Syrian Electronic Army Member Pleads Guilty to Hacking, Extortion

A member of the Syrian Electronic Army hacker group arrested earlier this year in Germany has pleaded guilty to hacking and extortion charges before a judge in the Eastern District of Virginia.

Peter “Pierre” Romar, 36, pleaded guilty to conspiracy to receive extortion proceeds and conspiracy to unlawfully access computers. According to the U.S. Department of Justice, the man faces up to five years in prison. Sentencing is scheduled for October 21.
Romar had been residing in Germany, where he was arrested by local law enforcement just before U.S. authorities announced the charges against Syrian Electronic Army members. He was extradited to the United States in May.
The Syrian Electronic Army surfaced in 2011 and it was active until recently, when authorities in the United States announced criminal charges against three of the group’s members. The hacker collective breached the systems of many high-profile targets in support of the Syrian regime, including government and media organizations.
According to authorities, Romar and another SEA member, 27-year-old Firas Dardar, known online as “The Shadow,” were also involved in an extortion scheme that targeted organizations in the U.S. and other countries. The cybercriminals breached the systems of various companies and threatened to damage their computers and data unless they paid a specified amount of money.
Since victims could not send the money directly to Dardar in Syria due to sanctions, Romar acted as an intermediary in Germany. U.S. authorities are aware of 14 victims, from which the hackers demanded more than $500,000, although in many cases the amount of the ransom was negotiated and eventually lowered.
Dardar and 22-year-old Ahmad Umar Agha, the SEA member known as “The Pro,” are still at large, and they are believed to be residing in Syria. The FBI has been offering $100,000 for information leading to their arrest.

Related Reading: Briton Accused of U.S. Govt Hack Can be Extradited

Related Reading: Kosovo Hacker Linked to IS Group Gets 20 Years in U.S. Prison

Related Reading: Two Men Arrested in U.S. for Hacking Emails of Top Officials

Vulnerabilities, Backdoors Found in D-Link Mobile Hotspot

Vulnerabilities, Backdoor Found in D-Link DWR-932B LTE Router

Security researchers have discovered numerous unpatched security vulnerabilities in the D-Link DWR-932B LTE router / access point, including backdoor accounts and default Wi-Fi Protected Setup (WPS) PIN. 

The device is being sold in various countries and appears to be customers’ security nightmare because of the numerous security weaknesses. The vulnerabilities were discovered by Pierre Kim, who decided to reveal only the most significant of them, and who says that the issues affect even the latest firmware version released by the vendor.

Earlier this year, Kim disclosed numerous unpatched vulnerabilities affecting the LTE QDH routers made by Quanta, including backdoors, hardcoded PIN, flaws in the web interface, remote code execution issue, and other bugs. The flaws that impact D-Link’s router are similar to those found in Quanta’s device, it seems.

The researcher discovered two backdoor accounts on the device and says that they can be used to bypass the HTTP authentication used to manage the router. There is an “admin” account with password “admin,” as well as a “root” account, with password “1234.” By default, telnetd and SSHd are running on D-Link DWR-932B, yet the latter isn’t documented, the researcher also explains.

Next, there is a backdoor inside the /bin/appmgr program, which allows an attacker to send a specific string in UDP to the router to start an authentication-less telnet server (if a telnetd daemon is not already running). The issue is that the router listens to 0.0.0.0:39889 (UDP) for commands and that it allows access without authentication as root if “HELODBG” is received as command.

D-Link DWR-932B also comes with 28296607 as the default WPS PIN, and has it hardcoded in the /bin/appmgr program. The HostAP configuration contains the PIN as well, and so do the HTTP APIs. What’s more, although the router allows the user to generate a temp PIN for the WPS system, the PIN is weak and uses an algorithm leveraging srand(time(0)) as seed. An attacker knowing the current date as time(0) can generate valid WPS PIN suites and brute-force them, the researcher explains.

Kim also reveals that the file /etc/inadyn-mt.conf contains a user and a hardcoded password, and that the HTTP daemon /bin/qmiweb contains multiple vulnerabilities as well. The router also executes strange, purposeless shell commands as root.

Furthermore, the router supports remote FOTA (Firmware Over The Air) and contains the credentials to contact the server hardcoded in the /sbin/fotad binary, as base64-strings. The researcher discovered that, although the FOTA daemon tries to retrieve the firmware over HTTPS, the SSL certificate has been invalid for one year and a half.

