The Security Pros and Cons of Using Email Aliases

/0 Comments/in /by

One way to tame your email inbox is to get in the habit of using unique email aliases when signing up for new accounts online. Adding a “+” character after the username portion of your email address — followed by a notation specific to the site you’re signing up at — lets you create an infinite number of unique email addresses tied to the same account. Aliases can help users detect breaches and fight spam. But not all websites allow aliases, and they can complicate account recovery. Here’s a look at the pros and cons of adopting a unique alias for each website.

What is an email alias? When you sign up at a site that requires an email address, think of a word or phrase that represents that site for you, and then add that prefaced by a “+” sign just to the left of the “@” sign in your email address. For instance, if I were signing up at example.com, I might give my email address as krebsonsecurity+example@gmail.com. Then, I simply go back to my inbox and create a corresponding folder called “Example,” along with a new filter that sends any email addressed to that alias to the Example folder.

Importantly, you don’t ever use this alias anywhere else. That way, if anyone other than example.com starts sending email to it, it is reasonable to assume that example.com either shared your address with others or that it got hacked and relieved of that information. Indeed, security-minded readers have often alerted KrebsOnSecurity about spam to specific aliases that suggested a breach at some website, and usually they were right, even if the company that got hacked didn’t realize it at the time.

Alex Holden, founder of the Milwaukee-based cybersecurity consultancy Hold Security, said many threat actors will scrub their distribution lists of any aliases because there is a perception that these users are more security- and privacy-focused than normal users, and are thus more likely to report spam to their aliased addresses.

Holden said freshly-hacked databases also are often scrubbed of aliases before being sold in the underground, meaning the hackers will simply remove the aliased portion of the email address.

“I can tell you that certain threat groups have rules on ‘+*@’ email address deletion,” Holden said. “We just got the largest credentials cache ever — 1 billion new credentials to us — and most of that data is altered, with aliases removed. Modifying credential data for some threat groups is normal. They spend time trying to understand the database structure and removing any red flags.”

According to the breach tracking site HaveIBeenPwned.com, only about .03 percent of the breached records in circulation today include an alias.

Email aliases are rare enough that seeing just a few email addresses with the same alias in a breached database can make it trivial to identify which company likely got hacked and leaked said database. That’s because the most common aliases are simply the name of the website where the signup takes place, or some abbreviation or shorthand for it.

Hence, for a given database, if there are more than a handful of email addresses that have the same alias, the chances are good that whatever company or website corresponds to that alias has been hacked.

That might explain the actions of Allekabels, a large Dutch electronics web shop that suffered a data breach in 2021. Allekabels said a former employee had stolen data on 5,000 customers, and that those customers were then informed about the data breach by Allekabels.

But Dutch publication RTL Nieuws said it obtained a copy of the Allekabels user database from a hacker who was selling information on 3.6 million customers at the time, and found that the 5,000 number cited by the retailer corresponded to the number of customers who’d signed up using an alias. In essence, RTL argued, the company had notified only those most likely to notice and complain that their aliased addresses were suddenly receiving spam.

“RTL Nieuws has called more than thirty people from the database to check the leaked data,” the publication explained. “The customers with such a unique email address have all received a message from Allekabels that their data has been leaked – according to Allekabels they all happened to be among the 5000 data that this ex-employee had stolen.”

HaveIBeenPwned’s Hunt arrived at the conclusion that aliases account for about .03 percent of registered email addresses by studying the data leaked in the 2013 breach at Adobe, which affected at least 38 million users. Allekabels’s ratio of aliased users was considerably higher than Adobe’s — .14 percent — but then again European Internet users tend to be more privacy-conscious.

While overall adoption of email aliases is still quite low, that may be changing. Apple customers who use iCloud to sign up for new accounts online automatically are prompted to use Apple’s Hide My Email feature, which creates the account using a unique email address that automatically forwards to a personal inbox.

What are the downsides to using email aliases, apart from the hassle of setting them up? The biggest downer is that many sites won’t let you use a “+” sign in your email address, even though this functionality is clearly spelled out in the email standard.

Also, if you use aliases, it helps to have a reliable mnemonic to remember the alias used for each account (this is a non-issue if you create a new folder or rule for each alias). That’s because knowing the email address for an account is generally a prerequisite for resetting the account’s password, and if you can’t remember the alias you added way back when you signed up, you may have limited options for recovering access to that account if you at some point forget your password.

What about you, Dear Reader? Do you rely on email aliases? If so, have they been useful? Did I neglect to mention any pros or cons? Feel free to sound off in the comments below.

Microsoft Patch Tuesday, August 2022 Edition

/0 Comments/in /by

Microsoft today released updates to fix a record 141 security vulnerabilities in its Windows operating systems and related software. Once again, Microsoft is patching a zero-day vulnerability in the Microsoft Support Diagnostics Tool (MSDT), a service built into Windows. Redmond also addressed multiple flaws in Exchange Server — including one that was disclosed publicly prior to today — and it is urging organizations that use Exchange for email to update as soon as possible and to enable additional protections.

In June, Microsoft patched a vulnerability in MSDT dubbed “Follina” that had been used in active attacks for at least three months prior. This latest MSDT bug — CVE-2022-34713 — is a remote code execution flaw that requires convincing a target to open a booby-trapped file, such as an Office document. Microsoft this month also issued a different patch for another MSDT flaw, tagged as CVE-2022-35743.

The publicly disclosed Exchange flaw is CVE-2022-30134, which is an information disclosure weakness. Microsoft also released fixes for three other Exchange flaws that rated a “critical” label, meaning they could be exploited remotely to compromise the system and with no help from users. Microsoft says addressing some of the Exchange vulnerabilities fixed this month requires administrators to enable Windows Extended protection on Exchange Servers. See Microsoft’s blog post on the Exchange Server updates for more details.

“If your organization runs local exchange servers, this trio of CVEs warrant an urgent patch,” said Kevin Breen, director of cyber threat research for Immerse Labs. “Exchanges can be treasure troves of information, making them valuable targets for attackers. With CVE-2022-24477, for example, an attacker can gain initial access to a user’s host and could take over the mailboxes for all exchange users, sending and reading emails and documents. For attackers focused on Business Email Compromise this kind of vulnerability can be extremely damaging.”

The other two critical Exchange bugs are tracked as CVE-2022-24516 and CVE-2022-21980. It’s difficult to believe it’s only been a little more than a year since malicious hackers worldwide pounced in a bevy of zero-day Exchange vulnerabilities to remotely compromise the email systems for hundreds of thousands of organizations running Exchange Server locally for email. That lingering catastrophe is reminder enough that critical Exchange bugs deserve immediate attention.

The SANS Internet Storm Center‘s rundown on Patch Tuesday warns that a critical remote code execution bug in the Windows Point-to-Point Protocol (CVE-2022-30133) could become “wormable” — a threat capable of spreading across a network without any user interaction.

