mrmoor/cyber-threat-intelligence huggingface dataset:
4. Prevent Lost Tablets and Smartphones from Turning into Something Worse: Portable devices means an increased risk of loss or theft.
These days, our portable devices often have greater access to more sensitive information than our PCs and Macs do – in the form of mobile banking apps, wallet apps and stored credit cards.
All modern tablets and smartphones have settings you should enable before you take these portable devices out of your home:  a. Passcodes to lock the device.
b. Encryption of information on the device.
c. Lost device location.
d. Deleting or “wiping” data if too many bad passcodes are tried or if you active it remotely.
5. Protect your Data on Smartwatches and Personal Fitness Devices: Smartwatches and personal fitness devices are similar to smartphones and tablets and have some of the same features.
In addition to using those features, you should take time to ensure you know what health information is being used and that the cloud account(s) these devices synchronize with have very strong passwords.
These devices gather some of your most personal information.
In some cases, the most serious risk isn’t around the device but the data being stored in the cloud.
6. Be Smart with Your Smart Home: Smart home is an umbrella term for a diverse set of devices that have one thing in common: they all feature some kind of internet connectivity.
Each and every device will have its own security and privacy settings and it pays to take time to understand those BEFORE you put these to work in your home.
Across the board, though, making sure your home router and Wi-Fi have good security and that you’re using good, strong unique passwords when paring devices with apps (where possible) are easy things you can do for all these devices.
7. Don’t Forget About Home Entertainment Apps, TVs and DVRs:
When we think about home entertainment, there’s really two things you need to think about with security.
First is the security of the devices themselves.
In nearly all cases, good security around home routers and Wi-Fi will be the best thing you can do for the devices.
But home entertainment isn’t just the physical devices.
It’s the apps you use to view content.
All apps like those from Netflix, Amazon, Hulu and others have their own passwords to connect to their service, and attackers crack and sell compromised accounts to these services.
Because of this, make sure you’re using good, strong unique passwords for the apps you use on these devices.
This will also protect these apps on your tablets, smartphones, PCs and Macs.
While You’re at it, Protect Your Gaming Consoles:
Similar to home entertainment devices, gaming consoles have both the security of the actual device and then the security of the cloud-based accounts to deal with.
Just like with home entertainment devices, it’s the cloud-based account that attackers are more interested in.
Here again, taking time to set up good strong passwords is key.
Also, many gaming platforms now include a second means of authentication (typically a text sent to your phone): you can and should enable that, if at all possible.
9. Configure User Profiles for Voice Assistants:
Voice assistants are some of the newest devices out there, which means they’re the least known and understood.
The biggest risk that’s been popularly discussed is voice command hijacking by outside sources.
While a cool news story, it’s not been documented to be a broad risk, especially as devices get better at specific voice recognition.
For these devices, take time to configure individual user profiles as much as possible.
And many of these devices feature mute buttons that can functionally turn them off when you don’t need them.
If you haven’t been using it, consider using that feature.
10. Use Smart Speakers Smartly:
Smart speakers can be thought of as a subset of home assistants in that they are voice-activated devices in your home.
And many smart speakers have digital home assistants built into them, making the distinction even less clear.
This means that what you would do for security for your digital home assistant would apply to smart speakers as well.
However, one thing to consider is if all you really want or need is a smart music device, it may make sense to keep your purchases focused on devices that do only that.
This can improve your security by reducing the risk posed by features that you don’t want or need.
11. Drive Safely and Securely with Smart Cars:
While “car hacking” is something that you see in the news, the reality is that practical smart car security is more common than headlines may lead you to believe.
A key differentiating feature with smart cars is they often have “smart” lock and ignition systems that are tied to fobs and/or your devices (like a smartphone).
Good smart car security in this case means building on the good security around devices and good physical security.
Ensure that any connected smart devices have good security, especially to protect against loss or theft.
Make sure you only give fobs to people that you trust.
And ensure that any cloud-connected accounts have good passwords and use a second authentication method, if possible.
12. Patch, Patch and Patch Some More:
We close this list with patching because it is the most important thing you can do.
Few people like getting into the guts of devices to manage updates and the apps on them but the reality right now is that this is not only critical for security and privacy, it’s also sometimes a process that can only be done manually.
For every kind of device or system, you should think about and understand how you can do updates for:  a.
The “firmware”: this is the software that is on the physical device itself, like the actual router, the actual car or the actual DVR.
b. The operating system on the device: Some devices don’t have an operating system separate from the firmware, but many do.
PCs and Macs have firmware and an operating system (Windows, macOS and Linux).
c. The apps and applications on the computer or device: Like we noted about home entertainment and gaming consoles, sometimes it’s the apps rather than the device itself that is important.
Many apps these days have auto-update capabilities.
But some don’t, so it’s important to make sure you know how apps get their updates.
