IT threat evolution in Q3 2024
IT threat evolution in Q3 2024. Non-mobile statistics
IT threat evolution in Q3 2024. Mobile statistics

Quarterly figures

According to Kaspersky Security Network, in Q3 2024:

• As many as 6.7 million attacks involving malware, adware or potentially unwanted mobile apps were prevented.
• Adware was the most common mobile threat, accounting for 36% of all detected threats.
• More than 222,000 malicious and potentially unwanted installation packages were detected, of which:
  
  • 17,822 were associated with mobile banking Trojans.
  • 1576 packages were mobile ransomware Trojans.

  
  

Quarterly highlights

Mobile attacks involving malware, adware or potentially unwanted apps dropped by 13% in Q3, to a total of 6,686,375. The figure is still above the early 2023 level.

Attacks on users of Kaspersky mobile solutions, Q1 2023 — Q3 2024 (download)

We attribute this drop to the ongoing decline in the activity of adware, primarily stealthware belonging to the AdWare.AndroidOS.HiddenAd family.

Meanwhile, threat actors had not abandoned their attempts to spread their creations through official app marketplaces. For instance, in the third quarter, we discovered the xHelper Trojan inside the Open Browser app on Google Play.

xHelper acts as a stealthy downloader, installing various apps on the device unbeknownst to the user. These downloaders can introduce both ads and malware onto your phone.

We also discovered many apps infected with the Necro Trojan, both in the Google Play store and outside of it. Necro is a multi-component Trojan with an extensive feature set. It can perform any action on a compromised device: from ad display and malware downloads to automatic subscriptions.

Mobile threat statistics

The number of detected Android malware and potentially unwanted app samples also decreased in the third quarter to 222,444.

Detected malicious and potentially unwanted installation packages, Q3 2023 — Q3 2024 (download)

Adware (36.28%) and riskware classified as RiskTool (23.90%) continued to dominate the landscape of installed software packages. The share of RiskTool decreased markedly from Q2. Conversely, there was a minor uptick in the proportion of detected adware.

Detected mobile apps by type, Q2* — Q3 2024 (download)

* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.

Compared to the previous quarter, there was a significant decrease in the number of installation packages for the BrowserAd and MobiDash adware. At the same time, there was an increase in the number of unique HiddenAd apps. The spike in new RiskTool.AndroidOS.Fakapp files, seen in the previous quarter, subsided, causing a decline in the overall RiskTool category.

Share* of users attacked by the given type of malicious or potentially unwanted app out of all targeted users of Kaspersky mobile products, Q2 — Q3 2024 (download)

*The sum may exceed 100% if the same users encountered multiple attack types.

Although the number of installation packages for AdWare.AndroidOS.HiddenAd increased, still, as mentioned above, the overall number of attacks by this malware decreased, which was reflected in its incidence on actual devices. Put simply, while cybercriminals released a variety of unique malware types, they were unsuccessful in infecting a large number of users.

Top 20 mobile malware programs

Note that the malware rankings below exclude riskware and potentially unwanted apps, such as adware and RiskTool.

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The list of the most prevalent malware did not see any significant changes compared to the previous quarter. The generalized cloud verdict of DangerousObject.Multi.Generic took its usual top spot, followed by WhatsApp mods with embedded Triada modules, the Fakemoney phishing app which tricked users into providing their personal data by promising easy earnings, the Mamont banking Trojan, and the Dwphon pre-installed malware.

Region-specific malware

This section describes malware types that mostly focused on specific countries.

* The country where the malware was most active.
** Unique users who encountered this Trojan modification in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same modification.

The list of malware types that targeted specific countries was updated with new samples: SmsThief.fs which attacked Turkish users, and SmsThief.ya and SmsThief.xy which both were being spread in India. The first one was associated with an ongoing Coper banker campaign in Turkey, while the other two were SMS spies masquerading as government or banking apps.

In addition, the list includes familiar malware that continued to operate in certain countries: the Tambir backdoor, and the BrowBot and Hqwar Trojans in Turkey, FakePay in Brazil, members of the UgandaSteal family in Indonesia and India, and others.

