Transatlantic Cable podcast episode 364 | Kaspersky official blog

/in

Episode 364 kicks off with a chat around the recent furore around Telegram’s problem with unsavoury content. Following that, the conversation moves to a story that might concern people who rely on TOR (The Onion Router), as it’s been disclosed that German police managed to de-anonymise data coming out of an exit node, in order to track and arrest owners of an illegal site.

To wrap up, the team discuss news that delivery robots have been acting erratic, with some cases of them running over pedestrians, seemingly on purpose.  Finally, to close conversation turns to Tamagotchi’s and their seeming imminent return.

If you like what you heard, please consider subscribing.

Telegram will now provide some user data to authorities
Police Broke Tor Anonymity to Arrest Dark Web Users in Major CSAM Bust
Delivery Robot Knocked Over Pedestrian, Company Offered ‘Promo Codes’ to Apologize
A Tamagotchi comeback? Toy gets first UK store as global sales double

Kaspersky official blog – ​Read More

Simple Mail Transfer Pirates: How threat actors are abusing third-party infrastructure to send spam

/in

Attackers are abusing normal features of legitimate web sites to transmit spam, such as the traditional method of verifying the creation of a new account. This web infrastructure and its associated email infrastructure is otherwise used for legitimate purposes, which makes blocking these messages more difficult for defenders. The breadth of different sources of spam suggests that the attackers have automated the process of initially identifying web infrastructure vulnerable to abuse. However, the complexity of executing each individual attack suggests more human involvement. Attackers are also testing credentials obtained from data breaches by credential stuffing IMAP and SMTP accounts. 

Spammers are always looking for creative ways to bypass spam filters. As a spammer, one of the problems with creating your own architecture to deliver mail is that, once the spam starts flowing, these sources (IPs/domains) can be blocked. Spam can more easily find its way into the inbox if it is delivered from an unexpected or legitimate source. Realizing this, many spammers have elected to attack web pages and mail servers of legitimate organizations, so they may use these “pirated” resources to send unsolicited email. 

There are many ways spammers accomplish this task: One is to abuse web pages connected to backend SMTP infrastructure, and another uses breached email/password credentials to try and log into email accounts they can use to send spam. Cisco Talos has new research that explores both styles of attack and delves into some of the tools used by spammers. 

Web form abuse 

The HTML <form> tag was released with HTML version 2.0, nearly 30 years ago. Since then, spammers have found creative ways to abuse web forms. The lack of proper input validation left many of these forms open to manipulation by attackers. Over time, these HTML form attacks became more sophisticated, sometimes employing cross-site scripting or SQL injection. Many administrators learned the hard way that their forms were vulnerable and forced to harden their forms as a result. However, spammers are a persistent bunch, and they look for anything they can use to facilitate malicious activities. Creative spammers have realized that *any* web form that triggers an email back to the user can be abused. 

Online account registration 

Many websites allow users to sign up for an account and log in to access specific features or content. Typically, upon successful user registration, an email is triggered back to the user to confirm the account. In this case, the spammers have overloaded the name field with text and a link, which is unfortunately not validated or sanitized in any way. The resulting email back to the victim contains the spammer’s link. 

An example spam message exploiting an account signup form

Event signup 

Like account registration, many websites let users register to participate in an event. Again, poor input validation and sanitization is prevalent on many of these sites, allowing the spammers to overload the name field with text and URLs. 

An example spam message exploiting an event registration form

Contact form 

Contact forms sometimes send users a copy of their form responses. This could be a checkbox on the form or an automatic reply. Again, the spammers rely on poor input validation and sanitization to transmit text and URLs to the victim. 

An example spam message exploiting a web site contact form

Google Quizzes, Calendar, Groups and other apps 

Talos previously reported on spammers abusing Google Quizzes. But that is not the only Google software that spammers have been abusing. Google Drawings, Sheets, Forms, Calendar and Groups all contain similar vulnerabilities that allow spammers to send unsolicited emails to victims. Additionally, by using a variety of Google applications, and ones that are located in different countries, they can largely avoid detection by Google. 

These messages from Google require some significant pre-attack setup. For example, to send spam from Google Quizzes, the attackers must set up a quiz and configure it correctly, then they must fill out the quiz, masquerading as the victim. Then, the attackers must log back into the Google Quiz they created to “grade” the results and send the quiz score email back to the victim. This suggests a significant human interaction on the part of the spammers. 

An example spam message sent via Google Drawings

 

An example spam message sent via Google SheetsAn example spam message sent via Google FormsAn example spam message sent via Google CalendarAn example spam message sent via Google Groups

Unfortunately for defenders, there is very little we can do to defend against such spam messages. Most of the emails sent by these contact forms are legitimate, so the malicious email blends in with the otherwise legitimate traffic. However, on the positive side, some of the extra content in the emails gives away that the message is not legitimate.   

SMTP server credential stuffing 

Have you ever wondered what cyber criminals do with all the information they’ve obtained in a data breach? If the stolen dataset contains email address usernames and passwords, then it is quite probable that those same credentials will work in other places. Trying the same set of credentials at other sites is known as “credential stuffing.”  

One of the main ways cybercriminals leverage stolen credentials is attempting to access the victim’s email. POP/IMAP servers are often juicy targets, because if an attacker can access a person’s email inbox, then they can find other accounts used by the victim, account usernames/passwords, cryptocurrency wallet keys or perhaps other lucrative, sensitive personal information. Attackers can also leverage access to the victim’s inbox to receive email-based multifactor authentication codes or password resets. 

One of the other, lesser-known ways attackers leverage stolen credentials is on the outbound side of the victim’s mailbox. If an attacker can log into the outbound smtp server as the victim, they can send out email using the victim’s email server. This provides the cybercriminal with a legitimate mail server and domain which are not likely blocked by various spam real-time blackhole lists (RBLs). 

How do cybercriminals locate mailboxes that have working credentials? Typically, the attacker will set up a personal mailbox somewhere (Yahoo, Gmail, etc.) and then send themselves test messages using the stolen credentials at the outbound SMTP server matching the email address’ domain. Some criminals have turned this into an online business by finding working SMTP server credentials and selling them to others. 

A test email from Smart Tools Shop. The price of working SMTP server credentials is $6The Smart Tools Shop interface shows the typical prices of SMTP server credentials 

There are also open-source tools used for these sorts of activities. Among the tools Talos sees most frequently are MadCat and MailRip, both of which are available to download and run on GitHub. 

The MadCat SMTP cracker tool found on Github

 MadCat is an open-source SMTP tool that includes credential-stuffing capabilities. The test emails can be recognized from the Subject header: “Subject: You get a new smtp”. Among some of MadCat’s advertised features is the ability to skip emails hosted by known security vendors such as Cisco. This feature is implemented rather poorly, however, because the code used to skip “dangerous emails” is simply a regular expression with words like “cisco,” “cloudflare,” “proofpoint,” etc., as if spam traps implemented by security organizations are all run out of the main corporate domain name (Spoiler alert: they are not). 

MailRip is another open-source tool capable of credential stuffing in outbound SMTP servers

Another tool that Talos frequently sees performing credential stuffing is a program named MailRip. Although it contains a disclaimer that the code is not to be used “for any kind of illegal activity,” it is a tool primarily designed to facilitate checking username/password combos on IMAP servers and outbound SMTP servers. 

Besides these commercial and open-source tools, Talos also sees attackers who have “rolled their own” tools used for this activity. Typically, the Subject headers are a giveaway that the messages are test emails looking for valid SMTP accounts. However, some of the subject headers and email bodies of test messages are encoded/encrypted. Below are some of the more frequent Subject headers Talos has encountered. 