“Another critical vulnerability worth mentioning is an elevation of privilege affecting Active Directory Domain Services (CVE-2022-34691),” SANS wrote. “According to the advisory, ‘An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow elevation of privilege to System.’ A system is vulnerable only if Active Directory Certificate Services is running on the domain. The CVSS for this vulnerability is 8.8.”

Breen highlighted a set of four vulnerabilities in Visual Studio that earned Microsoft’s less-dire “important” rating but that nevertheless could be vitally important for the security of developer systems.

“Developers are empowered with access to API keys and deployment pipelines that, if compromised, could be significantly damaging to organizations,” he said. “So it’s no surprise they are often targeted by more advanced attackers. Patches for their tools should not be overlooked. We’re seeing a continued trend of supply-chain compromise too, making it vital that we ensure developers, and their tools, are kept up-to-date with the same rigor we apply to standard updates.”

Greg Wiseman, product manager at Rapid7, pointed to an interesting bug Microsoft patched in Windows Hello, the biometric authentication mechanism for Windows 10.  Microsoft notes that the successful exploitation of the weakness requires physical access to the target device, but would allow an attacker to bypass a facial recognition check.

Wiseman said despite the record number of vulnerability fixes from Redmond this month, the numbers are slightly less dire.

“20 CVEs affect their Chromium-based Edge browser and 34 affect Azure Site Recovery (up from 32 CVEs affecting that product last month),” Wiseman wrote. “As usual, OS-level updates will address a lot of these, but note that some extra configuration is required to fully protect Exchange Server this month.”

As it often does on Patch Tuesday, Adobe has also released security updates for many of its products, including Acrobat and Reader, Adobe Commerce and Magento Open Source. More details here.

Please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.

LABScon | Security Research in Real Time – Talks Not To Miss, Part Two

/0 Comments/in /by

This is a continuation of our deep-dive into the inaugural LABScon 2022 agenda to shine a spotlight on the can’t-miss presentations on deck in Scottsdale in September.

LABScon will feature talks from various adjacent fields in InfoSec. From vulnerabilities to malicious browser extensions, Chinese APTs, and novel uses of machine learning to detect malicious activities, the agenda is packed with thought provoking content for researchers on the bleeding edge. LABScon 2022 will feature a complimentary track with expert workshops on analyzing Android malware, malware analysis with Ghidra, and more.

As the anticipation builds, we are excited to share our stage with speakers from the International Red Cross, Mandiant, Proofpoint, Cisco Talos, and our own SentinelOne research teams. In this post, we highlight a few more of the talks we can’t wait to host at LABScon.

Are Digital Technologies Eroding the Principle of Distinction in War? – Mauro Vignati (International Committee Of The Red Cross)


Until now, the cyber capabilities of a State have been assessed mainly on technical and tactical perspectives. But describing cyber operations is no longer sufficient to understand the capabilities that States deploy in the digital sphere during armed conflicts. It has been observed that States can gain a major advantage thanks to the digital transformation of societies, this is because armies in conflict are increasingly digitized as are the involved populations. Some prescient examples: States may encourage civilians to engage in offensive cyber operations against targets associated with the enemy or the transformation and consequently the dual use of smartphone applications “enhanced” to encourage users to contribute to the military effort.

Civilians have been used to perform military functions during armed conflicts and to assist in the war effort since time immemorial. With the digitalisation of societies, we are witnessing fundamental shifts both in terms of quality and quantity. The main qualitative shift is that these activities are now much closer to the actual conduct of military operations: we have moved from the provision of food, shelter, or equipment at some distance from the physical battlefield to the direct contribution to the operations on the digital battlefield and as support to kinetic operations. The main quantitative shift is that in the digital space it is much easier to scale up these activities. Encouraging civilian participation in cyber hostilities raises several concerns, first of all it undermines the central humanitarian value that undergirds the principle of distinction (between civilians and combatants), namely the protection of those who must be spared from the effects of the conflict. Encouraging individuals to fight as civilians will inevitably lead to more civilian casualties as combatants struggle to distinguish the fighters amongst the civilians.

UNC788: Wild Kittens and Where to Find Them – Ashley Zaya & Emiel Haeghebaert (Mandiant)


Charming Kitten, Phosphorus, TA453, and UNC788. You’ve heard these names before, but who and what are they, and where can you find them? In this session, Mandiant analysts Emiel Haeghebaert and Ashley Zaha will talk about UNC788, a cluster of threat activity that conducts cyber espionage and credential harvesting on behalf of the Iranian government. UNC788 is characterized by credential theft operations against corporate and personal email accounts and has consistently targeted Western think tanks and academics, current and former government officials, members of the Iranian diaspora in the United Kingdom, Israel, and the United States, as well as high-profile individuals within Iran.

This presentation promises to touch on the history of the group and, drawing on recent use cases, will illustrate how to leverage and turn the group’s bad habits and infrastructure patterns into reliable threat hunting techniques. It will cover how different third-party tools, like Censys, DomainTools, PassiveTotal, and VirusTotal are leveraged to identify new infrastructure in real time as well as changes in techniques over time. Attendance at this session will result in actionable takeaways for threat intelligence analysts!

Star-Gazing: Using A Full Galaxy of YARA Methods to Pursue an Apex Actor – Greg Lesnewich (Proofpoint)


This talk will explore a highly regarded but rarely publicly investigated threat actor, malware similarity, and YARA. Publicly available data yields just a generic AV signature with the actor’s name.

Using YARA as an analyzer with the console output, and a teeny bit of Python to develop a malware similarity methodology, we will highlight just how well our beloved YARA can pursue a true apex predator.

Quiver – Using Cutting Edge ML to Detect Interesting Command Lines for Hunters – Dean Langsam & Gal Braun (SentinelOne)


What do GPT3, DALL-E2, and Copilot have in common? By grasping the structure and nature of language, these projects can generate text, images, and code that provide added value to a user.  Now, they even understand command lines!

Quiver – QUick Verifier for Threat HuntER is an application aimed at understanding command lines and performing tasks like Attribution, Classification, Anomaly Detection, and many others.

DALL-E2 is known to take an input prompt in human language and draw a stunning image with impressive matching results; GPT3 and similar projects can create an infinite amount of text seemingly written by a real person; While Github’s Copilot can generate entire functions from a comment string.

Command lines are a language in themselves and can be taught and learned the same way other languages can. And the application can be as versatile as we want. Imagine giving a command line to an input prompt and getting the probability of it being a reverse shell, by an Iranian actor, or maybe used for cybercrime. A single prompt on its own may not help so much, but with the power of language models algorithms, the threat hunter can have millions of answers in a matter of minutes, shedding a light on the most important or urgent activities within the network.

In this session, we’ll demonstrate how we developed such a model, along with real-world examples of how the model is used in applications like anomaly detection, attribution, and classification.

Malshare: 10 Years Of Running a Public Malware Repository – Silas Cutler (Stairwell)


Since March 2013, alongside a handful of volunteers, I have run a fully public, never-for-profit malware repository named MalShare. The site allows anyone to register and immediately have access to our entire collection of malware samples.