Mobile banking Trojans

The third quarter saw detected mobile banking Trojans installation packages reach a total of 17,822.

Number of installation packages for mobile banking Trojans detected by Kaspersky, Q3 2023 — Q3 2024 (download)

The majority of the installation packages belonged to the Mamont family, which also dominated real-life cyberattacks.

Top 10 mobile bankers

* Unique users who encountered this malware as a percentage of all users of Kaspersky mobile security solutions who encountered banking threats.

securelist.com/malware-report-…

IT threat evolution in Q3 2024
IT threat evolution in Q3 2024. Non-mobile statistics
IT threat evolution in Q3 2024. Mobile statistics

Targeted attacks

New APT threat actor targets Russian government entities

In May 2024, we discovered a new APT targeting Russian government organizations. CloudSorcerer is a sophisticated cyber-espionage tool used for stealth monitoring, data collection and exfiltration via Microsoft, Yandex and Dropbox cloud infrastructures. The malware utilizes cloud resources for its C2 (command and control) servers, which it accesses via APIs using authentication tokens. CloudSorcerer also employs GitHub as its initial C2 server. CloudSorcerer functions as separate modules – for communication and data collection – depending on the process it’s running, but executes from a single executable. It leverages Microsoft COM object interfaces to perform its malicious operations.

While the modus operandi of the threat actor is reminiscent of the CloudWizard APT that we reported on in 2023, the malware code is completely different. Consequently, we believe CloudSorcerer is a new threat actor that has emulated a similar approach to interacting with public cloud services.

Two months later, in July 2024, CloudSorcerer launched further attacks against Russian government organizations and IT companies. The campaign, which we dubbed EastWind, used phishing emails with malicious shortcuts attached to deliver malware to target computers. The malware, which received commands via the Dropbox cloud service, was used to download additional payloads.

One of these was an implant called GrewApacha, used by APT31 since at least 2021. The other was an updated version of the backdoor used by CloudSorcerer in its earlier attacks. This one uses LiveJournal and Quora profiles as initial C2 servers.

The latest attacks also use a previously unknown implant with classic backdoor functionality called PlugY. This malware, which is loaded via the CloudSorcerer backdoor, has an extensive command set and is capable of supporting three different protocols for communicating with the C2. The code is similar to that of the DRBControl (aka Clambling) backdoor, which has been attributed to APT27 by several companies.

BlindEagle adds side-loading to its arsenal

In August, we reported a new campaign by Blind Eagle, a threat actor that has been targeting government, finance, energy, oil and gas and other sectors in Latin America since at least 2018. The campaign aligns with the TTPs (Tactics, Techniques and Procedures) and artifacts used by BlindEagle, although the attackers have introduced one new technique to their toolset – DLL side-loading.

The attack starts with phishing emails purporting to be a court order or summons from an institution in Colombia’s judicial system. The email contains a link in the body of the message that is also contained in the attached file, which appears to be a PDF or Word document. Victims are tricked into clicking the link to retrieve documents related to the lawsuit.

These documents are in fact password-protected ZIP or other archives. The archive files contain a clean executable file responsible for initiating the infection process through side-loading, alongside various malicious files used in the attack chain. One of these files carries an embedded loader named HijackLoader, which decrypts and loads the final payload. The final payload is a version of AsyncRAT, one of the Remote Access Trojans (RATs) used by BlindEagle in previous campaigns.

You can read more details about this campaign and the TTPs employed by this threat actor in general here.

Tropic Trooper spies on government entities in the Middle East

The threat actor Tropic Trooper, active since 2011, has historically targeted government, healthcare, transportation and high-tech sectors in Taiwan, the Philippines and Hong Kong. In June 2023, Tropic Trooper initiated a series of persistent campaigns targeting a government body in the Middle East.

We were alerted to the infection in June of this year when our telemetry indicated recurring alerts for a new China Chopper web shell variant discovered on a public web server. China Chopper is widely used by Chinese-speaking actors. The server was hosting a CMS (Content Management System) called Umbraco, an open source CMS platform for publishing content, written in C#. The observed web shell component was compiled as a .NET module of the Umbraco CMS.

