ESET descobre malware que assume o controle total da comunicação por e-mail

By: TI Inside Online

A ESET descobriu o LightNeuron, um backdoor do Microsoft Exchange que pode ler, modificar ou bloquear qualquer e-mail que passe pelo servidor, incluindo escrever novas mensagens e enviá-las ,sob a identidade de qualquer usuário legítimo da escolha dos invasores. O malware é controlado remotamente por meio de anexos em formato PDF e JPG ocultos em mensagens recebidas pelos usuarios.

O LightNeuron atende aos servidores de e-mail Microsoft Exchange pelo menos desde 2014. Os pesquisadores da ESET identificaram três organizações diferentes vítimas da ameaça, incluindo um ministério de relações exteriores em um país da Europa Oriental e uma organização diplomática regional no Oriente Médio. No Brasil, no entanto, não se tem conhecimento ainda de qual organização teria sido afetada.

O LightNeuron é o primeiro malware conhecido a usar incorretamente o mecanismo do Microsoft Exchange. “Na arquitetura do servidor de e-mail, o LightNeuron pode operar com o mesmo nível de confiança que os produtos de segurança, como filtros de spam. Como resultado, esse malware oferece ao invasor controle total sobre o servidor de e-mail e, portanto, sobre toda a comunicação do usuário”, explica Matthieu Faou, pesquisador de malware da ESET que conduziu a investigação.

Os pesquisadores da ESET coletaram evidências sugerindo que o LightNeuron pertence ao grupo de espionagem Turla, também conhecido como Snake. Este grupo e suas atividades são amplamente investigados pela ESET. “Acreditamos que os profissionais de segurança de TI devem estar cientes dessa nova ameaça”, diz Faou.

Para fazer com que os e-mails de comando e controle (C&C) pareçam inocentes, o LightNeuron usa esteganografia para ocultar seus comandos em imagens PDF ou JPG válidas. A capacidade de controlar a comunicação por e-mail torna o LightNeuron uma ferramenta perfeita para vazar documentos e também para controlar outras máquinas locais por meio de um mecanismo de C&C, o que é muito difícil de detectar e bloquear.

Mais: http://tiinside.com.br/tiinside/13/05/2019/

 

‘LightNeuron’ backdoor receives secret commands via Microsoft Exchange email servers; Russian link suspected

By: Bradley Barth

Researchers have uncovered what they say is the very first malware to achieve persistence in Microsoft Exchange email servers, which allows attackers to secretly execute commands via malicious emails featuring attachments with hidden code.

Dubbed LightNeuron, the furtive backdoor has been targeting Exchange servers since at least 2014, according to a blog post from ESET, whose researchers have provisionally linked the threat to the Russian cyber espionage group Turla. ESET discovered the backdoor on three victims: an unidentified Brazilian organization, a Ministry of Foreign Affairs in Eastern Europe and a regional diplomatic organization in the Middle East.

In addition to the confirmed Windows-based version, ESET believes there may be a Linux variant in use as well, based on artifacts turned up during its investigation.

The key to LightNeuron’s persistence technique is its ability to leverage “transport agents,” which according to Microsoft are tools that let users install custom software on Exchange servers and then process email messages that pass through the transport pipeline. These Transport Agents are granted the same level of trust as spam filters and other security products, ESET explains, which makes a successful infection all the more dangerous and hard to detect.

Using XML-based rules, a LightNeuron Transport Agent can interfere with a victim’s emails in a variety of ways — blocking them; composing and sending new ones; modifying their content, subjects and recipients; replacing attachments and more.

But the attackers’ can do much more than alter emails. They can also send commands via the compromised Exchange program, enabling them to write executables, launch executables and processes, delete or exfiltrate sensitive files and essentially control local machines via its command-and-control infrastructure.

To achieve this, the attackers simply send an email with a specially crafted PDF document or JPG image to any email address belonging to the infected organization. The commands inside these attached documents are hidden using steganography techniques.

“Once an email is recognized as a command email, the command is executed and the email is blocked directly on the Exchange server. Thus, it is very stealthy and the original recipient will not be able to view it,” states the blog post, authored by ESET researcher Matthieu Faou. Faou also penned an accompanying white paper that further details the threat.

More: https://www.scmagazine.com/home/security-news/lightneuron-backdoor

Vodafone Found Hidden Backdoors in Huawei Equipment

By: Daniele Lepido

 

While the carrier says the issues found in 2011 and 2012 were resolved at the time, the revelation may further damage the reputation of a Chinese powerhouse.

For months, Huawei Technologies Co. has faced U.S. allegations that it flouted sanctions on Iran, attempted to steal trade secrets from a business partner and has threatened to enable Chinese spying through the telecom networks it’s built across the West.

 Now Vodafone Group Plc has acknowledged to Bloomberg that it found vulnerabilities going back years with equipment supplied by Shenzhen-based Huawei for the carrier’s Italian business. While Vodafone says the issues were resolved, the revelation may further damage the reputation of a major symbol of China’s global technology prowess.

Europe’s biggest phone company identified hidden backdoors in the software that could have given Huawei unauthorized access to the carrier’s fixed-line network in Italy, a system that provides internet service to millions of homes and businesses, according to Vodafone’s security briefing documents from 2009 and 2011 seen by Bloomberg, as well as people involved in the situation.

Vodafone asked Huawei to remove backdoors in home internet routers in 2011 and received assurances from the supplier that the issues were fixed, but further testing revealed that the security vulnerabilities remained, the documents show. Vodafone also identified backdoors in parts of its fixed-access network known as optical service nodes, which are responsible for transporting internet traffic over optical fibers, and other parts called broadband network gateways, which handle subscriber authentication and access to the internet, the people said. The people asked not to be identified because the matter was confidential.

