STE WILLIAMS

Malware developers keep making it easier for even the most broke and technically inept bad guys to jump on the ransomware craze with cheap and user-friendly tools that are bound to fuel plenty more computer blackmail attacks in 2017. The latest evidence of the trend comes from a report out today of a new variant offered up by Russian cybercriminals through a software-as-a-service delivery mechanism that costs criminals only $175 to get started.

According to researchers with Recorded Future, the Karmen Cryptolocker malware variant is ransomware-as-a-service (RaaS) built on top of the open-source Hidden Tear project. It follows the standard ransomware m.o., with mechanisms for taking data hostage with AES-256 encryption, accepting Bitcoin payment from hostages. and automatically decrypting data upon payment. In addition to the low-cost barrier to”clients” – otherwise known as victims in the law-abiding world– and tally total money stolen, as well as update the software when updates are available.

RaaS is hardly a new phenomenon. Security researchers have been digging up similar examples over the last two years after McAfee Labs researchers found the Tox malware kit in the wild. But the professional sheen to the Karmen shows how ransomware tools continue to evolve as every type of criminal tries to make a buck on the ransomware gold rush.

Many technically minded criminals are able to crank out variations like Karmen for their less geeky brethren due to the now wide availability of code found in open-source projects like the one behind Karmen’s code. For example, just today, Cylance researchers reported another new variant of CrypVault ransomware, which uses the GnuPG open-source encryption tool to encrypt files.

“Unlike common ransomware, CrypVault is simply written using Windows scripting languages such as DOS batch commands, JavaScript and VBScript,” writes Rommel Ramos of Cylance. “Because of this, it is very easy to modify the code to create other variants of it. Any potential cybercriminals with average scripting knowledge should be able to create their own version of this to make money.”

For it’s part, the Hidden Tear project from which Karmen was derived was first developed as ‘educational ransomware’ software. But it took off with a mind of its own once the bad guys got their hands on it several years ago. The silver lining for security professionals is that the underlying code has vulnerabilities embedded within it, which has made it possible for ransomware researchers like Michael Gillespie to create decryptors for it. He’s already taken to Twitter to offer help to anyone affected by Karmen.

Nevertheless, Karmen still shines a light on the dangerous technical evolution of ransomware with some under-the-hood tinkering that Recorded Future researchers say are meant to deter sandbox analysis.

“A notable feature of Karmen is that it automatically deletes its own decryptor if a sandbox environment or analysis software is detected on the victim’s computer,” writes Diana Granger with Recorded Future. Her associates told Dark Reading that it’s meant to discourage security tools and researchers from learning too much about its code.

This kind of evasion technique is typical of most evolving malware and is happening among a number of notable malware types. Last month Trend Micro reported that new variants for Cerber are running anti-sandbox features to evade machine-learning security technology.

“This is a typical game of cat and mouse. Criminals make an innovation in their techniques, so defenders follow suit,” says Travis Smith, senior security research engineer for Tripwire. “Once the criminals activities are being slowed by defensive measures, they continue to change their tactics.   As far as the seriousness of these evasion techniques, they pose no additional risk to the end-user when it comes to protecting themselves.”

Unfortunately, according to a recent study by SecureWorks, even though 76% of organizations see ransomware as a significant business threat, only 56% have a ransomware response plan. According to Keith Jarvis, senior security researcher at SecureWorks, organizations worried about ransomware need to not only make sure their backup and endpoint protection protocols are firmly in place, they’ve also got to take a second look at email filtering and patch management.

 “We see most ransomware come in through emails and browser exploit kits that rely on poorly patched environments,” he says, pointing to Adobe Flash as a common culprit. “A great first step for email defense would be to block outright the most abused file extensions used by executables and scripts. Next would be to block Word documents that contain macros. If you take these steps, you’re going to block the overwhelming majority of ransomware.”

Related Content:

• Nearly 40% of Ransomware Victims Pay Attackers
• Cerber Ransomware Now Evades Machine Learning
• 7 Ways Hackers Target Your Employees
• 6 Free Ransomware Decryption Tools

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/advanced-low-cost-ransomware-tools-on-the-rise/d/d-id/1328675?_mc=RSS_DR_EDT

If we want to protect privacy, we must be clear about why it’s important, how we can prevent confusion, and who is protecting consumers. Privacy is at risk in unprecedented ways if we don’t put checks and balances on it from time to time. Sadly, the legal system is lagging behind the pace of innovation, as the last major privacy law was passed in 1986.

The true privacy mission also needs to prevent business practices that are deceptive or unfair to consumers, and include things that enhance informed consumer choice and public understanding of the competitive process, all without unduly burdening legitimate business activity. This is where the Federal Trade Commission (FTC) comes in.

You may be more familiar with the FTC’s work than you think. The FTC deals with issues that touch the economic life of every American, and it’s the only federal agency with both consumer protection and competition jurisdiction in broad sectors of the economy. It has moved much faster than our congressional leaders in putting consumer protections in place.