If you take some time to understand these basic ideas and take these basic steps, you can ensure that you’ve got a good start on using new devices more safely and with better privacy during the holiday season.  Of course, this isn’t an exhaustive list.
And it’s always good to know about other features and capabilities, for example child safety controls.
But the start of a journey of a thousand miles begins with one step, and the start of a journey of a thousand days of using these new devices safely can start with these simple steps.
We have recently been investigating an antivirus app in the Google Play store that was displaying fake virus detection results to scare users into purchasing a premium service.
According to the Google Play store statistics, users have downloaded “AntiVirus for Android™” more than one million times and the app was listed in Top 100 free apps in Tools category.
Our Wildfire analysis cloud captured the initial app and identified it as Scareware.
On January 20, we reported this issue to Google and two days later, they removed the app from Google Play.
“AntiVirus for Android™” was developed by a company named “CTG Network Ltd.
”(Figure 1)
According the (now removed) Google Play listing, the app was downloaded and installed between 1 million and 5 millions times.
Before the removal it had also received 5,162 recommendations and 16,531 reviews that resulted in an average score of 4.0.
According to AppBrain, the app was also listed in top 30 of Top Grossing Apps in Tools category in United States, Japan, France and South Korea.
Figure 1 AntiVirus for Android™ in the Google Play Store
When a user opens the app, it will always report that it has located two or three threats on the device (Figure 2), including the following:  Figure 2
The App Indicates Two Threats were Found  If the user clicks the “Repair” button, the apps will indicate that one of the threats was eliminated and advise the user to upgrade to its full version to remove the remaining threat(s).
If the user clicks the “Update to Full Protection” button they will be prompted to subscribe to a service that costs $4.99 (US) per month through In-App Purchase of Google Play (Figure 3).  Figure 3
The app requests that the user pay 4.99$ per month for full protection.
Through analyzing the app’s code we discovered a multiple indications that this program was not a legitimate Antivirus program, but actually Scareware.
First, the initial “threats detection results” are hard-coded in the app (Figure 4), which means the app wasn't actually detecting them on the phone.
The developer even directly named these “infected packages” as “fake.virus” in the source code.
Figure 4 Hard-coded fake threat detection results
Since the detection result is fake, the subsequent cleaning is not real either – the elimination operation is just marking a flag of "initial_virus_cleared" to “1” in the app’s internal database.
The code in Figure 5 shows that the “We have eliminated 1 of %d Threat(s)” message shown in Figure 3 is also hard coded.
Figure 5 Code that generated the fake threat cleared page.
One interesting difference between this program and other Fake AV apps is “AntiVirus for Android™” will actually provide real antivirus services to paid users.
The app integrates a mobile antivirus engine provided by Bitdefender and if users upgrade to the premium version, it will scan apps and the device’s SD card with that engine.
This is the main reason we classify the program as Scareware rather than just Fake AV.
It is not clear whether the integrated BitDefender AV engine is actually licensed to the app’s developer.
The engine retrieves code updated and new signatures updating from hxxp:// api.androidsantivirus .com /antivirus/android-arm, which is hosted on the app’s official website.
Figure 6 The App Integrates the BitDefender AV Engine for Premium Users
In March of 2014, a Fake AV app named “Virus Shield” was listed for sale at $3.99 and quickly rose to the top position of Google Play’s New Paid Apps list.
Virus Shield was downloaded over 30,000 times, fare fewer than this latest piece of Scareware, although we do not know how many users actually paid for the $4.99 monthly service before Google removed the app from the store.
The fact that AntiVirus for Android™ contains an actual AV engine makes it more difficult for other programs to identify it as Scareware, as this makes the program appear legitimate.
While Google has already removed this application from the Play store, we’ll keep monitoring the latest Android apps to make sure WildFire is providing the best protection for our customers.
This post is also available in:      日本語 (Japanese)  Bottom line
up front
In the past 48 hours, there has been a flurry of activity as hardware and software vendors move to address two sets of vulnerabilities that have been dubbed “Meltdown” and “Spectre”.
This blog is meant to give an overview of the situation, the vulnerabilities, assist Palo Alto Networks customers and others with their risk assessment, and provide recommendations for actions they can take to prevent successful attacks against these vulnerabilities.
On January 3, 2018, researchers, including those with Google Project Zero, released information on three new vulnerabilities:
They grouped these vulnerabilities under the names “Spectre” (CVE-2017-5753 and CVE-2017-5715) and “Meltdown” (CVE-2017-5754).
Comprehensive details on both of these are available at https://meltdownattack.com.
Security updates to address these vulnerabilities began to be released prior to disclosure on January 3, 2018.
Security updates are continuing to be released and are expected to be released over time due to the uniquely broad nature of these vulnerabilities.
At the time of this writing, there are no known active attacks against any of these vulnerabilities.
