Iranian Hackers Steal Academic Research Papers From Over 70 Universities

By: Brent Burgess                                                                                                                9/18/201

Around three weeks ago SecureWorks, a cybersecurity research group, discovered a massive phishing scheme that has been recently targeting many universities. This phishing attack has targeted over 76 universities in 14 countries, including Australia, Canada, China, Israel, Japan, Switzerland, Turkey, the United Kingdom, and the United States. Most of these spoof sites had domains which attempted to replicate the universities’ library pages, getting access to accounts attempting to enter their library resources, and obtaining 31 terabytes of academic knowledge. When the information was entered, they were redirected to the actual university library site where they either were signed in or asked to repeat their credentials. The 16 domains were created between May and August of this year. Many of these stolen research papers were then sold by texting an encrypted message to WhatsApp or Telegram.

These phishing attacks were found to be perpetrated by the Cobalt Dickens hacking group which has been found to be closely associated with the Iranian government. In March of this year, the United States had indicted the Mabna hacking group and nine members in connection with the group. This group’s previous attacks appeared to have the same infrastructure as the Cobalt Dickens attacks, implying some of the same members were involved. These universities which create cutting-edge research are high priority targets due to the value of their information presents as well as the difficulty of securing them. This hack has taken place shortly after the United States decided to re-establish economic sanctions with the United States implying a potential political motivation.

“This widespread spoofing of login pages to steal credentials reinforces the need for organizations to incorporate multi-factor authentication using secure protocols and          implement complex password requirements on publicly accessible systems.”                  -SecureWorks

Sources:

https://www.zdnet.com/article/iran-hackers-target-70-universities-in-14-countries/ https://www.express.co.uk/news/world/1017903/US-sanctions-Iran-hackers-nuclear-power-cybersecurity-donald-trump/                                    https://www.securityweek.com/iranian-hackers-target-universities-large-attack-campaign-secureworks                                                https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities

 

 

Crypto-jacking on Government Official Websites.

About a month ago it was discovered that there was a vulnerability being exploited on a browser plug-in called, Browsealoud. Browsealoud is a website plugin, developed by the company TextHelp, that adds speech, reading, and translation to websites, in an effort  to help those with dyslexia and other conditions.  Hackers injected a crypto-mining script on a Java file within the Browsealoud library. The script would mine the currency ‘monero’. Since the hackers attacked Browsealoud itself and not the individual websites, all the websites that were using Browsealoud (nearly 4000) were infected.  Some of the websites included  UK’s ICO (Information Commissioner’s Office) and NHS (National Health Service) and US’ federal judiciary. When someone visited a website using the plugin, the script would run and use the visitors CPU to begin mining.

Crytpo-mining is something to be wary about especially with the rise of Bitcoin and other cryptocurrencies. The hackers simply just wanted an easy way to mine more currency for themselves whether or not it was legally. There reason for doing this comes back to the acronym ‘MEECES’ which stands for money, ego, entertainment, cause, entrance, status. The attackers were just looking for some money in this case because as of now it is unknown who injected the script. It was very fortunate, with the information as of now, that no information of the users who used the website was stolen, and only were used to mine cryptocurrency.

Websites now should use more caution when implementing plugins to there website. Every company should have people testing for vulnerabilities within their services and should submit proof of this to their customers. In the future we need to become more aware of ways our websites and services can become vulnerable and the risks we take using them.

– Jordan Disciglio

Souces:
https://viraldocks.com/cryptojacking-attack-hits-4000-websites/

https://www.theguardian.com/technology/2018/feb/12/cryptojacking-attack-hits-australian-government-websites

Russian Government Cyber Attacks Targeting Critical US Infrastructure

In this modern, technology-run day-and-age, the use of cyber hacking by one nation against another is an increasingly frequent method of attack. The United States Computer Emergency Readiness Team in joint with the DHS and FBI recently released a report outlining specific types of attacks they have identified being used by the Russian government targeting the U.S. government as well as “organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors”. They have also confirmed that these attacks have been ongoing since at least March of 2016.

One type of attack uses spear phishing emails containing Microsoft Word files loaded with a malicious script. These script first installs some credential-harvesting tools like Hydra and CrackMapExec. Then, it attempts to retrieve a file on a server via SMB request. By doing so—whether or not the file exists—an authentication request is typically prompted to the user before continuing. At this point, the script will capture the hash of the user’s credentials, and make an attempt to extract the full username and password using the aforementioned tools installed on the machine.

