Brutal Kangaroo: CIA-developed Malware for Hacking Air-Gapped Networks Covertly

Brutal Kangaroo: CIA-developed Malware for Hacking Air-Gapped Networks Covertly



It has been created for Microsoft Windows that targets "closed networks by air gap jumping using thumb drives," mainly implemented in enterprises and critical infrastructures.



The newer version was using "unknown link file vulnerability (Lachesis/RiverJack) related to the library-ms functionality of the operating system."

A Decade Old Unix/Linux/BSD Root Privilege-Escalation Bug Discovered

A Decade Old Unix/Linux/BSD Root Privilege-Escalation Bug Discovered



Stack Clash

Each program running on a computer uses a special memory region called the stack. This memory region is special because it grows automatically when the program needs more stack memory. But if it grows too much and gets too close to another memory region, the program may confuse the stack with the other memory region. An attacker can exploit this confusion to overwrite the stack with the other memory region, or the other way around.



7 proof of Local exploit available



Affected systems  (Confirmed):

• Sudo on Debian, Ubuntu, and CentOS
• ld.so and most SUID-root binaries on Debian, Ubuntu, Fedora, and CentOS
• Exim on Debian
• rsh on Solaris 11 and so on
• Red Hat Enterprise

Patches are available from major distributions.

New PowerPoint malware delivery technique tested by spammers - Help Net Security

New PowerPoint malware delivery technique tested by spammers - Help Net Security

A spam run detected by several security companies has attempted to deliver malware through an innovative technique: a link in a PowerPoint slideshow.

The attack steps like this:

• A malicious Microsoft PowerPoint Open XML Slide Show (PPSX) or PowerPoint Show (PPS) is delivered attached in a bogus email (invoice, purchase order, what have you)
• Victims download the file and run it, and are faced with a single text link (or hyperlinked picture) in the file
• They are puzzled by it, and hover with the mouse’s pointer over it in order to discover where the link will take them
• That simple move triggers a mouseover action that leads to a security warning pop-up (Microsoft disables the content of suspicious files by default via Protected View)
• Users who are still curious and allow the program to be run, either by clickling the Enable All or Enable button, start a chain reaction: an embedded malicious PowerShell script is executed that downloads another downloader in the form of a JScript Encoded File (JSE), which retrieves the final payload from a C&C server (in this case, a banking Trojan).

New Fileless Ransomware with Code Injection Ability Detected in the Wild

New Fileless Ransomware with Code Injection Ability Detected in the Wild

Security researchers have recently discovered a new fileless ransomware, dubbed "Sorebrect," which injects malicious code into a legitimate system process (svchost.exe) on a targeted system and then self-destruct itself in order to evade detection.

Unlike traditional ransomware, Sorebrect has been designed to target enterprise's servers and endpoint. The injected code then initiates the file encryption process on the local machine and connected network shares.

This fileless ransomware first compromises administrator credentials by brute forcing or some other means and then uses Microsoft’s Sysinternals PsExec command-line utility to encrypt files.

"PsExec can enable attackers to run remotely executed commands, instead of providing and using an entire interactive login session, or manually transferring the malware into a remote machine, like in RDPs," Trend Micro says.

WHAT WAS THE BADLOCK

Since march 2016 there were rumors that windows & samba has a very dangerous vulnerability and advised system admins to ready to patch as soon as possible on 12^th april when Microsoft & SAMBA has scheduled to release their security patches .

SPECULATIONS:

Badlock was vulnerability in the SMB & DCERPC protocol used by the SAMBA & Windows which is overhyped by the http://badlock.org/ and compared with the Heartbleed (http://heartbleed.com/) bug found in the openssl in terms of the impact by using a very similar template. some people predicted that it could be as bad as MS08-067, the vulnerability that the Conficker worm exploited.

REALITY OF THE BADLOCK:

Microsoft & Samba release their security patches on 12th October for Badlock (CVE-2016-0128/CVE-2016-2118).

As per Microsoft Bulletin, the vulnerability is “caused by the way the SAM and LSAD remote protocols establish the Remote Procedure Call (RPC) channel.”

As per Samba advisory “A man in the middle can intercept any DCERPC traffic between a client and a server in order to impersonate the client and get the same privileges as the authenticated user account. This is most problematic against active directory domain controllers.”

Microsoft rated this vulnerability important not critical. As it is an Elevation of privilege and require MITM capability.

SHOULD ATTACKER EXPLOIT BADLOCK

Exploitation of this vulnerability is not simple and will not give the ROI due to following reasons

Attacker needs MITM (Middle in the man) Capability.

-        To achieve it attacker has to already compromise the victim network /System by other ways.

-        Attacker would be able to compromise single system at a time.

-        Attacker foot prints would be very large and easy to capture.

-        If Attcker already has MITM capability attacker can use it to accomplish to achieve more simple and valuable task rather than exploiting this bug .

CONCLUSION:

Practice followed by the peoples behind disclosure of the Badlock has been criticized heavily by the community since beginning & after it turnout to be a mute vulnerability everyone felt like cheated and trolled it with Sadlock https://sadlock.org/. It’s always a good choice to patch as soon as possible but decision cannot be driven by crating the hype and panic. Such incidence de-focus from the real issues like more critical & Remote Code execution vulnerabilities

HOW TO GET TRANSCRIPT FROM RGPV BHOPAL: SMART WAY

WHAT IS TRANSCRIPT

A transcript is a copy of a student's permanent academic record, which usually means all courses taken, all grades received, all honors received and degrees conferred to a student. Basically receiving all of your records from the first day of college till the college year now

WHY TRANSCRIPT REQUIRES

          If you are looking for higher studies specially in abroad or planning to migrate then Foreign universities/immigration authority/employer will ask you to submit the your original transcript in order to verify the equivalency of your education with the host country  education.

          In my case I needed transcript to get verification of my education credential via WES.

PROCESS TO APPLY FOR  TRANSCRIPT

In general you would expect to have a similar process to be followed by the universities to provide the transcript to student in a country and in this edge of technology they should have capability to do it online.

Unfortunately this is not true and every university has different process and different requirements of the documents.

MY JOURNEY

Being outside of india , I started to look how to get transcript from RGPV on Google and didn’t found much help only one thing was sure that I cannot apply it online. So as next step I contacted to university and got a very prompt response

“Dear Student,

You can download the Form of Transcript from the RGPV Portal (www.rgpv.ac.in) from the option "Downloads Forms" available on the Home Page. Read the inside  instructions carefully and submit the form and if any further issue regarding the process for applying then you can contact RGPV Student Helpline number 0755-4004747. 

Regards

 Technical Support Team””

          So I got the form but no details on the documents require fees require ? so RGPV is expecting that every student should call to get this detail . why not just add it with the form ?

REQUIRE DOCUMENTS

After some research I found that with the form you need original mark sheet of the semesters and any one  with original mark sheet can apply for transcript on your behalf. That was relief if you are outside of India/Bhopal.

But filling up the form was a challenge on it’s own as I have read student experience of making many mistakes in the form and going bake to amend themwhich wasted time & money.

 So after some more search I get to know that RGPV has a cyber café named cyber city https://www.facebook.com/cyber00786/timeline which makes life much easier for student.

THE PROCESS

1.    So First you get a 1 copy of the filled form and original mark sheets and take it to the RGPV. Staff is very helpful and they will guide you to the right room number.

2.    You have to submit the form & your original marksheet for verification which take 2 -3 hours depend on the crowd .

3.    Once verification get done  you will get back the form & your mark sheets  with all the details on the changes require in the form.

4.    Then you go back to café get done all the require changes. Get the required number of copies of your forms and envelops

5.    Go to the UTI bank ( it’s in the campus) get Challan ( it was 500 rs for 10 copies) please check with the university about the fees.

6.    Submit the all forms and challan on same windows and keep the student copy of your challan in secure place you will need it to get back your transcript which usually take two days.

TIPS

1.    Reach early morning about 9 AM if you want cyber café to fill up your form as if there is crowd then it could took you whole day to get fill up your form .

                                                  

                                                                         OR

2.    Call the café owner from the Facebook link  he will provide you his email id on which you can send the scan copy of your mark sheets. And they will keep your form ready by the time you will reach University.

3.    Remember that university accept the form for verification till 2.30 PM and bank will close by 4PM you have to manage your timing for form submission & issuance of the challan. I was having head to head with the time else I would have to spend another day in university.

4.    If you are not living in Bhopal and want to take your transcript with you make sure you have  two to three working days arrangement to stay in Bhopal.

DEATH AND RESURRECTION OF BYOB: HOW INDIAN MIDDLE CLASS HACKED TO BUY CARRY BAGS

Carry bag is a require instrument to carry items from shop to home. For every shopper carry bag is a necessity. Shoppes used to take them as granted and shopkeepers were more than happy to provide such begs as convenience and help to promote their business. Most of the big shops provided bags which have their shop name and serve as visiting card. It was a win –win situation for both parties. But now this situation has been changed as old saying there is no free lunch so no free shopping bags any more.  Long time ago before the popularity of the polybags /convenient bags, even before the start of the big Mall era shoppers used to carry their own bags to buy the groceries from the neighbors’ shopkeeper. With the help of the multinational companies and effective advertisement this situation has been changed and now all big malls are selling shopping bags as side product. Let’s see how this all came in to picture.

