Almost 3M users with infected devices with Chrome and Edge extensions

Up to 3 million devices infected by malware-laced Chrome and Edge add-ons.

Many of the "smart" and "advanced" users who use browser extensions (browser extensions) to download photos, videos, and other content from sites like Facebook, Instagram, Vimeo, and Spotify, have just "achieved" the results that security professionals have always warned about: they managed to contaminate their equipment with silent password stealers, who work without drawing almost any attention, even making the user think "he is safe and that he never had any problem with viruses and malware".

In reality, end users usually don't even know what malware is ...

Read more on this subject at ArsTechnica.

Are Linux Smartphones about to KILL Android?

In this video, not only another Linux phone will be presented. The author will dive into some questions about privacy and profit. In the end, he will think about Linux as a good option for mobiles.

Worthy a peek!

Are Linux Smartphones about to KILL Android? 

Microsoft Defender for Linux adds new security feature

Microsoft's server-based Linux protection program is now offering a public preview of improved endpoint detection and response features.

I know it's still hard for some of you to wrap your minds around it, but Microsoft really does support Linux these days. A case in point: Back in June, Microsoft released Microsoft Defender Advanced Threat Protection (ATP) for Linux for general use. Now, Microsoft has improved the Linux version of Defender, by adding a public preview of endpoint detection and response (EDR) capabilities.

This is still not a version of Microsoft Defender you can run on a standalone Linux desktop. Its primary job remains to protect Linux servers from server and network threats. If you want protection for your standalone desktop, use such programs as ClamAV or Sophos Antivirus for Linux.

For businesses, though, with workers from home now using their Macs and Windows PCs here, there, and everywhere, it's a different story. While based on Linux servers, you'll be able to use it to protect PCs running macOS, Windows 8.1, and Windows 10. 

With these new EDR capabilities, Linux Defender users can detect advanced attacks that involve Linux servers, utilize rich experiences, and quickly remediate threats. This builds on the existing preventative antivirus capabilities and centralized reporting available via the Microsoft Defender Security Center. Specifically, it includes:

• Rich investigation experience, which includes machine timeline, process creation, file creation, network connections, login events, and advanced hunting.
• Optimized performance-enhanced CPU utilization in compilation procedures and large software deployments.
• In-context AV detection. Just like with the Windows edition, you'll get insight into where a threat came from and how the malicious process or activity was created.

To run the updated program, you'll need one of the following Linux servers: RHEL 7.2+; CentOS Linux 7.2+; Ubuntu 16.04 or higher LTS; SLES 12+; Debian or higher; or Oracle Linux 7.2.

Next, to try these public preview capabilities, you'll need to turn on the preview features in Microsoft Defender Security Center. Before you do this, make sure you're running version 101.12.99 or higher. You can find out which version you're running with the command: 

mdatp health

You shouldn't switch all your servers running Microsoft Defender for Endpoint on Linux to the preview in any case. Instead, Microsoft recommends you configure only some of your Linux servers to Preview mode, with the following command:

$ sudo mdatp edr early-preview enable 

Once that's done, if you're feeling brave and want to see for yourself if it works, Microsoft is offering a way to run a simulated attack. To do this, follow the steps below to simulate a detection on your Linux server and investigate the case. 

1 - Verify that the onboarded Linux server appears in Microsoft Defender Security Center. If this is the first onboarding of the machine, it can take up to 20 minutes until it appears. 

2 - Download and extract the script file from here aka.ms/LinuxDIY to an onboarded Linux server and run the following command:

./mde_linux_edr_diy.sh

After a few minutes, it should be raised in Microsoft Defender Security Center.

Look at the alert details, machine timeline, and perform your typical investigation steps.

Good luck!  

By Steven J. Vaughan-Nichols for Linux and Open Source | November 17, 2020 -- 21:16 GMT (13:16 PST) | Topic: Security

Source: https://www.zdnet.com/article/microsoft-defender-for-linux-adds-new-security-feature/

Kazakhstan government is intercepting HTTPS traffic in its capital

If and when our government suggests something similar "for our safety", we should be concerned...

