security | Matt Crawford

Interesting Phishing Attempt

Matt Crawford — Wed, 28 Oct 2020 18:00:00 +0000

One of my co-workers received an e-mail with an attachment titled “INVOICE_26.HTML” and asked if there was anyway to scan it before clicking on it.

Since it’s an .html file virus scanners would claim it was not infected since the file isn’t infected with a virus or trojan. This is just a phishing attempt which starts when a user opens the fake internet page.

So I viewed the source code of the file in notepad ++ and this is what I found.









Djgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkocujgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkment is secjgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkured


Cljgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkicjgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkk bejgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugklow to vjgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkiew comjgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkplejgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkte fijgfhgfhgfchgfxhfesyrdzxdgszgczgcxzgfdzhfdxhgfxjgfxjgfcjhcgfjgckjhufkugkle

If you actually look through the code you will quickly learn that all that gibberish and random letters will not show up on the page due to it being between the tags shown below.

Instead anybody viewing the page would simply see the following words.

Document is secured

Click below to view complete file

View File

The words “View File” are actually a button which goes to the url shown in the code above.

Aka this is just a lame phishing attempt that somebody is trying to confuse the average person with however I’m no average person and simply do not fall for tricks like this.

Check out the links below for more information regarding phishing.

Leave me a comment below if you enjoyed this article!

The post Interesting Phishing Attempt first appeared on Matt Crawford.

Over 67,000 Websites Defaced via Recently Patched WordPress Bug

Matt Crawford — Tue, 07 Feb 2017 18:39:15 +0000

WordPress sites that haven’t been updated to the most recent version, v4.7.2, released last week, are under attack as four hacking groups are conducting mass defacement campaigns.

According to web security firm Sucuri, who detected the attacks after details of the vulnerability became public last Monday, the attacks have been slowly growing, reaching almost 3,000 defacements per day.

Attackers are exploiting a vulnerability in the WordPress REST API, which the WordPress team fixed almost two weeks ago, but for which they published public details last Monday.

Defacement attempts via REST API flaw over time (via Sucuri)

The vulnerability allows a remote attacker to craft an HTTP request that pings a REST API endpoint and alters titles and content on the user’s website.

Exploiting the flaw is trivial, and according to Sucuri, a few public exploits have been published online since last week.

Over 67,000 websites defaced already

Even if the vulnerability affects only WordPress 4.7.0 and 4.7.1 and the CMS has a built-in auto-update feature for security issues, many websites haven’t been updated.

Based on data collected from Sucuri’s honeypot test servers, four attackers have been busy in the past week trying to exploit the flaw.

Group name	IP	Estimated victims
w4l3XzY3	176.9.36.102 185.116.213.71 134.213.54.163 2a00:1a48:7808:104:9b57:dda6:eb3c:61e1 (IPv6 address)	66,000
Cyb3r-Shia	37.237.192.22	500
By+NeT.Defacer	144.217.81.160	500
By+Hawleri_hacker	144.217.81.160	500

Since the attacks have been going on for some days, Google has already started to index some of these defacements.

Defaced websites indexed by Google

Currently, the groups using the REST API flaw to deface websites are only doing it for public brand exposure, only altering page titles and their content by adding their own name.
One of the defaced sites

Sucuri’s CTO, Daniel Cid, expects to see professional defacers enter the fold, such as SEO spam groups that will utilize the vulnerability to post more complex content, such as links and images.

This types of defacements are used to boost the SEO ranking of other sites or promote shady products. Websites that suffer from SEO-targeted defacements also have their SERP (Search Engine Result Page) indicator affected and risk losing their reputation on search engines, which in turns drives down traffic to their site.

Website owners are advised to update to WordPress 4.7.2. as soon as possible in order to avoid losing visibility on Google due to this REST API security issue.

Source: Bleeping Computer

The post Over 67,000 Websites Defaced via Recently Patched WordPress Bug first appeared on Matt Crawford.

Adobe Acrobat auto-installed a vulnerable Chrome extension on Windows PCs

Matt Crawford — Thu, 19 Jan 2017 15:49:34 +0000

Adobe is no stranger to finding itself in the security headlines for all the wrong reasons, and it seems that things may not be changing as we enter 2017.

