Още по "диалога" Касперски<>Microsoft:
https://www.comss.ru/page.php?id=4168

Нова безфайлово инженктиране за заразяване, заобикалящо антивирусната защита

Spoiler

CyberheistNews Vol 7 #25   |   June 19th., 2017

---

[ALERT] New Fileless, Code-Injecting Ransomware Bypasses Antivirus 

Security researchers have discovered a new fileless ransomware in the wild, which injects malicious code into a legitimate system process (svchost.exe) on a targeted system and then self-destructs itself in order to evade detection by antivirus.

The nasty has been called SOREBRECT and unlike more generic "spray-and-pray" ransomware, it has been designed to specifically target enterprise systems in various industries.

SOREBRECT also takes pains to delete the infected system’s event logs and other artifacts that can provide forensic information such as files executed on the system, including their timestamps. These deletions deter analysis and prevent SOREBRECT’s activities from being traced.

This malicious code, after it has taken control of the machine, uses Microsoft’s Sysinternals PsExec command-line utility to encrypt files. I am sure that Mark Russinovich is not happy about this!

Why PsExec?

“PsExec can enable attackers to run remotely executed commands, instead of providing and using an entire interactive login session, or manually transferring the malware into a remote machine, like in RDPs,” Trend Micro says.

SOREBRECT Also Encrypts Network Shares

SOREBRECT also scans the local network for other connected computers with open shares and locks files available on them as well. “If the share has been set up such that anyone connected to it has read-and-write access to it, the share will also be encrypted,” researchers say.

In addition, SOREBRECT uses the Tor network protocol in an attempt to anonymize its communication with its command-and-control (C&C) server, just like almost every other malware.

SOREBRECT Ransomware Spreads Worldwide

According to Trend Micro, SOREBRECT was initially targeting Middle Eastern countries like Kuwait and Lebanon, but from last month, this threat has started infecting people in Canada, China, Croatia, Italy, Japan, Mexico, Russia, Taiwan, and the U.S.

This is not the first time when researchers have come across Fileless malware. Two months ago, Cisco's Talos researchers discovered a DNSMessenger attack that was completely fileless and used DNS TXT messaging capabilities to compromise systems.

In February, Kaspersky researchers also discovered fileless malware that resided solely in the memory of the compromised computers, which was found targeting banks, telecommunication companies, and government organizations in 40 countries.

Fileless malware is much harder to detect by antivirus than malware that first lies down a file on disk, and then does its dirty work. Kaspersky said: ""Unfortunately the use of common tools combined with different tricks makes detection very hard. In fact, detection of this attack would be possible in RAM, network and registry only."

What to Do About It

Below the best practices for securing your systems and network against SOREBRECT suggested by TrendMicro.

• Restrict user write permissions
• Limit privilege for PsExec
• Back up files
• Keep the system and network updated
• Deploy multi-layered security mechanisms
• Foster a cybersecurity-aware workforce.

Trend Micro advised: "User education and awareness helps improve everyone’s security posture. Like other malware, ransomware’s points of entry is typically through email and malicious downloads or domains. Organizations should conduct regular training to ensure that employees have a solid understanding of company security policy, procedure, and best practices."

https://www.tad.bg/bg/post/sorebrect-noviyat-bezfaylov-ransamuer

Някой не е удържал изтичането на WannaCry според експерта Джак Уилямс (Rendition InfoSec)

https://threatpost.ru/someone-failed-to-contain-wannacry/21686/

Редактирано 21 юни 20179 г. от ExaFlop (преглед на промените)

Microsoft security advisory 4025685 - за поддържани и вече неподдържани ОС:
https://support.microsoft.com/en-us/help/4025686/microsoft-security-advisory-4025685-guidance-for-supported-platforms

security update for Microsoft Graphics Component

http://www.catalog.update.microsoft.com/Search.aspx?q=4012583

Открита е дупка за руткити в сигурността на процесорите на Intel. Microsoft  са заявили, че няма да издават кръпка за нея.
https://threatpost.ru/ghosthook-attack-bypasses-windows-10-patchguard/21725/

Microsoft твърди: 'no known ransomware' runs on Windows 10 S
http://www.zdnet.com/article/microsoft-no-known-ransomware-windows-we-tried-to-hack-it/?loc=newsletter_large_thumb_featured&ftag=TRE-03-10aaa6b&bhid=21612512668834438687959483812463

Доклад на Касперски за рансъуеъра през 2016-2017

https://securelist.com/ksn-report-ransomware-in-2016-2017/78824/

Предстоящи промени/новости в сигурността в Windows 10 Fall Creators Update
https://blogs.windows.com/business/2017/06/27/announcing-end-end-security-features-windows-10/

