged is noteworthy indeed.  If you have any Linux infrastructure on your network, be sure to stay aware of this new potential threat.

0
Posted on Author Atlantic Computer Services Categories Blog

New Malware Uses Word Documents To Get On Your System

Researchers at HP have discovered a new malware loader that they’ve dubbed SVCReady.  While new malware strains are common, this one is distinct for a couple of different reasons.

Like many malicious programs, this spreads primarily via phishing email campaigns.  One way that this new strain differs however, is the fact that the malware is loaded onto the target machine via specially crafted Word documents attached to the email.

The idea is that these Word documents leverage VBGA macro code to execute shellcode that’s stored in the properties of the Word document.  That’s both new and dangerous.

The HP researchers found evidence that tracks the malicious code back to its origin in April of 2022, with the developers releasing several updates just one month later in May.  The number of updates is suggestive of a large, well-organized team that is committed to continued development of their new toy.

Currently, SVCReady boasts the following capabilities:

  • Download a file to the infected client
  • Take a screenshot
  • Run a shell command
  • Check if it is running in a virtual machine
  • Collect system information (a short and a “normal” version)
  • Check the USB status, i.e., the number of devices plugged-in
  • Establish persistence through a scheduled task
  • Run a file
  • And run a file using RunPeNative in memory

In addition to these capabilities, SVCReady can also fetch additional payloads from the command-and-control server.  While the bullet points above are dangerous in their way, it is the last, recently added capability that makes the new malware strain especially dangerous.  It enables the hackers to tailor the level of destruction for each infected target.

Worse, the new strain contains bits of code that lead the HP researchers to conclude that the threat actor TA551 may be behind it.  This is a large, well-organized group with ties to multiple other hacking organizations and ransomware affiliates. That implies that SVCReady may soon become much more widely available than it is now.

You will want to be sure this one stays on your radar.

0
Posted on Author Atlantic Computer Services Categories Blog

Hackers Are Teaming Up To Wreak Havoc On Corporate Users

It’s never a good thing when well-organized groups of hackers start working together, but that’s what appears to be happening.

Recently, evidence has emerged that the Black Basta ransomware gang has begun tight-knit cooperation with the infamous QBot malware operation. They share the specific goal of inflicting maximum damage on corporate targets.

While many different groups make use of QBot for initial infection, Black Basta’s use is somewhat different. The group is leveraging it to spread laterally through a network once they have infected it.

The partnership stands to be devastatingly effective.  Black Basta’s ransomware paired with QBot’s penchant for stealing banking credentials and injecting additional malicious payloads could easily deliver a one-two punch that would be very difficult for a company to recover from.

The bad news here is that QBot (also known as QakBot) can move quickly once inside a compromised network.

Fortunately, the way Black Basta is leveraging QBot, there is a window of opportunity between the time that QBot is moving laterally and the actual ransomware infection. So diligent IT Security professionals may be able to stop QBot’s spread before the ransomware payload is deployed.

That’s good in theory but the sad truth is that many companies won’t move quickly enough to stop the ransomware attack, which will leave them crippled from that and see their banking credentials compromised to boot.

Exactly how effective this new partnership will be remains to be seen, but both QBot and Black Basta have made names for themselves as fearsome hacking groups. Black Basta has been breaching dozens of networks over the course of their relatively short existence and QBot has made a name for themselves over a much longer period.

In any case, this is a dangerous combination and you will want to be on the alert for both groups and the ransomware they are deploying.  The hackers represent genuine threats, whether operating on their own or in tandem.

0
1 … 11 12 13 14 15 … 155