WeLiveSecurity

> would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question The og article by ESET Security [0] specifically talks about (Android/Chrome-supported) WebAPKs essentially bypassing the usual "untrusted sources" warning, and that even the App Info screen shows Play Store as the origin source for all installed WebAPKs. > tricky to teach someone to be tech literate with a moving target Not fool proof, but given the IoCs, think it might be best to block all but top 50k domains by default. Or, inform users if a domain they've never previously visited asks them to enter anything via clipboard or keyboard. [0] https://www.welivesecurity.com/en/eset-research/be-careful-what-you-pw… / https://archive.md/29SKK (hat-tip u/ChrisArchitect)

BTC because it's scarce BTC isn't really scarce, there's quiet a few newer iterations like Litecoin, Monereo, Ethereum, Dogecoin etc.. It's also worth noting the supply was minted mainly by miners doing very low difficulty work early on, using basic home computers. Satoshi made an intensional design choice to gain control of the supply for a very low cost, exploiting late adopters as bag holders. The incentive system for bitcoin mining might of anticipated gaining popularity as time passes and increasing the reward as the network grows, but the system was designed completely opposite of that, at the expense of the masses for the benefit of sending the supply to the mining nodes operating in the first few months. https://www.welivesecurity.com/wp-content/media_files/total_bitcoins_o…

In the same spirit, there is at least one botnet dubbed Linux/Moose [1] dedicated to penetrating home routers for the sole purpose of creating fake followers on social networks. [1] http://www.welivesecurity.com/2016/11/02/linuxmoose-still-breathing

Air-gapped, the only way to go. https://www.welivesecurity.com/2021/12/01/jumping-air-gap-15-years-nat… There are still several vectors even with the top security clearance procedures. They routinely miss things at security checkpoints. “Even a perfect air gap will be vulnerable to a variety of different attack vectors, including (but not limited to) the following: Physical compromise: An adversary bypasses physical security and gains access directly to the air-gapped network devices. Physical access is by far the most effective and obvious technique. Insider threats: Someone who is part of an organization and has access to air-gapped secure systems intentionally or unintentionally compromises a system. Supply chain compromise: A vendor with legitimate access to air-gapped systems unwittingly is compromised and brings infected devices into a network. Misconfiguration: Misconfiguration of access controls or permissions allows an attacker to access the air-gapped system through a separate device on the network. Social engineering (media drop): If an attacker was able to successfully conduct a malicious USB/media drop and an employee was to use that media within the air-gapped system, the network could be compromised. Other advanced tactics: Thermal manipulation, covert surface vibrations, LEDs, ultrasonic transmissions, radio signals, and magnetic fields are among a range of advanced tactics documented and demonstrated by researchers at Ben Gurion…

I've been gradually improving my dev setup security over the past few months based on continuous reports like this. Here are things I'm trying out to improve my setup: - Use VSCode dev containers for development [1a]. Once you've created one once then they're quite easy to use and you don't need much Docker knowledge - it just needs to be installed. It's perfect for spinning up web/console apps but I had trouble with other stuff like Flutter and Electron. - Similarly I got familiar with GitHub Codespaces for smaller projects [1b]. I've done live coding in an interview before (where I had to modify a simple Node project) and I would absolutely use containers/codespaces for anything like that these days [2]. You can spin one up straight from any GitHub repo page and they're easy to work with. - Read the OWASP guidelines regularly for things like npm, Node, and Docker best practises. e.g. for Docker use the smallest image you can (Alpine) and use explicit Docker image tags [3]. - Review npm/python packages before installing them using socket.dev - it shows a full dependency security overview for things like env variable access, network calls, supply chain attacks, recent code ownership changes etc. You can also disable postinstall scripts globally as suggested by OWASP [4]. [1a] https://code.visualstudio.com/docs/devcontainers/create-dev-container [1b] https://github.com/codespaces [2]…

Pay the researcher some credit and submit the original source: https://www.welivesecurity.com/en/eset-research/forgotten-uefi-shims-u…

You should stop using it anyway. Linkedin is a hunting ground for threat actors[1], and unless your part-time job is producing corposlop on industrial scale it amounts to little more than recruiter spam https://www.welivesecurity.com/en/social-media/linkedin-hunting-ground…

They don't understand sideloading, but you know what they understand? Weird apps that block your phone and show ads constantly (yes this exists) Typosquatting apps Apps that hold your phone for ransom if you don't pay a certain debt (yes this exists) https://www.welivesecurity.com/en/eset-research/beware-predatory-finte…

ESET's story seems to make more sense: https://www.welivesecurity.com/en/eset-research/update-winrar-tools-no… The exploit abuses ADSes with ..\ in the name to drop files on the system that aren't visible in the WinRAR file browser. It drops malware in the temp directory and then a .lnk in the Startup directory to activate an attack against COM, influencing the DLL that's being loaded by legitimate applications.

