Security | Matt Crawford

Interesting Phishing Attempt

Matt Crawford — Wed, 28 Oct 2020 18:00:00 +0000

One of my co-workers received an e-mail with an attachment titled “INVOICE_26.HTML” and asked if there was anyway to scan it before clicking on it.

Since it’s an .html file virus scanners would claim it was not infected since the file isn’t infected with a virus or trojan. This is just a phishing attempt which starts when a user opens the fake internet page.

So I viewed the source code of the file in notepad ++ and this is what I found.









Djgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkocujgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkment is secjgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkured


Cljgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkicjgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkk bejgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugklow to vjgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkiew comjgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkplejgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkte fijgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkle

If you actually look through the code you will quickly learn that all that gibberish and random letters will not show up on the page due to it being between the tags shown below.

Instead anybody viewing the page would simply see the following words.

Document is secured

Click below to view complete file

View File

The words “View File” are actually a button which goes to the url shown in the code above.

Aka this is just a lame phishing attempt that somebody is trying to confuse the average person with however I’m no average person and simply do not fall for tricks like this.

Check out the links below for more information regarding phishing.

Leave me a comment below if you enjoyed this article!

The post Interesting Phishing Attempt first appeared on Matt Crawford.

Coronavirus and you

Matt Crawford — Tue, 17 Mar 2020 15:02:53 +0000

By now you likely have seen the news regarding the Coronavirus (COVID-19) and how essentially the world has “shutdown” over concerns about spreading the Coronavirus around. If you haven’t I suggest you check out the CDC website to learn about it.

Since Coronavirus has spread most people are hording:

Toilet paper
Soap
Cleaning products
Hand Sanitizer
Masks
Food

Since Coronavirus has spread many nations & companies are:

shutting down stores
closing schools
closing jobs or pushing working from home
canceling sporting events
canceling concerts, festivals, parades, etc
offering free remote tools to work from home

Essentially the entire world is “shutdown” until further notice.

I urge everybody to take precautions but remain calm during this Coronavirus pandemic since freaking out will only cause added stress and chaos in an already crazy world.

Follow the steps at the CDC Website to take steps to protect yourself.

While the Coronavirus pandemic may be a very serious threat to the well being of people, I believe it’s also a great way for the government to control people in each nation & confine us all to our homes or take away other freedoms.

The Earn It Act

For example while the Coronavirus pandemic is going on congress is trying to pass “The EARN IT Act” which will do away with encryption and give the government the backdoor they have long wanted into your data. Read about it here.

If you haven’t yet please subscribe to my blog to keep on up my posts!

The post Coronavirus and you first appeared on Matt Crawford.

The cyber attack that knocked out Ukraine this morning is now going global

Matt Crawford — Tue, 27 Jun 2017 19:04:01 +0000

A sweeping set of cyber attacks hit critical services in Ukraine this morning, and have so far shown no signs of slowing down. The attacks appear to be related to a new strain of the ransomware known as Petya, which Costin Raiu, director of global research and analysis at Kaspersky Lab, says is already spreading worldwide.

In the space of hours, Ukraine’s government, top energy companies, private and state banks, main airport, and Kyiv’s metro system all reported hits on their systems. The attacker was not immediately clear—Wired, in a recent story, described Russia as using its neighbor as a “test lab for cyber war,” but Moscow denies any part in past attacks. Its own state oil giant Rosneft also reported being hit by a cyberattack today; Rosneft’s website was unresponsive at time of writing. It’s unclear if the attacks are linked. Another Russian oil firm, Bashneft, has been hit too.

More at QZ.com

The post The cyber attack that knocked out Ukraine this morning is now going global first appeared on Matt Crawford.

Vault 7 : CIA Hacking Tools Revealed!

Matt Crawford — Fri, 10 Mar 2017 16:02:29 +0000

Wiki leaks released details about CIA hacking tools and how extensive their spying really is and the news is absolutely terrifying!

If you weren’t worried about privacy before then you should be now!

Read the full details here at WikiLeaks

The post Vault 7 : CIA Hacking Tools Revealed! first appeared on Matt Crawford.

E-mail Scams & Phishing

Matt Crawford — Thu, 09 Feb 2017 21:13:46 +0000

We have been getting a ton of E-mail Scams and Phishing e-mails at work lately (mostly due to Office 365 and their poor spam filtering) and I wanted to take a few minutes to share some of them and point out how you can easily detect that they are not Genuine e-mails.