Why Am I Telling You This?
Last year, the Federal Communications Commission (FCC) pushed through, on a party-line vote, privacy regulations designed to benefit one group of favored companies over another group of disfavored companies. The rules would have required home Internet and mobile broadband providers to get consumers’ opt-in consent before selling or sharing Web browsing history, app usage history, and other private information with advertisers and other companies. The rules, although well-intentioned, were at odds with the existing and proven privacy framework put forth by the FTC.

The FCC wanted to reclassify the Internet as a service under Title II of the Telecommunications Act, a provision that lets the FCC set rates and ensures equal access to traditional phone service, such as what you have at home. This was not permissible under US law. In making this move, the FCC stripped the FTC of the current jurisdiction it had over Internet privacy and data sharing practices.

[Check out the two-day Dark Reading Cybersecurity Crash Course at Interop ITX, May 15 16, where Dark Reading editors and some of the industry’s top cybersecurity experts will share the latest data security trends and best practices.]

As one of the leading voices in email protection and chairman of the Email Experience Council, I believe the FCC should never have been allowed to declare “information services” a Title II service. But the FCC passed its own regulations, which subjected Internet service providers to onerous and unnecessary restrictions, and exempted edge providers.

Once the FCC declared the Internet a common carrier service, it removed all authority of the FTC to regulate. The privacy rules the FCC had in place are geared toward phone services, not the Internet. The rules didn’t fit, so it attempted to write Internet-specific regulations.

These actions had to be undone to restore authority over privacy and data sharing to the FTC. This solution needed to happen to undo the fruits of regulatory overreach and absurdity.

What Happens Now?
First, the legislation that’s been repealed isn’t active today, and never has been. There’ll be no change in whether an ISP is “allowed to sell your information.” You still have privacy protections. How, you ask?

When Trump signed the Congressional Review Act, the FCC can’t re-create the rules until Congress authorizes it to. Getting that legislation through Congress is pretty unlikely for the next couple of years. This will allow the FTC to regain the control and authority it has always had to protect consumers and regulate Internet service as it has done successfully for years.

There are some technical things consumers should understand to protect themselves.

If you use encryption (HTTPS), as many browsers and applications do, ISPs can track which websites you visit but not specific pages or what you do there. However, most advertisers already have this information and have since the dawn of the Internet. The websites you visit tell them when you buy things on Amazon or eBay, if you’re reading this story, when you’re on Facebook, etc.

What’s even more interesting is that if someone wants to track which websites you visit, it’s probably a lot easier to buy that information from a tiny, low-margin service provider in a lax jurisdiction or that is under FCC regulation than to do so from a large domestic ISP.

It’s also important to know that ISPs already self-regulate on opt-in for what the FCC tried to define as the most sensitive uses. These include Web browsing, app usage history, geo-location data, financial and health information, and the content of communications. As a user of their services, you opted in when the service was purchased.

What’s Next?
The changes, if allowed to go through, would have also stifled the industry’s use of data that is used by anti-spammers and security vendors, data used to prevent viruses and malware, and many other security-related things, thus making you less safe as a user of the Internet.

Another important point: Congress is looking at a complete rewrite of the Communications Act. Everything is up for grabs if this happens.

The FCC has said it will work with the FTC to ensure that consumers’ online privacy is protected through a consistent, comprehensive framework. The FCC knows that the best way to achieve those results would be to return jurisdiction over broadband providers’ privacy practices to the FTC, with its decades of experience and expertise in this area.

Consumers must continue to educate themselves and their families about how their information can be used and how they can control it. Simply reading the privacy policies of sites and applications you use is a start.

If you’re really worried about your information not being kept private, your best option is to use a virtual private network, which anonymizes Internet activity by routing it through another system and shielding it from your ISP. However, most ISPs are open about how you can opt out of any data use, and they give you control to do so.

Knowing how to protect your information identity is a must in the 21st century. Here are some tips from the FTC on doing it effectively.

Related Content:

• Privacy Babel: Making Sense of Global Privacy Regulations
• US Senate Overturns Obama Consumer Privacy Rule
• FCC Privacy Rule Repeal Will Have Widespread Security Implications

Dennis Dayman is the chief privacy and security officer at Return Path. He has more than 20 years of experience combating spam and in security/privacy issues, data governance issues, and improving email delivery through industry policy, ISP relations, and technical solutions. View Full Bio

Article source: http://www.darkreading.com/endpoint/the-implications-behind-proposed-internet-privacy-rules/a/d-id/1328598?_mc=RSS_DR_EDT

The first quarter of 2017 brought with it some significant changes to the threat landscape, and we aren’t talking about heavy ransomware distribution either.

In our second Cybercrime Tactics Techniques report. (Read the first one here.), we take a deep dive into what threats got our attention the most during the first three months of the year, what we expect to happen moving through the next quarter, and a behind the scenes interview with one of our Malwarebytes Labs analysts. Here is a sneak peek at what’s in the report.