Common Credential Stuffing Test Message Subject headers: 
Subject: Mail Inbox Test IDF50F22 
Subject: You get a new smtp (from MadCat SMTP cracker tool) 
Subject: smtp id 2496130 
Subject: g1ukczr0iz3b6o6xsk0al0tyqy8ggr (encrypted/encoded Subject/Body) 
Subject: test 
Subject: Testing: mx.example.com 
Subject: new SMTP from MadCat checker 
Subject: Smart Tools Shop – Test SMTP ID: 1016587 
Subject: MailRip Test Result ID0BAB7A (from MailRip Tool) 
Subject: !XProad mx.example.com|2525|nywepaq@example.com|f29r21caT4. (from Laravel Monster Tool) 
Subject: SMTP Check #131085 – Jemex Shop 
Subject: TESTING RELAY! 
Subject: SMTP Check #6148 – Spyxe Shop 
Subject: Your Account ID #62363 
Subject: Mail Test Result ID0CD637.  
Subject: aloha: 127.0.0.255 
Subject: Mail Auto-Email ID86E8A6 
Subject: Mail Email Test ID23CB4D 
Subject: Mail Test Result IDD762AB 
Subject: =?utf-8?q?New_working_smtp_=2350131001?=  

Thwarting SMTP server credential stuffers 

One way Talos has tried to thwart these types of attacks is to make them believe that the actors have found a working outbound email account.  

To accomplish this, Talos has configured some of our spam traps to deliver those messages we have identified by Subject as test messages from the credential stuffers, while every other email is sent to various internal anti-spam systems for processing. Once the credential stuffers believe they have found a valid account, they typically turn on the spam firehose, which causes all the connecting IP addresses to be dinged for sending spam, which significantly affects those addresses’ ability to deliver mail to the inbox. 

 The anti-spam industry has largely been successful at driving a wedge between legitimate senders and spammers, causing spammers to seek out new ways to deliver their mail.  

Rather than send directly, these spammers have chosen to try and blend in with legitimate traffic to make their spam more difficult to block.  

Defenses 

Create Unique Passwords: People are terrible at creating and remembering good passwords. For the past several decades, even, the most popular unsafe password has been “123456”. Despite years of guidance from the security community that people should use a unique password for every website, many users will re-use the same credentials at several different sites. When someone is using unique credentials everywhere, one single compromised account will not impact any other online accounts belonging to that victim.  

Use a password manager: All those unique passwords you have been creating are going to be hard to remember. But avoid storing credentials in a browser. These can be stolen by attackers quite easily. A perfect tool exists for storing your passwords: a password manager. It is best to use a dedicated password manger such as KeePass, LastPass or 1Password. 

Educate Users: Unfortunately for defenders, there is very little we can do to defend against spam messages sent from legitimate forms. Most of the emails sent via forms are legitimate, so the malicious email blends in with the otherwise legitimate email traffic. However, on the positive side, some of the extra content in the emails gives away that the message is not legitimate. Educating your users to be wary of such email messages is a good way to prevent them from falling victim to phishing and other attacks that arrive by email. 

Cisco Talos Blog – ​Read More

Deluge of Threats to Water Utilities: Plugging the Leaks in Operational Technology Security

/in

Executive Summary

Water treatment facilities are critical components of public infrastructure, with over 148,000 public water systems operating in the United States alone. Underscoring their criticality, these facilities are increasingly facing cyberattacks due to the lack of robust cybersecurity measures compared to other industries. In one of the most recent and gruesome hacks in September 2024, hackers attacked the Arkansas City water treatment plant, forcing it to switch to manual operations.

Cyble Research & Intelligence Labs (CRIL) has been emphasizing the critical need to safeguard operational technology (OT) assets and the existing negligence in adhering to basic cybersecurity protocols such as changing the default credentials, ensuring systematic network segmentation of OT assets, and mitigating their exposures over the internet.

Emphasizing the urgency, CISA too recently released a joint fact sheet, highlighting ongoing cyber-attacks conducted by pro-Russia hacktivists specifically targeting operational technology (OT) devices across North America and Europe.  

The joint fact sheet states – “authoring organizations are aware of pro-Russia hacktivists targeting and compromising small-scale OT systems in North American and European Water and Wastewater Systems (WWS), Dams, Energy, and Food and Agriculture Sectors. These hacktivists seek to compromise modular, internet-exposed industrial control systems (ICS) through their software components, such as human machine interfaces (HMIs), by exploiting virtual network computing (VNC) remote access software and default passwords”

Water Utilities in the Crosshairs of People’s Cyber Army

Since January this year, the pro-Russian hacktivist group People’s Cyber Army (PCA) has been observed to be targeting critical infrastructures such as Water Utilities across the US and Europe. Amongst their first attack, PCA targeted the water supply control systems in multiple Texan towns and a wastewater facility in a Polish village. According to the US media reports, this resulted in the spilling of tens of thousands of gallons of water onto streets and drainage systems, causing considerable public distress and potential environmental damage.

In March, they disseminated a video on their Telegram channel (later removed) claiming an attack on a French hydroelectric power station.

Cyble Research & Intelligence Labs (CRIL) observed that in the last six months, the People’s Cyber Army (PCA) has increased its attacks on Water Treatment facilities across the US and Europe.

Products and Protocols at Risk

Basis the investigation carried out by CRIL researchers, the majority of water treatment facilities in the US are at risk due to:


Threat Actors Exploiting VNC protocols: Hacktivist groups are leveraging internet-facing and near-obsolete VNC to access HMI systems installed in the environments of organizations dealing with the Wastewater Treatment Sector.

Internet-facing SCADAView CSX, a SCADA (Supervisory Control and Data Acquisition) software developed by Micro-Comm, Inc., is widely used in Water Utilities across the country. It provides a human-machine interface (HMI) for monitoring and controlling central telemetry units (CTUs).  Link

To further highlight the gravity of the situation, the map and statistics below indicate the growing number of internet-exposed water utilities across the United States. Considering the growing attacks on Water utilities, as highlighted in the previous section, such thinly protected assets are susceptible to serious threats from hacktivist groups and state/non-state actors.

Impact


Disruption of Operations: A cyberattack on the HMI could disrupt critical operations, leading to incorrect control of pumps, valves, and other equipment, potentially causing overflows, spillage, or contamination in the water treatment process.

Public Health Risks: A compromised HMI could result in the improper treatment of wastewater, leading to the release of untreated or improperly treated water into the environment. This could pose significant public health risks by contaminating drinking water sources or ecosystems.

Environmental Damage: An attack could cause systems to malfunction or shut down, releasing toxic chemicals or untreated sewage into nearby rivers, lakes, or the ground, causing long-term environmental damage.

Financial Losses: Downtime and recovery efforts resulting from a cyberattack could lead to significant financial losses for the facility due to halted operations, repair costs, and potential regulatory fines.

Safety Risks for Personnel: Malfunctioning HMI systems could create unsafe working conditions for operators and maintenance staff, potentially leading to accidents, injuries, or exposure to hazardous substances.

Hacktivism Chronicles

The People’s Cyber Army (PCA) first emerged shortly after the onset of the Russian-Ukrainian War in 2022 and maintains a substantial presence through its Telegram channel, which has 61,000 subscribers, and a network of private Telegram channels, where members set objectives, collaborate, and receive operational commands.

Early in its existence, PCA promoted Distributed Denial of Service (DDoS) attack tools, actively targeting Ukrainian infrastructure while encouraging followers to participate. They also provided training content, including a DDoS tool, through their Telegram channel to enable their subscribers to support them in their activism.

Gradually, PCA expanded its Telegram channel content to include narratives from Russian propaganda outlets, PMC Wagner, and pro-Russian war correspondents and bloggers.

By 2023, PCA expanded its operations beyond Ukraine and began targeting entities, especially Internet Service Providers (ISPs) in the EU and the US.

In 2024, the hacktivist group announced strategic alliances with other hacktivist groups with similar ideologies, such as NoName057(16), Federal Legion, CyberDragon, Phoenix, and 22C, to extend and collaborate in several hacktivist campaigns.

