Author: Lucie Loos

Marketing & Communication Director - Nameshield group

Satori Botnet: The hacker facing up to 10 years imprisonment did not act alone

Satori botnet
Image source: TheDigitalArtist via Pixabay

We now know more about the cyberpirate, Nexus Zeta, whose real name is Kenneth Currin Schuchman, who distinguished himself with the creation of the Satori botnet.

Pleading guilty to the charges regarding Satori botnet creation, his confessions describe the implementation of this attack using IoT flaws.

For reminder, a botnet is a set of infected computers remotely controlled by a cybercriminal. The machines that belong to a botnet are often called “bots” or “zombies”. The aim: to spread a malware or a virus to the greatest number of machines possible.

The hacker Nexus Zeta did not act alone but worked together with two other cybercriminals: Vamp who served as the primary developer/coder of Satori and Drake who managed the botnet sales.

The Satori botnet was created based on the public code of the Mirai IoT malware.

For reminder, in 2016, Mirai was the source of one of the biggest DDoS ever seen in 2016, targeting in particular the American provider DYN. The functioning is based on the permanent research on the Internet, of IP addresses corresponding to connected objects (IoT). Once the vulnerable connected objects identified, Mirai connects to them to install the malware.

If the Satori botnet mainly attacked the devices running with factory-set or easy to guess passwords, in its first month of deployment, it has infected over 100 000 devices.

Between 2017 and 2018, the three hackers continue to develop Satori, which they will rename Okiru and Masuta. The botnet went as far as to infect over 700 000 devices.

Officially accused by the American authorities, Kenneth Currin Schuchman is free until his trial. However, he breaks the pre-trial release conditions by accessing the Internet and developing a new botnet. It is in October 2018 that he is this time arrested and jailed. Pleading guilty, he’s facing up to ten years in prison and a fine of 250 000 dollars.

.AU domain names soon available for registration

.AU domain names soon available for registration
Image source: kitkatty007 via Pixabay

Until now, Australian domain names were only available for registrations in second level extensions, in particular .COM.AU.

If the decision to open the .AU registration goes back to 2015, it took four years to set the rules!

It seems that starting October 1st, 2019, the holder of the existing .com.au domain name, for example forexample.com.au, will be able to apply for priority status to register the exact match of their existing name in .AU, forexample.au.

The detail of the priority allocation system are below:

  • 2 priority status (from 2019/10/01 to 2020/04/01)

–Category 1 : Third level domain names (com.au, net.au, org.au, asn.au, id.au, edu.au, qld.edu.au, nsw.edu.au, eq.edu.au, act.edu.au, vic.edu.au, sa.edu.au, wa.edu.au, nt.edu.au, catholic.edu.au, schools.nsw.edu.au, education.tas.edu.au, sa.au, wa.au, nt.au, qld.au, nsw.au, vic.au, tas.au and act.au) registered on February 4th 2018 at the latest will be assigned to priority category 1 for the registration of the same name in .AU.

–Category 2: Third level domain names registered after February 4th 2018 will be assigned to priority category 2 for the registration of the same name in .AU.

  • The date of the general availability is not announced yet.

The registry indicates that more information will be published in the next weeks, we will keep you informed.

The new .AU licensing rules might also come into effect at the fourth quarter of 2019 (for all the extensions: .au, .com.au, .net.au, .org.au, .asn.au, .id.au).

Lastly, we can note that the general availability will allow the registration to individuals/companies which respect the Australian registry’s conditions (local presence in Australia).

For any questions, Nameshield’s teams are at your disposal.

Europe decides to apply sanctions to transboundary cybercriminals

Europe decides to apply sanctions to transboundary cybercriminals
Image source: GregMontani via Pixabay

On Friday May 17th, 2019, the Council of Ministers of the European Union presented the creation of a blacklist identifying the perpetrators of cybercrimes located outside the EU.

Thus this is a new legal context which has been validated by the EU in order to try to reduce the continuously growing cyberattacks’ number. Now, the EU will indeed be able to sanction individuals or entities involved in the cyberattacks carried out from outside the EU.