Vulnerabilities  These vulnerabilities present a unique situation because they ultimately are hardware-based vulnerabilities.
All three stem from issues in modern processors and are known to affect Intel and ARM chips.
The vulnerability status of AMD chips is unclear at the time of this writing.
Because these affect processors, this means that the operating systems and applications that run on top of these processors are vulnerable.
Because these vulnerabilities affect the processors at the physical layer, the only way for the vulnerabilities to be fully addressed is for the processors to be replaced or to have a firmware update.
Until then, the makers of operating systems can (and have) released patches that make the physical-layer vulnerabilities inaccessible.
For all intents and purposes, it “patches” the vulnerabilities.
Full technical details on the vulnerabilities are available at the sites referenced above.
But the key point to understand about these vulnerabilities is that they are information disclosure vulnerabilities that can enable processes and applications to access information they otherwise shouldn’t be able to: user-mode applications can access privileged information in the kernel and throughout the operating system.
For regular end-user systems and devices, malware and malicious scripts can use these vulnerabilities to access information like usernames, passwords and account information.
For shared-hosting environments like public cloud providers, this means that one hosted customer could potentially access the information of any other customer hosted on the same hardware.
Based on analysis of the vulnerabilities, an industry consensus is emerging that generic protections against attacks aimed at these vulnerabilities will be difficult, if not impossible to develop.
This means that prevention against attacks will have to focus on specific malware, attacks, and hosting sites as they emerge.
Because these are information disclosure vulnerabilities, they don’t pose the same, immediate danger like WannaCry/WanaCrypt0r or Petya/NotPetya.
This has more in common with the Heartbleed event of 2014.
In terms of the severity of the vulnerabilities themselves: they are important, but not critical.
They are information disclosure, not code execution, vulnerabilities.
The greatest area of risk is in shared-hosting scenarios.
Fortunately, most cloud providers have already deployed security updates and those that haven’t are expected to do so shortly.
For end-users and those managing networks, the greatest risk these vulnerabilities pose is exploitation by malware seeking to gather information like usernames and passwords from systems.  What makes these vulnerabilities most notable from a risk assessment point of view is breadth of exposure.
Since these potentially affect nearly every device with a modern processor, that means that full mitigation and remediation may not be possible.
Older systems (like Windows XP) and devices (like older Android smartphones and IoT devices) will likely never receive fixes for these vulnerabilities.
The actions to take in response to this event are clear and simple:  As always, we will continue to watch this event closely and provide any updates that we can.
For information on how Palo Alto Networks products are affected by these issues, customers can see our posting on the Live Community at: https://live.paloaltonetworks.com/t5/Customer-Advisories/Information-about-Meltdown-and-Spectre-findings/ta-p/193878/jump-to/first-unread-message.
If you have any questions, please visit the Threat & Vulnerability Discussions on our Live Community.
In recent research, Palo Alto Networks found attackers were targeting home routers to take control and use them for attacks against other websites that can bring them down.
These attacks could affect you in two ways:  What causes this kind of attack?
Weak passwords and out-of-date software can both enable attackers to take complete control of your home router.
Attackers target home routers like this by targeting default passwords and out-of-date software on the routers.
An easy thing you can do is restart your router once a week (typically by unplugging it).
You can also stay safe by changing the password on your router and updating the software.
If you’re not sure how to do this, contact your Internet Service Provider (ISP) that gave you the router for help.
When devices (in this case, the routers) are under someone else’s control like this, the collection is referred to as a “botnet”, a network (-net) of remotely controlled systems or devices (bot-).
When attackers have complete control of your home router, they can install attack software that they control, turning the device into a “bot”.
Attacks can make all the controlled routers in a botnet do anything they want, including sending huge amounts of data to try and bring websites down.
These kinds of attacks are called “Distributed Denial of Service” or “DDoS” attacks.
Attackers use them to take down websites for several reasons:  About Threat Briefs are meant to help busy people understand real-world threats and how they can prevent them in their lives.
There’s a very good reason why AWS remains a leader in cloud computing.
While many providers describe themselves as “customer obsessed,” few come close to our long-time partner in the lengths it goes to earn and retain the trust of its customers.
AWS starts with the customer and works backwards.
That means the vast majority of its feature enhancements and new services are directly driven from their input.
The latest is Amazon GuardDuty Malware Protection.
This threat detection tool, which will work closely with Trend Micro cloud solutions, will provide another valuable layer of defense in our fight against a shared adversary.
Shining a light on an expanding attack surface Spurred by a drive for greater cost efficiency and business agility, global organizations are migrating to the cloud in droves.
Gartner predicts the worldwide market for public cloud services will reach almost $495bn this year, and grow by over 21% in 2023.
In this environment, security remains a persistent concern for cloud builders, because if not properly managed, investments can increase the digital attack surface.