The People’s Cyber Army and Xacknet are likely to interact with or be controlled by the GRU – Russia’s military intelligence agency.

On July 19, 2024, the United States publicly revealed the identities of two members of the Russian-aligned hacktivist group People’s Cyber Army. It imposed sanctions on them for their involvement in cyber operations targeting critical U.S. infrastructure. Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko were identified as key figures within the group, with Pankratova serving as the group’s leader and Degtyarenko as a primary hacker. These sanctions highlight ongoing efforts to counter cyber threats from state-affiliated actors.

Conclusion

The increasing frequency and sophistication of hacktivist attacks on water utilities, particularly those attributed to groups like the People’s Cyber Army of Russia and other pro-Russian entities, underscores the need for promptly safeguarding such critical infrastructures. Recent incidents, such as the cyberattack on the Tipton West Wastewater Treatment Plant, reveal not only the technical capabilities of these groups but also their intent to disrupt essential services that millions rely on daily. The fact that these attacks have targeted municipal systems, often with limited resources for cybersecurity, raises alarms about the potential for more severe disruptions in the future.

Considering the increasing number of internet-exposed Water Utility assets across the United States, continuing use of outdated systems, and inadequate security protocols in such critical facilities, there is an urgent need to implement robust security measures. The Environmental Protection Agency (EPA) too has echoed these concerns, noting that a staggering 70% of inspected water utilities do not meet basic cybersecurity standards.

We see that Russian hacktivist groups leverage cyberattacks not only for operational disruption but also as a tool for propaganda. By publicly exposing vulnerabilities in a high-profile target like the United States Infrastructure, they seek to erode confidence in U.S. cybersecurity defenses. Notably, the People’s Cyber Army has escalated its targeting of critical infrastructure following sanctions on its leadership, signaling a clear intent to persist in these operations despite international pressure.

The potential consequences of inaction are dire, considering the world sits on the brink of kinetic and cyber war; these weaknesses in Water utilities not only pose threats of operational disruptions but also contamination of drinking water supplies, posing significant risks to public health.

Recommendations


Harden HMI Remote Access: Secure remote access to HMIs using VPNs to encrypt data and require Multi-Factor Authentication (MFA) for user verification. Limit access through whitelisted IP addresses and geo-fencing and regularly audit logs to detect unauthorized activities.

Strengthen Security Posture: Conduct regular vulnerability assessments and penetration testing to identify weaknesses. Use SIEM tools and Intrusion Detection Systems (IDS) for continuous monitoring and deploy endpoint protection on critical assets. Ensure timely software and firmware updates.

Network Segmentation: Separate IT and OT networks using firewalls and DMZs to limit exposure. Use VLANs to isolate critical systems and apply strict access controls to minimize unnecessary communication between network segments.

Asset Visibility: Use automated asset discovery tools to monitor all connected devices and maintain an updated inventory of hardware and software. Network traffic analysis helps detect anomalies, while passive scanning avoids disrupting operations.

Eliminate Default Passwords & Use MFA: Replace default credentials with strong, unique passwords and enforce regular password changes. Implement MFA for all accounts, especially those with privileged access, and remove unused accounts to reduce the attack surface.

Incident Response Plan: Prepare and refine an Incident Response Plan that defines roles and actions for cyber incidents. Include steps for containment, eradication, and recovery while ensuring clear communication protocols for internal stakeholders and external parties.

Enhance Employee Training and Awareness: Conduct ongoing cybersecurity training programs for all employees, particularly those with access to OT systems. This includes educating staff on recognizing phishing attempts, proper use of authentication mechanisms, and the importance of following security protocols to prevent accidental security breaches.

References

https://www.cisa.gov/sites/default/files/2024-05/defending-ot-operations-against-ongoing-pro-russia-hacktivist-activity-508c.pdf
https://www.scadaview.com/Micro-Comm/
https://cyble.com/blog/water-and-wastewater-treatment-facilities-vulnerable-to-cyber-attacks/

The post Deluge of Threats to Water Utilities: Plugging the Leaks in Operational Technology Security appeared first on Cyble.

Blog – Cyble – ​Read More

Urgent Security Advisory: CVE-2024-7593 Exposes Ivanti VTM to Attacks

/in

Overview

The Cybersecurity Infrastructure and Security Agency (CISA) and Ivanti have shared an update advisory highlighting a critical authentication bypass vulnerability, CVE-2024-7593, in Ivanti’s Virtual Traffic Manager (VTM). This vulnerability has garnered attention due to its inclusion in the CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating that it is currently being targeted by threat actors.

Ivanti’s Virtual Traffic Manager serves as a software-based application delivery controller designed to optimize and manage network traffic across web and application servers. By efficiently distributing traffic, inspecting requests, and managing workloads, VTM enhances application performance, security, and scalability. However, the identified vulnerability poses significant risks that organizations must address promptly.

Ivanti’s Virtual Traffic Manager (VTM) Vulnerability

The vulnerability classification for CVE-2024-7593, which pertains to an authentication bypass, falls under a critical rating with a CVSS score of 9.8. It affects several versions of Ivanti Virtual Traffic Manager, specifically versions 22.2, 22.3, 22.3R2, 22.5R1, 22.6R1, and 22.7R1.

This flaw allows remote attackers to create administrator accounts, granting them unauthorized access to critical administrative functions within the VTM. At the time of the advisory’s release, Cyble’s ODIN scanner detected 67 internet-facing instances of Ivanti VTM, predominantly located in Japan and the United States. Given this context, organizations are strongly advised to review their audit logs to identify any potential unauthorized access attempts.

Given that the vulnerability can be exploited through the management interface, Ivanti recommends limiting administrative access to the management interface exclusively within internal networks. By restricting access to private or corporate networks, organizations can significantly reduce their exposure to potential threats.

Conclusion

The Ivanti Virtual Traffic Manager plays a pivotal role in ensuring efficient network operations and application performance. However, the recent identification of CVE-2024-7593 highlights the importance of vigilant security practices. With this vulnerability being actively exploited by threat actors, it is important for organizations relying on Ivanti VTM to take immediate action.

Recommended Actions


Implement the most recent patches released by Ivanti. Regular software updates are essential to close security gaps and protect against exploits. Establish a routine for patch applications, ensuring that critical updates are prioritized.

Establish a robust patch management strategy that includes inventory management, assessment, testing, deployment, and verification of patches. Automating parts of this process can enhance efficiency and ensure consistent application.

To minimize the exposure of critical assets, organizations should segment their networks. This involves creating distinct zones for sensitive information and utilizing firewalls, VLANs, and access controls to regulate access.

Organizations must develop and maintain an incident response plan that outlines procedures for detecting, responding to, and recovering from security incidents. Regular testing and updates are essential to adapt to new threats.

Comprehensive monitoring and logging systems are vital for detecting malicious activities. Implementing Security Information and Event Management (SIEM) solutions can help organizations aggregate and analyze logs for real-time threat detection.

The post Urgent Security Advisory: CVE-2024-7593 Exposes Ivanti VTM to Attacks appeared first on Cyble.

Blog – Cyble – ​Read More

Apex Softcell Flaws Could Lead to Unauthorized Transactions, CERT-In Warns

/in

Overview

The Indian Computer Emergency Response Team (CERT-In) has warned users about five high-severity vulnerabilities in Apex Softcell’s mobile stock trading and back-office platforms.

The 32-year-old private company focuses on products and solutions for capital markets and the financial industry, making any vulnerability potentially critical.

According to the CERT-In advisory published last week, the vulnerabilities affect Apex Softcell LD Geo versions prior to 4.0.0.7 and LD DP Back Office versions prior to 24.8.21.1 and could allow a remote attacker to perform user enumeration, bypass OTP verification, manipulate unauthorized transactions, or gain unauthorized access to sensitive information of other user accounts.