Please leave us a comment at the bottom if you might of fallen for one of these phishing e-mails!

Colorful Language!

This first one is from somebody claiming to be “Cadwalader, Wickersham and Taft LLP” using colorful language and trying to trick you into clicking on a fake link to what is likely a phishing website or virus/malware.

Apple Phishing

This 2nd one is claiming to be from Apple & is trying to trick you to click a link and login to your apple account.

Were you to actually click the link and login to your apple account they likely would capture your real apple password through the fake website!

Upgrade your Account!

This is a phishing e-mail trying to trick you into clicking on a link to “Upgrade” your account to see your “missing e-mails”

Here’s another one trying to trick you into clicking a link to upgrade your account.

Print This

This one is trying to trick the user into clicking a link so they can help somebody out by “printing” a document for them. Quite a weird phishing e-mail if u ask me!

You’ve been selected!

Phishing scam from “Amazon” trying to get you to complete some survey. It’s not really from amazon and u won’t actually get anything but maybe some malware or a virus if you do anything this says!

Would you of fallen for any of these phishing e-mails?! Leave us a comment below!

The post E-mail Scams & Phishing first appeared on Matt Crawford.

Over 67,000 Websites Defaced via Recently Patched WordPress Bug

Matt Crawford — Tue, 07 Feb 2017 18:39:15 +0000

WordPress sites that haven’t been updated to the most recent version, v4.7.2, released last week, are under attack as four hacking groups are conducting mass defacement campaigns.

According to web security firm Sucuri, who detected the attacks after details of the vulnerability became public last Monday, the attacks have been slowly growing, reaching almost 3,000 defacements per day.

Attackers are exploiting a vulnerability in the WordPress REST API, which the WordPress team fixed almost two weeks ago, but for which they published public details last Monday.

Defacement attempts via REST API flaw over time (via Sucuri)

The vulnerability allows a remote attacker to craft an HTTP request that pings a REST API endpoint and alters titles and content on the user’s website.

Exploiting the flaw is trivial, and according to Sucuri, a few public exploits have been published online since last week.

Over 67,000 websites defaced already

Even if the vulnerability affects only WordPress 4.7.0 and 4.7.1 and the CMS has a built-in auto-update feature for security issues, many websites haven’t been updated.

Based on data collected from Sucuri’s honeypot test servers, four attackers have been busy in the past week trying to exploit the flaw.

Group name	IP	Estimated victims
w4l3XzY3	176.9.36.102 185.116.213.71 134.213.54.163 2a00:1a48:7808:104:9b57:dda6:eb3c:61e1 (IPv6 address)	66,000
Cyb3r-Shia	37.237.192.22	500
By+NeT.Defacer	144.217.81.160	500
By+Hawleri_hacker	144.217.81.160	500

Since the attacks have been going on for some days, Google has already started to index some of these defacements.

Defaced websites indexed by Google

Currently, the groups using the REST API flaw to deface websites are only doing it for public brand exposure, only altering page titles and their content by adding their own name.
One of the defaced sites

Sucuri’s CTO, Daniel Cid, expects to see professional defacers enter the fold, such as SEO spam groups that will utilize the vulnerability to post more complex content, such as links and images.

This types of defacements are used to boost the SEO ranking of other sites or promote shady products. Websites that suffer from SEO-targeted defacements also have their SERP (Search Engine Result Page) indicator affected and risk losing their reputation on search engines, which in turns drives down traffic to their site.

Website owners are advised to update to WordPress 4.7.2. as soon as possible in order to avoid losing visibility on Google due to this REST API security issue.

Source: Bleeping Computer

The post Over 67,000 Websites Defaced via Recently Patched WordPress Bug first appeared on Matt Crawford.

Ransomware Spreads Via Fake ‘Chrome Font Pack’

Matt Crawford — Tue, 07 Feb 2017 18:24:09 +0000

There is a new malware on the loose, masquerading as an update for Chrome. If you see a popup or other notice that tells you that you need a font update for Chrome, please ignore it and let us know immediately.

Palo Alto Networks threat intelligence analyst Brad Duncan reported that “Spora”, a powerful new ransomware strain that is able to encrypt files without communicating to a command-and-control server, is using a social engineering attack vector using fake “Chrome Font Pack” pop-ups.

