…NCC-CSIRT warns against two cyber vulnerabilities
American multinational IT company, HP Inc., says it has identified the latest techniques used by cybercriminals in its recent global HP Wolf Security threat insights report.
HP in a statement on Friday said that the insights report provides analysis of real world cybersecurity attacks by isolating threats that have evaded detection tools and made it to user endpoints.
It said that the HP Wolf Security threat research team identified a wave of attacks utilizing Excel add-in files to spread malware, helping attackers to gain access to targets, and exposing businesses and individuals to data theft and destructive ransomware attacks.
“In our research, there was a huge six-fold increase (+588%) in attackers using malicious Microsoft Excel add-in (.xll) files to infect systems compared to last quarter, a technique found to be particularly dangerous as it only requires one click to run the malware.
“The team also found adverts for Microsoft Excel add-in dropper and malware builder kits on underground markets, which make it easier for inexperienced attackers to launch campaigns,” it said.
According to the report, a recent QakBot. (a prevalent information-stealing malware) spam campaign used excel files to trick targets, using compromised email accounts to hijack email threads and reply with an attached malicious excel (.xlsb) file.
It said that after being delivered to systems, qakbot injects itself into legitimate Windows processes to evade detection.
HP noted that malicious Excel (.xls) files were also used to spread the Ursnif banking Trojan (Virus) to Italian-speaking businesses and public sector organisations through a malicious spam campaign, with attackers posing as Italian courier service BRT.
“Other notable threats isolated by the HP Wolf Security threat insight team include the return of TA505.
“HP identified a MirrorBlast email phishing campaign sharing many tactics, techniques, and procedures (TTPs) with TA505, a financially motivated threat group known for massive malware spam campaigns and monetizing access to infected systems using ransomware.
“The attack targeted organisations with the FlawedGrace Remote Access Trojan (RAT),” it said.
HP said others were fake gaming platform infecting victims with RedLine, a spoofed discord installer website tricking visitors into downloading the RedLine infostealer and stealing their credentials.
Mr Alex Holland, Senior Malware Analyst, HP Wolf Security threat research team, said: “Abusing legitimate features in software to hide from detection tools is a common tactic for attackers as using uncommon file types that may be allowed past email gateways.
He noted that security teams should ensure they don’t rely on detection alone but keep up with the latest threats by updating their defenses accordingly.
“Attackers are continually innovating to find new techniques to evade detection, so it’s vital that enterprises plan and adjust their defenses based on the threat landscape and the business needs of their users.
“Threat actors have invested in techniques such as email thread hijacking, making it harder than ever for users to tell friend from foe, “Holland said.
He said other key findings in the report notes that 13 per cent of email malware isolated had bypassed at least one email gateway scanner.
Holland noted that hackers used 136 different file extensions in their attempts to infect organisations, adding that 77 per cent of malware detected was delivered via email, while web downloads were responsible for 13 per cent.
“The most common attachments used to deliver malware were documents (29 per cent ), archives (28 per cent ), executables (21 per cent) and spreadsheets (20 per cent ).,” Holland said.
Dr Ian Pratt, Global Head of Security for Personal Systems, HP Inc. said: “Today, low-level threat actors can carry out stealthy attacks and sell access onto organised ransomware groups, leading to large-scale breaches that could cripple IT systems and grind operations to a halt.
Pratt said organisations should focus on reducing the attack surface and enabling quick recovery in the event of compromise.
NCC-CSIRT warns against two cyber vulnerabilities
Similarly, the Nigerian Communications Commission’s Cyber Security Incident Response Team (NCC-CSIRT) has identified two cyber vulnerabilities and advised telecoms consumers on measures to get protected from cyber-attacks.
The NCC Director of Public Affairs, Dr Ikechukwu Adinde, made this known in a statement on Friday, in Abuja.
Adinde said that the CSIRT, in its first-ever security advisory, less than three months after creation, had identified two cyber-attacks targeting consumers.
He said that the CSIRT had proffered solutions that could help telecommunication consumers from falling victim to the two cyber vulnerabilities.
According to him, the first was described as `Juice Jacking’, which can gain access into consumers’ devices when charging any mobile phones at public charging stations.
The other, he said, was a `Facebook for Android Friend Acceptance Vulnerability’, which targets only the Android operating system.
He further said according to CSIRT security advisory, 0001 released on Jan. 26, with Juice Jacking, attackers have found a new way to gain unauthorised entry into unsuspecting mobile phone users’ devices.
“This is when they charge their mobile phones at public charging stations.
“Many public spaces, restaurants, malls and even in the public trains do offer complementary services to customers, one of which is providing charging ports or sockets,’’ he said.
Adinde, however, said that an attacker could leverage this courtesy to load a payload in the charging station or cables they would leave plugged in at the stations.
“Once unsuspecting persons plug-in their phones at the charging station or the cable, the payload is automatically downloaded on the victim’s phone.
“This payload gives the attacker remote access to the mobile phone, allowing them to monitor data transmitted as text or audio using the microphone.
“The attacker can even watch the victim in real time if the victim’s camera was not covered.
“The attacker is also given full access to the gallery and also to the phone’s Global Positioning System (GPS) location,” he explained.
Adinde further said that an attacker gains access to a user’s mobile phone, he gets remote access which leads to breach in confidentiality, violation of data integrity and bypass of authentication mechanisms.
He stated that symptoms of attack may include sudden spike in battery consumption, device operating slower than usual, apps taking a long time to load, and when they load they crash frequently and cause abnormal data usage.
The director said that the NCC-CSIRT, however, had also proffered solutions to this attack, which include using, ‘charging only USB cable’, to avoid Universal Serial Bus (USB).
He also said that another solution was data connection; using one’s AC charging adaptor in public space; and not granting trust to portable devices prompt for USB data connection.
“Other preventive measures against Juice Jacking include; installing antivirus and updating them to the latest definitions always; keeping mobile devices up to date with the latest patches.
“Using one’s own power bank; keeping mobile phone off when charging in public places, as well as ensuring use of one’s own charger, if one must charge in public,’’ he said.
Adinde said that the NCC-CSIRT advisory 0001, warned that Facebook for Android was vulnerable to a permission issue.
This gave privilege to anyone with physical access to the android device to accept friend requests, without unlocking the phone.
“The products affected include versions 329.0.0.29.120 of Android OS. With this, the attacker will be able to add the victim as a friend and collect personal information of the victim.
“Information such as email, date of birth, check-ins, mobile phone number, address, pictures and other information that the victim may have shared, which will only be visible to his or her friends,’’ the director said.
He said that NCC-CSIRT, in the security advisory, also recommended to users to disable the feature from their device’s lock screen notification settings, to be protected from the Facebook-associated vulnerability.
“The NCC-CSIRT was inaugurated in Oct. 2021 to provide guidance and direction for the constituents in dealing with issues relating to the security of critical infrastructure in their possession.
“NCC-CSIRT is to periodically assess, review and collate the threat landscape, risks, and opportunities affecting the communications sector, in order to provide advice to relevant stakeholders in those regards.
“The NCC-CSIRT also ensures continuous improvement of processes and communication frameworks, to guarantee secure and collaborative exchange of timely information while responding to cyber threats within the sector.
“As the telecoms-industry specific intervention, the objective aligns with the objective of the National Cybersecurity Policy and Strategy (NCPS) document published by the office of the National Security Adviser,” he said.
Adinde added that recently, NCC-CSIRT raised a series of cyber-vulnerability awareness based on security advisories it received from the Nigerian Cybersecurity Emergency Response Team, the national body for the implementation of NCPS objectives.
