Category Archives: Phishing

image_pdfimage_print
2024, DataShielder, Digital Security, PassCypher, Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

Posted on by FMTAD
Digital world map showing cyberattack paths with Midnight Blizzard, Microsoft, HPE logos, email symbols, and password spray illustrations.
10
Mar

Discover Russian Tactics by Midnight Blizzard

Midnight Blizzard, supported by Russian strategy, targeted Microsoft and HPE, orchestrating sophisticated cyberattacks. We delve into the facts, consequences, and effective protective measures such as PassCypher and DataShielder to combat this type of espionage.

Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon: Protecting Government Communications from Cyber Threats
November 14, 2024
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know
October 15, 2024
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat
September 3, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat
August 20, 2024
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks
August 12, 2024
Hacker accessing a laptop displaying Google Workspace with a security breach notification.

2024 Digital Security

Google Workspace Vulnerability Exposes User Accounts to Hackers
August 1, 2024
Multiple computer screens displaying data breach alerts in a dark room, with the Pentagon in the background.

2024 Digital Security

Leidos Holdings Data Breach: A Significant Threat to National Security
July 25, 2024

Stay informed in our posts dedicated to Digital Security to follow its evolution thanks to our regularly updated topics

Explore our digital security feature on the Midnight Blizzard cyberattack against Microsoft and HPE by Jacques Gascuel. Stay updated and secure with our insights.

Updated March 20, 2024

Midnight Blizzard Cyberattack against Microsoft and HPE: A detailed analysis of the facts, the impacts and the lessons to learn

In 2023 and 2024, two IT giants, Microsoft and Hewlett Packard Enterprise (HPE), which has been using Microsoft 365 as its cloud messaging platform since 2017), fell victim to cyberattacks carried out by a hacker group linked to the Russian government. These attacks allowed hackers to gain access to the internal systems, source code, and sensitive data of companies and their customers. What are the facts, consequences and lessons to be learned from these incidents?

Update: Microsoft 365 Cyberattack Intensifies

Initial Underestimation: Researchers reveal the cyberattack on Microsoft 365 is far more severe than first anticipated.
APT Exploits Data: The APT group, orchestrating the attack, has leveraged exfiltrated data to delve deeper into Microsoft’s network.
Security Experts Raise Concerns: Security professionals express concerns over disjointed defense teams. They fear unidentified vulnerabilities may persist.
Microsoft’s Stance: Popular opinion suggests Microsoft is ‘caught off-guard’ against such sophisticated attacks.
Ongoing Efforts: Microsoft is now bolstering defenses, ensuring tighter coordination across security teams to address these challenges.

For more details, refer to the official Microsoft Security Response Center update.

How were the attacks carried out against Microsoft and HPE?

The attacks on Microsoft and HPE were carried out by the same hacker group, Midnight Blizzard, which is linked to the Russian government. The hackers used the same technique to infiltrate the networks of both companies: compromising Microsoft 365 email. This cloud-based messaging platform is used by many organizations to communicate and collaborate.

“Password Spray” Attack Method Against Microsoft and HPE

The compromise of Microsoft 365’s email and HPE’s email accounts was achieved through a simple but effective method known as “password spraying.” This technique, often used after a brute force attack, involves guessing a password by trying several combinations, usually from previous data breaches.

The hackers used this method to gain access to an old test account on Microsoft’s network. Once they gained access, they were able to infiltrate HPE’s email accounts.

“Password spraying” is a technique where hackers use common passwords to attempt to gain access to multiple accounts on the same domain. Using a list of commonly used weak passwords, a hacker can potentially gain access to hundreds of accounts in a single attack. This differs from “Credential Stuffing”, where a single set of credentials is used to attempt to access different accounts across multiple domains.

In the case of the Midnight Blizzard attack on Microsoft, the hacker group used a password spray attack to compromise a legacy non-productive test account and gain a foothold. They then used the account’s permissions to gain access to a very small percentage of Microsoft’s corporate email accounts, including members of the executive team and employees in cybersecurity, legal, and other functions. They managed to exfiltrate some emails and attached documents.

Once they gained access to email accounts, the hackers were able to exfiltrate sensitive data, such as emails, attachments, source code, and secrets.