Malicious module found inside Umbraco CMS on the compromised server

In the course of our subsequent investigation, we looked for other suspicious detections on this public server and identified several malware sets. These include post-exploitation tools that we have assessed with medium confidence to be related to this intrusion. We also identified new DLL search-order hijacking implants that are loaded from a legitimate vulnerable executable as it lacks the full path specification to the DLL it needs. This attack chain attempted to load the Crowdoor loader, named partly after the SparrowDoor backdoor described by ESET. During the attack, the security agent blocked the first Crowdoor loader, prompting the attackers to switch to a new, previously unreported variant with almost the same impact.

We attribute this activity with high confidence to the Chinese-speaking threat actor known as Tropic Trooper. Our findings show an overlap in the techniques reported in recent Tropic Trooper campaigns. The samples we found also demonstrate a high degree of overlap with samples previously attributed to Tropic Trooper.

The significance of this intrusion is that it involved a Chinese-speaking actor targeting a CMS platform that published studies on human rights in the Middle East, with a particular focus on the situation surrounding the Israel-Hamas conflict. Our analysis revealed that the entire system was the sole target during the attack, suggesting a deliberate focus on this specific content.

From 12 to 21: connections between Twelve and BlackJack groups

In the spring of 2024, posts containing personal data of real individuals began appearing on the -=TWELVE=- Telegram channel. This was soon blocked for violating Telegram’s terms of service, and the group remained inactive for several months. However, during our investigation of an attack in late June, we discovered techniques identical to Twelve’s and the use of C2 servers associated with this threat actor.

The Twelve group was established in April 2023 in the context of the Russian-Ukrainian conflict and has been attacking Russian government organizations ever since. The threat actor specializes in encrypting and then deleting its targets’ data, which suggests that the group’s primary objective is to cause as much damage as possible. Twelve also exfiltrates sensitive information from targeted systems and posts it on the group’s Telegram channel.

Interestingly, Twelve shares infrastructure, utilities and TTPs (Tactics, Techniques and Procedures) with the DARKSTAR ransomware group (formerly known as Shadow or COMET). This indicates that the two may belong to the same syndicate or activity cluster. At the same time, while Twelve’s actions are clearly hacktivist in nature, DARKSTAR adheres to the classic double extortion pattern. This variation in objectives within the syndicate highlights the complexity and diversity of modern cyberthreats.

In our September report on Twelve, we used the Unified Kill Chain methodology to analyze the group’s activities.

We also discovered overlapping TTPs with BlackJack, another hacktivist group that emerged in late 2023. This group’s stated aims, from its Telegram channel, is to find vulnerabilities in the networks of Russian organizations and government institutions. The threat actor has claimed responsibility for more than a dozen attacks, and our telemetry also contains information about other undisclosed attacks where indicators point to BlackJack’s involvement.

The group uses only freely available and open source software. This includes the use of the ngrok utility for tunneling, Radmin, AnyDesk and PuTTY for remote access, the Shamoon wiper and a leaked version of the LockBit ransomware. This confirms that this is a hacktivist group that lacks the resources typical of large APT threat actors.

Other malware

How “professional” ransomware groups boost the business of cybercriminals

Cybercriminals who want to get into the ransomware business don’t necessarily need to develop the software themselves. They can find a leaked ransomware variant online, buy ransomware on the dark web, or become an affiliate. In recent months, we have published several private reports detailing exactly this.

In April, IxMetro was hit by an attack that used a still-new ransomware variant dubbed “SEXi”, a group that focuses primarily on ESXi applications. In each of the cases we investigated, the targeted organizations were running unsupported versions of ESXi. This group deploys either LockBit or Babuk ransomware, depending on the platform – Windows or Linux, respectively.

In the majority of cases, the attackers leave a note containing an email address or URL for a leak site. In the case we looked at, the note included a user ID associated with the Session messaging app. The ID belonged to the attackers and was used across a number of different ransomware attacks on a variety of victims. This indicates a lack of professionalism and suggests that the attackers did not have a TOR leak site.