There was controversy earlier this month when news broke about how Adobe took the opportunity on Patch Tuesday of using its regular security updates to force Adobe Acrobat DC users into silently installing a Google Chrome extension.

As Bleeping Computer reports, most people first found out about the extension, which offers the ability to easily convert webpages into PDF files, when they saw a prompt asking them to approve the following permissions:

Read and change all your data on the websites you visit
Manage your downloads
Communicate with cooperating native applications

New SnapChat Privacy Issue

Matt Crawford — Fri, 11 Nov 2016 15:11:04 +0000

It has dawned on me that with SnapChat’s latest release there is a new SnapChat privacy issue that I have stumbled upon.

In the latest release of SnapChat they now allow people to “Press and hold on a snap to send it to a friend” which basically means.

IF your SnapChat privacy is set to Public then anybody can now send your stories to anybody & they can see it.
If your SnapChat privacy is set to Friends then anybody can send your stories to anybody but only your friends can see it.

I have tested this many different ways and it’s a pretty scary thought that this is possible. Worse yet, the person who’s snap you share IS NOT NOTIFIED that you shared it with whomever..

SnapChat really should of thought better about this before implementing this feature.

The post New SnapChat Privacy Issue first appeared on Matt Crawford.

Yahoo Security Breach

Matt Crawford — Fri, 23 Sep 2016 14:48:55 +0000

Yahoo finally comes clean about a security breach that happened over 2 years ago. I got this e-mail today which is a bit late in my opinion Yahoo.

Glad I don’t rely on their services for anything important because they clearly don’t have security in mind. See their e-mail below.

NOTICE OF DATA BREACH

Dear Matt,

We are writing to inform you about a data security issue that may involve your Yahoo account information.

What Happened?
A copy of certain user account information was stolen from our systems in late 2014 by what we believe is a state-sponsored actor. We are closely coordinating with law enforcement on this matter and working diligently to protect you.

What Information Was Involved?
The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers. Not all of these data elements may have been present for your account. The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation found to be affected.

What We Are Doing
We are taking action to protect our users:
We are asking potentially affected users to promptly change their passwords and adopt alternate means of account verification.
We invalidated unencrypted security questions and answers so they cannot be used to access an account.
We are recommending that all users who haven’t changed their passwords since 2014 do so.
We continue to enhance our systems that detect and prevent unauthorized access to user accounts.
We are working closely with law enforcement on this matter.

Our investigation into this matter continues.

What You Can Do
We encourage you to follow these security recommendations:
Change your password and security questions for any other accounts on which you used the same or similar information used for your Yahoo account.
Review your accounts for suspicious activity.
Be cautious of any unsolicited communications that ask for your personal information or refer you to a web page asking for personal information.
Avoid clicking on links or downloading attachments from suspicious emails.

Additionally, please consider using Yahoo Account Key, a simple authentication tool that eliminates the need to use a password altogether.

For More Information
For more information about this issue and our security resources, please visit the Yahoo Security Issue FAQs page available at https://yahoo.com/security-update.

Protecting your information is important to us and we work continuously to strengthen our defenses against the threats targeting our industry.

Sincerely,
Bob Lord
Chief Information Security Officer
Yahoo

The post Yahoo Security Breach first appeared on Matt Crawford.

How to use Proxy Servers

Matt Crawford — Thu, 21 Jul 2016 16:45:12 +0000

This article explains how to use Proxy servers which are useful for a lot of things which I will explain below.

What is a Proxy?

As the name implies, a proxy server is an intermediary between your PC or device and the Internet. This server makes requests to websites, servers and services on the Internet for you.

Let’s assume that you are at work, using a web browser to visit news.google.com and your browser is set to use a proxy server.

After you type news.google.com, the request is sent to the proxy server. The server then sends the request to the server where our website is hosted. The homepage of our website is returned to the proxy server which, in turn, returns it to you.

As a result, our website sees the proxy server as the actual visitor, rather than seeing you.