> often in horrific ways Let me guess, loan shark apps, or is there something even worse that I wasn't aware of? (Essentially ransomware that people "voluntarily" install in order to get a predatory loan, often without knowing how it actually operates. If they fail to pay, not only is their phone locked, but the data from it is used to threaten/extort them, from threatening to send their nudes to their contacts to death threats to relatives identified from the data - https://www.welivesecurity.com/en/eset-research/beware-predatory-finte…

Most of the time, when apps are caught doing something really shady, they're removed from the Play Store for doing the shady thing. A story wouldn't report that they stopped working because of a policy change, but some of these wouldn't make it into the store now: https://www.bleepingcomputer.com/news/security/apps-with-15m-installs-… https://www.zdnet.com/article/phantomlance-spying-campaign-breaches-go… https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-leg… There are also examples of apps using the filesystem to try to detect rooted devices, an invasion of user privacy: https://www.reddit.com/r/Android/comments/g6cdl6/apps_have_access_to_y…

Oh, but they do! There used to exist a boatload of malware on Android disguised as common conscience apps, famously flashlight apps/widgets. As a random example, see this one ( https://www.welivesecurity.com/2017/04/19/turn-light-give-passwords/ ) which is a banking trojan cosplaying as a flashlight widget. Now there is a more or less sophisticated permission system which users then bypass by still accepting any prompt if you promise them anything shiny...

Original article, with the technical analysis of the bootkit: https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-fi…

IIRC there have already been proof of concept attacks made using MicroSD cards with the microcontroller modified https://www.welivesecurity.com/2014/01/02/could-new-malware-steal-data…

Yes: https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst…

This was described in the original post[1]. > It is probable that this unknown component finds the last modified directory on the USB drive, hides it, and renames itself with the name of this directory, which is done by JackalWorm. We also believe that the component uses a folder icon, to entice the user to run it when the USB drive is inserted in an air-gapped system, which again is done by JackalWorm. [1] https://www.welivesecurity.com/en/eset-research/mind-air-gap-goldenjac…

Actual article: https://www.welivesecurity.com/en/eset-research/ngate-android-malware-…

This is a guess but they might just be fishing for valid phone numbers, as well as focusing on those who respond. https://www.welivesecurity.com/en/scams/scammers-phone-number/

The title is quite clickbaity I think, because of this: > Occurred no later than August 12, 2011, and wasn't detected for another 17 days which also had a discussion on HN in 2013: Who rooted kernel.org servers two years ago? (https://news.ycombinator.com/item?id=6438326) - Sep 2013 (45 comments) The article from ESET is here, Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain (https://www.welivesecurity.com/en/eset-research/ebury-alive-unseen-400… - May 2024 but the article itself only serves as an introduction to the PDF: https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-…

I was in the general IT space for Superfish and remember only models found at big box stores were affected. Not the typical "business-grade" machines typically bought by government, industrial, and enterprise. This article confirms my memory https://www.welivesecurity.com/2015/02/20/lenovo-superfish-dont-panic-…

LaLiga are some of the most egregious group for privacy concerns, it was a few years ago their own app would record your position and the audio around to ensure you were watching at a licensed bar for example [1]. It's rich that they would be so concerned with other apps purposes. 1) https://www.welivesecurity.com/2018/06/12/spains-la-liga-app-phones-de…

To prevent against a evil maid attack you would need to encrypt your drive In case of a malfunction, you risk loosing all your data Threat actors and law enforcement can bypass it UEFI threats moving to the ESP: Introducing ESPecter bootkit https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-intr…

> [0]: https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bo... So how do you remove it?

From the official analysis [0]: > The next feature deactivated by the installer is BitLocker Drive Encryption. The reason for this is that BitLocker can be used in a combination with Trusted Platform Module (TPM) to ensure that various boot files and configurations, including Secure Boot, haven’t been tampered with since BitLocker drive encryption was configured on the system. Considering that the installer modifies the Windows boot chain on a compromised machine, keeping BitLocker on for systems with TPM support would lead to a BitLocker recovery screen at the next bootup and would tip the victim off that the system had been compromised. [0]: https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth…

> The challenge is that most BEC attacks will use bank accounts outside the US. In truth, the IC3 RAT recovered less than 14% of the total US$2.4 billion in BEC losses last year. https://www.welivesecurity.com/2022/04/26/trouble-bec-how-stop-costlie… https://www.ic3.gov/Media/Y2022/PSA220504

Technical + IOCs : https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wi…

A couple of security-research links related to this virus: - (a high-level summary) https://www.welivesecurity.com/2022/02/24/hermeticwiper-new-data-wipin… - (a more-detailed technical analysis) https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/

Yeah, they also raised $8M back in 2016: https://techcrunch.com/2016/05/26/adding-a-youtube-integration-ampme-r… It seems that advertising didn’t work out, so they turned to in-app purchases in 2018 – roughly when the fake reviews also started. On the subscription, it’s harder to cancel than it is to sign up for, like all App Store IAP subscriptions. It really should be possible to easily cancel from within the app itself rather than going to the Settings app – something a lot of people don’t know how to do, unfortunately. “It used to be a legit app”: https://twitter.com/lap_felix/status/1480631686413041666?s=20 On the founder’s previous company: “Wajam: From start‑up to massively‑spread adware” https://www.welivesecurity.com/2019/06/05/wajam-startup-massively-spre…