The researcher also reveals that the security level of the UPNP program (miniupnp) in the router is lowered, which allows an attacker located in the LAN area to add Port forwarding from the Internet to other clients located in the LAN. “There is no restriction about the UPnP permission rules in the configuration file, contrary to common usage in UPnP where it is advised to only allow redirection of port above 1024,” Kim notes.

Because of this lack of permission rules, an attacker can forward everything from the WAN into the LAN, the researcher says. This means that they can set rules to allow traffic from the Internet to local Exchange servers, mail servers, FTP servers, HTTP servers, database servers, and the like.

An attacker can overwrite the router’s firmware with a custom firmware if they wanted to, “but with all these vulnerabilities present in the default firmware, I don't think it is worth making the effort,” Kim says. He also notes that, because the device has a sizable memory (168 MB), a decent CPU, and good free space (235 MB), along with complete toolkits installed by default, users should consider trashing it, “because it's trivial for an attacker to use this router as an attack vector.”

D-Link was informed on these issues in June, but the company failed to resolve them until now. Because 90 days have passed since the vulnerabilities were disclosed to the vendor, Kim decided to publish an advisory to reveal these bugs.

This is not the first time D-Link products have made it to the headline due to security vulnerabilities. The company patched a critical flaw in several DIR model routers in August, after a popular D-Link Wi-Fi camera was found in June to be affected by a serious flaw that was subsequently discovered in over 120 D-Link products.

Russian Hackers Target Journalists Investigating MH17 Crash

wo Russia-linked threat groups have been targeting citizen journalists investigating Moscow’s involvement in the downing of Malaysia Airlines flight MH17 in July 2014 as it was crossing Ukraine.
 
In October 2015, Trend Micro reported that the Dutch Safety Board (DSB), which had been investigating the cause of the crash, was targeted by the Russian cyberspy group known as Fancy Bear, Pawn Storm, APT28, Sofacy, Sednit and Tsar Team. The DSB published its report on the incident in the same month.
The same actor also appears to have targeted Bellingcat, a group of investigative journalists that uses open source information to report on various events taking place around the world.
Bellingcat has published numerous articles on the MH17 crash and its reporting has been used in the investigation conducted by the Joint Investigation Team (JIT), which includes members from Australia, Belgium, Malaysia, the Netherlands and Ukraine. Bellingcat founder Eliot Higgins was an official witness in the investigation.
The JIT, which focused on the criminal investigation, published its report on Wednesday, saying that the plane crashed after being hit by a missile brought in from Russia and fired from an area controlled by pro-Russian separatists.
According to threat intelligence firm ThreatConnect, Bellingcat members who covered the crash of flight MH17 had received spear phishing emails between February 2015 and July 2016. The emails, designed to look like they were coming from Google, were similar to the ones described in June by researchers at SecureWorks, who identified thousands of email accounts targeted by Fancy Bear, including ones belonging to journalists.
The attacks aimed at Bellingcat also involved domains and domain registration data that was previously linked to Fancy Bear activity, ThreatConnect said.
In addition to Fancy Bear, Bellingcat has been targeted by CyberBerkut, which claims to be a pro-Russia hacktivist group based in Ukraine. CyberBerkut has taken credit for attacks on Ukrainian, Polish and German government systems.
In February 2015, CyberBerkut breached a Bellingcat contributor’s account and used it to post a story titled “CyberBerkut is already here.” The targeted user was Ruslan Leviev, a Russian opposition blogger and Bellingcat contributor who had covered several Russia-related topics. Leviev said the attackers hijacked his Yandex, LiveJournal and Twitter accounts. The Yandex account was protected with a strong password and two-factor authentication, which led the blogger to believe that the attacker either had direct access to Yandex servers or had knowledge of a zero-day vulnerability.
While it is possible that Leviev was targeted for other Russia-related reporting and the attack carried out by CyberBerkut has nothing to do with Fancy Bear’s interest in the MH17 investigation, ThreatConnect believes a more likely scenario is that the two threat groups are somehow connected.
One possibility is that CyberBerkut targeted Leviev in a more aggressive attack after Fancy Bear’s spear-phishing emails failed. The information used to register CyberBerkut domains also suggests a tie to Fancy Bear.
Furthermore, there is evidence that CyberBerkut is connected to DCLeaks, a Russian-backed influence outlet that has been linked to Guccifer 2.0, the hacker who took credit for the attacks on the U.S. Democratic Party. While Guccifer 2.0 claims to be a hacktivist based in Romania, researchers believe he’s just a persona used by Fancy Bear to throw investigators off track.

