RSS Security

❌ About FreshRSS
There are new articles available, click to refresh the page.
☐ ☆ ✇ Security Affairs

Japanese computers hit by a wiper malware ahead of 2021 Tokyo Olympics

By: Pierluigi Paganini

Japanese researchers spotted an Olympics-themed wiper targeting Japanese users ahead of the 2021 Tokyo Olympics.

Tokyo Olympics could be a great opportunity for cybercriminals and malware authors, the US FBI warned private US companies of cyberattacks that might attempt to disrupt the 2021 Tokyo Olympics. Researchers from the Japanese security firm Mitsui Bussan Secure Directions (MBSD) discovered an Olympics-themed malware that implements wiping capabilities, The Record reported. The malicious code was specifically designed to target Japanese PCs and was detected ahead of the opening ceremony of the 2021 Tokyo Olympics.

Experts noticed that the file has been uploaded to VirusTotal from France, at the time of its discovery it was detected by multiple antivirus products as a generic threat.

The malicious code was designed to wipe certain file types (DOTM, DOTX, PDF, CSV, XLS, XLSX, XLSM, PPT, PPTX, PPTM, JTDC, JTTC, JTD, JTT, TXT, EXE, LOG) in the user’s personal Windows folder.

The malware only targets data under the Users folder, likely because it was designed to infect users who do not have administrator privileges.

Experts also discovered that the malware targets files created with the Ichitaro Japanese word processor, a circumstance that suggests it was developed to target Japanese users.

The malware also implements evasion and anti-analysis capabilities to prevent the malicious code from being analyzed.

The wiper uses the cURL app to access content on the XVideos adult video portal while deleting files on the infected systems. Experts believe that this feature was implemented to trick experts into believing that the infection took place while accessing adult sites.

The malware is also able to delete itself and evidence of its presence from infected computers.

The actual attack vector seems to be a malicious executable disguised as PDF file, the malicious code was found in a Windows EXE file that was disguised as a PDF file named: [Urgent] Damage report regarding the occurrence of cyber attacks, etc. associated with the Tokyo Olympics.exe.”

“The file looks like a PDF as far as the icon is seen, but it is disguised as an icon, and when you look at the detailed display of the folder, you can see that the extension is EXE as shown below.” reads the report published by the security firm. “The main purpose of this malware is to delete the user’s files, and all the target files under <user folder> ( including subfolders ) are deleted.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, 2021 Tokyo Olympics)

The post Japanese computers hit by a wiper malware ahead of 2021 Tokyo Olympics appeared first on Security Affairs.

☐ ☆ ✇ Security Affairs

Obtaining password hashes of Windows systems with PetitPotam attack

By: Pierluigi Paganini

A researcher found a flaw in Windows OS, tracked as PetitPotam, that can be exploited to force remote Windows machines to share their password hashes.

Security researcher Gilles Lionel (aka Topotam) has discovered a vulnerability in the Windows operating system that allows an attacker to force remote Windows machines to authenticate and share their password hashes with him. The news of the attack was first reported by The Record.

The attack abuse the Encrypting File System Remote (EFSRPC) protocol, which is used to perform maintenance and management operations on encrypted data that is stored remotely and accessed over a network.

Lionel also published a proof-of-concept (PoC) exploit code on GitHub.

“PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw function. This is possible via other protocols and functions as well 😉 .” reads the description provided by the expert.

“The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it’s more prevalent. But it’s possible to trigger with the EFSRPC named pipe and interface df1941c5-fe89-4e79-bf10-463657acf44d.”

In the PetitPotam attack demonstrated by the expert, he sent SMB requests to a remote system’s MS-EFSRPC interface and forced its system to initiate an authentication procedure and share its NTLM authentication hash.

The NTLM authentication hash can be used to carry out a relay attack or can be lately cracked to obtain the victim’s password. The PetitPotam attack can be very dangerous because it allows attackers to take over a domain controller and compromise the entire organization.

Hi all,
MS-RPRN to coerce machine authentication is great but the service is often disabled nowadays by admins on most orgz.
Here is one another way we use to elicit machine account auth via MS-EFSRPC. Enjoy!! 🙂

— topotam (@topotam77) July 18, 2021

Gilles highlighted that disabling support for MS-EFSRPC did not work to mitigate this attack. At the time of this writing, there is no workaround to mitigate this issue.

Lionel told BleepingComputer, that this as a vulnerability but rather the abuse of a legitimate function. 

The attack can potentially impact most of the supported Windows versions, it was successfully tested against Windows 10, Windows Server 2016, and Windows Server 2019 systems.

Mimikatz author Benjamin Delpy also successfully tested the PetitPotam attack and published a video PoC of the attack.

It's time to play with #mimikatz🥝& #kekeo🐤& #impacket
If you have a Windows PKI with its WebServer, you'll have problems🤪

No authentication/credential to *full domain owned*


👍@topotam77 EFS & PetitPotam
👍@ExAndroidDev PR

🥝 Benjamin Delpy (@gentilkiwi) July 23, 2021

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, windows)

The post Obtaining password hashes of Windows systems with PetitPotam attack appeared first on Security Affairs.

☐ ☆ ✇ Security Affairs

Estonian hacker Pavel Tsurkan pleads guilty for operating a proxy botnet.

By: Pierluigi Paganini

Estonian hacker Pavel Tsurkan has pleaded guilty in a United States court to the counts of computer fraud and of creating and operating a proxy botnet.

The Estonian national Pavel Tsurkan has pleaded guilty in a United States court to two counts of computer fraud and abuse.

According to court documents, Pavel Tsurkan (33) operated a criminal proxy botnet composed of more than 1,000 devices. The IoT botnet was tracked as the “Russian2015” because it was using the domain

The infected devices were acting as a proxy to transmit third-party internet traffic, then operators were offering it for rent to threat actors that used it to conduct multiple malicious activities.

“He then sold access to global cybercriminals who channeled their traffic through the victims’ home routers, using the victims’ devices to engage in spam campaigns and other criminal activity. The Alaska victims experienced significant data overages even when there were no home computers connected to the victims’ home networks. The data overages resulted in hundreds to thousands of dollars per victim.” reads the press release published by DoJ. 



The hacker compromised more than 1,000 computers and routers worldwide, DoJ reported that at least 60 victims are in Alaska.

“Today’s cybercriminals rely on increasingly sophisticated techniques to hijack computers and personal electronic devices for their criminal activities. Botnets like the ‘Russian2015’ are a dangerous threat to all Americans and today’s guilty plea demonstrates we can and will hold accountable foreign cybercriminals and their enablers,” said Acting U.S. Attorney Bryan Wilson, District of Alaska. “Our success in disrupting this botnet was the result of a strong partnership between private industry experts and law enforcement.”

The man will be sentenced on November 10, 2021, he faces up to 10 years in prison.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)

The post Estonian hacker Pavel Tsurkan pleads guilty for operating a proxy botnet. appeared first on Security Affairs.