Method of attack against Microsoft and HPE customers “phishing, malware or social engineering”

Midnight Blizzard also used this data to carry out subsequent attacks against Microsoft and HPE customers, using phishing, malware, or social engineering techniques.

Why were the attacks successful?

  • Hackers exploited security vulnerabilities such as the lack of multi-factor authentication, the persistence of legacy test accounts, or weak passwords.
  • The hackers acted in a discreet manner, using advanced and persistent techniques, such as encrypting communications, masking IP addresses, or imitating legitimate behavior.
  • The hackers were supported by the Russian government, which provided them with resources, information, and diplomatic protection.

Here’s a diagram that summarizes the steps to Microsoft 365 email compromise:

Microsoft 365 email compromise diagram

Diagram depicting the 'Midnight Blizzard' cyberattack against Microsoft and HPE using password spray tactics.

Stages of Microsoft’s Security Breach

Microsoft endured a multi-phase assault:

November 2023 saw the initial breach when attackers cracked an outdated test account via password spray attacks, cycling through many potential passwords.

By December, those intruders had penetrated select executive and security team email accounts, extracting sensitive emails and documents.

January 2024 brought Microsoft’s detection and countermeasures to thwart further unauthorized access. The company identified Midnight Blizzard, known by aliases such as APT29 and Cozy Bear, as the culprits.

Come March, it was disclosed that the invaders had also accessed Microsoft’s code repositories and internal systems, utilizing the stolen intel for subsequent assaults on Microsoft’s clientele, targeting to exploit vulnerabilities or clone functionalities.

The different consequences of this attack on Microsoft

Consequences for Microsoft and its customers

The attack had significant consequences for Microsoft and its customers. On the one hand, Microsoft had to tighten its security measures, notify affected customers, investigate the extent of the compromise, and restore trust in its services.

On the other hand, Microsoft’s customers faced the risk of being targeted by subsequent attacks using information stolen from Microsoft, such as secrets, source code, or sensitive data. Some customers may have suffered financial losses, reputational damage, or privacy breaches.

Geopolitical consequence

The attack also had geopolitical consequences, as it revealed the Russian government’s involvement in large-scale cyber espionage operations against Western interests. It has drawn condemnation from several countries, including the United States, the United Kingdom, France and Germany, which have called for a coordinated and proportionate response to the threat. It also reinforced the need to strengthen international cooperation on cybersecurity and to define common standards to prevent conflicts in cyberspace.

Steps to attack HPE

Midnight Blizzard executed the attack on HPE, leveraging Microsoft 365 email for entry—the platform HPE adopted in 2017.

Initially, in May 2023, the hackers infiltrated SharePoint, extracting a select set of files. Post-breach, HPE, alongside cybersecurity experts, promptly engaged in containment and recovery efforts.

Come December, new breaches surfaced; targeted mailboxes related to cybersecurity and business operations were compromised. These intrusions were suspected to be connected to the earlier SharePoint incident.

Finally, in January 2024, HPE disclosed the breach to the SEC, affirming the implementation of measures to remove the threat, alert impacted clients, gauge the breach’s scope, and reinstate service integrity.

The different consequences of this attack on HPE

First, the attack had similar consequences to the attack on Microsoft, but on a smaller scale.

Restoring trust in its services to their customersOn the one hand, HPE had to strengthen its security measures, inform affected customers, and restore trust in its services. HPE’s customers faced the risk of being targeted by subsequent attacks using information stolen from HPE, such as sensitive data.

Justify the lack of economic impact as a result of this attack

On the other hand, HPE stated that the incident did not have a material impact on its operations, financial condition or results of operations.

The similarities and differences between the two attacks

Both attacks were carried out by the same hacking group, Midnight Blizzard, which is linked to the Russian government. Both attacks used the same means of access, Microsoft 365 email, which is a cloud-based email platform used by many organizations. Both attacks allowed hackers to exfiltrate sensitive data, such as emails, attachments, source code, or secrets. Both attacks had consequences for the victim companies, their customers, and geopolitics.