More: https://www.bloomberg.com/news/articles/2019-04-30/vodafone-found-hidden-backdoors-in-huawei-equipment

OnePlus Left A Backdoor That Allows Root Access Without Unlocking Bootloader

By: sikur

Capturar

by Swati Khandelwal

November 13, 2017

Another terrible news for OnePlus users.

Just over a month after OnePlus was caught collecting personally identifiable information on its users, the Chinese smartphone company has been found leaving a backdoor on almost all OnePlus handsets.

A Twitter user, who goes by the name “Elliot Anderson” (named after Mr. Robot’s main character), discovereda backdoor (an exploit) in all OnePlus devices running OxygenOS that could allow anyone to obtain root access to the devices.

The application in question is “EngineerMode,” a diagnostic testing application made by Qualcomm for device manufacturers to easily test all hardware components of the device.

This APK comes pre-installed (accidentally left behind) on most OnePlus devices, including OnePlus 2, 3, 3T, and the newly-launched OnePlus 5. We can confirm its existence on the OnePlus 2, 3 and 5.

You can also check if this application is installed on your OnePlus device or not. For this, simply go to settings, open apps, enable show system apps from top right corner menu (three dots) and search for EngineerMode.APK in the list.

MORE: https://thehackernews.com/2017/11/oneplus-root-exploit.html

Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist

Gazer: A New Backdoor Targets Ministries and Embassies Worldwide

By: sikur

By 

backdoor-malwareSecurity researchers at ESET have discovered a new malware campaign targeting consulates, ministries and embassies worldwide to spy on governments and diplomats.

Active since 2016, the malware campaign is leveraging a new backdoor, dubbed Gazer, and is believed to be carried out by Turla advanced persistent threat (APT) hacking group that’s been previously linked to Russian intelligence.

Gazer, written in C++, the backdoor delivers via spear phishing emails and hijacks targeted computers in two steps—first, the malware drops Skipper backdoor, which has previously been linked to Turla and then installs Gazer components.

MORE: https://thehackernews.com/2017/08/gazer-backdoor-malware.html?m=1

Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist

Malware campaign targets Russian-Speaking companies with a new Backdoor

By: sikur

By Pierluigi Paganini

Trend Micro spotted a new espionage campaign that has been active for at least 2 months and that is targeting Russian-speaking firms with a new backdoor

Security experts at Trend Micro have spotted a new cyber espionage campaign that has been active for at least two months and that is targeting Russian-speaking enterprises delivering a new Windows-based backdoor, Trend Micro warns.

The hackers leverage on many exploits and Windows components to run malicious scripts to avoid detection. The last sample associated with this attack was uploaded to VirusTotal on June 6, 2017 and experts at Trend Micro observed five spam campaigns running from June 23 to July 27, 2017.

MORE: http://securityaffairs.co/wordpress/61906/hacking/backdoor-target-russian-speaking-firm.html

 

Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist

Russian Hackers Have Used the Same Backdoor for Two Decades

By: sikur

Russia3 

By ANDY GREENBERG  

Date: 04.03.17

ABOUT A YEAR ago, the two-decade-old trail of a group of Russian hackers led Thomas Rid to a house in the quiet London suburb of Hartley Wintney. Rid, a cybersecurity-focused political science professor and historian, wrote a long-shot email to David Hedges, a 69-year-old retired IT consultant who lived there. Rid wanted to know if Hedges might somehow still possess a very specific, very old chunk of data: the logs of a computer Hedges had used to run a website for one of his clients in 1998. Back then, Russian spies had commandeered it, and used it to help run one of the earliest mass-scale digital intrusion campaigns in computing history.

A few weeks later, Hedges answered as if he’d almost been expecting the request: The ancient, beige, HP 9000 computer that the Russians had hijacked was still sitting under his office desk. Its logs were stored on a Magneto optical drive in his home safe. “I’d always thought this might be interesting one day,” Hedges says. “So I put it in my safe and forgot about it until Thomas rang me.”

Over the months since then, Rid and a team of researchers from King’s College and the security firm Kaspersky have pored over Hedges’ data, which recorded six months of the Russian hackers’ moves as they breached dozens of American government and military agencies—a history-making series of intrusions that’s come to be known as Moonlight Maze. In research they’re presenting at the Kaspersky Security Analyst Summit Monday, they argue that their archaeological hacker excavation reveals more than just a digital museum piece from the dawn of state cyberespionage. The researchers say they’ve found a piece of vintage malicious code in that trove that survives today, as part of the arsenal of a modern-day team of Russian hackers—believed to have Kremlin ties—known as Turla. And they suggest that contemporary hacking team—though mutated and evolved through the years—could be the same one that first appeared in the late 90s, making it one of the longest-lived cyberespionage operations in history.

MORE: https://www.wired.com/2017/04/russian-hackers-used-backdoor-two-decades/

Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist

Hacker Shows How Easy It Is To Hack People While Walking Around in Public

By: sikur

evil-twin-wifi-hackingWi-Fi enabled devices — widely known as the Internet of Things (IoT) — are populating offices and homes in greater and greater numbers.

From smartphones to connected printers and even coffee makers, most of these IoT devices have good intentions and can connect to your company’s network without a problem.

However, as the Internet of Things (IoT) devices are growing at a great pace, they continue to widen the attack surface at the same time, giving attackers a large number of entry points to affect you some or the other way.

The attackers can use your smart devices to gain backdoor entry to your network, giving them the capability to steal sensitive data, such as your personal information, along with a multitude of other malicious acts.

MORE: http://thehackernews.com/2017/02/hacking-in-public.html?m=1

By  – Entrepreneur, Hacker, Speaker, Founder and CEO — The Hacker News and The Hackers Conference
Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist Lorep ipsum Lorep ipsum, journalist