While most people do take the time to evaluate videos and links posted on Facebook timelines by their friends, it can be confusing when one receives a link via Facebook Messenger. There is a new crypto-currency virus that is spreading via Facebook Messenger that is specifically targeted at users of cryptocurrency trading platforms with the intent of stealing their access details.
Facexworm – Spread Through Facebook Messenger
The malicious virus which is a Chrome extension first started making the rounds in August of 2017, but it is only in the last six months, with the massive increase in people signing up for cryptocurrency sites that it has become a big problem. The latest iteration of the Facexworm virus has been in circulation for a few weeks and has the potential to cause real damage.
Just one click on the ‘link’ or ‘video’ sent by a trusted Facebook friend will allow the extension to open and start working in the background of Chrome where it is able to unleash the capability to steal account credentials from cryptocurrency trading sites and further misdirect users to fake cryptocurrency sites. It is also able to inject miners into a host webpage to be used for mining cryptocurrencies without the owner’s knowledge. The virus is similar to ‘Digmine’ which was able to redirect users to fake video site with the potential to steal user account information. Once the fake site has the access via OAuth token from Facebook, it has access to all your details and those of your friends list.
Vigilance and Protection
Though Facebook and Chrome have been able to isolate and remove the viruses and put security protection in place, but the most important security measures start with the user. One must always check the authenticity of seemingly random links and videos sent via friends, not matter how enticing and interesting they look. When in doubt – delete the link without opening it!
I’m thinking of a recent case in which one prominent university fell victim to this menace, with worrying results. When the Ransomware infection hit the university in question, it locked down exam results shortly before they were due to be announced. No decrypter could be found for the specific infection, but the university had, fortunately, digitally backed up all of its exam results by recording them on excel spreadsheets. This allowed the administration to painstakingly reconstruct the locked-down results, but the announcement of those results was delayed for almost one month.
Backing up or Backing Down?
Depending on I.T. and administrative procedures, the consequences of Ransomware attacks can vary widely from one university to another. A recent attack on the University of Calgary in Alberta, for example, compelled that institution’s authorities to pay a ransom of $20,000 to have their computer systems files decrypted. The ransom had to be paid, simply because the university had failed to properly back up its data. This must be one of the most expensive lessons ever learned at any university.
Securing the University in a Risky Environment
Unfortunately, the bigger picture is worrying. Ransomware threats are constantly increasing in number and becoming ever-more sophisticated. What should our universities do to avoid getting “system infected” warnings due to Ransomware activity? One highly recommended precaution is to use automated and isolated backup mechanisms, together with an Intrusion Detection System (IDS) both at network level and for critical assets. An IDS is a powerful resource in the battle against Ransomware, because it provides specific insights into any potential threat. The AlienVault Unified Security Management (USM) platform may be especially desirable, because it has inbuilt IDS with SIEM (security information and event management) and real-time threat intelligence. Both of these features can help in the rapid detection of Ransomware and other threats.
Over half of all organizations assume that their IT networks have been penetrated, or will be in the future. The number of IT professionals admitting that they really don’t have complete control over sensitive systems and data is increasing each year.
The First Line of Defense Has Already Fallen
Perimeter detection is the first line of defense against any attack, whether it be physical, think an alarm going off when security in your home is breached, or an ATM blocking your back card if there have been too many incorrect PIN entries. The issue currently facing many IT experts, security analysts and information security professionals is that there has previously been an over reliance on perimeter detection as the ONLY line of defense. Not only are cyber-attacks completely bypassing perimeter detection, a recent survey reported that up to 30% of all security breaches never triggered the virtual alarms, but that preventative discovery is close to non-existent in many organizations.
What is even more alarming is what happens after a security breach.
The speed with which an organization reacts after a breach is vital in not only securing sensitive information but in examining and investigating exactly what happened, finding the compromised end-points and determining the full data risk impact as fast as possible. The problem is that most organizations are reactive instead of proactively aggressive in their search for potential threats at all times. In the same survey, it was noted that up to 25% of IT security professionals were notified of data breaches and cyber-attacks by a 3rd party. By then it could be too late.
Figuring out what happened after the fact is essential. Yes. Creating a secure environment that STOPS attacks is even more vital. To do that security professionals need to be vigilant, proactive and relentless in their hunt for cyber threats before they become cyber casualties of war.
As indicated in FortiGuard Advisory FGA-2010-53, an attack exploiting a critical zero-day vulnerability in Adobe Flash Player was found very recently roaming in the wild. Although the attack vector in the wild is a PDF file, it is a Flash Player vulnerability indeed (Adobe Reader embeds a Flash Player).
After analyzing the PDF sample, we do confirm that the core ActionScript in the embeded flash file, which triggers the exploit, is almost exactly the same as that of an example on flashamdmath.com, as Bugix Security guessed.
Almost? Indeed: the only difference lies in a single byte (at 0x494A, for those who’d like to make a signature based on that ;)), changed from 0×16 in the example to 0×07 in the exploit code:
What does this correspond to? Simply to an ActionScript Class id sitting in the “MultiName” part of the file (According to Adobe’s ActionScript Virtual Machine 2 Overview):
So, the original fl.controls::RadioButtonGroup class in the example becomes a fl.controls::Button class in the sample. Thus, at runtime, all references that are supposed to point to fl.controls::RadioButtonGroup actually refer to fl.controls::Button… which, somewhere below, triggers the vulnerability:
Based on this, it is not extremely challenging to guess how the attacker discovered this 0day vulnerability: Simply by running a “dummy” fuzzer on basic flash files, as many bug hunters are doing. We had already noticed the same thing likely happened for CVE-2010-1297 and CVE-2010-2884.
Security experts have recently discovered a previously unknown Mac-based spy malware that preys on outdated coding practices to launch real-world attacks on computers in the biomedical research industry.
The unsophisticated and out-of-date code has remained undetected for years on macOS systems. The malware has been labelled Fruitfly and it was first discovered as ‘OSX.Backdoor.Quimitchin’. An IT administrator working for information security firm Malwarebytes was alerted to the malware due to unusual outgoing activity sourced from a Mac computer.
The First Malware of 2017
Researchers are labelling the Fruitfly the first Mac Malware of 2017. Fruitfly is said to contain code dating back to OS X and it has been conducting surveillance on targeted networks for over two years. Fruitfly uses a hidden pearl script which communicates with command and control servers. Disturbingly for targeted biomed companies, Fruitfly can capture webcam, screenshots, grab system uptime while moving and clicking the mouse cursor.
Fruitfly’s reach can extend to connected devices in the same network as the corrupted Mac as it attempts to connect to these also. Fruitfly uses a secondary script along with Java class to conceal its icon from displaying in the macOS Dock. It’s still unknown how the malware was distributed and infected the Macs.
Code Dating from 1998
Researchers have found that the malware’s code pre-dates Apple’s OS X and that it is running on “libjpeg” code, JPEG-formatted images files that were last updated almost 20 years ago in 1998.
How Has it Gone Undetected for so Long?
In a blog post written by Malwarebytes’ Thomas Reed, he speculated that Fruitfly has been used selectively in very tightly targeted attacks which have limited its exposure. International espionage is a buzz topic right now and the nature of this form of attack is a hallmark of past Russian and Chinese attacks aimed at US and European scientific research.
Shimon Sheves truly embodies the adage, “Think Global, Act Local”. He is deeply passionate about his homeland of Israel and works tirelessly to support his community. Sheves is also the founder and chairman of HolistiCyber company that provides nation-state level cyber protection.