Under the guise of a "cybersecurity exercise," the Kazakhstan government is forcing citizens in its capital of Nur-Sultan (formerly Astana) to install a digital certificate on their devices if they want to access foreign internet services.

Once installed, the certificate would allow the government to intercept all HTTPS traffic made from users' devices via a technique called MitM (Man-in-the-Middle).

Starting today, December 6, 2020, Kazakh internet service providers (ISPs) such as Beeline, Tele2, and Kcell are redirecting Nur-Sultan-based users to web pages showing instructions on how to install the government's certificate. Earlier this morning, Nur-Sultan residents also received SMS messages informing them of the new rules.

Kazakhstan users have told ZDNet today that they are not able to access sites like Google, Twitter, YouTube, Facebook, Instagram, and Netflix without installing the government's root certificate.

This is the Kazakh government's third attempt at forcing citizens to install root certificates on their devices after a first attempt in December 2015 and a second attempt in July 2019.

Both previous attempts failed after browser makers blacklisted the government's certificates.

GOVERNMENT CALLS IT A CYBERSECURITY TRAINING EXERCISE

In a statement published on Friday, Kazakh officials described their efforts to intercept HTTPS traffic as a cybersecurity training exercise for government agencies, telecoms, and private companies.

They cited the fact that cyberattacks targeting "Kazakhstan's segment of the internet" grew 2.7 times during the current COVID-19 pandemic as the primary reason for launching the exercise. Officials did not say how long the training exercise will last.

The Kazakh government used a similarly vague statement last year, in 2019, describing its actions as a "security measure to protect citizens." Representatives for major browser makers, pivotal in blocking the Kazakh government's first two attempts to backdoor HTTPS traffic, told ZDNet they will investigate the recent incident and take appropriate measures. 

By Catalin Cimpanu for Zero Day | December 6, 2020 -- 15:46 GMT (07:46 PST)

Source: https://www.zdnet.com/article/kazakhstan-government-is-intercepting-https-traffic-in-its-capital/

NSA says Russian state hackers are using a VMware flaw to ransack networks

If you use VMWare, you might be concerned about your environment's security ...

Multiple VMware products are exploited in attacks that access Windows active directory.

DAN GOODIN - 12/7/2020, 4:19 PM

The National Security Agency says that Russian state hackers are compromising multiple VMware systems in attacks that allow the hackers to install malware, gain unauthorized access to sensitive data, and maintain a persistent hold on widely used remote work platforms.

The in-progress attacks are exploiting a security bug that remained unpatched until last Thursday, the agency reported on Monday. CVE-2020-4006, as the flaw is tracked, is a command-injection flaw, meaning it allows attackers to execute commands of their choice on the operating system running the vulnerable software. These vulnerabilities are the result of code that fails to filter unsafe user input such as HTTP headers or cookies. VMware patched CVE-2020-4006 after being tipped off by the NSA.

A hacker’s Holy Grail

Attackers from a group sponsored by the Russian government are exploiting the vulnerability to gain initial access to vulnerable systems. They then upload a Web shell that gives a persistent interface for running server commands. Using the command interface, the hackers are eventually able to access the active directory, the part of Microsoft Windows server operating systems that hackers consider the Holy Grail because it allows them to create accounts, change passwords, and carry out other highly privileged tasks.

“The exploitation via command injection led to installation of a web shell and follow-on malicious activity where credentials in the form of SAML authentication assertions were generated and sent to Microsoft Active Directory Federation Services, which in turn granted the actors access to protected data,” NSA officials wrote in Monday’s cybersecurity advisory.

For attackers to exploit the VMware flaw, they first must gain authenticated password-based access to the management interface of the device. The interface by default runs over Internet port 8443. Passwords must be manually set upon installation of software, a requirement that suggests administrators are either choosing weak passwords or that the passwords are being compromised through other means.