Most ransomware spreads either through spam and email attachments or “malvertising”—fake ads that contain malware or malware links. Spora exploits unpatched vulnerabilities in both browsers and operating systems.

Spora’s evil geniuses have compromised multiple websites and turned the website pages into an unreadable font. They tell visitors that the “HoeflerText” font is missing from the user’s browser and that they can fix this by downloading the “Chrome Font Pack.”

People then download and install the malicious code by double-clicking the “update.exe” file which kicks off the malicious code. The bad guys even provide help by showing where the victims can find the install file.

The moral of the story is this: Be vigilant, be aware, and be prepared. Keep your computer’s browsers updated to the latest versions, and make sure your operating systems are updated with the latest security patches.

And as always, “Think Before You Click”!

The post Ransomware Spreads Via Fake ‘Chrome Font Pack’ first appeared on Matt Crawford.

Adobe Acrobat auto-installed a vulnerable Chrome extension on Windows PCs

Matt Crawford — Thu, 19 Jan 2017 15:49:34 +0000

Adobe is no stranger to finding itself in the security headlines for all the wrong reasons, and it seems that things may not be changing as we enter 2017.

There was controversy earlier this month when news broke about how Adobe took the opportunity on Patch Tuesday of using its regular security updates to force Adobe Acrobat DC users into silently installing a Google Chrome extension.

As Bleeping Computer reports, most people first found out about the extension, which offers the ability to easily convert webpages into PDF files, when they saw a prompt asking them to approve the following permissions:

Read and change all your data on the websites you visit
Manage your downloads
Communicate with cooperating native applications

New SnapChat Privacy Issue

Matt Crawford — Fri, 11 Nov 2016 15:11:04 +0000

It has dawned on me that with SnapChat’s latest release there is a new SnapChat privacy issue that I have stumbled upon.

In the latest release of SnapChat they now allow people to “Press and hold on a snap to send it to a friend” which basically means.

IF your SnapChat privacy is set to Public then anybody can now send your stories to anybody & they can see it.
If your SnapChat privacy is set to Friends then anybody can send your stories to anybody but only your friends can see it.

I have tested this many different ways and it’s a pretty scary thought that this is possible. Worse yet, the person who’s snap you share IS NOT NOTIFIED that you shared it with whomever..

SnapChat really should of thought better about this before implementing this feature.

The post New SnapChat Privacy Issue first appeared on Matt Crawford.

Yahoo Security Breach

Matt Crawford — Fri, 23 Sep 2016 14:48:55 +0000

Yahoo finally comes clean about a security breach that happened over 2 years ago. I got this e-mail today which is a bit late in my opinion Yahoo.

Glad I don’t rely on their services for anything important because they clearly don’t have security in mind. See their e-mail below.

NOTICE OF DATA BREACH

Dear Matt,

We are writing to inform you about a data security issue that may involve your Yahoo account information.

What Happened?
A copy of certain user account information was stolen from our systems in late 2014 by what we believe is a state-sponsored actor. We are closely coordinating with law enforcement on this matter and working diligently to protect you.

What Information Was Involved?
The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers. Not all of these data elements may have been present for your account. The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation found to be affected.

What We Are Doing
We are taking action to protect our users:
We are asking potentially affected users to promptly change their passwords and adopt alternate means of account verification.
We invalidated unencrypted security questions and answers so they cannot be used to access an account.
We are recommending that all users who haven’t changed their passwords since 2014 do so.
We continue to enhance our systems that detect and prevent unauthorized access to user accounts.
We are working closely with law enforcement on this matter.

Our investigation into this matter continues.

What You Can Do
We encourage you to follow these security recommendations:
Change your password and security questions for any other accounts on which you used the same or similar information used for your Yahoo account.
Review your accounts for suspicious activity.
Be cautious of any unsolicited communications that ask for your personal information or refer you to a web page asking for personal information.
Avoid clicking on links or downloading attachments from suspicious emails.

Additionally, please consider using Yahoo Account Key, a simple authentication tool that eliminates the need to use a password altogether.

For More Information
For more information about this issue and our security resources, please visit the Yahoo Security Issue FAQs page available at https://yahoo.com/security-update.

Protecting your information is important to us and we work continuously to strengthen our defenses against the threats targeting our industry.

Sincerely,
Bob Lord
Chief Information Security Officer
Yahoo

The post Yahoo Security Breach first appeared on Matt Crawford.