Affected Products and Vulnerabilities

The affected products include Apex Softcell LD Geo versions prior to 4.0.0.7 and Apex Softcell LD DP Back Office versions prior to 24.8.21.1. Several vulnerabilities have been identified but not yet announced, including CVE-2024-47085, CVE-2024-47086, CVE-2024-47087, CVE-2024-47088, and CVE-2024-47089.

CVE-2024-47085: Parameter Manipulation Vulnerability

This vulnerability exists in the LD DP Back Office because of improper validation of the parameters “cCdslClicentcode” and “cLdClientCode” in the API endpoint. Authenticated remote attackers could exploit this vulnerability via the manipulation of parameters in the API request body, leading to the exposure of sensitive information belonging to other users.

CVE-2024-47086: OTP Bypass Vulnerability

Another LD DP Back Office vulnerability, this one caused by improper implementation of an OTP validation mechanism in certain API endpoints, could be exploited by an authenticated remote attacker who provides arbitrary OTP values for authentication, subsequently changing the API response, and bypassing OTP verification for other user accounts.

CVE-2024-47087: Information Disclosure Vulnerability

This vulnerability in LD Geo is due to improper validation of certain parameters (Client ID, DPID, or BOID) in the API endpoint. Authenticated remote attackers could exploit this vulnerability by manipulating parameters in the API request body, leading to sensitive information exposure.

CVE-2024-47088: User Enumeration Vulnerability

This vulnerability in LD Geo is created by missing restrictions for excessive failed authentication attempts on its API-based login. Remote attacks could exploit this by conducting a brute force attack on login OTP, which could lead to unauthorized access to other user accounts.

CVE-2024-47089: Unauthorized Transaction Manipulation Vulnerability

This LD Geo vulnerability is caused by improper validation of the transaction token ID in the API endpoint. Authenticated remote attackers could exploit this by manipulating the transaction token ID in the API request, leading to unauthorized access and modification of transactions belonging to other users.

Users should upgrade Apex Softcell LD Geo to version 4.0.0.7 and Apex Softcell LD DP Back Office to version 24.8.21.1.

Conclusion

Remote attackers could manipulate transactions, bypass authentication, and access sensitive user information, and the implications of these vulnerabilities could be severe. To mitigate these risks, all users of Apex Softcell LD Geo and LD DP Back Office must immediately upgrade to the latest versions—4.0.0.7 and 24.8.21.1, respectively. Proactive measures and timely updates are essential to monitor and secure sensitive financial data as well as maintain the integrity of trading operations.

Mitigation and Recommendations


Users must upgrade to Apex Softcell LD Geo version 4.0.0.7 and LD DP Back Office version 24.8.21.1 to close the identified vulnerabilities.

Ensure that all API endpoints validate input parameters rigorously to prevent parameter manipulation and unauthorized access.

Employ anomaly detection systems to identify unusual patterns, such as excessive failed login attempts, which may indicate brute-force attacks.

Perform periodic security assessments and penetration testing on the trading platforms to identify and address vulnerabilities proactively.

Train users to recognize potential phishing attempts and unauthorized access attempts, reinforcing the importance of strong, unique passwords.

Enforce the principle of least privilege, granting users only the access necessary for their roles, thereby reducing the impact of a compromised account.

Subscribe to security advisories and maintain awareness of newly discovered vulnerabilities related to the software in use to ensure timely responses.

The post Apex Softcell Flaws Could Lead to Unauthorized Transactions, CERT-In Warns appeared first on Cyble.

Blog – Cyble – ​Read More

Talos discovers denial-of-service vulnerability in Microsoft Audio Bus; Potential remote code execution in popular open-source PLC

/in

Cisco Talos’ Vulnerability Research team recently disclosed two vulnerabilities in Microsoft products that have been patched by the company over the past two Patch Tuesdays. 

One is a vulnerability in the High-Definition Audio Bus Driver in Windows systems that could lead to a denial of service, while the other is a memory corruption issue that exists in a multicasting protocol in Windows 10. 

Additionally, Talos researchers have disclosed three vulnerabilities in OpenPLC, a popular open-source programmable logic controller.  

For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website. 

Microsoft High-Definition Audio Bus Driver denial-of-service vulnerability 

Discovered by Marcin “Icewall” Noga. 

TALOS-2024-2008 (CVE-2024-45383) is a vulnerability in the Microsoft HD Audio Bus Driver that could allow an attacker to cause a denial of service. 

The driver allows the Windows operating system to communicate with external audio devices that play sound, including those that are integrated into machines’ motherboards or connected via HD audio interfaces.  

A mishandling of IRP requests in the driver’s interface could allow an attacker to send multiple IRP Complete requests to the driver, causing the DoS and forcing the operating system into the “Blue Screen of Death.” 

Stale memory dereference in Microsoft Pragmatic General Multicast Server 

Discovered by a Cisco Talos researcher. 

A memory corruption vulnerability exists in the Pragmatic General Multicast server in the Microsoft Windows 10 Kernel.  

The Pragmatic General Multicast protocol is an IP-based multicasting protocol that is implemented by Microsoft as part of the Message Queueing service available in different versions of Windows. 

A specially crafted network packet can lead to the access of stale memory structure, resulting in memory corruption. An attacker can send a sequence of malicious packets to trigger TALOS-2024-2062 (CVE-2024-38140). 

Talos independently discovered this issue and reported it to Microsoft prior to their patch release earlier this year. However, Microsoft informed us that an internal researcher had already discovered this issue. 

Three vulnerabilities in OpenPLC 

Discovered by Jared Rittle.

Talos recently discovered three vulnerabilities in OpenPLC, an open-source programmable logic controller designed to provide a low-cost option for automation in many manufacturing and logistics settings. 

Two of the issues — TALOS-2024-2004 (CVE-2024-36980, CVE-2024-36981) and TALOS-2024-2016 (CVE-2024-39589, CVE-2024-39590) — can lead to a denial-of-service on the targeted device. An adversary could exploit these vulnerabilities by sending a series of specially crafted Ethernet/IP requests. 

Another stack-based buffer overflow vulnerability, TALOS-2024-2005 (CVE-2024-34026), can also be exploited in this way. However, in this case, it could lead to remote code execution.  

Cisco Talos Blog – ​Read More

Cyble Recognized in G2 Fall 2024 for Leadership and Best-in-Class Dark Web Monitoring Setup and Usability 

/in

In this digital era, cyber threats become increasingly sophisticated, and companies need advanced solutions to protect their digital assets, particularly from the darker corners of the internet. Cyble, a prominent player in the cybersecurity domain, has achieved notable recognition in the G2 Fall 2024 Report. The company has been honored for its excellence in Dark Web Monitoring, earning accolades in the categories of Leadership, Easiest Setup, and Easiest to Use. These accolades solidify Cyble’s position as a leader in the industry and underscore its commitment to providing user-friendly and effective cybersecurity solutions. 

The Significance of G2’s Recognition 

G2 is a globally renowned platform that aggregates user reviews for software and services, providing valuable insights into their real-world applications and performance. To be recognized by G2 is a significant endorsement, as these accolades are based on authentic user experiences and feedback. Cyble’s multiple recognitions in the G2 Fall 2024 Report demonstrate the company’s ability to deliver high-quality and user-centric solutions that meet the evolving needs of businesses in mitigating cybersecurity threats. 

Leadership in Dark Web Monitoring 

Cyble’s recognition as a leader in Dark Web Monitoring is a testament to its comprehensive capabilities and market influence. This accolade is bestowed upon companies that not only offer robust solutions but also exert significant influence and presence in the market. 

Why Cyble Stands Out? 

1. Advanced Threat Detection: Cyble’s Dark Web Monitoring platform is acclaimed for its advanced threat detection capabilities. It continuously scans the dark web for potential threats, ensuring that businesses are promptly informed about any compromised data or emerging risks. 