According to recent Trend Micro research, many global organizations are already struggling to securely manage their cloud assets.
We found that 73% of IT and business leaders are concerned with the size of their attack surface, and 43% claim it is “spiralling out of control.”
Cloud is the area where most respondents say they have least insight.
They want their cloud providers to do more—for example by building enhanced detection into their systems, to complement third-party tools.
That’s part of the reason why AWS built Amazon GuardDuty Malware Protection was built.
This new feature is triggered by detection of known malicious signatures across the cloud network.
Based on this detection, the service scans the associated Amazon EBS storage environment for malware and reports any findings to AWS Security Hub.
Open APIs from here link to products like Trend Micro Cloud One to enhance existing detection and response efforts.
Better together Trend Micro and AWS have been working closely together for over a decade now, and this latest announcement represents another exciting stage in the journey.
Customers will welcome AWS native threat detection as a complement to their Trend Micro Cloud One capabilities, delivering a comprehensive range of features to secure the hybrid cloud.
Once they add the AWS tool to our virtual patching, vulnerability scanning, lateral movement detection, posture management and other capabilities, joint customers will have a powerful set of integrated offerings to deliver simple, all-in-one cloud security and compliance.
In addition, this move from AWS validates our XDR strategy, which is focused on using as many data sources as possible to enhance detection and response.
The bottom line is that security takes a village.
Customers, cloud providers and security vendors have a shared responsibility to work together as the threat landscape continues to evolve.
That’s what we’ll continue to do, expanding and deepening our strategic partnerships with AWS and other providers in a collective effort to make the digital world safer.
Tags  Cloud | Latest News | Malware | APT & Targeted Attacks |
Compliance & Risks | Articles, News, Reports
We discovered a new malware that targets online gambling companies in China via a watering hole attack, in which visitors are tricked into downloading a malware loader disguised as a legitimate installer for well-known apps such as Adobe Flash Player or Microsoft Silverlight.
Closer examination of the loader shows that it loads either a Cobalt Strike shellcode or a previously undocumented backdoor written in Python, a new type of malware that we found to be named BIOPASS RAT (remote access trojan).
BIOPASS RAT possesses basic features found in other malware, such as file system assessment, remote desktop access, file exfiltration, and shell command execution.
It also has the ability to compromise the private information of its victims by stealing web browser and instant messaging client data.
What makes BIOPASS RAT particularly interesting is that it can sniff its victim’s screen by abusing the framework of Open Broadcaster Software (OBS) Studio, a popular live streaming and video recording app, to establish live streaming to a cloud service via Real-Time Messaging Protocol (RTMP).
In addition, the attack misuses the object storage service (OSS) of Alibaba Cloud (Aliyun) to host the BIOPASS RAT Python scripts as well as to store the exfiltrated data from victims.
We consider BIOPASS RAT as still being actively developed.
For example, some markers that we discovered during our analysis refer to different versions of RAT code, such as “V2” or “BPSV3”.
Many of the loaders that we found were used to load Cobalt Strike shellcode by default instead of the BIOPASS RAT malware.
Furthermore, BIOPASS RAT also creates scheduled tasks to load the Cobalt Strike shellcode during the initialization, indicating that the malicious actor behind the attack still heavily relies on Cobalt Strike.
We also found several clues that show how the malware might be connected with the Winnti Group(also known as APT41).
In this blog entry, we will dive deeper into BIOPASS RAT with a detailed technical analysis of the infection chain, the different components of the malware, and any possible associations with Winnti.
Infection chain
The initial delivery mechanism of BIOPASS RAT uses of a watering hole, a compromised website in which the malicious actors inject their custom JavaScript code to deliver malware.
In most of the cases that we observed, the attackers usually place their injection script in their target’s online support chat page.
Figure 1. The login panel of BIOPASS RAT       Figure 2. Code showing the watering hole attack injection     The injected script will try to scan the affected host by sending HTTP requests to a list of ports.
If it receives any response with an expected string from these ports, the script will stop.
This step is likely designed to avoid attacking an already infected victim.
We found that the BIOPASS RAT has the ability to open an HTTP service running on localhost on a port chosen from a hard-coded list.
This functionality allows the script to identify whether the victim has already been infected by their malware.
It conducts this identification by testing whether the port is open or not and then by checking the response.      Figure 3.
The script used to check for existing BIOPASS RAT infections     If the script confirms that the visitor has not yet been infected, it will then replace the original page content with the attackers’ own content.
The new page will show an error message with an accompanying instruction telling website visitors to download either a Flash installer or a Silverlight installer, both of which are malicious loaders.
It is important to note that both Adobe Flash and Microsoft Silverlight have already been deprecated by their respective vendors.
Figure 4.
The fake Adobe Flash Player download page of the watering hole attack      Figure 5.