Another type of attack again used phishing to obtain credentials via a link in a falsified .pdf contract agreement. Users were directed to follow a link in the document to enter their email address and password in order to agree to the service contract. Once the credentials were in hand, attackers used them to attempt to gain access to the internal systems of these important infrastructure institutions. A back-door was installed to allow persistent access, and attackers could then modify firewall settings and Windows registry keys.

The release of this information is significant in two ways. First, it is just another example as to the extreme importance of vigilant cyber security awareness and practice. Both of these attacks rely on the ignorance and thoughtlessness on the side of the end-user to gain access into the system. Whether it’s opening unsolicited Microsoft Word documents or agreeing to unfamiliar (and unofficial) contracts, both scenarios rely on users divulging their credentials without suspicion as to whether the requesting source is legitimate.

Second, it is another example of the changing landscape of cyber security and cyber hacking as it continues to be used more frequently by governments as a weapon against other nations. Now more than ever is cyber security conversation and awareness important for all people as we enter an age of online warfare.

— Brendon Stowe
Student, R•I•T
Web & Mobile Computing


Source:
Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors

“Responsible” disclosure? AMD given 24 hours to fix

Reminiscent (but unrelated to) the Spectre and Meltdown vulnerabilities that plagued Nvidia earlier this year, AMD was recently hit with a fairly significant set of vulnerabilities.  Although the vulnerabilities were less severe than the ones hitting Nvidia (these vulnerabilities require administrative access to exploit rather than just the ability to write memory), the method by which they were made public is alarming.

According to AMD’s initial assessment, there are three groups of vulnerabilities, all requiring administrative access to exploit.  MASTERKEY is an exploit by which someone who has already corrupted the system can hide their corruption from the AMD Secure Processor checks throughout reboot.  RYZENFALL and FALLOUT allow a user to install malware on the system that is difficult to detect.  While those issues will be patched with a firmware update, CHIMERA is a hardware issue that allows malware to be hidden, which cannot be fully patched through an update.

According to AMD as well as various media outlets, the company had less than 24 hours after being notified of the issues before the discoverer (CTS Labs) went public with the vulnerabilities.  While the technical details of the vulnerability were not (and have still not yet been) made public, this creates very bad PR for AMD, as well as encourages others who may have access to the technical details to exploit the issue before a fix can be made (compared to only knowing that they had been discovered as a fix was released).

In response to the controversy, Ilia Luk-Zilberman (the Chief Technology Officer of CTS Labs) posted an open letter explaining the decision as well as their issues with responsible disclosure.  Responsible disclosure is a generally-agreed-upon policy that, upon finding a serious security issue with a program, software, or system, one should report it to the manufacturer, maintainer, or security team so that they can have a patch ready before the public knows of the issue.  This helps maintain PR, prevent a company from being caught off-guard, and helps consumers know that they are as protected as they can be.  This policy was handled with many recent exploits such as DirtyCOW and Spectre/Meltdown (although those were accidentally leaked a few days early).

Another aspect of responsible disclosure is a time limit on the vulnerability (typically cited as 90 days) before the discoverer posts the vulnerability.  This is to ensure that the company puts priority on fixing the issue instead of pushing it off (after all… even though it’s broken, no one knows about it, so it’s probably fine).  This famously happened with the MoonPig vulnerability last year, in which the greeting card company MoonPig had an incredibly broken API (there was no need to log in as a user, just cite their user ID), and refused to fix it for over a year until the details went public.

CTS Labs, however, decided that the risk of not going public outweighed the benefits, so they released the possible impacts of the vulnerabilities without disclosing technical details of the vulnerability or how to exploit it.

– Ryan V.

Link

AI is an amazing development in Computer Software, and is being used to make computers and software think intelligently, like a human. This has led to software that can recognize handwriting, robots that know how to play chess, and lead malware attacks.

According to a study completed by a group of technology agencies released a few weeks ago, AI cam be used maliciously in many ways, and the use of it will increase in the future. The ability to recognize handwriting can be used to create forged documents, the ability to recognize and predict patterns can led to an increase in “fake news” articles that can be used to spread malware. Facial Recognition, while it is helpful, can be used by drones to specifically target a person in order to cause harm to them.

The purpose of this report was to simply bring attention to the idea of AI being used for malicious reasons, and encourage the community to come up with a plan in order to prevent the technology that we have worked so hard to create from being misused, and discuss some of the ethical dilemmas of this type of technology.

-Zoe James

https://www.technewsworld.com/story/85155.html

https://www.tutorialspoint.com/artificial_intelligence/artificial_intelligence_agents_and_environments.htm

https://www.eff.org/files/2018/02/20/malicious_ai_report_final.pdf