Key Group (aka keygroup777) has utilized no fewer than eight different ransomware families in its relatively short history (since April 2022):

Use of leaked ransomware builders by Key Group

Over the approximately two-year period that the group has been active, it has made minor adjustments to its TTPs with each new ransomware variant. For example, the persistence mechanism was consistently implemented via the registry, though the specific technique differed by family. In most cases, autorun was used, but we’ve also seen them using the startup folder. While Russian-speaking groups typically operate outside Russia, this is not the case with Key Group. Like SEXi’s, Key Group’s operations are not particularly professional. For example, the primary C2 channel is a GitHub repository, which makes the group easier to track, and communication is conducted over Telegram, as opposed to a dedicated server on the TOR network.

Mallox is a relatively new ransomware variant that first came to light in 2021 and kicked off an affiliate program in 2022. It’s unclear how the authors obtained the source code: perhaps they wrote it from scratch, used a published or leaked version, or – as they claim – purchased it. Although it started as a private group running its own campaigns, it launched an affiliate program shortly after its inception. It is noteworthy that the group only engages with Russian-speaking affiliates and does not do business with novices. Affiliates are explicitly instructed to target organizations with a minimum revenue of $10 million and to avoid hospitals and educational institutions. Mallox uses affiliate IDs, making it possible to track affiliate activity over time. In 2023, there were 16 active partners. In 2024, only eight of the original affiliates were still active, with no newcomers. Other than that, Mallox has all the typical Big Game Hunting attributes that other groups have, such as a leak site and a server hosted on TOR.

You can read more about the above threats here. You can also read our full report on Mallox ransomware here. To learn more about our crimeware reporting service, contact us at crimewareintel@kaspersky.com.

HZ Rat backdoor for macOS

In June, we discovered a macOS version of the HZ Rat backdoor. The backdoor was being used to target users of the enterprise messenger DingTalk and the social networking and messaging platform WeChat. Although we do not know the original distribution point for the malware, we were able to locate an installation package for one of the backdoor samples – a file named OpenVPNConnect.pkg.

OpenVPNConnect.pkg on VirusTotal

The samples we discovered almost exactly replicate the functionality of the Windows version of the backdoor with the exception of the payload, which is received in the form of shell scripts from the attackers’ server. We noticed that some versions of the backdoor utilize local IP addresses to connect to the C2, leading us to believe the threat might be targeted. This also suggests that the attackers intend to use the backdoor for lateral movement through the target network.

The data collected about the targets’ companies and contact information could be used to spy on people of interest and lay the groundwork for future attacks. During the course of our investigation, we did not encounter the use of two of the backdoor’s commands (write file to disk and send file to server), so the full scope of the attacker’s intentions remains unclear.

Hacktivist group Head Mare targets Russia and Belarus

Since the start of the Russo-Ukrainian conflict, numerous hacktivist groups have emerged whose main goal is to cause damage to organizations on the opposing side of the conflict. One such group is Head Mare, which targets organizations in Russia and Belarus.

While such hacktivist groups tend to use similar TTPs, Head Mare uses more up-to-date methods to gain initial access. For example, the attackers leveraged a recently discovered vulnerability in WinRAR (CVE-2023-38831) that allowed them to execute arbitrary code on a compromised system via a specially crafted archive. This approach allows the group to more effectively deliver and disguise the malicious payload.

As is the case with most hacktivist groups, Head Mare maintains a public account on the X social network, which it uses to post information about some of its victims.

Head Mare post on X

Head Mare has targeted a variety of industries, including government, energy, transportation, manufacturing and entertainment. The group mainly uses publicly available software, which is typical of hacktivist groups. However, Head Mare’s toolkit also includes custom malware, PhantomDL and PhantomCore, delivered via phishing emails. In addition to its primary goal of causing damage to targeted organizations, Head Mare also deploys LockBit and Babuk ransomware, which demand a ransom for restoring encrypted data.

Loki: a new private agent for the popular Mythic framework

In July, we discovered a previously unknown backdoor called Loki, which was used in a series of targeted attacks against Russian companies in various industries, including engineering and healthcare. From our analysis and information gleaned from open sources, we determined that Loki is a private version of an agent for the open source Mythic framework. This has its origins in an open source framework for post-exploitation of compromised macOS systems, called Apfell. Two years later, several developers joined the project, the framework became cross-platform and was renamed Mythic. Mythic allows the use of agents in any language, for any platform, with the required functionality. Around two dozen agents have been published in the official Mythic repository, including Loki.

