By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

Head for the hills, folks! It’s not often that we cover security here, but serious times call for serious talk. There is a trojan called Trickbot, and it is one of the stealthiest malware threats in recent memory. Doesn’t help that it is going after anything and everything that crosses its path. And to make matters worse, this is a rapidly evolving threat. The latest twist in its tale is that it is targeting Windows 10 users specifically via new methods that not only evade but actually disable Windows Defender on these systems. Trickbot may be in the news for all the wrong reasons these days, but this malware is not new. It has been causing trouble since 2016. Since then, this banking trojan is estimated to have compromised no less than 250 million email accounts. So much so that many in the cybersecurity world consider Trickbot as the topmost threat targeting the computing landscape. This malware is designed with a laser focus on stealing the private data of users. Whether it be harvesting emails or stealing logins and passwords, hijacking web browsers or altering displayed websites, stealing banking details or transferring money out of crypto wallets, Trickbot is doing it all. The developers behind Trickbot have updated this malware numerous times over the years, adding advanced new traits every time. One of these features is screen locking, where the more recent versions of Trickbot are capable of locking the computer screens of the victims. What’s even worse, and an extremely dangerous addition is the capability of hijacking several different kinds of applications and then stealing credentials, recording information relating to web browsing, as well as system details itself like the CPU, operating system and running processes. Complete details can be found on OUR FORUM.

Microsoft security researchers discovered an unusual phishing campaign which employs custom 404 error pages to trick potential victims into handing out their Microsoft credentials. To do this, the attackers register a domain and instead of creating a single phishing landing page to redirect their victims to, they configure a custom 404 page which shows the fake login form. This allows the phishers to have an infinite amount of phishing landing pages URLs generated with the help of a single registered domain. "The 404 Not Found page tells you that you’ve hit a broken or dead link – except when it doesn’t," says Microsoft's research team. "Phishers are using malicious custom 404 pages to serve phishing sites. A phishing campaign targeting Microsoft uses such technique, giving phishers virtually unlimited phishing URLs." "Phishers are using malicious custom 404 pages to serve phishing sites. A phishing campaign targeting Microsoft uses such technique, giving phishers virtually unlimited phishing URLs." The custom 404 error pages these attackers use to harvest their victims' credentials are perfectly camouflaged as legitimate Microsoft account sign-in pages, down to the smallest details. All the links on the phishing page, including the ones at the bottom and the ones used to access one's Microsoft account and to create a new one, are directing straight to official Microsoft login forms in an effort to make targets less suspicious. The only elements missing from the phishing page are the "Sign-in options" link above the "Next" button and the cookies notification at the top of the page. "Because the malformed 404 pages are served to any non-existent URL in an attacker-controlled domain, the phishers can use random URLs for their campaigns," adds Microsoft. "We also found that the attackers randomize domains, exponentially increasing the number of phishing URLs." Learn more by visiting OUR FORUM.

A new Bluetooth vulnerability named "KNOB" has been disclosed that allow attackers to more easily brute force the encryption key used during pairing to monitor or manipulate the data transferred between two paired devices. In a coordinated disclosure between Center for IT-Security, Privacy and Accountability (CISPA), ICASI, and ICASI members such as Microsoft, Apple, Intel, Cisco, and Amazon, a new vulnerability called "KNOB" has been disclosed that affects Bluetooth BR/EDR devices, otherwise known as Bluetooth Classic, using specification versions 1.0 - 5.1. This flaw has been assigned CVE ID CVE-2019-9506 and allows an attacker to reduce the length of the encryption key used for establishing a connection. In some cases, an attacker could reduce the length of an encryption key to a single octet. "The researchers identified that it is possible for an attacking device to interfere with the procedure used to set up encryption on a BR/EDR connection between two devices in such a way as to reduce the length of the encryption key used," stated an advisory on Bluetooth.com. "In addition, since not all Bluetooth specifications mandate a minimum encryption key length, it is possible that some vendors may have developed Bluetooth products where the length of the encryption key used on a BR/EDR connection could be set by an attacking device down to a single octet." This reduction in key length would make it much easier for an attacker to brute force the encryption key used by the paired devices to communicate with each other. Once the key was known to the attackers, they could monitor and manipulate the data being sent between the devices. This includes potentially injecting commands, monitoring keystrokes, and other types of behavior. Full details are posted on OUR FORUM.