2. Comprehensive Insights: The platform provides detailed insights into threats, including the source, nature, and potential impact. This helps businesses understand the context of the threats and implement appropriate mitigation strategies. 

3. Proactive Defense: By identifying threats at their source, Cyble enables organizations to adopt a proactive defense strategy, mitigating risks before they escalate into significant security breaches. 

Customer Endorsements 

Users have highlighted the platform’s effectiveness in uncovering hidden threats that standard security measures might overlook. Cyble’s commitment to delivering actionable intelligence allows businesses to stay ahead of cybercriminals, protecting their sensitive information and maintaining their reputation. 

Easiest Setup: Rapid Deployment and Minimal Disruption 

In today’s fast-paced business environment, the ability to quickly deploy and integrate cybersecurity solutions is crucial. Cyble’s recognition for the easiest setup emphasizes its commitment to providing solutions that are not only powerful but also accessible and easy to implement. 

Seamless Integration 

Employing advanced but straightforward integration processes, Cyble ensures that its Dark Web Monitoring platform can be seamlessly incorporated into existing security infrastructures with minimal disruption. This ease of setup is particularly beneficial for businesses that need to quickly fortify their defenses without diverting valuable resources to complex installations. 

User Feedback on Setup Process 

Users have consistently praised Cyble for its user-friendly setup procedures. Key highlights include: 

Quick Onboarding: Businesses can get the platform up and running swiftly, which is crucial for immediate threat monitoring. 

Minimal Technical Hurdles: The setup process does not require extensive technical knowledge or specialized skills, making it accessible to a broader range of users. 

Comprehensive Support: Cyble offers robust support during the setup phase, ensuring users can navigate any challenges smoothly. 

Easiest to Use: Intuitive Design and User-Friendly Features 

In addition to rapid deployment, the usability of cybersecurity solutions significantly impacts their effectiveness. Cyble’s accolade for the easiest-to-use platform reflects its dedication to creating an intuitive user experience that facilitates quick adoption and efficient operation. 

User-Centric Design 

The design philosophy behind Cyble’s Dark Web Monitoring platform focuses on simplicity and functionality. Key aspects of its user-friendly interface include: 

Intuitive Dashboard: The platform’s dashboard is designed to provide a clear and concise overview of threats, making it easy for users to access critical information at a glance. 

Easy Navigation: Navigating through the platform is straightforward, with well-organized sections and clearly labeled features that enable users to find what they need quickly. 

Detailed Reporting: Users receive comprehensive reports that are easy to understand, helping them make informed decisions without the need for extensive technical knowledge. 

Real-World User Experiences 

Users have highlighted several aspects that contribute to the platform’s ease of use: 

Lower Learning Curve: The intuitive design ensures that users can quickly learn to navigate and utilize the platform’s features. 

Efficiency: The streamlined interface allows for efficient threat monitoring and response, saving time and resources. 

Accessible Features: Even users with minimal cybersecurity background can leverage the platform’s full capabilities effectively. 

Cyble’s accolades in the G2 Fall 2024 Report are a significant milestone, but the company remains focused on continuous improvement and innovation. The cybersecurity landscape is ever-evolving, and staying ahead requires a dynamic and proactive approach. 

Future Enhancements 

Leveraging Advanced Technologies: Cyble is committed to integrating cutting-edge technologies like artificial intelligence and machine learning to enhance its threat detection and analysis capabilities. 

Expanding Regional Focus: The company plans to extend its reach, providing localized and contextually relevant solutions to meet the unique cybersecurity needs of different regions. 

Continuous User Feedback: By actively seeking and integrating user feedback, Cyble aims to refine its products continuously, ensuring they remain effective and user-friendly. 

Conclusion 

Cyble’s multiple recognitions in the G2 Fall 2024 Report for Leadership, Easiest Setup, and Easiest to Use in Dark Web Monitoring highlight its excellence and leadership in the cybersecurity domain. These accolades reflect the company’s commitment to providing high-quality, user-centric solutions that address businesses’ specific needs in protecting against cyber threats. 

By focusing on advanced threat detection, seamless integration, and an intuitive user experience, Cyble ensures that businesses can safeguard their digital assets effectively. As the digital landscape continues to evolve, Cyble’s dedication to innovation and customer satisfaction guarantees that it will remain a trusted partner for organizations seeking robust and reliable cybersecurity solutions. 

The post Cyble Recognized in G2 Fall 2024 for Leadership and Best-in-Class Dark Web Monitoring Setup and Usability  appeared first on Cyble.

Blog – Cyble – ​Read More

Cyble Recognized in G2 Fall 2024 Report as a Testament to Excellence in Brand Intelligence 

/in

In an era where cybersecurity is paramount, the recognition and reputation of a security solution provider can significantly influence its credibility and market standing. Cyble has once again set a higher benchmark in the cybersecurity industry by achieving multiple prestigious accolades in the G2 Fall 2024 Report. These achievements include being recognized as a High Performer Fall, Leader Asia Fall, Leader Asia Pacific Fall, Easiest to Use Fall, and Easiest Setup Fall 2024 in the Brand Intelligence category. This comprehensive recognition underscores Cyble’s commitment to excellence and user satisfaction. 

The Importance of G2’s Recognition 

G2, a globally renowned platform for software and services reviews, plays a crucial role in the decision-making processes of businesses worldwide. What sets G2 apart is its reliance on authentic user reviews and experiences. Earning high ranks in G2 reports is a direct reflection of user satisfaction, product reliability, and the overall quality of service provided. Therefore, Cyble’s multiple recognitions in G2’s Fall 2024 Report are particularly noteworthy and demonstrate the company’s industry leadership. 

High Performer Fall 2024: Consistent Excellence 

Cyble’s recognition as a High Performer Fall 2024 signifies its consistent delivery of superior brand intelligence solutions. High Performer awards are given to firms that have high customer satisfaction scores in their respective categories but may not have the presence of market giants. Despite the competitive nature of the cybersecurity landscape, this accolade highlights the effectiveness and reliability of Cyble’s brand intelligence solutions, tailored to meet the unique needs of various organizations. Users have acknowledged the platform’s robust capabilities, marked improvement in threat detection, and intelligent insights that help businesses safeguard their digital assets. 

Leader Asia Fall and Leader Asia Pacific Fall 2024: Regional Dominance 

Cyble’s dual recognition as a Leader in both Asia and Asia Pacific regions in the Fall 2024 Report is a testament to its regional dominance and understanding of localized cybersecurity challenges. This recognition is awarded to companies that are not only high performers but also have significant market presence and influence in their respective regions.  

In regions where cyber threats are evolving rapidly and are often sophisticated, organizations require resilient and adaptive solutions. Cyble has successfully addressed these needs by providing insightful, region-specific intelligence that helps businesses anticipate, mitigate, and respond to potential threats. User reviews from these regions highlight Cyble’s ability to deliver effective, culturally aware, and linguistically sensitive cybersecurity solutions. 

Easiest to Use Fall 2024: User-Friendly Interface 

Ease of use is a critical factor in the adoption and effective application of any cybersecurity tool. In recognition of this, Cyble has been awarded the Easiest to Use Fall 2024 badge in the Brand Intelligence category, reflecting its commitment to providing a seamless and intuitive user experience. The platform’s interface is designed to be user-friendly, enabling even those with minimal technical knowledge to navigate and utilize its powerful features effectively. 

User testimonials praise the platform’s intuitive dashboard, straightforward navigation, and comprehensive yet easy-to-understand reports. This user-centric approach empowers businesses to quickly grasp and act on crucial cybersecurity insights without the steep learning curve often associated with high-end security solutions. 

Easiest Setup Fall 2024: Rapid Deployment and Integration 

In today’s fast-paced business environment, time is of the essence. The Easiest Setup Fall 2024 award recognizes Cyble’s excellence in enabling swift deployment and integration. A user-friendly setup process ensures that companies can get their cybersecurity measures up and running without unnecessary delays. This is particularly beneficial for businesses that need to quickly address their security needs without diverting significant resources to understanding and implementing complex solutions. 