Symantec намерили лесен начин за защита от вируса Petya:
Вирусът проверява има ли файл C:\Windows\perfc (без разширение).
За да се защитите просто създайте с помощта на notepad нов файл perfc и го преместете в папка C:\Windows. Когато вирусът срещне този файл, той веднага прекратява работа.
https://inforesist.org/symantec-nashel-sposob-zashhityi-ot-virusa-vyimogatelya/

Редактирано 28 юни 20179 г. от ExaFlop (преглед на промените)

Сравняване на #NotPetya и #Petya — наистина ли може да се декодират файловете?

https://habrahabr.ru/company/pt/blog/331962/?utm_source=tw&utm_medium=social&utm_campaign=sravnivaem-notpetya-i-petya--realno
 

Още по Петите:
https://habrahabr.ru/company/infosecurity/blog/331788/

За Windows 10 и Petya:
https://blogs.technet.microsoft.com/mmpc/2017/06/29/windows-10-platform-resilience-against-the-petya-ransomware-attack/

Авторът на Petya публикува главния декодиращ ключ:
https://www.bleepingcomputer.com/news/security/author-of-original-petya-ransomware-publishes-master-decryption-key/

Редактирано 7 юли 20179 г. от ExaFlop (преглед на промените)

Излязоха юлските кръпки - закърпени са 49 дупки - Windows Server, Internet Explorer, Edge, Office, Exchange, SharePoint, .NET Framework и Adobe Flash Player:

https://portal.msrc.microsoft.com/en-us/security-guidance

Запушиха дупката в NTLM:
https://threatpost.ru/microsoft-closes-ntlm-authentication-relay-vulnerability/21883/

 

Как да предпазим неприкосновеността на отпечатано на принтерите си.

http://resetprinters.com/

Ваксиниране срещу Petya/NotPetya
https://www.bleepingcomputer.com/news/security/vaccine-not-killswitch-found-for-petya-notpetya-ransomware-outbreak/

" Avast,  производител на софтуер за сигурност, придоби Piriform , базирана в Обединеното кралство, която стои зад много успешни настолни и мобилни приложения като CCleaner, Recuva, Speccy и Defraggler...." Повече може да прочетете  ТУК

Източник: BleepingComputer

Хакери са се насочили към атака на хотелските безжичбни мрежи със "зъл" малуеър:
http://www.zdnet.com/article/hackers-are-using-hotel-wi-fi-to-spy-on-guests-steal-data/
http://www.nsaneforums.com/topic/298577-hackers-are-targeting-hotel-wi-fi-with-particularly-evil-malware/

Редактирано 25 юли 20179 г. от ExaFlop (преглед на промените)

5 начина да опазим мрежата си обезопасена:
https://www.pcmag.com/feature/354912/5-ways-to-keep-your-network-safe/5

Излезе нов инструмент за декодиране на Petya под формата на зареждащ имидж (iso)
https://github.com/hasherezade/petya_key/releases
Инструментът работи на базата на Master Key и и може да дешифрира всички модификации на Petya (без NotPetya).
Важно е да се прочете ReadMe.md

В САЩ са открити в бензоколонки скимери, изпращащи СМС със сканираната информация:
Скоро и у нас...
http://www.securitylab.ru/news/487513.php

Специалисти демонстрираха как се хаква и придобива контрол върху Tesla Model X

http://www.securitylab.ru/news/487517.php

Да се смееш ли, да плачеш ли - кафеавтомат заразил компютрите на нефтохимически завод с рансъмуеър:
http://www.securitylab.ru/news/487476.php

Редактирано 28 юли 20179 г. от ExaFlop (преглед на промените)

Чудих се в кой раздел да покажа как грешките в аритметиките на MS Excel  може да са опасни за здравето на човека. И реших да е в Новините за сигурността:

http://www.zdnet.com/article/excel-errors-microsofts-spreadsheet-may-be-hazardous-to-your-health/?loc=newsletter_featured_related_listing&ftag=TRE-03-10aaa6b&bhid=21612512668834438687959483812463

Руснаците тестват нова секретна анти-GPS система:
https://life.ru/t/наука/1034673/smi_rossiia_ispytala_siekrietnuiu_sistiemu_borby_s_zapadnoi_gps

Редактирано 12 август 20179 г. от ExaFlop (преглед на промените)

SyncCript крие компонентите си в картинки и не се засича:
http://www.nsaneforums.com/topic/299888-synccrypt-ransomware-able-to-sneak-past-most-antivirus-defenses/

Microsoft: над 50% от незащитените машини с Windows 7 не ползват никакъв AV софтуер:
http://www.nsaneforums.com/topic/299878-microsoft-over-50-percent-of-windows-7-unprotected-machines-arent-running-any-av/

Редактирано 19 август 20179 г. от ExaFlop (преглед на промените)