North Korea hacking focused more on making money than espionage – South Korean study

SEOUL — North Korea is behind an increasingly orchestrated effort at hacking into computers of financial institutions in South Korea and around the world to steal cash for the impoverished country, a South Korean state-backed agency said in a report.

In the past, suspected hacking attempts by North Korea appeared intended to cause social disruption or steal classified military or government data, but the focus seems to have shifted in recent years to raising foreign currency, the South’s Financial Security Institute (FSI) said.

The isolated regime is suspected to be behind a hacking group called Lazarus, which global cybersecurity firms have linked to last year’s $81 million cyber heist at the Bangladesh central bank and the 2014 attack on Sony’s Hollywood studio.

The U.S. government has blamed North Korea for the Sony hack and some U.S. officials have said prosecutors are building a case against Pyongyang in the Bangladesh Bank theft.

In April, Russian cybersecurity firm Kaspersky Lab also identified a hacking group called Bluenoroff, a spinoff of Lazarus, as focused on attacking mostly foreign financial institutions.


The new report, which analyzed suspected cyberattacks between 2015 and 2017 on South Korean government and commercial institutions, identified another Lazarus spinoff named Andariel.

“Bluenoroff and Andariel share their common root, but they have different targets and motives,” the report said. “Andariel focuses on attacking South Korean businesses and government agencies using methods tailored for the country.”

Pyongyang has been stepping up its online hacking capabilities as one way of earning hard currency under the chokehold of international sanctions imposed to stop the development of its nuclear weapons program.

Cyber security researchers have also said they have found technical evidence that could link North Korea with the global WannaCry “ransomware” cyberattack that infected more than 300,000 computers in 150 countries in May.

“We’ve seen an increasing trend of North Korea using its cyber espionage capabilities for financial gain. With the pressure from sanctions and the price growth in cryptocurrencies like Bitcoin and Ethereum — these exchanges likely present an attractive target,” said Luke McNamara, senior analyst at FireEye, a cybersecurity company.

North Korea has routinely denied involvement in cyberattacks against other countries. The North Korean mission to the United Nations was not immediately available for comment.

ATMs, online poker

The report said the North Korean hacking group Andariel has been spotted attempting to steal bank card information by hacking into automated teller machines, and then using it to withdraw cash or sell the bank information on the black market. It also created malware to hack into online poker and other gambling sites and steal cash.

“South Korea prefers to use local ATM vendors and these attackers managed to analyze and compromise SK ATMs from at least two vendors earlier this year,” said Vitaly Kamluk, director of the APAC research center at Kaspersky.

“We believe this subgroup (Andariel) has been active since at least May 2016.”

The latest report lined up eight different hacking instances spotted within the South in the last few years, which North Korea was suspected to be behind, by tracking down the same code patterns within the malware used for the attacks.

One case spotted last September was an attack on the personal computer of South Korea’s defense minister as well as the ministry’s intranet to extract military operations intelligence.

North Korean hackers used IP addresses in Shenyang, China to access the defense ministry’s server, the report said.

Established in 2015, the FSI was launched by the South Korean government in order to boost information management and protection in the country’s financial sector following attacks on major South Korean banks in previous years.

The report said some of the content has not been proven fully and is not an official view of the government.

source: interaksyon.com

Cybercrime ring steals up to $1 billion from banks — Kaspersky

A multinational gang of cyber criminals has stolen as much as $1 billion from as many as 100 financial institutions around the world in about two years, Russian computer security company Kaspersky Lab said on Saturday.

The company said it was working with Interpol, Europol and authorities from different countries to try to uncover more details on what it being called an unprecedented robbery.

The gang, which Kaspersky dubbed Carbanak, takes the unusual approach of stealing directly from banks, rather than posing as customers to withdraw money from companies’ or individuals’ accounts. It said the gang included cyber criminals from Europe, including Russia and Ukraine, as well as China.

Carbanak used carefully crafted emails to trick pre-selected employees into opening malicious software files, a common technique known as spear phishing. They were then able to get into the internal network and track down administrators’ computers for video surveillance.

In this way, Kaspersky said, the criminals learned how the bank clerks worked and could mimic their activity when transferring the money.

In some cases, Carbanak inflated account balances before pocketing the extra funds through a fraudulent transaction. Because the legitimate funds were still there, the account holder would not suspect a problem.

Kaspersky said Carbanak also remotely seized control of ATMs and ordered them to dispense cash at a predetermined time, when a gang member would be waiting to collect the money.

“These attacks again underline the fact that criminals will exploit any vulnerability in any system,” Sanjay Virmani, director of Interpol Digital Crime Center, said in a statement prepared by Kaspersky. “It also highlights the fact that no sector can consider itself immune to attack and must constantly address their security procedures.”

source: interaksyon.com

Banking apps on Android phones most at risk of virus: Kaspersky

JERUSALEM — Banking applications on Android phones are most vulnerable to cyber crime, the chief executive and co-founder of Russian anti-virus software maker Kaspersky Lab said on Monday.