“A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account can execute commands with unrestricted privileges on the underlying operating system,” VMware said in an advisory published on Thursday. “This account is internal to the impacted products and a password is set at the time of deployment. A malicious actor must possess this password to attempt to exploit CVE-2020-4006.”

The active attacks come as large numbers of organizations have initiated work-from-home procedures in response to the COVID-19 pandemic. With many employees remotely accessing sensitive information stored on corporate and government networks, software from VMware plays a key role in safeguards designed to keep connections secure.

The command-injection flaw affects the following five VMware platforms:

• VMware Access 3 20.01 and 20.10 on Linux
• VMware vIDM 5 3.3.1, 3.3.2, and 3.3.3 on Linux
• VMware vIDM Connector 3.3.1, 3.3.2, 3.3.3, 19.03
• VMware Cloud Foundation 6 4.x
• VMware vRealize Suite Lifecycle Manager 7 8.x

People running one of these products should install the VMware patch as soon as possible. They should also review the password used to secure the VMware product to ensure it’s strong. Both the NSA and VMware have additional advice for securing systems at the links above.

Monday’s NSA advisory didn’t identify the hacking group behind the attacks other than to say it was composed of “Russian state-sponsored malicious cyber actors.” In October, the FBI and the Cybersecurity and Infrastructure Security Agency warned that Russian state hackers were targeting the critical Windows vulnerability dubbed Zerologon. That Russian hacking group goes under many names, including Berserk Bear, Energetic Bear, TeamSpy, Dragonfly, Havex, Crouching Yeti, and Koala.

From: https://arstechnica.com/information-technology/2020/12/nsa-says-russian-state-hackers-are-using-a-vmware-flaw-to-ransack-networks/

Apple devices massive attack

Recently I wrote here about security for end users, comparing Apple and Linux softwares with Microsoft Windo

Unfortunately, I have just learned that a massive attack is ongoing on several Apps for Apple's mobile devices (iPhone, iPad, etc).

I have read many technical news with their "weird" jargon. And here is, in simple words, what happened:

Software developers need XCode, a software tool provided by Apple itself. Many of them downloaded a Chinese version of the tool, instead of Apple's original version. So, the softwares built with these forfeit version of XCode are all compromised. Roughly, there may be something around 400-500 softwares compromised.

What damage can they cause?
According to BBC, "[...]the perpetrators would also be able to send fake alerts to infected devices to trick their owners into revealing information. It added they could also read and alter information in compromised devices' clipboards, which would potentially allow them to see logins copied to and from password management tools"

What can be done?
You should remove the App if it is one of the compromised. You can read here is a list of some of them, but this list is not complete. Good news: Apple is taking car of it for you! According to CNBC, "Apple said it was cleaning up its iOS App Store to remove malicious iPhone and iPad programs identified in the first large-scale attack on the popular mobile software outlet". Bad news: Apple has not finished it's cleaning job.

Conclusion:
Please, just do not go on installing any Apps just because the daughter of the distant cousin of the neighbor of your friend's dentist told you "it rocks"!!! It does not matter which device you have, you might be in for it.

TMG URL Category errors

Not really an error, but some URLs are wrongly categorized by TMG, such as www.bancohonda.com.br, a financial tool from Honda. TMG consider this as a weapon site:

Not only this, but several other URLs are not correctly filed. That is easy to resolve, but WHY a financial site is considered a Weapons site?

Kernel vulnerabilities

Some serious vulnerabilities in kernel are forcing an update for Ubuntu Users, since version 6. Before the press start to shout out loads of hyperbolics tales stressing how vulnerable Linux really "is", everybody must know that solutions are ready to be downloaded and applied.

Knowing Ubuntu, desktop users have already been alerted about this update, that must be installed. But for Ubuntu Server administers, it must be manually performed.