Customers have highlighted the platform’s straightforward installation process, smooth integration with existing systems, and minimal need for extensive technical support. This ease of setup has been pivotal in helping businesses, regardless of size, to fortify their defenses promptly and efficiently. 

The Holistic Impact of Cyble’s Recognitions 

Cyble’s multiple accolades in the G2 Fall 2024 Report serve as a comprehensive validation of its capabilities and market influence. Each award captures a different aspect of user satisfaction and product excellence, highlighting a broader picture of Cyble as a leader in brand intelligence: 

1. Customer-Centric Approach: The recognitions reaffirm Cyble’s focus on understanding and addressing customer needs, delivering user-friendly and effective solutions. 

2. Regional Expertise: Being a leader in Asia and Asia Pacific showcases Cyble’s ability to cater to diverse market requirements, handling region-specific challenges adeptly. 

3. Innovative Solutions: The consistent delivery of high performance and ease of use highlights Cyble’s innovative approach to cybersecurity, focusing on making advanced technology accessible and practical for all users. 

Future Prospects and Continuous Improvement 

While these accolades are a significant achievement, Cyble remains committed to continuous improvement and innovation. The ever-evolving nature of cyber threats demands that cybersecurity solutions providers stay ahead of the curve, anticipating new challenges and developing proactive measures. Cyble’s approach involves ongoing research, user feedback, and leveraging advanced technologies like artificial intelligence and machine learning to enhance its offerings continually. 

Conclusion 

Cyble’s recognition in the G2 Fall 2024 Report as a High Performer, Leader in Asia and Asia Pacific, Easiest to Use, and Easiest Setup underlines its excellence in the brand intelligence sector. These accolades reflect the company’s enduring commitment to delivering high-quality, user-centric cybersecurity solutions that address both global and regional challenges. As businesses worldwide navigate the complexities of digital transformation and increasing cyber threats, Cyble stands out as a trusted partner, committed to safeguarding their digital futures with innovative and reliable brand intelligence tools. 

The future looks promising as Cyble continues to push the boundaries of cybersecurity, maintaining its position as an industry leader dedicated to protecting businesses in an interconnected world. 

The post Cyble Recognized in G2 Fall 2024 Report as a Testament to Excellence in Brand Intelligence  appeared first on Cyble.

Blog – Cyble – ​Read More

How to Intercept Data Exfiltrated by Malware via Telegram and Discord

/in

Often, malware uses platforms like — Telegram and Discord for data exfiltration. Due to its simplicity and the lack of need for building a server architecture, this exfiltration method has gained significant popularity. However, this very simplicity is also its weakness. 

In this article we’ll show you how to obtain information related to threat actors’ activities using Telegram API, which can help reveal their identity, attribute malware samples to known families or discover new ones.  

Parsing a Telegram Chat  

First, we need to find a relevant malware sample using Threat Intelligence Lookup with the following query: 

​​domainName:”api.telegram.org”​

TI Lookup instantly provides matching sandbox sessions found across its vast database 

TI Lookup reveals a hundred sandbox sessions featuring samples that match our query.

Start your first investigation in TI Lookup 



Get a free trial


We can select one of them and rerun it with the MITM Proxy feature enabled.

The sandbox analysis setup window in ANY.RUN lets you configure your environment 

In Telegram, to send a message, two main methods are typically used: 

/sendMessage 

/sendDocument 

For sending text 

For sending text and files 

Any HTTP method (GET, POST, etc.) can be used. The GET method allows parameters to be passed in the query string (url-encoded) 

Only the POST method is available. The POST method requires parameters to be passed in the request body 

After turning on the MITM Proxy and starting the sandbox session, we navigate to the HTTP Requests tab, where we can see a request to api.telegram.org. 

The HTTP Requests tab displays all requests recorded during the session

Looking at the POST request to /sendDocument, we see that it uses the form-data method for transmission. 

In this case, the bot token can be obtained from the URL of the request, and the chat_id from the body (in the screenshot, it is the first parameter in the body). 

Data/contents of the request to the Telegram API

We can also examine the response from the server. It arrives in JSON format and contains a lot of useful information: the chat_id, bot username, bot name/title, chat name, and chat type. 

The server response examined in the ANY.RUN sandbox 

In this sandbox session, we can see an example of a request to /sendMessage using the GET method, where the data is passed in the query string (url-encoded): 

Encoded query string shown in the ANY.RUN sandbox 

Analyze malware and phishing in ANY.RUN sandbox 



Sign up for free


Using CyberChef, we can decode the query string. Here is what the sent data looks like: 

The system info exfiltrated to a Telegram bot 

In this case, the bot token and chat_id are present in the query string. 

Now, let’s use the attacker’s chat_id and bot token. The chat_id can refer to either a group chat or direct messages. First, we check if the bot has a webhook: 

https://api.telegram.org/bot<token>/getWebhookInfo

The presence of a webhook means a high chance of early detection of abuse.

The result of a request to /getWebhookInfo when no webhook is set 

If a webhook is present, we save its data and delete it using /deleteWebhook. 

NOTE! The webhook may have a secret token which could reveal the substitution. 

Description of the secret token

If there is no webhook, the likelihood of detection is very low.  

Next, you need to:  

Create a Telegram group  

Make yourself anonymous 

And only then add the bot to the group 

Here is how you can create a group using different clients: 

Telegram Desktop 

Menu (☰) > New Group > Next > Create  

Telegram Web (K version) 

New (🖉) > New group > Next (⮕) > Next (⮕) 

Telegram App 

Menu (☰) > New Group > Next (⮕) > Create (✓) 

Then the group chat will open, if not – open it manually 

Next, we need to set the Administrators list and change your user settings:

Telegram Desktop 

Settings (⋮) > Manage Group > Administrators > Right click on your profile > Edit admin rights 

Telegram Web (K version) 

Click on group header > Side-menu appears > Edit (🖉) > Administrators > Click on your user profile 

Telegram App 

Click on group header > Edit (🖉) > Administrators > Click on your user profile 

In the opened window, toggle Remain anonymous and click Save. 

It’s important to select Remain anonymous 

If everything is successful, the input field will display the placeholder “Send anonymously.” For Telegram Web, you may need to refresh the page. 

The input field contains the “Send anonymously” text 

Now, let’s add the bot to the group: 

Telegram Desktop 

Click on group header > Add member (+) > Enter bot name and click > Add 

Telegram Web (K version) 

Click on group header > Side-menu appears > Add member (+) > Enter bot name and click > Next (⮕) > Pop-up appears > Add 

Telegram App 

Click on group header > Click on “+ Add members” > Enter bot name and click > Submit (✓) > Pop-up appears > Add 

The bot username can be obtained by calling /getMe.

The bot username is “LABKEN_BOT”

After adding the bot, the following message will be displayed: 

The bot was successfully added

Next, it is necessary to call the /getUpdates method with the argument offset=-1. 

This will reset the bot’s update history to the most recent update. 

The latest update awaiting processing by the bot, in JSON format

From the data received from the server (see the image above), we take the update_id and chat_id and save them. The chat_id is the ID of the group to which we added the bot. 

Next, we call /getUpdates again with the argument offset=update_id + 1. 

The server returns an empty array of updates 

This will completely clear the bot’s update history. After this, if a webhook existed, we restore it using /setWebhook. 

Once the bot has been added, you can use several methods such as /forwardMessage, /copyMessage, /deleteMessage, /getChat, and /getChatAdministrators, which are among the most useful. 

You can experiment with these methods in interactive mode here: https://telegram-bot-api.vercel.app 

Remove the “bot” part when entering the bot token

We enter the bot token in the token field. 