Eugene Kaspersky said 99 percent of mobile attacks are towards Android-based phones, since Apple has strict controls and does not allow third-party applications.

The most disturbing trend in cyber attacks was a growing shift to mobile devices from computers and a major cyber attack using mobile phones was bound to happen since cellular users are not properly protected, he told Reuters.

“I expect something really bad to happen to change people’s minds and awareness,” he said, noting that it took the Chernobyl virus in 1998 for people to properly protect their computers.

“Cyber crime is moving to mobile but people are not aware. It’s still not as big as computer crime but it’s growing fast. The trend is a very dangerous situation,” he said at a cyber-tech conference in Israel, where he wants to open a research and development lab.

Kaspersky makes one of the top-selling anti-virus programs in the United States, where it has gained market share in recent years against products from Symantec Corp, Intel’s McAfee and Trend Micro.

He said it was hard to determine where most cyber attacks are coming from geographically but cyber criminals typically speak Chinese, Spanish, Portuguese and Russian.

source: interaksyon.com

Largest-ever cyber attack slowing global Internet services

LONDON — One of the largest ever cyber attacks is slowing global internet services and the disruption could get worse, experts said on Wednesday, after an organization blocking “spam” content became a target.

Spamhaus, a London and Geneva-based non-profit group which helps weed out unsolicited “spam” messages for email providers, said it had been subjected to “distributed denial of service” (DDoS) attacks on an unprecedented scale for more than a week.

“Based on the reported scale of the attack, which was evaluated at 300 Gigabits per second, we can confirm that this is one of the largest DDoS operations to date,” online security firm Kaspersky Lab said in a statement.

“There may be further disruptions on a larger scale as the attack escalates.”

Spamhaus publishes blacklists used by internet service providers (ISPs) to weed out spam in email traffic.

The group is directly or indirectly responsible for filtering as much as 80 percent of daily spam messages, according to Cloudflare, a company that said it was helping Spamhaus mitigate the attack.

“We’ve been under this cyber-attack for well over a week,” Steve Linford, chief executive of Spamhaus, told the BBC. “They are targeting every part of the internet infrastructure that they feel can be brought down.”

Perpetrators of DDoS attacks typically target websites by flooding servers with messages from multiple systems so they cannot identify and respond to legitimate traffic.

Paul Vlissidis, group technical director at internet security firm NCC, said the volumes of traffic involved in the attack were having a knock-on effect on the rest of the internet.

Because many computers were involved in the attack, it was difficult to defend against.

“If you have a few computers sending large amounts of traffic you can filter them out easily. When literally thousands and thousands are involved it makes it much, much harder,” he told Reuters.

However, according to thinkbroadband, an independent British information website which allows users to test their broadband speed, there appeared to be little evidence of a slowdown.

“Of course it is possible that people may be finding some services or sites they access over the Internet are performing slower than usual … but there appears to be no evidence to say that UK broadband users have been slowed down across the board,” it said on its blog.

source: interaksyon.com

"Green Hornet" actor appointed Kaspersky Lab's new Brand Ambassador

Manila, Philippines - Kaspersky Lab, a leading secure content and threat management solutions developer, is proud to announce the appointment of creative genius Jay Chou as its latest brand ambassador for the Asia Pacific, as part of the unique branding strategies of Kaspersky Lab to protect more than 300 million users globally.

Chou hit the international market with the remake of the Green Hornet, where he portrayed the character of Kato (formerly played by Bruce Lee in the TV series).

The Taiwanese actor is also a film director, singer-songwriter, music and film producer, a one-man entertainment juggernaut, who effortlessly combines Chinese and Western music styles in an eclectic mix of R&B, rock, pop and ethnic music. He is also gifted with a personality that wins fans and friends globally.

With his versatility as an artist, Chou earned the respect of millions of Asian and Western artists and fans.

His popularity has also earned him the spot of becoming the Asia Pacific Brand Ambassador for Kaspersky Lab.

Kaspersky Lab's award-winning products, services and technologies have exceptionally high and accurate malware detection rates, meeting Jay Chou's needs as an individual user and as a corporate network owner with important personal and corporate information to keep safe.

Under this partnership, Chou will work with Kaspersky Lab to launch new releases of products for home users and corporate users.

“Jay Chou is an amazing multi-talented entertainer and entrepreneur with a uniqueness, innovativeness and creativity that is an ideal match for Kaspersky Lab. As an individual and corporate user of our products who has a great interest in technology, Kaspersky and Jay Chou is an ideal match. We are excited about this partnership and look forward to much great collaborations with Jay,” said Kaspersky Lab Asia Pacific Managing Director Harry Cheung.

Cheung said that the brand works towards achieving ever higher levels of security and threat management for a safer digital environment and is constantly on the lookout for ambassadors who can take the important message of security to a wider audience.

“Kaspersky has been experiencing tremendous growth over the past few years due to our market leading products and innovative campaigns. We are the only security brand working with high profile brand ambassadors who are able to embody the values and benefits of using our products,” Cheung said.