Related: Russian Cyberspies Use "Komplex" Trojan to Target OS X Systems

All Your iMessage Contacts Are Belong to Apple

Apple can’t tap into iMessage conversations, thanks to end-to-end encryption, but the iPhone maker does know who you message or attempt to message with.

Earlier this year, Apple entered a spat with the FBI when it refused to unlock an iPhone that belonged to Islamic terrorist Syed Rizwan Farook, who together with his wife Tashfeen Malik, killed 14 people in a mass shooting in San Bernardino, California in December 2015. Apple at the time claimed that it couldn't unlock the device and said the FBI was essentially asking it to create a backdoor into the iPhone.

In the end, the FBI was able to unlock the device without Apple’s involvement (it was helped by an outside party which reportedly cost more than $1 million, but the spat sparked debate over the use of backdoors. Privacy advocates, security experts, and tech companies supported Apple’s decision, arguing that available encryption products would be undermined if a backdoor was included in them.

As it turns out, Apple’s stance might have been influenced by marketing reasons too, and not purely by its determination to protect user privacy. When the Apple/FBI battle ended, the tech company emerged as a determined privacy advocate, but the incident didn’t tell the entire story. The document (below) obtained by The Intercept shows that Apple can tap into some information regarding user’s iMessage conversations, and that it does share these details with law enforcement when required to do.

Specifically, while it can’t view the conversations you carry out with your iMessage contacts, Apple does log the queries the messaging app makes to its servers to determine whether the person you are trying to contact is using the iMessage system or not. Based on these details, a message is sent to the Messages or SMS app, and it appears in conversations either as a blue or a green bubble.

Apple’s logs record each such query and include information like your phone number, the phone number you entered, the date and time when you entered the number, and your IP address. Basically, this means that Apple knows who you were trying to contact (or at least their phone number), when you were trying to contact that person, and your approximate location at that time based on your IP address (which could be spoofed via VPN).

Not only does Apple log these details, but it also shares them with the police when court orders compel it to. While Apple says that it retains those logs for only 30 days, court orders that request such information can typically be extended in additional 30-day periods, The Intercept notes. These can be combined to create extensive lists of numbers someone has been entering.

The document, reportedly titled “iMessage FAQ for Law Enforcement,” clearly states that these logs do not offer proof that you actually contacted a number you entered in the Message app. “The document implies that Messages transmits these numbers to Apple when you open a new chat window and select a contact or number with whom to communicate, but it’s unclear exactly when these queries are triggered, and how often,” The Intercept explains.

The content of sent messages remains safe from intruding eyes, because iMessage is encrypted end-to-end, but Apple admits to be sharing requested information with the police, if that information is in its possession. “In some cases, we are able to provide data from server logs that are generated from customers accessing certain apps on their devices,” Apple told The Intercept.

“We work closely with law enforcement to help them understand what we can provide and make clear these query logs don’t contain the contents of conversations or prove that any communication actually took place,” an Apple spokesperson also said.

In the end, Apple remains true to its claim that your conversations are private and that only you and your contacts can access them, though the company does know who you might have been talking to. Apple might not be willing to weaken the security of its products by including a backdoor, but it should be more straightforward when it comes to the kind of information it can access and subsequently share with law enforcement.

Related: Video Conferencing Solution Protects Content and Metadata

Related: Researcher Proves FBI Wrong With iPhone Passcode Hack

Related: WhatsApp Toughens Encryption After Apple-FBI Row

Leak of 200 Million Yahoo Accounts Linked to 2014 Hack

An investigation conducted into the two Yahoo security incidents disclosed recently revealed the existence of a connection and led researchers to believe that the claim of 200 million accounts being stolen in 2012 is likely false.