What you need to do is:

1) Update your repositories:

$ sudo apt-get update

2) Verify the kernel installed version

$ uname -r

2.6.32-25-generic

My kernel version is generic.

Install the right kernel version and dependencies:

$ sudo apt-get install linux-generic

And reinstall the server.

Root Security in Ubuntu

Most of my Linux students always question about Ubuntu's root password. "It is not comfortable, it is unnecessary", and many more excuses. That led me to start changings in my Linux study-pack, in User Administration chapter.

Why ?

Definitively, it is really dangerous to use any OS with an administrative account. At any moment, you can be called to do something else, or for a phone call, or even something that only you can do (and since you work with computers, you ALWAYS forget to do!!!).

Anyway, if this happen, and you need to leave the workstation, maybe you are not editing a file or doing something more complex, or you are doing one of those heavy duties. If you aren't involved with this, that's okay.

If you are, you will either remember to lock your graphic desktop (or CLI environment) or not. If you remember, that's okay.

If you don't, someone else can do anything as the administrator. This is really unwanted. And worst, commands issued are not logged. Some of them may write something. But not them all.

One more thing, and I really dislike this: I do not want to give away root permission to my team. Root password (when exists) should be known by few members, all of them with administrative corporative responsibilities.

SUDO

Ubuntu Server root account has no valid password, by default. Since this is the only account common to all Linux distro, nobody will be able to access it. Since it is needed to know an account, system gets little bit less unsafe.

“sudo” allows a user to execute commands as any other, mostly administrative commands. At first, the user created at install time is included in this "administrative staff". This user can do anything with sudo, as root. The configuration file is /etc/sudoers. This is written upon Karmic Koala (Ubuntu 9.10).

Including an Administrative account

If I want to include Thomas Martin (let's suppose his account is tmartin) as an administrative user, all I have to do is to add him to "admin" group:

sudo adduser tmartin admin

From now on, he can do anything as root. But, whatever he does will be registered in /var/log/auth.log. Watch this example from user "teste":

Nov 13 21:55:14 fw-tosh sudo: teste : TTY=tty1 ; PWD=/home/teste ;
USER=root ; COMMAND=/usr/bin/aptitude install vim

He installed (or tried to install) vim in Nov 13, at 21:55, in TTY1, he was in his home directory when issued this command, and it ran with "root" id We can also see that this happened in “fw-tosh” host.

What this line does not tells me is if his operation was well succeeded or not. But there are other log files, such as /var/log/dpkg.log that really help.

My old Acer has finally gone ...

After almost 5 years wth me, my Acer laptop (Celeron) has been sold. Since it's arrival, it has mostly worked with Ubuntu in a partition, and Windows XP in another.

After some months, only Ubuntu, and until last month, Ubuntu 9.04. I bought a brand new one (thanks, Lon !!!) from Toshiba. And a friend of us asked me that laptop for his son. I told him to keep Ubuntu, for it is better, safer, and all the stuff we know about it.

- No, because he will have to learn lots of new concepts, and on.

And that is for studying only. After some words, I finally gave up, and had to start reinstalling Windows XP on it. Vista would not work well. My first problem was with drivers, since I didn't have them. Not that difficult, Acer's site is really a breeze. I downloaded almost 10 drivers and started a painful path of OS rebuilding. More than 8 reboots after, I had a fully functional Windows: sound, video and anything useful else. Typical. No Compiz, jelly windows, cube desktop, or many other useful stuffs. Hummm ... I mentioned it was only a Celeron with 1G ?

Office, Avira, hotfixes, all this stuff to be installed AFTER ending OS on Partition. More than 1:30 hours, My future ex-Acer is ready to serve someone else: a teenager ... (brrr).

One week after, all the system was compromised with "some" viruses. Now, after all that problems, he'll give Linux a chance. I'll let you know about it after.