The company launches FastTrack for Windows 10 guidance, providing experts who can talk through deployment scenarios with partners. Microsoft Monday unveiled a new benefit for partners that are moving customers from Windows 7 to Windows 10, with the company now offering expert assistance around Windows 10 deployments. The end of support date for Windows 7 is set for Jan. 14, 2020, and Microsoft has made a series of investments to help with the transition, said Bob Davis, corporate vice president for Microsoft 365, in a blog post. The latest of these investments is the launch of FastTrack for Windows 10 deployment guidance. The benefit takes the form of free expert assistance on Windows 10 deployments for situations where there are at least 150 licenses of an eligible service or plan. "Sometimes you have a complex scenario and aren’t even sure where to start, or you’ve encountered a problem that has your migration stalled. There are times when you need to talk to an expert to get guidance on where to go next," Davis said.  FastTrack, Davis said in the post, will assist with envisioning a technical plan and determining how to deploy new users—and will continue to offer help throughout the deployment.

Researchers often give security vulnerabilities catchy names to help them attract more attention. Many of these monikers seem like nonsense--Heartbleed, Spectre, and Meltdown all sound more like emo bands than security flaws--but apparently the researchers at Eclypsium prefer to be a bit more direct. When the company revealed serious issues with more than 40 drivers on Saturday, it simply titled its report Screwed Drivers. (Catchy.) Eclypsium said it found severe vulnerabilities in drivers from "every major BIOS vendor" as well as the likes of Asus, Toshiba, Nvidia, Intel, AMD, and Huawei, which is pretty bad news. But worse still was the company's realization that all of the insecure drivers had been signed by valid Certificate Authorities and certified by Microsoft. Eclypsium said this means the insecure drivers can be installed "on all modern versions" of Windows despite their flaws. The company also explained that "there is currently no universal mechanism to keep a Windows machine from loading one of these known bad drivers" and that some features "specific to Windows Pro, Windows Enterprise and Windows Server may offer some protection to a subset of users." And that's only if administrators decide to use those features; otherwise, their Windows devices will allow the insecure drivers to be installed anyway. "Vulnerable or outdated system and component firmware is a common problem and a high-value target for attackers, who can use it to launch other attacks, completely brick systems, or remain on a device for years gathering data, even after the device is wiped. Lots more can be found on OUR FORUM.

We take a look at a phishing campaign that pretends to be an "Unusual sign-in activity" alert from Microsoft that could easily trick someone into clicking on the enclosed link. With companies such as Google and Microsoft commonly sending users alerts when unusual activity has been discovered on their account, users may feel its normal to receive them and would then click on the enclosed link. Attackers are capitalizing on this by sending emails that pretend to be "Microsoft account unusual sign-in activity" alerts from Microsoft. When compared to the legitimate email notifications sent by Microsoft, they look almost identical with the same information fields and even the same sender address. What's different, though, is that when you click on the "Review recent activity" email link, instead of going to Microsoft to review your account's sign-in activity, you are brought to a fake landing page on a non-Microsoft site that asks you to log in. When a victim enters their credentials, the information will be saved for the phishers to retrieve later so that they can access your account. No matter what credentials are entered in the fake login form, the user will always be redirected to an error page on Microsoft's live.com site. This is to make it look like there is a problem with your account and that nothing strange is going on. While some users may have felt that the emails are safe because they are coming from a legitimate Microsoft email address, it is always important to remember that the From email address can always be spoofed to be from any account an attacker wants. Therefore, even if a phishing email looks legitimate, it is important to pay attention to the URLs of the landing pages before entering your login credentials in a displayed login form. Follow this thread by visiting OUR FORUM.

 

GTranslate