In early August, a hacker claimed to possess 200 million Yahoo user accounts stolen from the tech giant back in 2012. The hacker, known online as Peace and peace_of_mind, had offered to sell the data for 3 Bitcoin on a marketplace called TheRealDeal, where he had previously sold hundreds of millions of Tumblr, Myspace, VK and LinkedIn accounts.
Then, earlier this month, Yahoo confirmed that attackers, which the company believes were sponsored by a nation state, breached its systems in 2014 and stole at least 500 million user accounts. Yahoo never confirmed the alleged 2012 incident, although some suggested that the company discovered the 2014 breach while investigating those claims.
Security firm InfoArmor launched an investigation and determined that the vast majority of the 200 million credentials were not associated with Yahoo accounts. Experts believe the data likely comes from multiple third-party leaks and that some of the credentials match only because people reuse passwords. It’s worth noting that some people questioned the validity of the 2012 dump ever since samples of the data were made available.
InfoArmor believes Peace faked the data after having a falling-out with tessa88, another hacker who recently offered to sell hundreds of millions of accounts stolen from various services. According to researchers, tessa88 and Peace exchanged stolen information, until the former was called out over fake and low-quality dumps.
However, evidence uncovered by InfoArmor suggests that there is a link between these cybercriminals and the threat actor that carried out the 2014 attack confirmed by Yahoo.
Researchers believe tessa88 is linked to the real Yahoo hackers through an unidentified actor that played the role of a proxy. This proxy allegedly obtained the Yahoo data from professional black hats in Eastern Europe and provided it to various other actors, including cybercriminals and a state-sponsored party that had been interested in exclusive database acquisitions.
Tessa88 had previously received accounts from the proxy and InfoArmor believes tessa88 and Peace expected to get the Yahoo data as well. However, since that did not happen, Peace created a fake dump and claimed it came from a 2012 breach.
According to the security firm, the 500 million accounts were stolen from Yahoo after the compromised database was divided into hundreds of equal parts. The files, which contained data organized alphabetically, were exfiltrated in segments.
InfoArmor said the actual Yahoo dump is still not available on any cybercrime forums. However, the data has been monetized by some cybercriminals and the company believes it might have also been leveraged in attacks targeting U.S. government personnel.
Yahoo breach aftermath
News of the breach has caused serious problems for Yahoo, just as the company’s core business is about to be acquired by Verizon for $4.8 billion. Some believe the incident could impact the deal, but Verizon has yet to comment.
Several class actions have been filed against Yahoo by customers, including people who claim to be directly affected by the breach.
Earlier this week, U.S. Senator Patrick Leahy sent a letter to Yahoo CEO Marissa Mayer asking how such a massive breach could go undetected for two years. Senator Mark Warner has asked the Securities and Exchange Commission (SEC) to determine if the company fulfilled obligations to keep the public and investors informed, as required by law.
Mayer reportedly neglected cybersecurity since she took over the company. According to The New York Times, current and former employees said the CEO focused on functionality and design improvements rather than security.
Alex Stamos, who left his CISO position at Yahoo last year to become Facebook’s CSO, was allegedly denied financial resources for proactive security solutions. Mayer is said to have also rejected a proposal to reset all user passwords fearing that the move would result in more users abandoning its services.
Related: Yahoo Pressed to Explain Huge 'State Sponsored' Hack
Related: Russia? China? Who Hacked Yahoo, and Why?

Russian Cyberspies Use "Komplex" Trojan to Target OS X Systems

Researchers at Palo Alto Networks have come across an OS X Trojan they believe has been used by a notorious Russia-linked cyber espionage group in attacks aimed at the aerospace industry.