When MalShare first launched, the idea of openly sharing malware was highly controversial; I was told the site would never survive against existing commercial options and the site would only serve to give threat actors deeper insight into defender visibility. Nearly ten years later, we’re still online. What started out as a handful of open web directories has grown into a service used by thousands of researchers and integrated into numerous tools.

Android Malware Analysis: From Triage to RE (Workshop) – Vitor Ventura (Cisco Talos)


Android malware is packing anti-analysis and anti-debug techniques. This workshop will provide the attendees with the knowledge to apply and adapt techniques aimed at bypassing such protections.

This is a full hands on workshop designed to provide the attendees with the knowledge to bypass the most common techniques used by malware to prevent analysis. During the workshop no automated tools will be used for analysis. The objective is that the attendees understand how they can use techniques like instrumentation and patching to help them analyze and bypass malware defenses when the automated tools fail, while using only free and open source tools.

Request an Invite

There are still a limited number of tickets available, so if you haven’t yet requested your invite, now is the time to push that button.

The Good, the Bad and the Ugly in Cybersecurity – Week 32 

/0 Comments/in /by

The Good

This week, a U.S. individual was found guilty of committing 14 federal crimes related to phishing, credential theft, unauthorized access to his employer’s computer network and fraudulent activity which netted him over $25 million.

Argishti Khudaverdyan, 44, of Burbank, was a former employee of T-Mobile, and over a period of five years fraudulently unlocked phones on multiple networks, including T-Mobile, Sprint, AT&T and others, allowing the phones to be sold on the black market.

Khudaverdyan obtained T-Mobile employees’ credentials through phishing emails and socially engineering the T-Mobile IT Help Desk. He also obtained T‑Mobile employee credentials from accomplices in overseas call centers. Khudaverdyan targeted high-level employees, using their personal identifying information in calls to the T-Mobile IT Help Desk requesting password resets. He used over 50 different employees’ accounts to gain unauthorized access to T-Mobile systems and unlock hundreds of thousands of cell phones.

Khudaverdyan and accomplices advertised their fraudulent unlocking services through brokers, email solicitations, and websites such as unlocks247[.]com, falsely claiming the unlocks were “official” T-Mobile unlocks. Khudaverdyan will face statutory maximum sentences of 20 years in federal prison when he is sentenced in October.

The Bad

A semiconductor manufacturer of power engineering components including those used in many wind power turbines has been hit by LV ransomware this week. In a statement, Semikron said it had been “the victim of a cyber attack by a professional hacker group. As part of this attack, the perpetrators have claimed to have exfiltrated data from our system.”

Semikron says it is working on restoring encrypted parts of its network. However, other sources have suggested the ransomware operators are extorting the company and threatening to leak the allegedly stolen data, a double-extortion tactic that is far more common and successful these days than just encrypting data and only demanding payment for a decryptor.

Such tactics increase the effort for criminals but offer richer rewards. Effectively targeting enterprise data that will be of value typically involves some form of human operated ransomware. A common modus operandi leverages some form of initial access such as credential theft through phishing or social engineering, or exploiting a common vulnerability. Actors then use implants such as Cobalt Strike to maintain a backdoor into the target environment, identify and exfiltrate valuable data.

There are suggestions that LV ransomware shares the same source code as the notorious REvil ransomware but is being operated by a different group. For now, Semikron has not made a public statement regarding any ransom demands or whether it is in negotiation with the attackers. The company says it is working with relevant authorities and will update customers and partners if any evidence of data theft is found.

The Ugly

Multiple vulnerabilities in some of Cisco’s most popular business routers have been found that could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.

A total of eight vulnerabilities have been identified; three in particular, CVE-2022-20827, CVE-2022-20841 and CVE-2022-20842, could be weaponized to execute code on the device with elevated privileges. Cisco says the vulnerabilities may be dependent on one another, with exploitation of one of the vulnerabilities required to exploit another.

CVE-2022-20827 could allow an attacker to submit crafted input to the router’s web filter database update feature. A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges. CVE-2022-20841 is a vulnerability in the Open Plug and Play (PnP) module of four different router models. An attacker could exploit the bug by sending malicious input to an affected device and gain the ability to execute arbitrary commands on the underlying Linux operating system. CVE-2022-20842 affects the web-based management interface of certain router models and could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition.

Cisco says they have no evidence of these bugs being exploited in the wild at present, and that there are no workarounds other than applying the patches available. Inevitably, threat actors will actively seek out businesses that fail to patch, and all Cisco customers are urged to check the list of affected models and patch without delay.

Class Action Targets Experian Over Account Security

/0 Comments/in /by

A class action lawsuit has been filed against big-three consumer credit bureau Experian over reports that the company did little to prevent identity thieves from hijacking consumer accounts. The legal filing cites liberally from an investigation KrebsOnSecurity published in July, which found that identity thieves were able to assume control over existing Experian accounts simply by signing up for new accounts using the victim’s personal information and a different email address.

The lawsuit, filed July 28, 2022 in California Central District Court, argues that Experian’s documented practice of allowing the re-registration of existing Experian accounts without first verifying that the existing account holder authorized the changes violates the Fair Credit Reporting Act.

In July’s Experian, You Have Some Explaining to Do, we heard from two different readers who had security freezes on their credit files with Experian and who also recently received notifications from Experian that the email address on their account had been changed. So had their passwords and account PIN and secret questions. Both had used password managers to pick and store complex, unique passwords for their accounts.

Both were able to recover access to their Experian account simply by recreating it — sharing their name, address, phone number, social security number, date of birth, and successfully gleaning or guessing the answers to four multiple choice questions that are almost entirely based on public records (or else information that is not terribly difficult to find).

Here’s the bit from that story that got excerpted in the class action lawsuit:

KrebsOnSecurity sought to replicate Turner and Rishi’s experience — to see if Experian would allow me to re-create my account using my personal information but a different email address. The experiment was done from a different computer and Internet address than the one that created the original account years ago.

After providing my Social Security Number (SSN), date of birth, and answering several multiple choice questions whose answers are derived almost entirely from public records, Experian promptly changed the email address associated with my credit file. It did so without first confirming that new email address could respond to messages, or that the previous email address approved the change.

Experian’s system then sent an automated message to the original email address on file, saying the account’s email address had been changed. The only recourse Experian offered in the alert was to sign in, or send an email to an Experian inbox that replies with the message, “this email address is no longer monitored.”

After that, Experian prompted me to select new secret questions and answers, as well as a new account PIN — effectively erasing the account’s previously chosen PIN and recovery questions. Once I’d changed the PIN and security questions, Experian’s site helpfully reminded me that I have a security freeze on file, and would I like to remove or temporarily lift the security freeze?

To be clear, Experian does have a business unit that sells one-time password services to businesses. While Experian’s system did ask for a mobile number when I signed up a second time, at no time did that number receive a notification from Experian. Also, I could see no option in my account to enable multi-factor authentication for all logins.

