Category: Cybersecurity

Game of Thrones: The return of the [MALWARES] white walkers by dozens

Game of Thrones: The return of the [MALWARES] white walkers by dozens
Image source: Irfan Rafiq via Pexels

As with each event where massive interest is expected, the launch of the final season of Game of Thrones is a golden opportunity for pirates.

According to a Kaspersky’ study, this series would be the favorite of the cybercriminals. It represented 17% of the infected contents last year, i.e. 20 934 web users! According to this same study, the most targeted episodes are logically the first and last episodes of the season.

For if the fans are many in France, without subscription, the only solution to watch the so awaited episodes is illegal downloading on torrent websites.

It is through this means that the cybercriminals infect the unsuspecting web users’ computers. First warning, do not install programs at the request of the torrent websites, they can contain a malware!

Indeed, two kinds of frauds are principally used:

  • Malwares: the malicious software are launched on torrent websites used by the fans of the series to access to the watching of the precious episodes.
  • Phishing: many phishing attempts have been counted, the pirates use the official image of Game of Thrones to try to retrieves your personal data.

This season, the cybercriminals are almost as creative as the scriptwriters of the successful series: many and various fake contests allow these hackers to collect email addresses and other bank details.

Counterfeiting is also in the game, with an observed increase of websites proposing many so-called “official” products but being nothing more than counterfeits.

Thus, Nameshield recommends to the fans to be highly vigilant!

For reminder, here are the basic principles to respect in order to serenely navigate and not be trapped by unscrupulous hackers:

  • Do not download any plugin of suspicious origin
  • Properly analyze the URLs before any purchase
  • Check the presence of the famous HTTPS
  • Check that the final address corresponds to the searched website

As always on the web, an extra vigilance is needed, because if spring wins our regions, don’t forget that on the web, winter is coming…

ANSSI annual report – The 5 cyber threats observed in 2018

ANSSI annual report – The 5 cyber threats observed in 2018
Image source: TheDigitalArtist via Pixabay

On April 15, 2019, ANSSI (the National Cybersecurity Agency of France), unveiled its annual report during a press conference. The agency identified 1869 alerts, 391 incidents without counting critical importance operators, 16 major incidents and 14 cyber defence operations for 2018. ANSSI also identified 5 major trends in terms of cyber threats observed in France and in Europe in 2018.

Analysis of cyber threat in 2018 – The 5 major trends

1.Cyber-espionage

Major concern for ANSSI in 2018, according to the agency, cyber-espionage represents the highest risk for the organizations.

Extremely discrete, benefiting from important financial resources, the attackers plan for many years highly targeted and highly sophisticated attacks. In 2018, it was noted that the cyber attackers are increasingly interested in vital activity sectors and specific critical infrastructures like the defence, health or research sectors.

2.Indirect attacks

According to ANSSI, indirect attacks have known an important increase in 2018. Indeed, to avoid the security measures implemented by big companies, which are more and more aware of the cyber risk, the attackers aim intermediaries, like providers, who are more vulnerable, to reach their final targets.

Compromising one partner is enough to reach many companies. So it is essential to choose partners that place their information system’s security at the top of their concerns.

3.Destabilization and influence operations

Because of the nature of the targets and the claims, these attacks though technically moderate, have often an important symbolic impact. An increase has been observed in 2018.

4.Cryptojacking

For reminder, cryptojacking is a cyberattack that consists in using the computer’s power of its victim to mine cryptocurrency.

In 2018, many attacks of this kind were observed. The more and more organized attackers benefit from the security flaws to compromise their victims’ equipment by placing cryptocurrencies’ miners without them knowing it.

5.Online frauds

Online frauds represent as much of a constant cyber threat for the companies and the big organizations as for the individuals. ANSSI noted an important growth of online frauds last year. Big operators are becoming more concerned about cybersecurity, so the attackers turn towards targets less exposed but more vulnerable, like territorial authorities or actors in the health sector which thus were the targets of many phishing attacks in 2018.

Conclusion

The multiplicity and the magnitude of the attacks observed during 2018, prove that it is essential to implement security measures to prevent these cyber threats, within big organizations, big groups as well as small companies.

“The conclusion is clear: 2018 proves once again that digital risk, far from being ethereal, must be at the heart of our concerns. Not only those of ANSSI! The cyberattacks affect all of society. That is why we must all seize the matter.” explains Guillaume Poupard, ANSSI’s General Director.

15 websites proposing DDoS attacks closed by the FBI

15 websites proposing DDoS attacks closed by the FBI
Image source: typographyimages via Pixabay

In its last quarterly report, Nexusguard stated that after the FBI closed 15 websites providing cyberattacks services, a decrease of 85% of the DDoS attacks’ scale and 24% of big attacks were observed.

In the same way, these closings would lead to the decrease of 11% of the attacks’ volume comparing to the same period in 2018 and at an international level.

Indeed, it was in December 2018 that the FBI successfully shut down 15 websites proposing DDoS attacks services, called “booters” or “booters services” in the business.

To achieve their goals, these booters use IP stresser, which originally are tools allowing to test the server or the network’s resilience. The cybercriminals hijack these IP stresser and send through them a large volume of requests towards the servers until they are overloaded and unable to respond anymore.

The Nexusguard report also indicates that the 15 websites closed by the FBI would be the technical source of about 11% of the global DDoS attacks of various sizes since 2014. Of course, this decrease might only be temporary, the multiplication of bot networks being the real plague of our decade in terms of cybercriminality.