Benefits of a Proxy Server

Here are some benefits of using a proxy server to:

Spoofing your IP address
Hide your real IP address, location and other information
Improve security by remaining anonymous
Provide access to blocked resources on the internet

Proxy Lists

There are a bunch of proxy lists on the internet where u can get proxy information from to use for this purpose but here are few that I found. You can find more lists like this by googling the term “Free proxy list”

Getting Started

There are several ways to use a proxy server. You can simply visit a website of a proxy server and surf to a website from there or you can add the proxy server to your browser settings for a more permanent browsing experience.

Using Proxy from the web

Visit one of the proxy servers from a known proxy list and they normally allow you to input the name of the website that you wish to view.

For example one I like to use is called Hide My Ass and when you visit it you cna see it allows you to enter the url of the site you wish to v isit and you can even set some other variables as well.

Setup Proxy for Chrome & IE

Open Control Panel > Internet Options > Connections > LAN Settings > Proxy Server > Check box and enter the proxy address and port that you want to use.

Note: Find updated proxy server IP & Port you wish to use from the Proxy List Above

Setup Proxy for Firefox

Click the 3 lines in the upper right corner and click Options

Then click Advanced > Network > Connection > Settings > then enter the address and port u wish to use there.

Note: Find updated proxy server IP & Port you wish to use from the Proxy List Above

If you have questions or problems leave a comment below!

The post How to use Proxy Servers first appeared on Matt Crawford.

Understanding SnapChat Privacy

Matt Crawford — Tue, 12 Jul 2016 18:00:20 +0000

If you have never used SnapChat you might of wondered how their security settings work, so I’ve done quite a bit of work testing SnapChat Privacy settings and how they all work.

I used to think that by changing your account from “Everyone” to “Friends Only” would also change the privacy level of current snaps on your story. However that is in fact NOT the case.

The Privacy setting on your SnapChat only conforms to when you posted said snap to your story. For example if you posted photo A to your story when it was set to “Everyone” and later you changed it to “Friends Only”, photo A can still be seen by “Everyone” and it’s privacy setting didn’t change.

Here are the general permissions that SnapChat allows

“Everyone” permission

If you have your privacy set to Everyone they will see all your story snaps without you having to add them back as a friend.

“Friends Only” permission

If you have your privacy set to Friends Only they will only see your story if you added them as a friend.

“Custom” Permission

If you have your privacy set to Custom they will only see your story if u haven’t blocked them otherwise.

Below are different scenarios that I tested and have results for each one as well.

New Friends (previously not your friend)

If you have your privacy set to Everyone they will see all your story snaps.
If you have your privacy set to Friends Only they will see all your story snaps.
If your privacy was set to Custom they won’t see any of your story snaps except new ones u add after they become your friend unless you block them.

Removing a friend

So you just removed a friend from your SnapChat & now you believe they can’t see your snaps anymore? Well u might be wrong!

Removing a friend from your list doesn’t remove yourself from their list so:

If you have your privacy set to Everyone they will see all your story snaps.
If you have your privacy set to Friends Only they shouldn’t be able to see your story snaps anymore.
If you have your privacy set to Custom they shouldn’t be able to see your story snaps anymore.

I hope this was helpful and please comment if you have questions, or hit me up on SnapChat or Twitter!

SnapChat: t3dus
Twitter: t3dus or g3kxyz

The post Understanding SnapChat Privacy first appeared on Matt Crawford.

Pokemon Go

Matt Crawford — Tue, 12 Jul 2016 15:39:32 +0000

It’s likely by now that you have heard of the new game craze called Pokemon Go that was released on July 6, 2016, that is unless you’ve been living under a rock for the past week or so.

Pokemon Go allows players to capture, battle and train virtual Pokemon who appear throughout the real world. It works by using GPS on your smart phone and the camera of compatible devices. This post explains what Pokemon Go in a bit more detail than what I’ve given here.

What I find hilarious is the fact that people who are playing this game are getting hurt while doing so by walking into signs, fire hydrants, and other objects because they aren’t paying attention where they are walking. In fact I feel the game might be so dangerous that somebody could even get killed while playing it by walking into traffic.