In response to my story, Experian suggested the reports from readers were isolated incidents, and that the company does all kinds of things it can’t talk about publicly to prevent bad people from abusing its systems.

“We believe these are isolated incidents of fraud using stolen consumer information,” Experian’s statement reads. “Specific to your question, once an Experian account is created, if someone attempts to create a second Experian account, our systems will notify the original email on file.”

“We go beyond reliance on personally identifiable information (PII) or a consumer’s ability to answer knowledge-based authentication questions to access our systems,” the statement continues. “We do not disclose additional processes for obvious security reasons; however, our data and analytical capabilities verify identity elements across multiple data sources and are not visible to the consumer. This is designed to create a more positive experience for our consumers and to provide additional layers of protection. We take consumer privacy and security seriously, and we continually review our security processes to guard against constant and evolving threats posed by fraudsters.”

That sounds great, but since that story ran I’ve heard from several more readers who were doing everything right and still had their Experian accounts hijacked, with little left to show for it except an email alert from Experian saying they had changed the address on file for the account.

I’d like to believe this class action lawsuit will change things, but I do not. Likely, the only thing that will come from this lawsuit — if it is not dismissed outright — is a fat payout for the plaintiffs’ attorneys and “free” credit monitoring for a few years compliments of Experian.

Credit bureaus do not view consumers as customers, who are instead the product that is being sold to third party companies. Often that data is sold based on the interests of the entity purchasing the data, wherein consumer records can be packaged into categories like “dog owner,” “expectant parent,” or “diabetes patient.”

A chat conversation between the plaintiff and Experian’s support staff shows he experienced the same account hijack as described by our readers, despite his use of a computer-generated, unique password for his Experian account.

Nevertheless, most lenders rely on the big-three consumer credit reporting bureaus, including Equifax, Experian and Trans Union — to determine everyone’s credit score, fluctuations in which can make or break one’s application for a loan or job.

On Tuesday, The Wall Street Journal broke a story saying Equifax sent lenders incorrect credit scores for millions of consumers this spring.

Meanwhile, the credit bureaus keep enjoying record earnings. For its part, Equifax reported a record fourth quarter 2021 revenue of 1.3 billion. Much of that revenue came from its Workforce Solutions business, which sells information about consumer salary histories to a variety of customers.

The Biden administration reportedly wants to create a public entity within the Consumer Financial Protection Bureau (CFPB) that would incorporate factors like rent and utility payments into lending decisions. Such a move would require congressional approval but CFPB officials are already discussing how it might be set up, Reuters reported.

“Credit reporting firms oppose the move, saying they are already working to provide fair and affordable credit to all consumers,” Reuters wrote. “A public credit bureau would be bad for consumers because it would expand the government’s power in an inappropriate way and its goals would shift with political winds, the Consumer Data Industry Association (CDIA), which represents private rating firms, said in a statement.”

A public credit bureau is likely to meet fierce resistance from the Congress’s most generous constituents — the banking industry — which detests rapid change and is heavily reliant on the credit bureaus.

And there is a preview of that fight going on right now over the bipartisan American Data Privacy and Protection Act, which The Hill described as one of the most lobbied bills in Congress. The idea behind the bill is that companies can’t collect any more information from you than they need to provide you with the service you’re seeking.

“The bipartisan bill, which represents a breakthrough for lawmakers after years of negotiations, would restrict the kind of data companies can collect from online users and the ways they can use that data,” The Hill reported Aug. 3. “Its provisions would impact companies in every consumer-centric industry — including retailers, e-commerce giants, telecoms, credit card companies and tech firms — that compile massive amounts of user data and rely on targeted ads to attract customers.”

According to the Electronic Frontier Foundation, a nonprofit digital rights group, the bill as drafted falls short in protecting consumers in several areas. For starters, it would override or preempt many kinds of state privacy laws. The EFF argues the bill also would block the Federal Communications Commission (FCC) from enforcing federal privacy laws that now apply to cable and satellite TV, and that consumers should still be allowed to sue companies that violate their privacy.

A copy of the class action complaint against Experian is available here (PDF).

Scammers Sent Uber to Take Elderly Lady to the Bank

/0 Comments/in /by

Email scammers sent an Uber to the home of an 80-year-old woman who responded to a well-timed email scam, in a bid to make sure she went to the bank and wired money to the fraudsters.  In this case, the woman figured out she was being scammed before embarking for the bank, but her story is a chilling reminder of how far crooks will go these days to rip people off.

Travis Hardaway is a former music teacher turned app developer from Towson, Md. Hardaway said his mother last month replied to an email she received regarding an appliance installation from BestBuy/GeekSquad. Hardaway said the timing of the scam email couldn’t have been worse: His mom’s dishwasher had just died, and she’d paid to have a new one delivered and installed.

“I think that’s where she got confused, because she thought the email was about her dishwasher installation,” Hardaway told KrebsOnSecurity.

Hardaway said his mom initiated a call to the phone number listed in the phony BestBuy email, and that the scammers told her she owed $160 for the installation, which seemed right at the time. Then the scammers asked her to install remote administration software on her computer so that they could control the machine from afar and assist her in making the payment.

After she logged into her bank and savings accounts with scammers watching her screen, the fraudster on the phone claimed that instead of pulling $160 out of her account, they accidentally transferred $160,000 to her account. They said they they needed her help to make sure the money was “returned.”

“They took control of her screen and said they had accidentally transferred $160,000 into her account,” Hardaway said. “The person on the phone told her he was going to lose his job over this transfer error, that he didn’t know what to do. So they sent her some information about where to wire the money, and asked her to go to the bank. But she told them, ‘I don’t drive,’ and they told her, “No problem, we’re sending an Uber to come help you to the bank.’”

Hardaway said he was out of town when all this happened, and that thankfully his mom eventually grew exasperated and gave up trying to help the scammers.

“They told her they were sending an Uber to pick her up and that it was on its way,” Hardaway said. “I don’t know if the Uber ever got there. But my mom went over to the neighbor’s house and they saw it for what it was — a scam.”

Hardaway said he has since wiped her computer, reinstalled the operating system and changed her passwords. But he says the incident has left his mom rattled.

“She’s really second-guessing herself now,” Hardaway said. “She’s not computer-savvy, and just moved down here from Boston during COVID to be near us, but she’s living by herself and feeling isolated and vulnerable, and stuff like this doesn’t help.”

According to the Federal Bureau of Investigation (FBI), seniors are often targeted because they tend to be trusting and polite. More importantly, they also usually have financial savings, own a home, and have good credit—all of which make them attractive to scammers.

“Additionally, seniors may be less inclined to report fraud because they don’t know how, or they may be too ashamed of having been scammed,” the FBI warned in May. “They might also be concerned that their relatives will lose confidence in their abilities to manage their own financial affairs. And when an elderly victim does report a crime, they may be unable to supply detailed information to investigators.”

In 2021, more than 92,000 victims over the age of 60 reported losses of $1.7 billion to the FBI’s Internet Crime Complaint Center (IC3). The FBI says that represents a 74 percent increase in losses over losses reported in 2020.

