Tag Archive for: gain

Allies To Gain Access to US Ransomware Data Under New Policy

/in


Allies To Gain Access to US Ransomware Data Under New Policy

Allies To Gain Access to US Ransomware Data Under New Policy

The White House is set to announce a new policy for responding to ransomware attacks, as the number of such attacks continues to grow substantially. The US accounts for 46% of ransomware attacks globally, according to Anne Neuberger, Deputy National Security Advisor.

Recent high-profile attacks have hit major companies like casino operator MGM Resorts and cleaning products maker Clorox. In these attacks, hackers encrypt systems and demand ransom payments, usually in cryptocurrency, to decrypt them. Sensitive stolen data is often used to further extort victims.

The new White House policy will facilitate intelligence sharing related to ransomware attackers between the US and its allies. In particular, authorities will share cryptocurrency wallet addresses criminals use to collect ransoms.

The policy reflects the increasingly interconnected nature of ransomware schemes. Attackers routinely use infrastructure and data from one country to attack organizations in others. Enhanced coordination will allow rapid response.

A 40-country alliance led by the US, including Nigeria, Singapore and South Korea, will collaborate to cut off ransomware funding flows. The group will leverage artificial intelligence to trace ransom payments on the blockchain and maintain a blacklist of known criminal wallets.

“Ransomware attackers extorted at least $456.8 million from victims in 2022, down from $765.6 million the year before,” Chainalysis reported.

Source: Chainalysis

With this alliance, authorities hope to stem the tide of attacks. But with billions in cryptocurrency paid annually to ransomware criminals, curbing the epidemic remains an ongoing battle.

Source…

Hackers Gain Control of Casino Card Shuffling Machine for Godlike Control Over Games

/in


“Basically, it allows us to do more or less whatever we want.”

Shifty Shufflers

The house doesn’t always win.

Researchers at the security firm IOActive say they’ve discovered that a card shuffling machine called the Deckmate, widely used by casinos and long thought to be impervious, is actually vulnerable to hacking, Wired reports — an exploit that could give a skilled cheater omniscient knowledge of every player’s cards.

The investigation was spurred by a gambling scandal last year, when during a game of poker, a newcomer holding a terrible hand called the bluff of a veteran player — a call so baffling that the commentator thought that the live graphics were displaying the cards incorrectly.

Accusations of cheating followed, along with an official investigation by Hustler Live Casino, the host of the scandalous game. The casino’s report concluded there was no evidence of foul play, and averred that the Deckmate used at the game was “secure and cannot be compromised.”

Under the Table

That’s where the IOActive researchers begged to differ.

“At that point, it’s a challenge,” Joseph Tartaro, a researcher at the security firm, told Wired.

Presenting at a Las Vegas security conference, Tartaro and his team found that the latest version of the card shuffler, the Deckmate 2, can be hacked through its exposed USB port.

They theorize that a conniving player could pretend to drop something, go under the table where the Deckmate lies, and plug a device into the USB port. And if physically plugging in a hacking device lacks subtlety, the researchers claim that it could also be hacked remotely through the Deckmate’s internal modem.

From there, cheaters could access the shuffler’s internal camera that watches the cards, and relay that data over Bluetooth to a phone held by a partner nearby who could communicate with a trick like hand signals.

As a test, IOactive researchers made a hacking device out of a Raspberry Pi, exploiting, among several vulnerabilities, faulty firmware that let them tamper with the Deckmate’s encrypted code without detection. They paired this with a Bluetooth app that displayed the hands of other players based on the data.

“Basically, it allows us to do more or less whatever we…

Source…

Iranian hacking group impersonating nuclear experts to gain intel from Western think tanks

/in


A cyber espionage group linked to the Iranian government has been impersonating think-tank employees to phish Middle Eastern nuclear weapons experts, according to researchers at Proofpoint.

The group — called “TA453,” “Charming Kitten” or “APT35,” depending on the threat intelligence service you’re relying on — has a long track record of targeting U.S. and European government officials, politicians, think tanks and entities involved in critical infrastructure.

The latest campaign detailed by Proofpoint dates from March to May of this year and begins with benign emails that seek to establish a rapport with foreign policy researchers in the West.

Those initial emails were later followed by phishing emails that link to a password-protected DropBox URL, ostensibly to access the research. Instead, it executes .RAR and LNK files and run a PowerShell script that installs a backdoor on the victim’s system, before calling out to a cloud hosting provider for additional malware payloads.

Full infection chain for GorjolEcho, one of the malware payloads deployed by Charming Kitten (Source: Proofpoint)

Joshua Miller, senior threat researcher at Proofpoint, told SC Media the campaign appears to be extremely targeted: thus far they are aware of fewer than 10 individuals who received phishing emails from the group. Miller said their visibility over the campaign is restricted to data and follow-ups culled from Proofpoint customers, and that none were successfully infected.

It’s not the first time Charming Kitten, which U.S. officials have linked to Iran’s Islamic Revolutionary Guard Corps’ intelligence organization, has targeted think tanks and other research institutions, seemingly in an effort to gather intelligence about Western foreign policy decision-making. While the group has targeted government officials in the past, they may find it easier to obtain some of the same information they’re looking for by targeting and compromising parties at the edge of those discussions.

“When we see them go after think tanks [and] academics, basically they’re informing the policy positions of the West and governments for nuclear sanctions or diplomatic policies. The idea is that that…

Source…

Hackers Reportedly Gain Access to Drug Enforcement Administration Data Portal

/in


It’s thought hackers have managed to compromise a data portal run by the US Drug Enforcement Administration (DEA), unlocking access to a wealth of information.

As cybersecurity journalist Brian Krebs reports, the breach would have allowed the attackers to prowl through 16 federal law enforcement databases covering a wide variety of investigative data. How did this happen? A failure to implement multi-factor authentication seems to be a key cause.

Krebs wrote that he’s learned “the alleged compromise is tied to a cybercrime and online harassment community that routinely impersonates police and government officials to harvest personal information on their targets.”

He said a tip for this story came from an unnamed administrator at Doxbin—“a highly toxic online community that provides a forum for digging up personal information on people and posting it publicly.” Krebs further noted that this unauthorized access could be abused to upload fake data about suspects, citing commentary from Nicholas Weaver, a researcher at the University of California at Berkeley’s International Computer Science Institute.

False tips have often been used to initiate “swatting” attacks, in which hoax reports about crimes in progress lead to police swarming a residence with heavily armed SWAT teams. The target–or a random bystander–can wind up dead in the process. 

Unfortunately, Krebs has personal experience with that scenario. In 2013, Fairfax County, Va., police showed up at his door, guns drawn after getting a phony tip that Russians had broken in and shot his wife. The perpetrator was caught after participating in an online forum clandestinely run by the FBI, and subsequently got sentenced in 2016.

The login page for the DEA’s El Paso Intelligence Center (yes, EPIC) invites users to log in with a government-issued Personal Identity Verification card, but also allows traditional username and password access. The source Krebs spoke to told him that “the hacker who obtained this illicit access was able to log in using the stolen credentials alone, and that at no time did the portal prompt for a second authentication factor.”

That would be a serious security risk for a webmail…

Source…