Attack on the domain name system: the priority is to protect your access

Cyberattack - DNS Hijacking - cyber espionage
Image source : Geralt via Pixabay

Last weekend, the media has widely communicated on the consequences of an unprecedented attack that targeted the domain names.

Indeed, during the night of 22-23 February ICANN reported the large-scale attacks on the domain names: it is DNS hijacking. These attacks consist in “replacing the authorized servers addresses” with “addresses of machines controlled by the attackers”, as explained by the organization, allowing the attackers to examine the data in order to find passwords, email addresses etc., even to completely capture the traffic towards their servers.

A wave of attacks that began in November 2018

Actually, this is not an attack but a wave of attacks that the domain names system has endured for several weeks now.

Since the end of November 2018, an attack has targeted Lebanon and the United Arab Emirates and affected .GOV domain names. In this attack, the cybercriminals have proceeded with DNS hijacking.

At the beginning of January 2019, the company FireEye reported in an article, a wave of DNS hijacking that has affected domain names belonging to government, telecommunications and internet infrastructure entities across the Middle East and North Africa, Europe and North America.

If the attackers were then not identified, the initial research suggested the attacks could be conducted by persons based in Iran.

Important fact regarding the attack of February 22: this time, it struck, sometimes successfully, important actors of the Internet.

What are these attacks?

The method used is the DNS hijacking deployed on a large scale. This is a malicious attack, also called DNS redirection. Its aim: overwrite the TCP/IP parameters of a computer in order to redirect it towards a fraudulent DNS server instead of the configured official DNS server. To do this, the attacker takes control of the targeted machine through different techniques to alter the DNS configurations.

The American government, among others, recently warned about these series of highly sophisticated attacks of which the aim would be to siphon a large volume of passwords. These attacks would target more specifically governments and private companies.

Between DNS hijacking and cyber espionage

According to Talos’ article of November 2018, the attackers behind these attacks would have collected emails and connection information (login credentials – passwords) by hijacking the DNS, so that the traffic of the emails and the VPN (Virtual Private Networking) of the targeted institutions would be redirected to a server controlled by the cybercriminals.

Once the connectors collected, other attacks can be launched for espionage purposes, like the Man-In-The-Middle.

Then how to effectively protect yourself?

You must be aware that if these attacks essentially aim the domain names system, we can never say it enough, the first entry point of your domain names portfolio for an attacker is your access to the management platform.

The first and utmost recommendation is to protect your access

For many years, Nameshield has developed securing measures for the access to the domain names management platform (IP filter, ACL, HTTPS) and in addition proposes the 2 factors authentication and the SSO.

If these complementary solutions are still not implemented, Nameshield strongly recommends to implement them, in particular the 2 factors authentication in order to fight against passwords thefts.

To implement the DNSSEC protocol

The implementation of DNSSEC, if it was more widely deployed, would prevent or at least lessen the impact of these attacks by limiting their consequences.

It’s becoming increasingly urgent that DNSSEC is adopted on a massive scale, for both resolvers and authoritative servers.

To protect your domain names

The implementation of a registry lock on your strategic names will prevent their fraudulent modifications.

Although no perfect solution exists today to fully protect the infrastructures from cyberattacks, it is the implementation of several preventive measures combined that will allow to reduce the vulnerabilities (so) easily exploited by the pirates.

DNS Flag Day: Are you ready?

DNS Flag Day - Blog Nameshield

Lately, the DNS keeps being talked about! After the first KSK rollover of October 2018, then the deactivation of the former KSK key on last January 11, here comes the time of the DNS Flag Day!

DNS Flag Day: What is it all about?

The Flag day is an expression used in IT to indicate the deadline and/or radical change.

Let us remember that when it was created, the weight of cybercrime threats affecting the DNS infrastructure didn’t exist. If the security was relegated to the background, the evolution of attacks have made it absolutely necessary: The DNS must be strengthened!

It’s in this context that the EDNS standard has been created in 1999 (updated in 2013 in the RFC6891). EDNS has particularly allowed the implementation of DNSSEC, the DNS’ geolocation and other measures aiming to strengthen the security.

This transition was not without difficulties. Abusive EDNS standard adoptions, lack of updates, bypasses have led to the creation of many patches and accommodations of the recursive servers’ code (particularly, in order to be able to differentiate DNS servers which cannot properly support EDNS from the ones unreachable for other reasons).

Two decades later, the maintenance of all these patched software has become more than difficult and leads to bugs that can compromise the DNS security. Obviously, the weight of these patches affects the speed of the response times.

It’s time for this standard to be implemented by all, or they will no longer be able to efficiently deal with new DNS attacks, like amplification or layer 7 attacks.

That’s why, major IT actors (Google, Cloudfare, Facebook, Cisco..), of which the developers of recursive servers decided as one to no longer support DNS servers that do not respect the EDNS standard as of February 1, 2019. The Flag Day arrives!

And concretely?

From the DNS Flag Day, on February 1, all the DNS servers not in compliance with the EDNS standard (or not functioning because of a firewall incompatible with EDNS), thus not responding to EDNS requests will be considered as unreachable; accommodations and other patches being removed from the new versions of the DNS software.

To simplify, not placed on compatible DNS, your domain name may no longer respond.

How to anticipate?

That is why it is important to ensure that DNS servers hosting your names‘ zones are compatible EDNS, in particular if they are not placed on Nameshield’s DNS infrastructure or if your company maintains its own infrastructure.

The DNS Flag Day website also allows to test the compliance of your name: https://dnsflagday.net/

Of course, our team is at your disposal for any question.