The abuse of ride-sharing services to scam the elderly is not exactly new. Authorities in Tampa, Fla. say they’re investigating an incident from December 2021 where fraudsters who’d stolen $700,000 from elderly grandparents used Uber rides to pick up bundles of cash from their victims.

LABScon | Security Research in Real Time – Talks Not To Miss, Part One

/0 Comments/in /by

The speakers are pumped, the stunning venue is primed, and the guest list is (almost) complete. For the inaugural LABScon, the program committee has worked tirelessly on an incredible agenda showcasing fresh research from some of the sharpest minds in the industry.

LABScon, a SentinelLabs event presented by SentinelOne, will take place over three days from September 21-24th, showcasing bleeding-edge research into cyber threat actors, malware hunting techniques, vulnerabilities, exploits, and tools from the best cybersecurity researchers on the planet.

Hosted at Arizona’s premier resort, The Phoenician, LABScon is an intimate, invite-only conference. Want to know what’s going on and who else will be there? Here’s a first look showcasing the LABScon 2022 speaker lineup and some of the topics we are most excited about.

Who’s Speaking at LABScon

Arrival day will kick off with a casual and candid conversation between former Director of CISA and co-founder of Krebs Stamos Group, Chris Krebs and Thomas Rid, founding director of the Alperovitch Institute for Cybersecurity Studies at Johns Hopkins SAIS, to welcome guests and set the tone for the conference. The LABScon Keynote day will include distinguished speakers like Dmitiri Alperovitch, head of the Silverado Policy Accelerator, and co-founder of CrowdStrike, and veteran security journalist and author Kim Zetter.

In an homage to the foundations of malware analysis, we are honored to host Mark Russinovich, CTO of Microsoft Azure, as he shares the secret history of the essential SysInternals suite of tools we all use and love.

And that’s just for starters! There’s an exciting program with more than 30 talks and workshops at LABScon, packed into three full days of education, entertainment, and collaboration. The list of confirmed speakers for LABScon is already available here. Just keep an eye on the #LABScon Twitter feed for ongoing speaker and agenda updates.

In the meantime, enjoy this sneak peek at what’s on offer. Below, we proudly spotlight a selection from the presentations and workshops we have lined up to give you a flavor of what to expect at LABScon 2022.

Is CNVD ≥ CVE? A Look at Chinese Vulnerability Discovery and Disclosure – Kristin Del Rosso (Sophos)

The US is still lagging behind China in terms of vulnerability discovery and disclosure. While the gap between the US National Vulnerability Database (NVD) and the Chinese NVD (CNNVD) has slightly shrunk over the last 5 years, there are still hundreds of vulnerabilities registered in China that are yet to be listed on the US NVD. The CNNVD is a known subsidiary of the Chinese Ministry of State Security’s Technical Bureau, which drives Chinese cyber espionage, and has a history of altering CVE disclosure dates and providing APT groups with exploits.

This talk will walk through the discovery of a CNVD that is not listed on the US NVD, and the larger picture behind the discovery and disclosure of vulnerabilities in China. This will cover how and where they are sourced, including a newly discovered sourcing event, the scope of disparity between US and Chinese vulnerability reporting, and how researchers can proactively hunt to close this knowledge gap between US and Chinese CVEs.

Demystifying Threats to Satellite Communications in Critical Infrastructure – MJ Emanuel – CISA

Satellite communications are an integral part of many industrial control systems across many sectors, but their usage, specifically in critical infrastructure, continues to be misunderstood by the industry. While there have been multiple investigations into vulnerabilities and exploitation methods of satellite systems, less attention has been given to threat vectors and how they impact the environments that rely on them – much buzz was generated by the Viasat outages in February and their effect on European wind turbines, but not on how much the service disruption impacted these systems. Furthermore, a lot of guidance into securing satellite communication systems focuses heavily on military applications, which can have different architectures and needs than those deployed in critical infrastructure networks.

Drawing on lessons learned from recent incident responses involving satellite companies and systems, this talk will cover the basics of how different sectors rely on satellite communications, trust relationships of the satellite provider ecosystem that could be potentially abused by threat actors, how various attack methods could impact infrastructure processes, and potential detection methods of abuse.

Breaking Firmware Trust From The Other Side: Exploiting Early Boot Phases (Pre-Efi) – Alex Matrosov (Binarly)

Vulnerabilities in System Management Mode (SMM) and more general UEFI applications/drivers (DXE) are receiving increased attention from security researchers. Over the last 12 months, the Binarly efiXplorer team disclosed 107 high-impact vulnerabilities related to SMM and DXE firmware components. But newer platforms have significantly increased the runtime mitigations in the UEFI firmware execution environment (including SMM). The new Intel platform firmware runtime mitigations reshaped the attack surface for SMM/DXE with new Intel Hardware Shield technologies applied below-the-OS.

The complexity of the modern platform security features is growing every year. The general security promises of the platform consist of many different layers defining their own security boundaries. Unfortunately, in many cases, these layers may introduce inconsistencies in mitigation technologies and create room for breaking general security promises, allowing for  successful attacks.

In this presentation, we will share our work exploring recent changes in the UEFI firmware security runtime using one of the most recent Intel CPUs as an example. The  presentation will cover the evolution of firmware mitigations in SMM/DXE on x86-based CPUs and a discussion about  the new attacks on Intel Platform Properties Assessment Module (PPAM), which are often used in tandem with Intel SMI Transfer Monitor (STM).

These topics have never been publicly discussed from the offensive security research perspective.

Whose Router Is It Anyway? – Danny Adamitis (Black Lotus Labs)

Black Lotus Labs, the threat intelligence division within Lumen Technologies, is currently tracking elements of a sophisticated campaign that has been leveraging infected SOHO routers to target North American and European networks of interest undetected for nearly two years. We identified a multistage remote access trojan (RAT), dubbed ZuoRat, developed for SOHO devices that grants the actor the ability to pivot into the local network and gain access to additional systems on the LAN by hijacking network communications to maintain a foothold.

Chasing Shadows: The Rise Of A Prolific Espionage Actor – Kris McConkey (PwC UK)

The proliferation of tooling such as ShadowPad across China-based APT actors and the existence of digital quartermasters has long been a feature of public reporting and a strong indication of ultimate actor sponsorship, based on US indictments and adjacent research.

One of these actors, however, stands out for its technical capabilities, rapid operational tempo, and global reach. Red Scylla combines access to shared tools with sophisticated custom capabilities, aggressive scanning of targets across the globe, and substantial resources, enabling it to compromise public and private sector victims spanning three continents. This talk will detail the rise and operations of a dominant player in the international corporate espionage world.