The Loki agent we discovered is a Mythic-compatible version of the agent for another framework, Havoc. The Loki modification inherited several techniques from Havoc to make it more difficult to analyze the agent, such as encrypting its memory image, indirectly calling system API functions, searching for API functions by hash and more. However, unlike the agent for Havoc, Loki was split into a loader and a DLL, where the main functionality of the malware is implemented.

Based on our telemetry, and the filenames of infected files, we believe that in several cases Loki was distributed via email, with unsuspecting victims launching the file themselves. More than a dozen companies have encountered this threat, although we believe the number of potential victims may be higher.

There is currently not enough data to attribute Loki to any known group. Rather than using standard email templates to distribute the agent, we think it’s likely that the attackers are approaching each target individually. We have also not found any unique tools on the infected machines that could help with attribution. The attackers seem to prefer using only publicly available traffic tunneling utilities such as gTunnel and ngrok, and the goReflect tool to modify them.

Tusk: unravelling a complex infostealer campaign

The Kaspersky Global Emergency Response Team (GERT) recently identified a complex campaign consisting of several sub-campaigns orchestrated by Russian-speaking cybercriminals. The sub-campaigns imitate legitimate projects, with slight modifications to names and branding, and using multiple social media accounts to enhance their credibility.

All the active sub-campaigns host the initial downloader on Dropbox. This downloader is responsible for delivering additional malware samples to the target’s machine, mostly infostealers (Danabot and StealC) and clippers (which monitor clipboard data). Additionally, the threat actors employ phishing tactics to entice individuals into revealing further sensitive information, such as credentials, which can then be sold on the dark web or used to gain unauthorized access to gaming accounts and cryptocurrency wallets, resulting in direct financial loss.

We identified three active sub-campaigns and 16 inactive sub-campaigns related to this activity, which we dubbed “Tusk”. In the three active sub-campaigns we analyzed, the threat actor uses the word “Mammoth” (a slang word used by Russian-speaking threat actors to refer to victims) in log messages of initial downloaders. Analysis of the inactive sub-campaigns suggests that they are either old campaigns or campaigns that haven’t started yet.

Our report includes our analysis of the three most recently active sub-campaigns – TidyMe, RuneOnlineWorld and Voico.

These campaigns underscore the persistent and evolving threat posed by cybercriminals who are adept at mimicking legitimate projects to deceive victims. By capitalizing on user trust in well-known platforms, these attackers effectively deploy a range of malware designed to steal sensitive information, compromise systems, and ultimately reap financial gain.

The use of social engineering techniques such as phishing, coupled with multi-stage malware delivery mechanisms, demonstrates the advanced capabilities of the threat actors involved. Their use of platforms like Dropbox to host initial downloaders, along with the deployment of infostealer and clipper malware, suggests a coordinated effort to evade detection and maximize the impact of their operations.

The similarities between different sub-campaigns and the shared infrastructure across them indicates a well-organized operation, potentially linked to a single actor or group with specific financial motives.

The discovery of 16 inactive sub-campaigns further illustrates the dynamic and adaptable nature of the threat actor’s operations.

You can read our report here.

SambaSpy

In May, we discovered a campaign exclusively targeting victims in Italy, which is quite unusual, as cybercriminals typically broaden their range of targets to maximize their profits. However, in this campaign, the attackers check at various stages of the infection chain to ensure that only people in Italy are infected.

The final payload of the infection is a new RAT (Remote Access Trojan) called SambaSpy, a full-featured RAT developed in Java and obfuscated using the Zelix KlassMaster protector. The malware includes an extensive list of functions, including file system management, process management, keylogging, screen grabbing and webcam control.

The attackers lure their targets with phishing emails disguised as messages from a real estate agency. If the target clicks the link in the message, they are redirected to a malicious website that checks the system language and browser. If the potential victim’s system is set to Italian and they open the link in Edge, Firefox or Chrome, they receive a malicious PDF file that infects their device with either a dropper or a downloader. The difference between the two is minimal: the dropper installs the Trojan immediately, while the downloader first downloads the necessary components from the attackers’ servers. Those who don’t meet these criteria are redirected to the website of an Italian cloud-based solution for storing and managing digital invoices.