MSN Messenger access Microsoft secretly

At least, most of MSN Messenger does not know that ...

Recently I was called by a friend, to help him in his computer problems. A reasonable desktop box, with Windows XP and ESET anti-virus.

MSN 2009 had been installed, but just was not working. I started ESET firewall, and set him to block data traffic, incoming or outgoing. This way I could watch any MSN access. Unfortunatelly, it did not worked at all, so I started working in some others tries, but left Firewall working in the same way. Searching on Internet, I found this page, with older versions of MSN.

After downloading 8.5, I started removing the 2009 version. Surprisingly, ESET Firewall blocked an access try to the Software Vendor. And more than 3 times !!! I cannot understand this. If I was uninstalling the software, why to contact Microsoft ?

I immediately thought of VLC, as shown in this popup. This just did not happened with MSN. The software did not warned me of this, just did it. this is disgusting. They could at least prompt the user about what was about to be done.

After this bad experience, after breathing deeply, I decided to continue, of course. Having installed 8.5 version, I started it, and I was prompted by a warning of a new version to be installed. Of course, I denied, and ... nothing happened. Twice, 3 times, and nothing happened. That means, get the new verson, it is an order. Or else just does not use it.

Wow! Those guy are really bold!! The computer is owned by the one who bought it, if he wants to use it with an older version, it is his business, not Microsoft business.

Mais uma vez fiquei tremendamente irritado. O computador pertence ao seu dono, ou seja, a quem desembolsou dinheiro para o comprar, e o fornecedor do software se acha no direito de impôr suas decisões sobre qual versão do software o usuário tem que usar. It was his own money!!!

Went for a little (a lotta) water, to cool my hatred. I found some tricks to apply on Register (nothing that easy, as many says) and MSN 2009 (after being re-downloaded) was ready to be used. That's okay, it is a Beta version. It will be fixed.

But, I ask any of you: Why does it must be this way ? please, technical answers, and not those built upon a "I think" basis.

AVG says Windows (only a file) is a big Virus.

I have just received an email from my ex-student Rubenaldo. This email points to some interesting links that show AVG and a very tiny mistake: at version 7.5 and 8.0, user32.dll is a virus. Check it out:

http://apcmag.com/
http://www.geek.com/

So, let's open our minds, and understand what can happen:

1 - User starts AVG
2 - AVG complains
3 - User erases the file, and the SO stops

Unfortunately, most of end users, or home users, believe that anti-virus software can let them protected. As we see above, this just does not happen.

Others OS

Not only this, but the most popular end-user operating system is way too vulnerable, if we compare to others, mostly MacOS and Linux.

As my first post, I want to show, as impartially as I can, that there are other ways to do the same job. Of course, I want to show that nothing is a whole solution in itself.

In an cnet Review in 2006, Natasha Lomas remembered the famous Apple campaign, and pointed some flaws. We should never forget that softwares will allways have failures. The point is: Some are worst.

To state this, when you can, take a look at Security Focus Bugtraq Vulnerabilities List. Today (11-21-2008), I found the following results:

Vendor = Apple : 30 pages of vulnerabilities
Vendor = Ubuntu: 31 pages of vulnerabilities
Vendor = Microsoft: 68 pages of vulnerabilities

Note that I choose no software. Only the vendor. Also, most of the vulnerabilities there are solved. So, numbers here will not reflect the security information we are searching.

Usability

Besides, we must consider the usability question: "Will I know how to deal with that ?" The other Operating System may seem really secure, or less insecure. But, will I know how to deal with it's stuffs ? The text editor has the same controls ? My spreadsheet will have suffcient collumns/rows to work ?

I will make things worst then: Okay, I don't have sufficient time to re-learn it all. I will keep it simple. But I wish I could work without worrying so much about malwares. So, the end is to invest in a anti-virus solution, somehow expensive. And, sometimes it really does not work, or work insufficiently.

The question??? it is "How to lift security levels to the user ?"