InkySquid: The Missing Arsenal – Paul Rascagneres (Volexity)


InkySquid (aka Group123, APT37) is an infamous threat actor linked to North Korea that has been active for at least 10 years. This actor is known to use social engineering in order to breach targets and exploit n-day vulnerabilities in Hangul Word Processor (HWP), as well as browser-based technologies. One of the most documented intrusion sets used by this actor is RoKRAT, a Windows RAT using cloud providers as C2 servers. In this presentation, attendees will learn about an undocumented macOS port of RoKRAT. Paul will describe the internal mechanisms and different espionage features of the malware, as well as built-in attempts to bypass macOS security features and embedded exploit code based on n-day exploits.

Request an Invite

There are still a limited number of tickets available, so if you haven’t yet requested your invite, now is the time to push that button.

CISO Insights | How to Get the Most Out of XDR

/0 Comments/in /by

Extended Detection and Response (XDR) has generated a lot of buzz in recent times with security practitioners, analysts, and the vendor community. According to the Gartner Hype CycleTM for Security Operations, 2022, XDR is at peak market interest, promising to deliver significant security visibility and response improvements to threat exposures.

XDR promises to reduce complexity and cost while improving incident response and remediation, and increasing productivity. With so much to gain, it’s not surprising that these benefits have at times met with some over-zealous marketing, leaving CISOs and other interested buyers with the unenviable task of sorting through the messaging to understand the true benefits.

Analysts and industry pundits say the potential of XDR is that it can make good on unmet security promises, like those made by SIEM (security information and event management) platforms, accelerating how security teams detect, investigate, and remediate threats with greater productivity and lower ownership costs.

And while many companies are interested in adopting XDR, what should organizations consider as they research the growing number of solutions in the market? Here are three key insights from CISOs we interviewed to help you prioritize as you look to adopt XDR.

Start With an XDR Solution With Roots in EDR

“I want to replicate what is working with EDR to other areas in my organization.”

As we talked to different CISOs, one common insight we heard for implementing XDR was extending what works currently in their organization to other attack surfaces–XDR that is based on a solid EDR foundation and all the benefits that brings. That means, for example, drawing on EDR’s high-fidelity telemetry to provide critical supporting data from endpoints, as well as the real-time detection and remediation capabilities of EDR.

However, XDR extends beyond endpoint protection to providing detection and response coverage across the entire organization. This means that it provides greater visibility and more context into threats. The high fidelity telemetry that makes EDR so valuable and provides vital supporting data from endpoints, is now available from more sources.

Good EDRs offer real-time behavioral detection and remediation, which can be deployed more broadly across the organization with XDR. Alerts that might otherwise have been missed at an early stage can now be identified earlier and remediated before they have a significant impact. And it is easier to get a more complete understanding of what is happening within the whole enterprise security estate.

Choose an XDR That Increases SecOps Efficiency

“One of our key objectives this year is to improve security productivity with built-in controls.”

Look for an XDR solution that increases SecOps efficiency with various built-in integrations that extend functionality and lighten the burden on taxed security teams.

Cybersecurity analysts are already overloaded and the situation is likely to get worse as threats increase, tools proliferate and the skills shortage continues to negatively impact the efficacy of security operations practitioners. That’s why it’s important to have a tool that automatically correlates related activity into unified alerts, which drastically simplifies the task for analysts. Central to the above points is automation. It’s crucial to maximizing the value of your existing tools and to unburdening the SOC team. Automation can improve threat detection, triage and response.

For example, with SentinelOne’s threat intelligence integration, threats are auto enriched from various sources, enabling customers to accelerate threat investigation and triage capabilities. Customers can also make use of an extensive library of threat hunting queries curated by SentinelOne research which continually evaluates the latest methodologies to uncover new IOCs and Tactics, Techniques, and Procedures (TTPs).

And all of this can be consolidated into fewer alerts, which reduces the strain on security teams. For example, in the 2022 MITRE Engenuity’s ATT&CK Evaluation, which tested leading XDR solutions against a range of benchmarks, SentinelOne’s Singularity XDR consolidated two days of continuous testing into just nine campaign-level console alerts. This demonstrates the ability to alleviate SOC burdens by using machine speed to correlate and contextualize large numbers of alerts. In the end, fewer alerts, fewer clicks and fewer screens mean increased SOC efficiency.

Invest in an XDR That Maximizes Existing Security Investments

“You are ONE of the many solutions that my SOC uses. Do you play nice with others?”

A strong XDR solution helps maximize the value of your security investments. While a closed XDR requires the vendor to supply all the required sensors for typical use cases, an open XDR concentrates on backend analytics and workflow and integrates with the organization’s existing security controls.

That makes sense because many organizations have tools and technologies deployed in their SOC that it would be wasteful to simply decommission. These best-in-breed technologies provide point solution coverage and each comes with a steep learning curve and operational burden for SecOps efficiency. Switching those out for a new tool simply starts you on another learning curve with a new burden. XDR can allow you to make use of these existing tools, connecting them through simple built-in integrations.

SentinelOne’s Singularity Marketplace makes it easy to add integrations to third-party systems such as SIEM or SOAR solutions, with just a few clicks. Email, identity management systems, cloud services and other third-party systems can all be brought into the XDR system, which is a huge improvement on having to secure each one individually and use a different dashboard to manage alerts. These integrations can then be enabled and automated without the need to write complex code.

On top of these benefits is a lower total cost of ownership for the organization. XDR expands the powerful capability to the entire connected ecosystem of security tools across the enterprise. Automated response actions now extend to third-party applications. For example, you can force step-up authentication in your identity management tools when the system detects suspicious behavior. Users will then be asked to submit additional forms of authentication. And you can automatically block email or web connectivity for suspicious resources or users based upon pre-defined rules and triggers. Automated one-click responses serve to reduce adversary dwell time and contain threats quickly.

Seeing Beyond the Buzz for Measurable Outcomes

When choosing an XDR, CISOs need to look beyond the buzz and focus on what really matters: the outcomes it can deliver. Identifying KPIs not only helps to determine the effectiveness of tools and processes but also to communicate that effectiveness to the leadership and board. Cybersecurity is not always something the board understands, but the leadership will be aware of the growing risk of attacks and will want to know that their defenses are aligned with the company’s risk profile and appetite.

XDR can improve common KPIs because of its faster, deeper and more effective threat detection and response than individual, disparate tools like EDR and SIEM. Drawing on a wider range of sources means that XDR can improve Mean Time to Detect (MTTD). XDR’s central source of information and more manageable alert workload helps to reduce Mean Time to Investigate (MTTI) by accelerating triage and reducing time to investigate and scope. XDR’s simple, fast and relevant automation reduces Mean Time to Respond (MTTR) by enabling simple, fast, and relevant automations to quickly contain threats.

Of course, the board is not just concerned with the effectiveness of cybersecurity measures. Its members have to worry about budgets, too. It can sometimes seem as if CISOs are constantly asking for the money to add yet more tools, so XDR’s ability to reduce total cost of ownership is welcome. AI and automation mean that security analysts carry less of a burden, which means they can work more efficiently and be more productive.

While it can sometimes be difficult to know how much difference a security tool or platform is making, XDR delivers clear, measurable benefits. It helps reduce costs, increases efficiency and improves visibility across the entire cyber security estate.