SambaSpy infection chain 1

SambaSpy infection chain 2

While we don’t yet know which cybercriminal group is behind this sophisticated attack, circumstantial evidence indicates that the attackers speak Brazilian Portuguese. We also know that they’re already expanding their operations to Spain and Brazil, as evidenced by malicious domains used by the same group in other detected campaigns.

securelist.com/malware-report-…

Pumpkin spice, also known as allspice with better marketing, has found its way into a seemingly endless amount of products over the years. It goes beyond the obvious foodstuffs of pies and cakes; because there are plenty of candles, deodorants, and air fresheners ready to add a little more spice to your world. One such autumnal smell enthusiast, YouTube user [J-Knows], sought to automate the delivery mechanism with his 3D printed pumpkin spice aerosol sprayer.

The sprayer device uses an Arduino to rotate a small 3D printed arm that depresses the button on an air freshener cap. This design came as a result of multiple attempts to create a clip that would securely attach to a standard canister. When problems arose with the clip slipping out of place after the motor rotated, a pinch of sticky tack ended up being just the solution. With the proper amount of adhesion, the automated sprayer could now “pollute” any space it is in, as [J-Knows] described.

What took this project to another level is the addition of an Adafruit GPS module. It was coded to respond when it was within one mile of a Starbucks — arguably the organization responsible for the pumpkin spice craze. For some the company’s pumpkin spice latte (PSL) is synonymous with all things fall, and marks the beginning of the season when it is brought back to the coffee menu. Though not being a regular coffee drinker himself, [J-Knows] fully committed to the bit by taking his creation on a test trip to his local Starbucks for a PSL. Judging by the amount of pumpkin spice aerosol solution that ended up on his car dash, he is going to be smelling it into the next year.

youtube.com/embed/Rnx5D53qFy4?…

hackaday.com/2024/11/29/gps-en…

Recentemente è stata identificata una vulnerabilità in Windows 11 versione 23H2 che consente agli aggressori locali di ottenere privilegi elevati a causa di un overflow di numeri interi nel driver “ksthunk.sys”. Il problema è stato scoperto nella funzione “CKSAutomationThunk::ThunkEnableEventIrp“, che è responsabile dell’elaborazione dei processi a 32 bit in un ambiente a 64 bit.ssd-disclosure.com/ssd-advisor…

La ricerca è stata presentata all’evento TyphoonPWN 2024, dove è stato dimostrato il successo dell’utilizzo dell’exploit. Lo sviluppatore che ha partecipato al concorso si è classificato secondo.

Microsoft ha affermato che la vulnerabilità è già stata risolta, ma non ha fornito una data esatta per la correzione. Dal controllo è emerso che il problema persiste nell’ultima versione di Windows 11 e che non esiste un numero CVE e una documentazione ufficiali per la correzione.

L’errore è legato ad un’elaborazione errata della dimensione del buffer, che porta ad un overflow. Un utente malintenzionato può ottenere il controllo della memoria ed eseguire scritture arbitrarie, consentendo l’inserimento del token di sistema nel processo corrente e ottenendo privilegi di amministratore.

Per il funzionamento viene utilizzata la seguente sequenza:

1. Bypassare il controllo “ProbeForRead” attraverso la manipolazione dell’indirizzo di memoria.
2. Un overflow del buffer provoca il danneggiamento di un oggetto di memoria vicino.
3. Le primitive vengono create per leggere e scrivere in aree di memoria arbitrarie.
4. Modificando il token del processo, l’aggressore ottiene l’accesso ai privilegi SYSTEM.

Lo sfruttamento di questa vulnerabilità minaccia la sicurezza sia dei dispositivi personali che delle reti aziendali. Poiché la vulnerabilità è legata all’elaborazione della memoria, lo sfruttamento richiede notevoli competenze tecniche, ma se attaccato con successo, le conseguenze potrebbero essere catastrofiche.