• Cerber ransomware took over as top dog with respect to distribution and market share.
• Locky ransomware has dropped off the map, likely due to the desired change by the controllers of the Necurs spam botnet. However, with a lack of new Locky versions being developed since before the beginning of the year, the fate of its creators are unknown.
• The Mac threat landscape saw a surge of new malware and backdoors in Q1 2017, including a new Mac ransomware (FindZip).
• On the Android side, two notable malware families have been causing a lot of trouble: HiddenAds.lck, which locks the device from being able to remove the app, therefore allowing for more advertisement revenue for the creators, and Jisut, a mobile ransomware family that has been spreading like wildfire.
• In the exploit kit world, RIG continues to have the greatest market share of the few exploit kits that are still active, and we expect this to continue. RIG exploit kit remains on top mainly due to its lack of competition rather than its technical sophistication.
• Malicious spam campaigns have also started utilizing password protected zipped files and protected Office documents to evade auto analysis sandboxes utilized by security researchers.
• In social media scams, users were bombarded with links to WWE nude photo dumps that lead to gift card survey scams.
• Tech support scammers, finding difficulty working with North American payment processors, have begun accepting alternate forms of payment, such as Apple gift cards and bitcoin.

Looking ahead to the second quarter of the year:

• We expect to see continued heavy distribution of Cerber through Q2 2017 due to new developments made to the malware design, and its continued use of the ransomware as a service (RaaS) model.
• As far as Cerber losing its crown, it is unlikely within the next quarter that any competitor will rise in market share enough to dethrone Cerber, barring something happening to the developers of Cerber, and their ability to develop and distribute the ransomware.
• The continued heavy development of Mac malware throughout Q2 is highly likely.
• The Android ransomware Jisut is expected to continue its trend of high distribution and spread. We predict the same for HiddenAds.lck.
• Distribution mechanisms are likely going to develop new features and functionality, be it through social engineering tactics utilized by exploit kits and malicious spam or from the discovery of new exploits, potentially revitalizing the exploit kit market.
• Finally, in the world of scams, we expect to see an uptick of ‘exit scams’ and tech support scammers utilizing social media advertising to scam each other. At the same time, we predict the increase collaboration of PUPs and TSS through the spread of tech support scammer advertisements being pushed alongside potentially unwanted programs.

Download the full Cybercrime Tactics Techniques report here.

Article source: http://www.darkreading.com/partner-perspectives/malwarebytes/cybercrime-tactics-and-techniques-q1-2017----/a/d-id/1328664?_mc=RSS_DR_EDT

A Cuban man potentially faces up to 22 years in prison and a $750,000 fine, after he pleaded guilty to two criminal counts in an identity theft case involving current and former workers at the University of Pittsburgh Medical Center (UPMC), federal authorities announced Monday.

Yoandy Perez Llanes, 33, and his cohorts stole Social Security numbers, birth dates, and other personal information from tens of thousands of current and former employees at UPMC in 2014.

Llanes and his co-conspirators hacked into UPMC’s computer databases, then turned around and used the data to file more than 900 false 2013 tax returns with the Internal Revenue Service. And rather than receive a cash refund, Llanes requested any returns be provided as Amazon gift cards, which then were used to buy electronics. The purchased electronics were shipped to Venezuela, where Llanes and his associates snapped them up.

During the nearly two years that Llanes engaged in aggravated identity theft and money laundering, he and his cohorts received $1.48 million from the bogus tax returns. Llanes will be sentenced on Aug. 18.

Read the Department of Justice release here.

Article source: http://www.darkreading.com/threat-intelligence/identity-thief-faces-potential-22-year-prison-sentence/d/d-id/1328655?_mc=RSS_DR_EDT

SWIFT said yesterday that there are no signs of foul play in its network or messaging systems following last week’s data dump by the Shadow Brokers.

Shadow Brokers released several Windows exploits, which were allegedly stolen from the NSA and used to break into SWIFT systems. The information released by Shadow Brokers, which dates back several years, indicates the leaked tools could be used to access two service bureaus, or third-party providers connecting businesses to SWIFT. This would provide the NSA a view into communications between customers and organizations outsourcing their SWIFT activity.

SWIFT says it is in contact with the service bureaus involved to ensure they know about the allegations and have taken the necessary preventative measures. The EastNets Service Bureau, one of the organizations, says its customers have not been affected.

SWIFT confirmed that its systems were not targeted. “We can confirm that there is no impact on SWIFT’s infrastructure or data, and we have no evidence to suggest that there has been any unauthorised access to SWIFT’s network or messaging services,” the financial messaging service said in a press FAQ.

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/vulnerabilities---threats/swift-system-unaffected-following-shadow-brokers-leak/d/d-id/1328667?_mc=RSS_DR_EDT