Parting Thoughts

The world of cybersecurity is constantly changing and it is often wise to be skeptical about new trends. However, XDR is more than a new trend. It is a new way of thinking about security – a platform that can be deployed to make an organization fit for the modern challenges in the ever-evolving cybersecurity landscape. With teams short of staff and those staff overwhelmed by alerts and drowning in data, a new approach is long overdue. XDR goes beyond the latest marketing buzzwords to deliver meaningful impact for organizations of every size. It is an essential part of the future of the modern SOC.

If you’d like to read more about CISO insights to help you with XDR adoption, read the 5 CISO Best Practices Whitepaper.

To learn more about how the SentinelOne Singularity platform can help your organization achieve these goals, contact us for more information or request a free demo.

SentinelOne Singularity XDR
Supercharge. Fortify. Automate. Extend protection with unfettered visibility, proven protection, and unparalleled response. Discover the power of autonomous with Singularity XDR.

Learn More

No SOCKS, No Shoes, No Malware Proxy Services!

/0 Comments/in /by

With the recent demise of several popular “proxy” services that let cybercriminals route their malicious traffic through hacked PCs, there is now something of a supply chain crisis gripping the underbelly of the Internet. Compounding the problem, several remaining malware-based proxy services have chosen to block new registrations to avoid swamping their networks with a sudden influx of customers.

Last week, a seven-year-old proxy service called 911[.]re abruptly announced it was permanently closing after a cybersecurity breach allowed unknown intruders to trash its servers and delete customer data and backups. 911 was already akin to critical infrastructure for many in the cybercriminal community after its top two competitors — VIP72 and LuxSocks — closed or were shut down by authorities over the past 10 months.

The underground cybercrime forums are now awash in pleas from people who are desperately seeking a new supplier of abundant, cheap, and reliably clean proxies to restart their businesses. The consensus seems to be that those days are now over, and while there are many smaller proxy services remaining, few of them on their own are capable of absorbing anywhere near the current demand.

“Everybody is looking for an alternative, bro,” wrote a BlackHatForums user on Aug. 1 in response to one of many “911 alternative” discussion threads. “No one knows an equivalent alternative to 911[.]re. Their service in terms of value and accessibility compared to other proxy providers was unmatched. Hopefully someone comes with a great alternative to 911[.]re.”

NEW SOCKS, SAME OLD SHOES

Among the more frequently recommended alternatives to 911 is SocksEscort[.]com, a malware-based proxy network that has been in existence since at least 2010. Here’s what part of their current homepage looks like:

The SocksEscort home page says its services are perfect for people involved in automated online activity that often results in IP addresses getting blocked or banned, such as Craigslist and dating scams, search engine results manipulation, and online surveys.

But faced with a deluge of new signups in the wake of 911’s implosion, SocksEscort was among the remaining veteran proxy services that opted to close its doors to new registrants, replacing its registration page with the message:

“Due to unusual high demand, and heavy load on our servers, we had to block all new registrations. We won’t be able to support our proxies otherwise, and close SocksEscort as a result. We will resume registrations right after demand drops. Thank you for understanding, and sorry for the inconvenience.”

According to Spur.us, a startup that tracks proxy services, SocksEscort is a malware-based proxy offering, which means the machines doing the proxying of traffic for SocksEscort customers have been infected with malicious software that turns them into a traffic relay.

Spur says SocksEscort’s proxy service relies on software designed to run on Windows computers, and is currently leasing access to more than 14,000 hacked computers worldwide. That is a far cry from the proxy inventory advertised by 911, which stood at more than 200,000 IP addresses for rent just a few days ago.

Image: Spur.us

SocksEscort is what’s known as a “SOCKS Proxy” service. The SOCKS (or SOCKS5) protocol allows Internet users to channel their Web traffic through a proxy server, which then passes the information on to the intended destination. From a website’s perspective, the traffic of the proxy network customer appears to originate from a rented/malware-infected PC tied to a residential ISP customer, not from the proxy service customer.

These services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they make it difficult to trace malicious traffic to its original source.

The disruption at 911[.]re came days after KrebsOnSecurity published an in-depth look at the long-running proxy service, which showed that 911 had a history of incentivizing the installation of its proxy software without user notice or consent, and that it actually ran some of these “pay-per-install” schemes on its own to guarantee a steady supply of freshly-hacked PCs.

That story also showed once again that the people who are building and leasing these botnets are surprisingly easy to identify in real life, particularly given that they operate malware-based anonymity services that enable a great deal of cybercrime activity.

Such was the case again with SocksEscort. Hilariously, the common link that exposed the real-life identities of the people running this SOCKS service was that they all worked for the same online shoe store.

ANGRY CODERS

SocksEscort[.]com was originally registered to the email address “michdomain@gmail.com,” which according to DomainTools.com was used to register a handful of related domains, including its previous incarnation — super-socks[.]biz. Cached versions of the site show that in 2010 the software which powers the network was produced with a copyright of “Escort Software.”

Super-socks[.]biz came online around the same time as another domain registered to that “michdomain” email: ip-score[.]com, which soon became shorthand on several cybercrime forums for a service that could tell visitors whether their Internet address  — or more precisely, the proxy they were using —  was flagged by any security software or services as compromised or malicious.

IP-score offered a revenue sharing program for websites that chose to embed its IP-scoring code, and the copyright on that userbar program was “Angry Coders.”

A copy of ip-score.com, as indexed by Archive.org.

A review of the Internet addresses historically used by Super-socks[.]biz and SocksEscort[.]com reveals that these domains at various times over the years shared an Internet address with a small of other domains, including angrycoders[.]net, iskusnyh[.]pro, and kc-shoes[.]ru.

Cached copies of angrycoders[.]net from the Wayback Machine don’t reveal much about this particular group of irate programmers, but a search on the domain brings up several now-dormant listings for an Angry Coders based in Omsk, a large city in the Siberian region of Russia. The domain was registered in 2010 to an Oleg Iskushnykh from Omsk, who used the email address iboss32@ro.ru.

According to Constella Intelligence [currently an advertiser on KrebsOnSecurity], Oleg used the same password from his iboss32@ro.ru account for a slew of other “iboss” themed email addresses, one of which is tied to a LinkedIn profile for an Oleg Iskhusnyh, who describes himself as a senior web developer living in Nur-Sultan, Kazakhstan.

Iskusnyh’s Github profile shows he has contributed code to a number of online payment-related technologies and services, including Ingenico ePayments, Swedbank WooCommerce, Mondido Payments, and Reepay.

DON’T JUDGE A MAN UNTIL YOU’VE WALKED A MILE IN HIS SOCKS

The various “iboss” email accounts appear to have been shared by multiple parties. A search in Constella’s database of breached entities on “iboss32@gmail.com” reveals someone using the name Oleg Iskusnyh registered an online profile using a phone number in Bronx, New York. Pivoting on that phone number — 17187154415 — reveals a profile exposed in the breach at sales intelligence firm Apollo with the first name “Dmitry” who used the email address chepurko87@gmail.com.