Gli esperti raccomandano:

• Installare tutti gli aggiornamenti disponibili per Windows 11.
• Utilizzare soluzioni antivirus in grado di rilevare comportamenti anomali dei processi.
• Impostare restrizioni sull’esecuzione di applicazioni sospette sulla rete locale.

Nell’era digitale, la sicurezza del sistema dipende non solo dalle barriere tecniche, ma anche dalla vigilanza degli utenti e degli specialisti pronti a riconoscere e neutralizzare rapidamente le potenziali minacce, trasformando le vulnerabilità tecniche in opportunità per migliorare i meccanismi di protezione.

L'articolo Windows 11 Nel Mirino: L’Exploit per il bug del Driver ksthunk.sys Minaccia le reti proviene da il blog della sicurezza informatica.

Il Tor Project ha annunciato il lancio di una campagna per reclutare volontari per installare 200 nuovi bridge WebTunnel entro la fine dell’anno. Questi bridge sono essenziali per combattere la crescente censura di Internet, soprattutto nei paesi con accesso limitato a Internet.

Tor attualmente utilizza 143 bridge WebTunnel che aiutano gli utenti a aggirare il blocco dei siti Web e le restrizioni di accesso a Internet. Tuttavia, la maggiore censura di Internet in alcune regioni crea ulteriori ostacoli influenzando i meccanismi di elusione integrati come obfs4 e Snowflake.

I bridge WebTunnel sono un nuovo tipo di tecnologia introdotta da Tor nel marzo 2024. Consentono al traffico Tor di essere mascherato da HTTPS, rendendolo difficile da rilevare. A differenza dei bridge standard che utilizzano protocolli come obfs4, WebTunnel funziona attraverso un server web con un certificato SSL/TLS valido, rimanendo non rilevabile dai sistemi di blocco.

I problemi affrontati dagli utenti Tor includono tentativi di bloccare bridge e strumenti di bypass, rimozione di applicazioni rilevanti dagli store e restrizioni a livello di provider di hosting. Ciò rende difficile per gli utenti russi l’accesso gratuito a Internet e sottolinea la necessità di aumentare il numero di bridge WebTunnel.

La campagna durerà fino al 10 marzo 2025 e i partecipanti che installeranno cinque o più ponti riceveranno un regalo commemorativo dal Progetto Tor. Per partecipare è necessario:

• un bridge per indirizzo IPv4;
• disponibilità di un certificato SSL/TLS valido;
• sito web che supporta il bridge;
• larghezza di banda minima 1 TB/mese;
• Disponibilità dei bridge 24 ore su 24 (sono accettabili i riavvii per gli aggiornamenti);
• funzionamento obbligatorio dei ponti durante tutto l’anno.

L’organizzazione consiglia di evitare l’utilizzo dell’hosting Hetzner ed è pronta a fornire istruzioni per la creazione di bridge sul proprio sito ufficiale.

Il progetto Tor spera che i nuovi bridge WebTunnel contribuiscano a mantenere l’accesso a Internet libero a fronte di un maggiore controllo sulla rete.

L'articolo Vuoi Combattere la Censura? Tor Ha Bisogno di Te! proviene da il blog della sicurezza informatica.

Ciao a tuttə del Poliverso! 😺

Io sono Synth, è un anno ormai che sono nel #Fediverse e ho deciso di espandermi su Friendica per esplorarne le possibilità dato che è un po' di tempo che nutro curiosità per questo software.

Questo account non è il mio main, quello lo potete trovare su Misskey.social sul mio profilo @synthBirba , quello rimarrà il mio profilo "generico" ITA/ENG, qui vorrei concentrarmi nel comunicare esclusivamente in italiano e con persone che parlano la stessa lingua.

Ho scelto questa istanza perchè mi è capitato diverse volte di interagire con utenti che vengono da qui ^^

Presto farò l'annuncio anche sul mio main su Misskey per confermare il "collegamento" degli account (e sempre presto spero di approdare su PixelFed per caricare foto di gatti e quel che capita!)

Spero di trovarmi bene, di conoscere sempre più gente e di interagire in maniera interessante anche per voi c: