Cyber News Rundown: Voter Records for Sale

Reading Time: ~2 min.2018 Voter Records for Sale As the United States midterm elections draw closer, concern surrounding voter information is on the rise, and for good reason. Records for nearly 35 million registered voters from 19 different states were found for sale on a hacker forum, with prices ranging from $500 to $12,500, depending on the state. […]
The post Cyber News Rundown: Voter Records for Sale appeared first on Webroot Blog.

Link: https://www.webroot.com/blog/2018/10/19/cyber-news-rundown-voter-records-sale/

Podcast: A Utility Ransomware Attack Post-Hurricane

A “critical water utility” was hit by a recent ransomware attack, significantly impeding the service in the week after Hurricane Florence hit the East Coast of the U.S. The Onslow Water and Sewer Authority (ONWASA) said in a Monday release that a “sophisticated ransomware attack… has left the utility with limited computer capabilities.” While customer data […]

Link: https://threatpost.com/podcast-a-utility-ransomware-attack-post-hurricane/138391/

BYOB – Build Your Own Botnet

BYOB (Build Your Own Botnet)Disclaimer: This project should be used for authorized testing or educational purposes only.BYOB is an open-source project that provides a framework for security researchers and developers to build and operate a basic botnet to deepen their understanding of the sophisticated malware that infects millions of devices every year and spawns modern botnets, in order to improve their ability to develop counter-measures against these threats.It is designed to allow developers to easily implement their own code and add cool new features without having to write a RAT (Remote Administration Tool) or a C2 (Command & Control server) from scratch.The RAT’s key feature is that arbitrary code/files can be remotely loaded into memory from the C2 and executed on the target machine without writing anything to the disk.Serverusage: server.py [-h] [-v] [–host HOST] [–port PORT] [–database DATABASE]Command & control server with persistent database and console Console-Based User-Interface: streamlined console interface for controlling client host machines remotely via reverse TCP shells which provide direct terminal access to the client host machines Persistent SQLite Database: lightweight database that stores identifying information about client host machines, allowing reverse TCP shell sessions to persist through disconnections of arbitrary duration and enabling long-term reconnaissance Client-Server Architecture: all python packages/modules installed locally are automatically made available for clients to remotely import without writing them to the disk of the target machines, allowing clients to use modules which require packages not installed on the target machines Clientusage: client.py [-h] [-v] [–name NAME] [–icon ICON] [–pastebin API] [–encrypt] [–obfuscate] [–compress] [–compile] host port [module [module …]]Generate fully-undetectable clients with staged payloads, remote imports, and unlimited modules Remote Imports: remotely import third-party packages from the server without writing them to the disk or downloading/installing them Nothing Written To The Disk: clients never write anything to the disk – not even temporary files (zero IO system calls are made) because remote imports allow arbitrary code to be dynamically loaded into memory and directly imported into the currently running process Zero Dependencies (Not Even Python Itself): client runs with just the python standard library, remotely imports any non-standard packages/modules from the server, and can be compiled with a standalone python interpreter into a portable binary executable formatted for any platform/architecture, allowing it to run on anything, even when Python itself is missing on the target host Add New Features With Just 1 Click: any python script, module, or package you to copy to the ./byob/modules/ directory automatically becomes remotely importable & directly usable by every client while your command & control server is running Write Your Own Modules: a basic module template is provided in ./byob/modules/ directory to make writing your own modules a straight-forward, hassle-free process Run Unlimited Modules Without Bloating File Size: use remote imports to add unlimited features without adding a single byte to the client’s file size Fully Updatable: each client will periodically check the server for new content available for remote import, and will dynamically update its in-memory resources if anything has been added/removed Platform Independent: everything is written in Python (a platform-agnostic language) and the clients generated can optionally be compiled into portable executable (Windows) or bundled into an standalone application (macOS) Bypass Firewalls: clients connect to the command & control server via reverse TCP connections, which will bypass most firewalls because the default filter configurations primarily block incoming connections Counter-Measure Against Antivirus: avoids being analyzed by antivirus by blocking processes with names of known antivirus products from spawning Encrypt Payloads To Prevent Analysis: the main client payload is encrypted with a random 256-bit key which exists solely in the payload stager which is generated along with it Prevent Reverse-Engineering: by default, clients will abort execution if a virtual machine or sandbox is detected ModulesPost-exploitation modules that are remotely importable by clientsKeylogger (byob.modules.keylogger): logs the user’s keystrokes & the window name enteredScreenshot (byob.modules.screenshot): take a screenshot of current user’s desktopWebcam (byob.modules.webcam): view a live stream or capture image/video from the webcamRansom (byob.modules.ransom): encrypt files & generate random BTC wallet for ransom paymentOutlook (byob.modules.outlook): read/search/upload emails from the local Outlook clientPacket Sniffer (byob.modules.packetsniffer): run a packet sniffer on the host network & upload .pcap filePersistence (byob.modules.persistence): establish persistence on the host machine using 5 different methodsPhone (byob.modules.phone): read/search/upload text messages from the client smartphoneEscalate Privileges (byob.modules.escalate): attempt UAC bypass to gain unauthorized administrator privilegesPort Scanner (byob.modules.portscanner): scan the local network for other online devices & open portsProcess Control (byob.modules.process): list/search/kill/monitor currently running processes on the hostCoreCore framework modules used by the generator and the serverUtilities (byob.core.util): miscellaneous utility functions that are used by many modulesSecurity (byob.core.security): Diffie-Hellman IKE & 3 encryption modes (AES-256-OCB, AES-256-CBC, XOR-128)Loaders (byob.core.loaders): remotely import any package/module/scripts from the serverPayloads (byob.core.payloads): reverse TCP shell designed to remotely import dependencies, packages & modulesStagers (byob.core.stagers): generate unique payload stagers to prevent analysis & detectionGenerators (byob.core.generators): functions which all dynamically generate code for the client generatorDatabase (byob.core.database): handles interaction between command & control server and the SQLite database ContactWebsite: https://malwared.comEmail: security@malwared.comTwitter: https://twitter.com/malwaredllcDownload BYOB

Link: http://feedproxy.google.com/~r/PentestTools/~3/8QSu_u2pj0Y/byob-build-your-own-botnet.html

Unsecure RDP Connections are a Widespread Security Failure

Reading Time: ~2 min.While ransomware, last year’s dominant threat, has taken a backseat to cryptomining attacks in 2018, it has by no means disappeared. Instead, ransomware has become a more targeted business model for cybercriminals, with unsecured remote desktop protocol (RDP) connections becoming the favorite port of entry for ransomware campaigns. RDP connections first gained popularity as attack […]
The post Unsecure RDP Connections are a Widespread Security Failure appeared first on Webroot Blog.

Link: https://www.webroot.com/blog/2018/09/25/unsecure-rdp-connections-widespread-security-failure/