Europe seeks through this measure to protect as far as possible the most critical infrastructures, regarding electoral or health systems for example, from cybercriminals, by abolishing the impunity which the international hackers seemingly enjoyed.

If there is no name on this famous list today, the situation could change soon.

Recently, the British Foreign Secretary, Jeremy Hunt declared that “for too long now, hostile actors have been threatening the EU’s security through disrupting critical infrastructure, attempting to undermine democracy and stealing commercial secrets and money running to billions of Euros. Hence, this decision was necessary.”

It’s now very clear that the cyberattacks carried out by nations, against nations or entities, tend to multiply. It’s important to note that these sanctions can be retroactive. To this day, the sanctions are not clearly defined: travel bans and assets freeze against those we know have been responsible for these actions? Several options are presently being studied.

Cyberattack: G7 and France organize a cyberattack simulation in the finance industry

Cyberattack: G7 and France organize a cyberattack simulation in the finance industry
Image source : TheDigitalArtist via Pixabay

Faced with the upsurge and the continually increasing strength of cyberattacks, a simulation exercise of a cyberattack in the finance industry will be organized by the members of the G7, the world’s major economic powers.

In the French presidency context, France will be the one that will run this test in which 24 financial authorities of the 7 members of the G7 will participate during 3 days.

Today it is no secret that the banking sector is one of the most targeted by cybercriminals [according to an IBM’s research, 19% of the attacks would aim banking institutions].

Thus, for the first time, the G7 countries organize a cyberattack cross-border simulation in early June 2019. This test is organized by the Banque de France (the central bank of France) and proposes the following scenario: a malware will be injected in a technical component widely used in the financial sector.

As indicated by Bruno Le Maire, the Minister of Economy and Finance of France “cyber threats are the proof that we need more multilateralism and cooperation between our countries”.

According to this argument, this same exercise will be conducted at the same time in the other countries, giving it a specific dimension. If other exercises of this kind have indeed already been done before, particularly by the Bank of England and the European Central Bank, none of these tests was done simultaneously.

What are the results sought in this joint exercise? Firmly establishing the risks of a cyberattack’s epidemic spread, in order to be able to enhance the infrastructures security and to ensure the reactivity in case of attack and prevent a wide contagion.

Game of Thrones: The return of the [MALWARES] white walkers by dozens

Game of Thrones: The return of the [MALWARES] white walkers by dozens
Image source: Irfan Rafiq via Pexels

As with each event where massive interest is expected, the launch of the final season of Game of Thrones is a golden opportunity for pirates.

According to a Kaspersky’ study, this series would be the favorite of the cybercriminals. It represented 17% of the infected contents last year, i.e. 20 934 web users! According to this same study, the most targeted episodes are logically the first and last episodes of the season.

For if the fans are many in France, without subscription, the only solution to watch the so awaited episodes is illegal downloading on torrent websites.

It is through this means that the cybercriminals infect the unsuspecting web users’ computers. First warning, do not install programs at the request of the torrent websites, they can contain a malware!

Indeed, two kinds of frauds are principally used:

  • Malwares: the malicious software are launched on torrent websites used by the fans of the series to access to the watching of the precious episodes.
  • Phishing: many phishing attempts have been counted, the pirates use the official image of Game of Thrones to try to retrieves your personal data.

This season, the cybercriminals are almost as creative as the scriptwriters of the successful series: many and various fake contests allow these hackers to collect email addresses and other bank details.

Counterfeiting is also in the game, with an observed increase of websites proposing many so-called “official” products but being nothing more than counterfeits.

Thus, Nameshield recommends to the fans to be highly vigilant!

For reminder, here are the basic principles to respect in order to serenely navigate and not be trapped by unscrupulous hackers:

  • Do not download any plugin of suspicious origin
  • Properly analyze the URLs before any purchase
  • Check the presence of the famous HTTPS
  • Check that the final address corresponds to the searched website

As always on the web, an extra vigilance is needed, because if spring wins our regions, don’t forget that on the web, winter is coming…