Next, we call /forwardMessage with the arguments: 

chat_id: the ID of the group chat 

from_chat_id: from the malware request 

message_id: the index of the message in the chat 

Fill out the fields

We enter the parameters in the corresponding fields (chat_id, from_chat_id, message_id) and click Execute.

JSON response

As a result, we receive a response in JSON format containing information about the forwarded message. 

As a result of the request, a message is sent to the group

You can also do this directly in the browser: 

https://api.telegram.org/bot<token>/forwardMessage?chat_id=<your_chat_id>&from_chat_id=<malware_chat_id>&message_id=<message_id_from_malware>

For demonstration purposes, we will use another bot mentioned earlier. The actual request is: https://api.telegram.org/bot7023899363:AAFEzgbfWzhyE32Lf95TKSRYEYXMd4AfMyk/forwardMessage?chat_id=-1002455457772&from_chat_id=6354844663&message_id=49817 

The server response

The server returns data about the forwarded message, similar to the previous example. Here, we can see the message_id (in our group), the sender (from), the original chat (forward_origin, forward_from), and the date the original message was sent as a UNIX timestamp (forward_date). 

The result in the chat: 

Executing the request resulted in the message being forwarded to the group 

How to Copy the Entire Chat 

If you want to copy a chat entirely, you need to understand how message_id works. 

This id is actually the index of the message. 

For private chats and each group (group/supergroup), the indices run in parallel. Message_id for private chats is shared across all chats with users. With each message received from an individual user or sent to an individual user, the message_id increments by one. 

Thus, the first message in a chat with one user might have a message_id of 4096, even though in the context of the chat it should have a message_id of 1. In groups, however, message_id works as expected, starting from 1. 

This can be visualized as follows: 

Message_id 

Group 1 

Group 2 

User 1 

User 2 

1 

1 

1 

 

2 

2 

 

2 

3 

3 

3 

 

4 

4 

4 

 

5 

5 

 

5 

To determine the type of chat, you can use the /getChat method. 

If it is a group (group/supergroup), there shouldn’t be any significant issues 

If it is a private chat, there is a possibility that the bot has chats with multiple users, and some messages may not be accessible without the IDs of those users.

There is no simple way to retrieve all messages from a chat; some messages may not be accessible to the bot, but it will definitely have access to the messages it has sent.

In the malware request, we can see the message_id of the message from the malware, allowing us to estimate the number of messages. 

Next, we iterate through all messages from 1 to the required number. Telegram allows for a stable rate of 20 requests per minute with short bursts. 

To copy multiple messages at once, you can use /forwardMessages, which allows copying up to 100 messages in a single request. Thus, in one minute, you can stably copy 2000 messages or more if you utilize bursts. 

Using a Python script, we can copy the entire chat

We recommend saving the server responses, as they contain additional data useful for research: the date of the original message, its ID, and the ID of the original chat. 

For more detailed information on the Telegram Bot API, refer to the documentation.

Parsing Discord 

Replicating the same method with Discord is challenging due to the use of webhooks. 

A Discord webhook allows sending messages to a chat for which it was designated. Retrieving a message without knowing the message_id is difficult because Discord uses a snowflake ID, which includes the timestamp of the message and service information for identification. 

The only known message IDs for you will be those you managed to intercept. 

Among the methods that can be executed directly in the browser, there are only two: 

Retrieving webhook data: 


Retrieving a message: 

following sandbox session. 

We once again run it with the MITM Proxy enabled.

The HTTP Requests tab shows a POST request to discord.com/api/webhooks

Next, we find a request to Discord.  

The full URL of the request, including the webhook_id and webhook_token 

We copy the request URL. 

The result of executing a GET request in the browser

By inserting the URL into the browser’s address bar, we can obtain data about the webhook, including its name (name) and the channel it is associated with (channel_id) 

Now, let’s open the server response in the sandbox session. We’ll use the simplified view to find the message ID. 

After a POST request to the webhook URL, the server returns all information about the message
The information in JSON format

More useful are the methods that require POST and PATCH requests. 

By sending a request to the previous URL, we can modify the message using PATCH. 

You can also edit the webhook. Similarly, instead of retrieving webhook data using GET, you can use PATCH. 

A POST request to the webhook URL will allow you to send a message. 

For more detailed information, refer to the webhook documentation.

Python Scripts for Parsing Telegram Chats

We have prepared demonstration scripts in Python to make it easier to replicate the techniques shown above. You can find these scripts in our GitHub repo.  

Script 1: prepare_bot.py 

This script allows you to obtain the chat ID of the group to which the bot will be added. The script will warn about the presence of a webhook and offer to delete it. If the bot already has unprocessed updates, the script will offer to delete them. 

After that, you only need to add the bot to the group. The script will restore the webhook if it existed and delete the update about being added to the group. 

As an example, we’ll use the following bot token: 

bot6562806943:AAGufR13-622BXIjHsbpmkQygiIJA1Vo–c 

Once we run the script , the chat ID will be displayed. 

The result of running the script with no webhook 

If a webhook is present:

The script reports a webhook, displays its parameters, and warns about potential risks

Script 2: forward_message.py 

The next useful script is forward_message.py, which allows forwarding messages from one chat to another. 

The bot must have access to messages from the first chat and must be able to send messages to the second chat. 

You can specify the range of messages to forward, the method for handling HTTP 429 (too many requests), and the frequency of requests. 

All request results will be saved in a separate directory, which can also be reassigned. 

Here is how you can use forward_message.py

The script writes the launch parameters to the console and the ID of the message it attempts to forward. 

The results of running forward_message.py

Server responses will be saved in separate JSON files in a specified directory. 

Example of a saved server responses 

Script 3: forward_messages.py 

The next script is forward_messages.py. Despite the similar name and settings, it has some differences from forward_message.py: 

It forwards up to 100 messages in a single request. 

You do not receive data about the messages. 

Here is how you can use forward_messages.py

Example: 

The results of running forward_messages.py

The script writes the launch parameters to the console, the range of messages it attempts to forward, and the number of messages that were successfully forwarded within that range. 

Example of saved server responses

The server returns only an array containing the IDs of the messages forwarded using the /forwardMessages. 

Malware configs 

For more convenient data extraction, ANY.RUN lets you access malware’s configuration via the MalConf tab (see sandbox session). In this configuration, you can find the token. If there is info about requests in the process memory, their parameters are also displayed.

You can also explore ready-made links for API requests, which you can paste into your browser’s address bar.

The available links for Telegram are: 

Get info about the bot 

Get incoming updates 

Get webhook 

Delete webhook 

Drop incoming updates 

Example of a config for a Telegram bot, displaying its token

For Discord, malware typically uses webhooks. With a GET request, the only available action is to retrieve information about the webhook itself. 

See another session with an extracted malware config. 

The configuration displays the webhook token in the format webhook_id/webhook_token

In most cases, the malware retains data about the request and its result in memory, and you can obtain these details from the configuration.  

For Telegram, the most important data are chat_id and token. Thanks to ANY.RUN’s config extraction, you can see the text of the message sent by the malware. 

Extracted request from which you can obtain the bot_token and chat_id
Example of an extracted response from the server

Malware that uses Discord is often written in Python or JavaScript.  

In most cases, they do not leave complete data about requests in memory. However, if such data remains, you will be able to see it in the MalConf tab. 

We can obtain the message ID, channel ID, sending date, URL for downloading attachments, and other useful information from the server response.

Response from the server containing information about the sent message

About ANY.RUN  

ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, Yara Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.  