That email is connected to a LinkedIn profile for a Dmitry Chepurko in Pavlodar, Kazakhstan. Chepurko’s resume says he’s a full stack developer, who most recently worked in the Omsk offices of a German shoe company called KC Shoes (the aforementioned kc-shoes.ru]. Chepurko’s resume says before that he worked on his own for a decade using the freelancing platform Upwork.

The Upwork profile listed in Chepurko’s LinkedIn C.V. is no longer active. But that same now-defunct Upwork account link is still listed as the profile of a “Dmitry C.” in an UpWork profile page for the Angry Coders team in Omsk, Russia.

The UpWork profile page for the Angry Coders programming team from Omsk, RU.

Who is the “Alexander S.” listed above under the “Agency members” heading in the Upwork profile for Angry Coders? Historical DNS records from Farsight Security show angrycoders.net formerly included the subdomain “smollalex.angrycoders[.]net”.

A simple Internet search on “kc-shoes” reveals a Github account for a user from Omsk with the first name Alexander and the account name “Smollalex.” Alexander’s Github account indicates he has contributed code to the kc-shoes website as well.

Constella’s service shows that “Smollalex” was a favorite handle chosen by an Alexandr Smolyaninov from Omsk. The Smollalex Github account associates this individual with a company in Omsk that sells parts for oil and gas pipelines.

That shoes are apparently the common link among the Angry Coders responsible for SocksEscort is doubly amusing because — at least according to the posts on some cybercrime forums — one big reason people turn to these proxy services is for “shoe botting” or “sneaker bots,” which refers to the use of automated bot programs and services that aid in the rapid acquisition of limited-release, highly-sought-after designer athletic shoes that can then be resold at huge markups on secondary markets.

It’s not clear if the Angry Coders team members remain affiliated with SocksEscort; none of them responded to requests for comment. There were certain connections made clear throughout the research mentioned above that the Angry Coders outsourced much of the promotion and support of their proxy service to programmers based in India and Indonesia, where apparently a large chunk of its customers currently reside.

Further reading:

July 29, 2022: 911 Proxy Service Implodes After Disclosing Breach

July 28, 2022: Breach Exposes Users of Microleaves Proxy Service

July 18, 2022: A Deep Dive Into the Residential Proxy Service ‘911’

June 28, 2022: The Link Between AWM Proxy & the Glupteba Botnet

June 22, 2022: Meet the Administrators of the RSOCKS Proxy Botnet

Sept. 1, 2021: 15-Year-Old Malware Proxy Network VIP72 Goes Dark

The Good, the Bad, and the Ugly in Cybersecurity – Week 31

/0 Comments/in /by

The Good

The U.S. State Department is offering up to $10 million to people who offer tips that help law enforcement investigate and disrupt state-sponsored threat actor groups.

This week, the State Department’s official Rewards for Justice Twitter account announced an increase in reward money offered to people who come forward with information on members or individuals affiliated with state-sponsored threat groups. The tweet specifically called out Andariel, APT38, Bluenoroff, Guardians of Peace, Kimsuky, and Lazarus Group, as well as any groups that “are involved in targeting critical U.S. infrastructure in violation of the Computer Fraud and Abuse Act.”

These increases reflect the U.S. government’s growing scrutiny on state-sponsored threat actors in North Korea, which have previously attacked cryptocurrency exchanges, financial institutions, and most recently healthcare organizations. The State Department first issued a $5 million bounty for information that would disrupt North Korean cyber criminal activities in April 2020, before issuing another call to action in March of 2022, when DPRK-sponsored threat actors launched a series of attacks to fund the North Korean government’s operations.

In light of other successful operations to disrupt international cyber criminals, it’s encouraging to see the U.S. government turn its attention to such notorious threat actors.

The Bad

On Tuesday, NetStandard, a Kansas-based MSP, suffered a cyber attack which forced the company to shut down its cloud-based services.

In an email to its customers, NetStandard disclosed that they had detected signs of a cyber attack in the environment for its MyAppsAnywhere cloud services, which include Hosted GP, Hosted CRM, Hosted Exchange, and Hosted SharePoint services.

Although the email also assured MyAppsAnywhere customers that none of NetStandard’s other services were impacted at the time of publication, NetStandard’s website was temporarily shut down following the incident. After they initially detected signs of an attack, the NetStandard team shut down their MyAppsAnywhere services, created an active incident bridge to stop attackers from causing more damage, and immediately contacted their insurance provider to find a third-party cybersecurity firm to provide remediation support and restore NetStandard’s services.

Since the initial disclosure, NetStandard has not provided public-facing updates to non-customers about the outages. However, security researchers believe that NetStandard was likely hit by ransomware, since ransomware operators like the REvil ransomware gang have previously threatened MSPs for their client base. By compromising the MSP’s clients, threat actors can extort multiple targets and increase the amount of money they gain and damage they can cause.

MSPs play a valuable role in keeping small and medium-sized businesses up and running, and it’s incredibly unfortunate that threat actors are targeting providers like NetStandard to reach a large number of smaller businesses. As the U.S. government continues to warn MSPs that they are at risk, we encourage MSPs to adopt recommended best practices to secure their environments and their customer data.

The Ugly

A private sector offensive actor (PSOA) has uncovered and used multiple Windows zero-day exploits in targeted cyber attacks.

In a recent report, researchers from Microsoft’s MSTIC identified the actor behind a cluster of threat activity it tracks as ‘KNOTWEED’ as being DSIRF, an Austria-based surveillance outfit that made the news for developing and selling Subzero, a malware toolkit that targets phones, computers and other internet-connected devices.

DSIRF, the report says, deployed Subzero in attacks targeting Microsoft customers in Europe and Central America, including banks, law firms, and strategic consultancies. In particular, DSIRF exploited CVE-2021-31199 and CVE-2021-31201, two Windows privilege escalation exploits, prior to their being patched in 2021. A third Windows privilege escalation vulnerability, later patched as CVE-2021-36948, was also used to drop Subzero malware. The researchers found that attack chain involved a malicious DLL signed by ‘DSIRF GmbH’.

Unlike other private sector offensive actors, DSIRF appear to run both access-as-a-service and hack-for-hire operations. In access-as-a-service, the actor sells full end-to-end hacking tools that can be used by the purchaser in operations, with the PSOA not involved in any targeting or running of the operation. In hack-for-hire, detailed information is provided by the purchaser to the PSOA, who then runs the targeted operations. Based on observed attacks and news reports, MSTIC believes that DSIRF may blend these models.

The private sector offensive actor space has been a cause of concern for some time now, with this just the latest of multiple cases coming to light of their involvement in areas that go far beyond their stated remit of aiding and abetting law enforcement agencies in pursuit of terrorist or criminal enterprises. Attacks on civil rights campaigners, dissidents, journalists and legitimate political opponents are increasingly being supported or undertaken by PSOA products or personnel.