The Ukrainian Computer Emergency Response Team (CERT) has issued a statement on a new attack campaign by suspected Russian threat actors which are compromised victims’ VPN accounts to access and encrypt networked resources. More details are available here:
Initial compromise is achieved by tricking victims into downloading “Advanced IP Scanner” software which actually contains Vidar malware. CERTU-UA believes this was achieved by initial access brokers (IABs) working for the Russians.
“It should be noted that the Vidar stealer, among other things, steals Telegram session data, which, in the absence of configured two-factor authentication and a passcode, allows unauthorized access to the victim’s account,” the statement continued.
“As it turned out, the victim’s Telegram was used to transfer VPN connection configuration files (including certificates and authentication data) to users. Given the lack of two-factor authentication when establishing a VPN connection, attackers were able to gain an unauthorized connection to the corporate network.”
Once inside, attackers conducted reconnaissance work using the Netscan tool and then launched Cobalt Strike Beacon, exfiltrating data using the Rclone program. There are also signs of the threat actors using Anydesk and Ngrok at this stage.
It’s unclear how widespread the campaign was, although “several” Ukrainian organizations are thought to have been impacted since spring 2022.
Most pointedly, CERT-UA confirmed that the end goal is not to generate profits from a ransom but to destroy victim environments.
Dr. Darren Williams, CEO and Founder, BlackFog had this comment:
“This is another great example of a clever phishing technique to disguise the attack vector inside another application. These are very difficult to detect with existing solutions because of the mechanism of action that steals VPN session information to ultimately exfiltrate data from the device. VPN’s have been routinely targeted in the past because they contain a treasure trove of valuable data for extortion and a centralized repository of data from the victim and the organization. Once the attacker has gained access it is very easy to spread laterally within the organization. This emphasizes why companies need to not only provide defense strategies but also proactive ones that protect an organization and its devices from unauthorized data exfiltration.”
This is clearly an attack meant to hurt Ukraine. Hopefully they are doing their best to make sure that attacks like this are not successful going forward. I say that because while they are winning on the the battlefield, the battlefield has changed to being cyberspace. And for the rest of us, I would say that 2FA for your VPN connections is a must to stop this sort of thing from happening to you.
Elon Musk Just Killed Twitter’s SMS Based 2FA…. WHAT WAS HE THINKING??? [UPDATE: Working For Some Again]
Posted in Commentary with tags Twitter on November 14, 2022 by itnerdI don’t get it. I’ll just put that out there right out of the gate. I say that because a reader pointed me towards this Tweet:
With Twitter SMS 2FA turned off, this service will not function. As in you will be locked out of your Twitter account and you will not be able to log back in if you log out. That’s because Musk clearly decided to kill whatever back end service or services send out the code to your phone via SMS.
Now if you use other forms of 2FA for Twitter, for example you use Microsoft Authenticator to generate a code to log into Twitter, you’re fine. But for those who use strictly SMS for 2FA, and that would be a lot of people I suspect, could be in deep trouble unless they immediately do the following via Twitter’s web interface:
More instructions can be found here. Just ignore anything that refers to SMS or text messaging. Seeing as it’s broken at the moment.
Now to be fair to Musk as I have to look at this from both sides of the fence, SMS based 2FA is weak and exploitable. Thus killing it is a good idea. But to do it with zero warning to users is just plain stupid. That of course assumes that he killed it based on this Tweet.
Now he might not have had a clue what this did, and now by turning whatever back end service supports Twitter SMS 2FA, he’s screwed over a ton of Twitter users in the process.
But the other possibility is that Twitter 2FA broken and there is nobody left who can fix it. Which effectively is the same thing as he turned it off because he laid off half the staff, and those with the knowledge to fix stuff at Twitter are likely not returning his phone calls. Either way, Musk is proving that he’s way out of his league with Twitter. And Twitter users will suffer as a result.
Just another day in Musk run Twitter I guess.
UPDATE: It looks like this service is slowly coming back up. Over the past hour, there have been reports on Twitter that users who were unable to use SMS 2FA can now use it again. But I am not sure that I would trust it as Musk may just break it again.
Leave a comment »