Chou, for his part, said that like the core values upheld by Kaspersky Lab, he also values quality of service and satisfaction of audiences. He understands that protecting one’s investments from a harsh digital crime is paramount and that all Internet users must also be able to put in place all the necessary precautions.

"I trust Kaspersky Lab fully as updates are speedy and constant. There is no downtime, no security breaches and malware gets dealt with quickly and efficiently. I have the peace of mind of the best protection. Kaspersky is my only choice for IT security protection'' Jay Chou said.

source: mb.com.ph

Kaspersky Lab appeals to Global Programmers to help fight DUQU

Manila, Philippines - Kaspersky Lab, a leading secure content and threat management solutions developer, appeals to the programming community to solve the deep mystery in the Duqu saga that sparks theories that it was launched as a way to conduct high-level cyber-espionage and sabotage.

Duqu is a sophisticated Trojan that was created by the same people who created the infamous Stuxnet worm. Its main purpose is to act as a backdoor into the system and facilitate the theft of private information.

In an effort to find out Duqu’s intentions and where it would be going, security experts from Kaspersky Lab ask the vast programming community worldwide to share in the analysis of Duqu.

Kaspersky Lab Chief Security Officer Alexander Gostev said that the help of the programming community would help identify how Duqu was made and to track down its creators. Doing such would prevent attacks that would use it as a weapon.

The big unsolved mystery of the Duqu Trojan relates to how the malicious program was communicating with its Command and Control (C&C) servers once it infected a victim’s machine. The Duqu module that was responsible for interacting with the C&Cs is part of its Payload DLL.

After a comprehensive analysis of the Payload DLL, Kaspersky Lab researchers have discovered that a specific section inside the Payload DLL, which communicates exclusively with the C&Cs, was written in an unknown programming language. Kaspersky Lab researchers have named this unknown section the “Duqu Framework.”

Gostev reveals that Duqu has been found to be using either a totally new or an unknown programming language, unlike most malware that were developed by traditional programming languages like C++ or Visual C++.

Having such a different programming language already points out to the type of sophistication in creating the Duqu malware, which in turn reveals the high-level programming skill sets used by its creators.

According to Alexander Gostev, the creation of a dedicated programming language demonstrates just how highly skilled the developers working on the project are, and points to the significant financial and labor resources that have been mobilized to ensure the project is implemented.

“Given the size of the Duqu project, it’s possible that an entirely different team was responsible for creating the Duqu Framework. With the extremely high level of customization and exclusivity that the programming language was created with, it is also possible that it was made not only to prevent external parties from understanding the cyber-espionage operation and the interactions with the C&Cs, but also to keep it separate from other internal Duqu teams who were responsible for writing the additional parts of the malicious program,” Gostev says.

So far, the majority of Duqu infections have been found in Iran. However, it does not stop its creators to target other newly-industrialized countries, especially those in Asia where many industries are already adopting technology in their business, since the country has already become a major hub for IT outsourcing services.

The Philippines, for one is already a major hub for IT outsourcing services. The spread of Duqu in the Philippines could have dire effects on its multibillion-dollar outsourcing business.

source: mb.com.ph

Kaspersky finds largest attack on Mac OS by malware Flashback/Flashfake

Manila, Philippines - Kaspersky Lab, a leading secure content and threat management solutions developer, recently analyzed the Flashfake botnet and discovered a massive number of infected computers worldwide, most likely running Mac OS X. The botnet is being distributed via infected websites as a Java applet that pretends to be an update for the Adobe Flash Player.

About 670,000 computers worldwide, 98 percent of them running Mac OS X, were infected by Flashfake. Kaspersky Lab attests that this is the largest Mac-based infection to date, with the largest number of victims targeting developed countries. The United States had the most infected computers (300,917) followed by Canada (94,625), the United Kingdom (47,109) and Australia (41,600).

Infections also found in France (7,891), Italy (6,585), Mexico (5,747), Spain (4,304), Germany (4,021), Japan (3,864) and Philippines is among the countries that contribute the average count of 1- 2,547 said Kaspersky Lab security expert, Igor Soumenkov in his blog.

Security expert Alexander Gostev also stated in his blog that they were able to reverse-engineer the Flashfake malware that enabled them to successfully analyze the communications between infected computers and the command and control (C&C) servers of Flashfake.

“After intercepting one of the domain names used by the Flashback/Flashfake Mac Trojan and setting up a special sinkhole server last Friday, April 6, we managed to gather stats on the scale and geographic distribution of the related botnet. We continued to intercept domain names after setting up the sinkhole server and we are currently still monitoring how big the botnet is. We have recorded a total of 670,000 unique bots. Over the weekend of April 7 to 8, we saw a significant fall in the number of connected bots,” added Gostev.

Kaspersky Lab is also directing users to visit the website www.flashbackcheck.com, specifically made to determine if a computer is infected with the malware using a tool that looks into the device’s universal unique identifier (UUID). It also has instructions on how remove the malware if it is found.

source: mb.com.ph