The malware, dubbed “Komplex,” appears to have been developed by the threat actor known as Sofacy, Pawn Storm, APT28, Sednit, Fancy Bear and Tsar Team. The gang has been tied to numerous high-profile attacks, including ones aimed at the U.S. government and the country’s political parties, the German parliament, and the World Anti-Doping Agency (WADA).
According to Palo Alto Networks, Komplex attacks start with a binder component that deploys a decoy document, which is displayed with the Preview application in OS X, and the Trojan’s dropper. The dropper component is designed to drop and execute the main payload and ensure its persistence by configuring the system to launch it when OS X starts.
Once it infects a device, the malware establishes contact with its command and control (C&C) server and collects system information. The Trojan allows attackers to execute arbitrary commands and download additional files to the affected machine.
Palo Alto Networks’ analysis revealed that Komplex is likely the unnamed Mac Trojan described in a June 2015 blog post by BAE Systems. At the time, the malware had been delivered via a vulnerability in the MacKeeper security and optimization software.
Researchers also discovered links between Komplex and the variant of the Carberp malware used by the Sofacy group in attacks targeting the U.S. government. While Carberp is designed to target Windows systems, experts have identified several similarities, including in URL generation logic, file extensions, encryption and decryption methods, command handling, and Internet connectivity checks.
“Based on these observations, we believe that the author of Sofacy’s Carberp variant used the same code, or at least the same design, to create the Komplex Trojan,” Palo Alto Networks explained in a blog post. “A benefit of retaining many of the same functionalities within the Windows and OS X Trojans is that it would require fewer alterations to the C2 server application to handle cross-platform implants.”
Experts also uncovered C&C infrastructure overlaps as some of the domains used by Komplex are known to be associated with Sofacy activity.
Ryan Olson, intelligence director at Palo Alto Networks’ Unit 42, told SecurityWeek that they first detected Komplex at the beginning of August. While there is no indication of significant changes in the malware functionality compared to the variant analyzed by BAE Systems last year, the attackers have apparently switched from exploiting MacKeeper vulnerabilities to using decoy documents.
While experts have not been able to precisely determine which organizations have been targeted with this OS X Trojan, based on decoy documents, they believe one of the targets was likely associated with the aerospace industry.
Related: Fysbis Backdoor Preferred by Pawn Storm Group to Target Linux

Spammers Increasingly Hijacking IPv4 Addresses

As new IPv4 addresses are more and more difficult to come by, spammers are increasingly hijacking existing IP address ranges for their nefarious purposes, Spamhaus researchers warn. 

The issue, researchers explain, is that spammers need a constant flow of fresh IP addresses, because those they use get a bad reputation of being sources of spam quite fast. This issue isn’t new, and spammers are constantly looking for new means of getting fresh IP addresses.

Back in January, researchers accused Verizon of routing over 4 million IP addresses that were in the hands of cybercriminals. At the time, the Internet Service Provider (ISP) was accused of not looking closely at the routing requests, which allowed cybercriminals to use their stolen addresses unhindered.

Now, Spamhaus reveals that spammers are “hijacking existing IP address ranges from under the noses of the legitimate owners and ARIN (American Registry for Internet Numbers),” and that Legacy IP address ranges are most targeted by cybercriminals. These addresses, issued before ARIN's inception in 1997, can’t be revoked even if the yearly fees aren’t paid, meaning that they can lie dormant, sometimes forgotten by the legitimate owners.

One of the first incidents where hijacked legacy IP address ranges were used for spam was observed in 2012, when cybercriminals were abusing the 147.50.0.0/16 ranges, owned by Chemstress Consultant Company. The original record is dated in 1991, but hijackers started their abuse in 2011 by registering a domain to “Timothy Tausch,” the name from the original ARIN records.

After that, the hijackers tricked ARIN into updating Timothy Tausch's contact information with an email address they were in control of. Next, the 147.50.0.0/16 IP addresses started being announced on behalf of the hijacker. The nefarious activity was rapidly shut down by the ISP for non-payment, researchers say.

In recent years, hijacking incidents have been getting worse, researchers say. Below, you can see a chart of the network BGP announcements of ranges believed to be hijacked (only ranges with “live” SBL listings are included – nobody has claimed legitimate ownership yet).

According to Spamhaus, while the announcements on the left-hand side of the chart are mainly legitimate, they slowly decrease as more companies that become defunct stop using their IP address ranges.

“Then, in recent years, these ranges start being hijacked by spammers, at times, announcements of up to 5 million IP addresses,” Spamhaus researchers explain. “Sending email through hijacked IP address ranges is of course one of the few criminal provisions of the U.S. CAN-SPAM Act. And hijacking usually involves other serious crimes such as wire fraud, forgery, and identity theft.”

According to Spamhaus, it appears that this type of malicious activity might continue until law enforcement begins prosecuting the criminal hijacking gangs and the spammers they work with. They also explain that ARIN’s ability to take action is sometimes limited, because it must abide by procedures defined via its Policy Development Process, and might not be able to take action even when notified of false information being added to its records.

Related: Necurs Botnet Fuels Jump in Spam Email

Related: Top Websites Fail to Prevent Email Spoofing