With ANY.RUN you can: 

Detect malware in seconds

Interact with samples in real time

Save time and money on sandbox setup and maintenance

Record and study all aspects of malware behavior

Collaborate with your team 

Scale as you need

Request free trial →

Sandbox Sessions Used in Research

Telegram API

POST request to /sendDocument: https://app.any.run/tasks/93e29328-a39a-4769-94d7-44256e1c9cbb

GET request to /sendMessage: https://app.any.run/tasks/861482ae-8f96-41ff-918f-3a642c87db79/ 

Discord API

POST request to webhook URL: https://app.any.run/tasks/189ce54d-7b1a-4d6f-a3ab-c6ea88d1aa5b 

Configurations

Two telegram bots and one discord webhook in one sample: https://app.any.run/tasks/861482ae-8f96-41ff-918f-3a642c87db79?malconf=66e7c1acfec4983250763c78 

Discord webhook and server response: https://app.any.run/tasks/b86b6efc-093b-4418-ab4d-7385e1761bb8?malconf=true 

IOCs 

Statement of Account as of AUGUST 2024SOA.pdf.exe ()

MD5: ddbaaa52ea1192377573a76e4ac8fb7b

SHA256:  

svchost.exe / Builder.exe 

MD5: 6aba4665085cf92ad3d569a7b37f2b53 

SHA256: 7f158a2e68162d7e882dc389c8c4d8e4dcd1161272fd4ba5a2edd63e31385f69 

Builder.exe 

MD5: 3c168aa3065d0ff315220f060fbae7b3 

SHA256: e72325336065b6a088a43221a4e7da4e86e2c627c2b671c1b05a643dc19e9060 

svchost.exe  

MD5: 50dce71a753bad01a07904f2af283123 

SHA256: 8fb751033d1546ce28f5dcef171857ee879bdd31d76be2ae556f246c258473f3 

csrss.exe 

MD5: 0998890ccf8a3d8702db7a84fe6dd7b3 

SHA256: c33e1408ea96b9ea7a72d44d7742effb4a98776711b7c94c4997a155af61b220 

Stlr.exe 

MD5: 712e31bac690f0f557c37f324cfe541b 

SHA256: 5809167017915ccd66d1fff1c39da41ea43f0dcf0a6b8fd3e5938281a5d78ac4 

The post How to Intercept Data Exfiltrated by Malware via Telegram and Discord appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

How to make offline backups of documents, photos, music, and videos from websites and online services | Kaspersky official blog

/in

With browser bookmarks, Gmail’s bottomless inbox, the ever-present Wikipedia, and the effective backup of iOS devices in iCloud, it’s easy to get the impression that data online is stored both safely and forever. Sadly though —  it’s not always the case. Therefore, it’s a good idea to make a backup of important personal information and protect it from ransomware and spyware. This post examines the whats, whys, and hows of the backup process.

Nine loss scenarios

We could write a fat textbook on how online data can disappear or otherwise become inaccessible, but we’ll limit ourselves here to listing some real-life instances of data going AWOL to better demonstrate their variety:

You bookmark your favorite recipes on a cooking website, but, after a redesign and restructuring of the site, the articles move to new addresses and your links are broken.
You listen to music on a streaming service, but songs disappear from your playlist because of copyright issues.
You chat with friends in a messenger and expect the chat history to be there forever — but the service shuts down and your history is lost.
You compile a bibliography for a thesis or research paper, but some of the referenced articles are published on sites that later close down or get paywalled.
You use a free note-taking service that suddenly becomes payable or shuts down.
You saved a link to a helpful tax and benefits guide on a government website, but some time later it becomes unavailable.
You store your photos and videos in an online photo album, but the provider decides to lower the image resolution, which causes blurring of video backgrounds and text in screenshots.
You published a website, but the hosting provider loses all your data in a cyberattack.
You liked or published a social media post, but a few months later you can’t find it. It might not even be deleted — you just have no means to search for it.

Online content loss can be divided up into two distinct types: (1) where you can no longer find information that used to be publicly available; and (2) where you lose your own data: notes, photos, or documents.

The first type of data loss is global in scale: according to a recent study, 38% of links active in 2013 were broken ten years later. For government websites, this figure is 13%; for Wikipedia links — 11%. A recent report on China’s internet landscape stated that web pages published before 2004 were near impossible to find since site owners actively purge old content. In an ironic twist, the posts of a Chinese blogger on this topic were themselves deleted.

Losing your own non-public data occurs less often, but hits much harder, so backing it up should be a priority.

What to save and how

First of all, make a list of all your important data. Think carefully about what’s really valuable to you in the digital world, and where it’s stored. Family photos? Household accounts? PhD thesis? Design ideas for your future apartment? Personal notes? Tracks of all your runs? Sort everything in descending order of importance, and make backups working your way down. Depending on the type of information, there are several backup options.

Downloading files to your drive

This is the simplest way to back up photos, documents, and other files that are stored online and can be easily opened on a computer. Saving web pages in the same way is harder, but still doable — for example, you can use the “Save as PDF” option. We recommend creating a coherent storage system on your computer so that you can easily find such files later. If their volume is too large, you can use a removable drive or set up network-attached storage (NAS) at home. To protect your data from ransomware and spyware, use robust security software, such as Kaspersky Premium. And to insure against equipment malfunction, you can set up a RAID array of drives on your computer or NAS device (the simplest, most reliable, but pricier option is RAID 1).

Exporting from online services

Online applications and services that don’t use files as such (messengers, email clients, databases, note apps) often let you export data, or create an archive file or backup. Read the respective help and explore the settings to find out how to export and what formats are available.

Usually, the most common formats are offered: HTML, PDF, TXT, or CSV. In this case, exported data can be easily viewed without specialized software and then migrated to another service. At the end of this post you’ll find links to backup-guides for popular online services.

But sometimes the export file is a black box containing a backup that only allows data restoration within the same service. This is the case, for example, with WhatsApp backups stored on Google Drive or iCloud.

Using specialized software

Some online services offer no export or backup options at all — social networks and streaming services are often guilty of this. In this case, it’s worth doing a search for a specialized export tool or online service using queries like SERVICENAME export or SERVICENAME backup. Two important warnings: before downloading anything, (1) install reliable protection on your computer to avoid picking up malware instead of a useful tool; and (2) make sure that the export procedure doesn’t violate local laws or copyrights.

Saving data backup to another online service

For important web pages, you can create backups in specialized services. For example, Pocket is great for personal use — the premium version saves not just a link to the document, but a full-text copy of it. For public use, copies of web pages can be saved to the internet archive web.archive.org or the like-minded archive.is. We’ll soon be posting about these services separately.

Storing backups in multiple online services at the same time

This insures against shutdown or technical issues with one of the services. You can combine this tip with the first one above by downloading files and saving them, say, to a Dropbox local folder on your own drive, which will automatically sync with your cloud storage. This way, the file will have both offline and cloud backups. Storing two copies of a document, for example, in OneDrive and Google Drive may seem paranoid, but it truly is reliable.

Setting up automatic backups to another service

This is the pinnacle of internet archiving — eliminating the need to update backups manually. For files, you can create a scheduled task for copying from one folder to another — allowing you to duplicate them on your home server and in cloud storage. Some note-taking services have additional sync modules that let you automatically create, say, a note in Joplin or Obsidian when new tasks appear in Todoist, add movies marked “favorite” on IMDb to separate notes, copy articles saved in Pocket to Evernote, and so on. Many such scenarios can be implemented through ready-made recipes in cross-platform automation tools like IFTTT and Zapier.

When data migration is backed up by the law

In some countries and regions, the right to download one’s data and migrate it to another service (data portability) is enshrined in law: among them are the European Union, India, Brazil, and the US State of California. If your online service offers no export or backup options, you can contact support, cite the relevant law, and get a copy of your data.

Remember to back up your online data on a regular basis — at least once a month.

How to back up data from specific online services

Because recommendations vary depending on the service and type of data, we have a series of dedicated posts grouped together with the backup tag. The list will be updated and supplemented regularly, but right now you can read about creating backups for the following:

Notion
Telegram
WhatsАpp
Authenticator apps for two-factor authentication
Other services

And don’t forget to keep your backups safe!…

Kaspersky official blog – ​Read More