Collaborate Disseminate
[Walker] has a very interesting new project: a completely different take on a self-destructing USB drive. Instead of relying on encryption or other “visible” security features, this device looks and …read more Continue reading USB Drive Keeps Your Secrets… As Long As Your Fingers Are Wet?
While hackers all over the world rely on emails and text messages to breach networks, one infamous criminal group appears to be turning to the mailman to deliver their malicious code. Malware authored by FIN7, which researchers say has stolen over $1 billion in recent years, has been delivered by the U.S. Postal Service to multiple organizations in recent months, according to security company FireEye. The code comes on USB sticks that, once inserted into a computer, install a “backdoor,” called Griffon, capable of stealing sensitive information. The malicious code, which multiple security companies have attributed to FIN7, burrows into the target computer and beacons back to the group for further instructions. How many of the USB deliveries led to network breaches remains unclear. The hacking attempts raise questions about how a group thought to be based in Eastern Europe, and one that U.S. officials have hunted for years, has been […]
The post Malware from notorious FIN7 group is being delivered by snail mail appeared first on CyberScoop.
Continue reading Malware from notorious FIN7 group is being delivered by snail mail
“I feel bad here because I feel like I’m ruining a really good story.” Continue reading Owner of USB Stick Found in Seal Poop Has Come Forward
One BMDS site’s patching was so deficient, it failed to address a critical vulnerability that first came to light nearly three decades ago. Continue reading How not to secure US missile defences
With their ability to carry malware into sensitive environments, USB drives have long been a red flag for industrial facilities. A new study puts hard data behind those concerns and shows how the drives can propagate advanced threats like Stuxnet and Trisis. Of the 50 industrial sites on four continents where Honeywell International analyzed USB usage, 44 percent of sites detected and blocked at least one malicious file. These weren’t just run-of-the-mill files: 15 percent of the threats detected and blocked were infamous malware packages like Stuxnet and Trisis (2 percent each), Mirai (6 percent) and WannaCry (1 percent). About a quarter of the threats blocked could cause “a major disruption to an industrial control environment,” according to Honeywell, an industrial automation giant. The overall volume of USB-based malware found by Honeywell researchers was relatively small, but the types of threats detected were more serious than researchers had anticipated. “It’s […]
The post USB threat to industrial facilities comes into sharp focus with new Honeywell data appeared first on Cyberscoop.
Continue reading USB threat to industrial facilities comes into sharp focus with new Honeywell data
Energy-management software giant Schneider Electric has alerted customers that they may have received malware-laced USB drives in recent shipments of some of the company’s products. The USB drives contained product documentation and “non-essential software utilities” in support of Schneider Electric’s Conext Combox and Conext Battery Monitor solar-power-related products, the company said in a security advisory dated Aug. 24. Some USB drives shipped with the products “were contaminated with malware during manufacturing by one of our suppliers,” the advisory states. The USB drives do not contain operational software and the products’ operational security is therefore unaffected, according to Schneider Electric. “All major anti-malware” scanners can detect and block the malware, the company said. “Users are strongly encouraged to securely discard any USB removable media provided with these products,” the advisory says. “Users who believe they may have used one of the potentially-affected USB removable media are encouraged to perform a full scan […]
The post Schneider Electric snafu shows the need to stay vigilant over supply chain appeared first on Cyberscoop.
Continue reading Schneider Electric snafu shows the need to stay vigilant over supply chain
A cyber espionage group known for attacking organizations in Japan and South Korea has targeted USB drives in a likely effort to infect “air gapped” systems, according to new research. The so-called Tick hacking group has gone after a specific type of USB drive made by an unnamed South Korean defense company, said researchers with cybersecurity company Palo Alto Networks. The newly revealed malware isn’t part of an active campaign and was likely used in attacks years ago, according to the researchers. Nonetheless, the apparent effort to infiltrate air-gapped systems speaks to the lengths to which advanced hackers will go to reach sensitive infrastructure. Whereas other malware used by Tick requires an internet connection to reach a command-and-control server, the group’s “SymonLoader” malware needs no such connectivity, according to the researchers. Instead, the malware tries to extract a hidden payload from a plugged-in USB drive – a technique that is […]
The post ‘Tick’ espionage group is likely trying to hop air gaps, researchers say appeared first on Cyberscoop.
Continue reading ‘Tick’ espionage group is likely trying to hop air gaps, researchers say
Thanks to auto-play, it’s possible to crash Windows systems by simply inserting the drive into the USB port, no further user interaction necessary. Continue reading USB Sticks Can Trigger BSOD – Even on a Locked Device
Malware-laden USB sticks were accidentally sent by IBM to a series of enterprise customers that had purchased storage systems developed by the computing giant, according to a company advisory published last week. An unidentified number of these drives were mailed as an installation tool for users setting up IBM Storewize V3700 and V5000 Gen 1 storage systems. IBM says that all of the infected USBs carried the same serial number: 01AC585. An IBM spokesperson did not respond to CyberScoop’s inquiry. It remains unclear how the malware originally found its way onto the drives. When plugged into a vulnerable system, the memory stick will immediately launch the legitimate Storewize initialization tool, which in this case also carries hidden malicious computer code that copies itself to a temporary folder. Fortunately, the malware itself is not executable, meaning that it won’t automatically run on a computer in order to infect the Storwize disks. […]
The post IBM shipped malware-laden USB sticks to unsuspecting customers appeared first on Cyberscoop.
Continue reading IBM shipped malware-laden USB sticks to unsuspecting customers