But those aren’t the only dangers in the game as The Guardian reported stating that players who signed up for the game in fact potentially gave Niantic Labs full access to google accounts where they can go as far as to read & send e-mail, access, edit and delete documents in google drive, google photos, and they can even access browser & map history. While I don’t believe Niantic Labs has intentionally sought to gain access to users personal data it is still worrying to me that this type of thing is possibly in this day in age where security is on almost everybody’s mind.

I’m sure Niantic Labs and google will sort out the Pokemon Go security issues with google accounts soon & users likely won’t have to do anything on their end to fix the security issue.

So what are u waiting for? Go download Pokemon Go and watch where u walk and don’t get hit by a car!

The post Pokemon Go first appeared on Matt Crawford.

Ghost Linux Security hole Revealed

Matt Crawford — Wed, 28 Jan 2015 18:43:40 +0000

Have you heard about the critical linux security hole that was revealed dubbed “Ghost”? Well if you haven’t then I suggest you get up to speed on this critical security hole and get your linux servers patched asap.

The below section is quoted from the article at zdnet.

“The security hole can be triggered by exploiting glibc’s gethostbyname functions. This function is used on almost all networked Linux computers when the computer is called on to access another networked computer either by using the /etc/hosts files or, more commonly, by resolving an Internet domain name with Domain Name System (DNS).

To exploit this vulnerability, all an attacker needs to do is trigger a buffer overflow by using an invalid hostname argument to an application that performs a DNS resolution. This vulnerability then enables a remote attacker to execute arbitrary code with the permissions of the user running DNS. In short, once an attacker has exploited GHOST they may be capable of taking over the system.”

For more details please read the full article at zdnet.

The post Ghost Linux Security hole Revealed first appeared on Matt Crawford.

Safebox for Cloud Storage

Matt Crawford — Sun, 11 May 2014 05:13:34 +0000

For years I have worried about how secure my cloud storage data is expecially on services like Google Drive and Dropbox and I have been looking for ways to secure my data.

I’ve tried a number of things such as using Axcrypt for individual files and creating TrueCrypt volumes on my cloud storage but all of them have their own flaws and issues which I’m not going to list in this review.

I may of came up with a solution for both my issues with the previous encryption services. I recently I have been playing with a new service I discovered named Safebox.

Safebox works differently by creating a folder named Safebox on your computer where you would store the unencrypted documents which later get encrypted and put into a .safeboxdata folder on your cloud storage.

Here is a screenshot of my “Top Secret Document” I created that I needed encrypted.

Here is a screenshot of the same file encrypted on my Dropbox account.

I also took a little time to test the decryption process, by installing Safebox on my work computer to test the decryption process and right away I ran into some issues where my file wasn’t properly decrypted and was made unreadable on my work pc.

Reason why this happened is because it also encrypts the temporary windows file so until the file is closed on whichever computer has it currently open it will be unreadable on other computers.

I’m running out of time tonight to further test this product so I will leave you with my conclusion on Safebox.

Conclusion

Here is my conclusion on the product Safebox which appears to be a great product but it does not come without it’s pros and cons which I outlined below.

I will also state that I’m undecided if I will plan to use this to secure my personal documents or not due to some of the cons I listed below.

Pros

Encrypts documents prior to sending them to cloud storage.
Encrypts Filenames.
Military Grade AES 256 bit encryption.
Master Password to access all files.
Does not require an account and they don’t upload your information, file details or keys to their servers.
One time fee of $9.99 & no annual subscription fee.
User-Friendly & Easy to use.
Data Encrypted prior to being synced on the cloud.

Cons

Files don’t decrypt correctly if left open on another computer.
Puts each encrypted file in it’s own folder inside of .safeboxdata
Does not cleanup empty directly folders which used to contain deleted encrypted files.
Not possible to share encrypted files to a friend or co-worker unless u give them your master password and possibly your cloud storage account information.
No known portable versions available.
Resetting master password erases all your files.

Thank you for reading my review of this software and I hope it helps you in your purchasing decisions & securing your cloud storage solution.

The post Safebox for Cloud Storage first appeared on Matt Crawford.