EVOLUTION PERIOD (BEFORE 2000)

 I belong to a middleclass family and I have spent my childhood from small to large scale city thanks to my father’s frequent transferable job. During my child hood I have observerd that every place had very similar infrastructure. We had multiple small shops for grocery, cloths and other requirements and one or two one stop big shops. We used to do most of the shopping from the small shops and went to big shops only for some big occasions. Though big shops had cheaper options but going there for everyday stuffs wasn’t feasible.

We always carried multiple cloth bags to shop and even we used to carry our utensils to get liquid items e.g oil, Ghee, milk etc. As open items were cheaper then buying packed items and we could see what quality we were getting.

Slowly big shops introduced concept of the thin polybags so you don’t need to carry multiple begs they can stuffs small items in to thin polybags and you just need to stuffs them in to your carry begs. This concept quickly adopted by the small shopkeepers as well. As this facility was free (no visible extra charge) shoppers stop carrying multiple bags and utensils as getting liquid items in the polybags was very convenient. I believe extra cost of the polybags somehow shifted to the shoppers in other forms e.g. with weight of the items.

END OF BYOB 

 On start of the 21^st century when world was facing great recession .Various countries open there gate for multinational companies and globalization of consumers become a new trend. Developing countries like India got big buildings and big malls in its big cities. These malls restricted carrying your own bags inside the mall. If you bring your own bag (BYOB) you have to submit it and keep the token. They provide you there on shopping bags. Once you finish your shopping they stuff your items into big polybags so you don’t have to stuffs them into your carry beg.  Again it was a great convenience and off course cost was invisible to the consumer. Cost of these begs were absorbed by the malls as this practice was a win-win situation for them.

-        These big polybags works as instrument of the malls advertisement. More people will carry their bags more advertisement for the malls

-        It helps curving the theft of the items from the mall.

-        Consumer don’t have to plan their shopping then can enter any time without worry about how they will carry the items

These bags were so lucrative many people started frequent visits to these mall and started more and more shopping from there rather than small neighbor shop. Young generation stop carrying any carry bag with them. Even if some would carry their own bag they would be tagged as old generation.

WHY SELLING OF SHOPPING BAGS STARTED 

As use of polybags increased World health organizations & researcher started realizing the side effect of this phenomenon.  They have noticed following prominent issues

-        These beg were not recyclable.

-        Polybags are hazardous for animal.

-        Burning them harms environment and ozone layer.

There were many protests to ban use of the polybags. Many movements started with no polybags sign. Group has been formed activist started promoting to say no to polybags and not to shop from the shops those provide polybags.

But people already became habitual of not bringing their own bags and it wasn’t feasible for shopkeeper to provide other type of carry beg. It was a catch 22 situation and solution came as the recyclable bags.

Due the government pressures big shops and malls started providing recyclable bag to consumer but soon realized that cost of these bags is much higher and due to inflation they have to pass this cost to the consumer.

And a new business of selling of carry bags has been started. 

WHY WE BUY CARRY BAGS

Now a days most of the shops & malls charges extra for  carry bag from 2 rs to 50 rs  depends on the shop.  It is not guaranteed if these bags are rally recyclable. We are end paying this extra money every time I wonder why ?

-        They charge

-        We don’t carry our own bag

-        We do impulse shopping

The real answer is our shopping habit. We entered into shop to check out some stuffs and end up buying some other items. We don’t plan our shopping so we don’t carry bags. We are spoiled buy choices we spend hours in the mall to get right cloth/shoes/grocery for us and when cashier ask extra for carry bag we couldn’t say no as we wouldn’t have any other option by that time. We don’t do accounting how much money we are spending on buying these bags which we through away.  Ask yourself when you have carried same bag on your next shopping?

WHAT GOES COMES BACK

I had multiple discussions with intellectual people and some of them give a very strong reason on extra charge of taking carry bag by the shops. As carry bags are hazardous to environment extra charge would reduce the usage of these bags and there is some rule and regulations enforce by the government to reduce the countries carbon footprints. And it’s business so shops should earn the profit.

I wonder what government was doing when multinational companies were spoiling the Indian middle class with free carry bag. Wasn’t they were creating new market to sell the unrequired bag. If government and malls are really worried about the environment they should provide extra discount of not taking the bag from the mall instead of charging extra or should reward in some other manner.

Shops and mall should increase the awareness of benefit of carrying your own bag. In current scenario we don’t see any efforts by the shops or the government.

As responsible citizen we should bring back the BYOB (bring your own bag) trend and say no to malls carry bag and strong no to buy them and save money & save environment else we will be spending at least 2% of our shopping money in these extra bags. In my opinion It will take one complete generation to change its habit.