Lifeboat Foundation

Rather than steal credentials or hold data for ransom, a recent campaign observed by Sophos prevents people from visiting sites that offer illegal downloads.

The objective of most malware is some kind of gain — financial or otherwise — for the attackers who use it. However, researchers recently observed a unique malware with a single intent: Blocking the infected computers from visiting websites dedicated to software piracy.

The malware (which SophosLabs principal researcher Andrew Brandt called “one of the strangest cases I’ve seen in a while”) works by modifying the HOSTS file on the infected system, in a “a crude but effective method to prevent a computer from being able to reach a web address,” he wrote in a report published Thursday.

A malware called Crackonosh infected 222000 PCs in order to mine $2 million worth of Monero cryptocurrency.

Cybersecurity experts reported the detection of at least four flaws in Dell SupportAsist’s BIOSConnect feature, the exploitation of which would allow threat actors to deploy remote code to affected devices. It should be noted that this software is preinstalled by default on most Dell computers running Windows systems, and BIOSConnect allows remote firmware update and some operating system recovery features.

This set of flaws received a score of 8.3÷10 on the Common Vulnerability Scoring System (CVSS) scale, and its exploitation would allow privileged remote hackers on the target system to impersonate an official Dell service in order to take control of the operating system boot process and thus break any security controls enabled. So far no active exploitation attempts or a functional attack have been detected for the abuse of these flaws.

Continue reading “Vulnerabilities in Dell laptops’ software allow hackers to execute code remotely in millions of devices” »

Flaws in card reader technology let a security firm consultant wreak havoc with point-of-sale systems and more.

Microsoft, via its Security Intelligence account on Twitter, has issued a warning to Windows users of a new type of phishing scam that involves emails requesting users to dial a call center. They warn users to not dial the call center because following the instructions given by a human operator can lead to malware infections. The malware scam only works with Windows computers that have Microsoft Excel.

The new threat involves BazarLoader, a type of malware that allows backdoor access to infected computers. BazarLoader works by allowing criminals to sneak in through a hidden backdoor on a user’s computer, which allows them to install viruses or other types of malware. Over the past several years, criminals have used different methods to trick users into carrying out instructions that allow BazarLoader to infect their computer. In this new campaign, Microsoft reports that such criminals are using an email/call center approach.

Continue reading “Microsoft issues warning about a malware campaign involving a call center” »

Cyber criminals are increasingly using virtual machines to compromise networks with ransomware.

By using virtual machines as part of the process, ransomware attackers are able to conduct their activity with additional subtlety, because running the payload within a virtual environment reduces the chances of the activity being discovered – until it’s too late and the ransomware has encrypted files on the host machine.

During a recent investigation into an attempted ransomware attack, cybersecurity researchers at Symantec found the ransomware operations had been using VirtualBox – a legitimate form of open-source virtual machine software – to run instances of Windows 7 to aid the installation of ransomware.

Putting IT security practices in place will enable organizations to prevent ransomware attacks and help IT teams combat security challenges.

According to Check Point research, the number of organizations affected by ransomware has been growing at 9% monthly since the start of the year. From WannaCry, Petya, and SamSam to Ryuk, these ransomware attacks have caused huge financial and reputation losses for both public and private sector organizations – the recent attacks on Colonial Pipeline are just the latest example.

Organizations are in a tight spot to prevent these cyberattacks and safeguard what they have built over the years. While IT teams are already battling the challenges of securing remote endpoints in the changing work sphere, the rise in cyberattacks has added additional responsibilities on their shoulders.

A total of 26 high-severity vulnerabilities affect NVIDIA Jetson chipsets.

Chipmaker patches nine high-severity bugs in its Jetson SoC framework tied to the way it handles low-level cryptographic algorithms.

Flaws impacting millions of internet of things (IoT) devices running NVIDIA’s Jetson chips open the door for a variety of hacks, including denial-of-service (DoS) attacks or the siphoning of data.

NVIDIA released patches addressing nine high-severity vulnerabilities including eight additional bugs of less severity. The patches fix a wide swath of NVIDIA’s chipsets typically used for embedded computing systems, machine-learning applications and autonomous devices such as robots and drones.
Impacted products include Jetson chipset series; AGX Xavier, Xavier NX/TX1, Jetson TX2 (including Jetson TX2 NX), and Jetson Nano devices (including Jetson Nano 2GB) found in the NVIDIA JetPack software developers kit. The patches were delivered as part of NVIDIA’s June security bulletin, released Friday.