There were also differences between the two attacks. The attack on Microsoft was longer, deeper, and more widespread than the attack on HPE. The attack on Microsoft lasted several months, while the attack on HPE lasted a few weeks. The attack on Microsoft allowed the attackers to gain access to the company’s source code repositories and internal systems, while the attack on HPE was limited to email and SharePoint files. The attack on Microsoft affected thousands of customers, while the attack on HPE did not specify how many customers were affected.

What types of data does Midnight Blizzard exfiltrate?

What types of data does Midnight Blizzard exfiltrate?

Midnight Blizzard is the name given to a group of cybercriminals who have carried out cyber attacks against Microsoft, HPE, and their customers. This group is also known as Nobelium, Cozy Bear, or APT29. It managed to break into these companies’ cloud email systems and steal sensitive data. Microsoft said that Midnight Blizzard also accessed some of its source code and internal systems, but that it did not compromise Microsoft-hosted client systems.

“In recent weeks, we have seen Midnight Blizzard [Nobelium] use information initially exfiltrated from our corporate email systems to obtain, or attempt to obtain, unauthorized access,” Microsoft said in a blog post. “This includes access to some of the company’s source code repositories and internal systems. To date, we have found no evidence that Microsoft-hosted client systems have been compromised.”

Midnight Blizzard Exfiltrated Data Category

The data exfiltrated by Midnight Blizzard can be grouped into three main categories:

Communication data

Communication data is data that relates to interactions between Microsoft and HPE employees, partners, or customers. They include emails, attachments, contacts, calendars, notes, or instant messages. This data may contain confidential, strategic or personal information, such as trade secrets, project plans, contracts, reports, opinions, identifiers. This data was exfiltrated at Microsoft and HPE.

Source code data

Source code data is data that relates to the development of Microsoft’s products or services. They include files, repositories, versions, comments, or tests related to the source code. This data may reveal technical, functional, or security information, such as algorithms, architectures, features, vulnerabilities, patches, or backdoors. This data was exfiltrated only at Microsoft.

Internal system data

Communication and internal system data is data that relates to the exchange and operation of Microsoft and HPE’s internal systems. This includes emails, attachments, contacts, calendars, notes, instant messages, files, configurations, logs, audits, or scans of internal systems. This data may contain confidential, strategic or personal information, such as trade secrets, project plans, contracts, reports, opinions, identifiers. This data can also provide information about the performance, security, or reliability of internal systems. This data was exfiltrated at Microsoft and HPE.

What are the estimated values of the data exfiltrated by Midnight Blizzard?

It is difficult to estimate the exact value of the data exfiltrated by Midnight Blizzard, as it depends on several factors, such as the quantity, quality, freshness, rarity, or usefulness of the data. However, an approximate range can be attempted based on official sources or existing studies.

HPE’s SEC filing indicates that the security incident’s repercussions on their operational, financial, or business performance were minimal. This suggests the exfiltrated data’s worth is on the lower end, possibly just a few thousand dollars. On the other hand, Microsoft’s annual report documents a staggering $168.1 billion in revenue for 2023, with $60.7 billion attributed to their cloud division. Such figures lead to the conclusion that the stolen data from Microsoft could be highly valuable, potentially in the millions. Further, the Ponemon Institute’s study reports the average data breach cost in 2023 at $4.24 million, the highest to date, encompassing various associated costs. These costs include activities like detection and response, as well as indirect losses like diminished productivity and tarnished reputation. Therefore, it stands to reason that the value of data taken from Microsoft and HPE’s customers is similarly high, potentially reaching tens of millions of dollars.

What are the potential consequences of the data exfiltrated by Midnight Blizzard?

The data exfiltrated by Midnight Blizzard can have serious potential consequences for the victim companies, their customers, and geopolitics. Here are a few examples:

  • Communication data can be used to carry out phishing, malware, or social engineering attacks, impersonating trusted individuals, exploiting security vulnerabilities, or manipulating emotions. These attacks can aim to steal other data, take control of systems, destroy or alter data, or extort ransoms.
  • Source code data can be used to discover and exploit vulnerabilities, to copy or modify functionality, to create competing products or services, or to infringe intellectual property. These actions may adversely affect the security, quality, innovation, or competitiveness of Microsoft or HPE products or services.
  • Internal system data may be used to understand and disrupt Microsoft or HPE’s operations, organization, or performance, to reveal sensitive or confidential information, to create false information or rumors, or to influence decisions or behaviors. These actions may damage the reputation, trust, satisfaction, or loyalty of Microsoft or HPE customers, partners, or employees.

How could PassCypher HSM have prevented the cyberattack on Microsoft and HPE?

The cyberattack on Microsoft and HPE used weak or reused passwords to access email accounts. PassCypher NFC HSM or PassCypher HSM PGP is a hardware-based password manager, which allows you to create and use strong, unique, and random passwords, without knowing, remembering, displaying, or entering them manually. It uses Freemindtronic’s EviCore HSM PGP or EviCore NFC HSM technology to communicate contactlessly with compatible devices, and has a complicated and complex random password generator with self-entropy control based on shannon mathematical calculation.

With PassCypher NFC HSM or PassCypher HSM PGP solutions, users can effectively protect themselves against password spray attacks quickly, easily, and even free of charge. This is because PassCypher HSM PGP is originally completely free. He presented for the first time in Marseille on 6-7 March 2024 at AccessSecurity at the PhosPhorus Technology stand, partner of Fullsecure Andorra.

How could DataShielder have protected email messages and email attachments from being exfiltrated by hackers?

As you read more in this article, the cyberattack against Microsoft and HPE exfiltrated communication data, such as emails, attachments, contacts, notes, or instant messages. DataShielder NFC HSM or DataShielder HSM PGP are solutions for encrypting post-quantum data via NFC HSM or HSM PGP. Users encrypt and decrypt their communication data, only from their HSMs via physically outsourced segmented keys from the IT or phone systems. It works without a server or database and without any dependency on the security of communication systems. Of course, without the need to connect to an online service, or entrust your encryption keys to a third party. They have a random AES-256 encryption key generator. In particular, it embeds Freemindtronic’s EviCypher technology, which also encrypts webmail such as Outlook. With DataShielder solutions, users can protect themselves from data exfiltration by hackers and ensure the confidentiality, integrity, and authenticity of their communications.

Recommendations to protect yourself from cyber threats

The cyberattacks against Microsoft and HPE show that cyber threats are real, growing, and sophisticated. They also show that businesses of all sizes, industries, and locations need to take cybersecurity seriously and adopt best practices to protect themselves effectively. Here are some recommendations:

  • Enable multi-factor authentication, which involves requiring two or more credentials to log in to an account, such as a password and a code sent via SMS or email. This helps reduce the risk of being compromised by a password spray attack.
  • Review account permissions, which determine access rights to company resources and data. This helps limit the risk of an attack spreading from a compromised account.
  • Monitor suspicious activity, which may indicate an attempted or successful attack, such as unusual logins, file changes, data transfers, or security alerts. This makes it possible to detect and stop an attack as early as possible.
  • Use security solutions that provide protection, detection, and response to cyber threats, such as antivirus, firewalls, intrusion detection and prevention systems, or monitoring and analytics services. This makes it possible to strengthen the security of the information system and to benefit from the expertise of cybersecurity professionals.
  • Educate users, who are often the weakest link in the security chain, and who can fall victim to phishing, malware, or social engineering. This includes training them in good cybersecurity practices, informing them of the risks and instructions to follow in the event of an incident, and encouraging them to adopt responsible and vigilant behavior.

In conclusion

In conclusion, Midnight Blizzard’s cyberattacks expose critical vulnerabilities in global tech infrastructure. Through these incidents, we learn the importance of robust security measures like PassCypher and DataShielder. Moving forward, adopting advanced defenses and staying informed are key to combating future threats. Let’s embrace these lessons and protect our digital world.

Sources:

Articles, Crypto Currency, Cryptocurrency, Digital Security, EviPass Technology, NFC HSM technology, Phishing

Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers

Posted on by FMTAD
Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers
16
Dec
Ledger security breaches written by Jacques Gascuel, inventor specializing in safety and security of sensitive data, for Freemindtronic. This article will be updated with any new information on the topic.

Ledger security incidents: How Hackers Exploited Them and How to Stay Safe

Ledger security breaches have exposed the personal data and private keys of many users. Ledger is a French company that provides secure devices to store and manage your funds. But since 2017, hackers have targeted Ledger’s e-commerce and marketing database, as well as its software and hardware products. In this article, you will discover the different breaches, how hackers exploited them, what their consequences were, and how you can protect yourself from these threats.

Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon: Protecting Government Communications from Cyber Threats
November 14, 2024
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know
October 15, 2024
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat
September 3, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat
August 20, 2024
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks
August 12, 2024
Hacker accessing a laptop displaying Google Workspace with a security breach notification.

2024 Digital Security

Google Workspace Vulnerability Exposes User Accounts to Hackers
August 1, 2024
Multiple computer screens displaying data breach alerts in a dark room, with the Pentagon in the background.

2024 Digital Security

Leidos Holdings Data Breach: A Significant Threat to National Security
July 25, 2024

Ledger Security Breaches from 2017 to 2023: How to Protect Your Cryptocurrencies from Hackers

Have you ever wondered how safe your cryptocurrencies are? If you are using a Ledger device, you might think that you are protected from hackers and thieves. Ledger is a French company that specializes in cryptocurrency security. It offers devices that allow you to store and manage your funds securely. These devices are called hardware wallets, and they are designed to protect your private keys from hackers and thieves.

However, since 2017, Ledger has been victim of several security breaches, which have exposed the personal data and private keys of its users. These breaches could allow hackers to steal your cryptocurrencies or harm you in other ways. In this article, we will show you the different breaches that were discovered, how they were exploited, what their consequences were, and how you can protect yourself from these threats.

Ledger Security Issues: The Seed Phrase Recovery Attack (February 2018)

The seed phrase is a series of words that allows you to restore access to a cryptocurrency wallet. It must be kept secret and secure, as it gives full control over the funds. In February 2018, a security researcher named Saleem Rashid discovered a breach in the Ledger Nano S, which allowed an attacker with physical access to the device to recover the seed phrase using a side-channel attack.

How did hackers exploit the breach?

The attack consisted of using an oscilloscope to measure the voltage variations on the reset pin of the device. These variations reflected the operations performed by the secure processor of the Ledger Nano S, which generated the seed phrase. By analyzing these variations, the attacker could reconstruct the seed phrase and access the user’s funds.

Simplified diagram of the attack

Figure Ledger Security Issues: The Seed Phrase Recovery Attack (February 2018)
Statistics on the breach
  • Number of potentially affected users: about 1 million
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: February 20, 2018
  • Author of the discovery of the breach: Saleem Rashid, a security researcher
  • Date of publication of the fix by Ledger: April 3, 2018

Scenarios of hacker attacks

  • Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to connect the device to an oscilloscope and measure the voltage variations on the reset pin. The attacker can then use a software tool to reconstruct the seed phrase from the measurements.
  • Scenario of remote access: The attacker needs to trick the user into installing a malicious software on their computer, which can communicate with the device and trigger the reset pin. The attacker then needs to capture the voltage variations remotely, either by using a wireless device or by compromising the oscilloscope. The attacker can then use a software tool to reconstruct the seed phrase from the measurements.

Sources

1: Breaking the Ledger Security Model – Saleem Rashid published on March 20, 2018.

2: Ledger Nano S: A Secure Hardware Wallet for Cryptocurrencies? – Saleem Rashid published on November 20, 2018.

Ledger Security Flaws: The Firmware Replacement Attack (March 2018)

The firmware is the software that controls the operation of the device. It must be digitally signed by Ledger to ensure its integrity. In March 2018, the same researcher discovered another breach in the Ledger Nano S, which allowed an attacker to replace the firmware of the device with a malicious firmware, capable of stealing the private keys or falsifying the transactions.

How did hackers exploit the Ledger Security Breaches?

The attack consisted of exploiting a vulnerability in the mechanism of verification of the firmware signature. The attacker could create a malicious firmware that passed the signature check, and that installed on the device. This malicious firmware could then send the user’s private keys to the attacker, or modify the transactions displayed on the device screen.

Simplified diagram of the attack

Figure Ledger Security Flaws: The Firmware Replacement Attack (March 2018)

Statistics on the breach

  • Number of potentially affected users: about 1 million
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: March 20, 2018
  • Author of the discovery of the breach: Saleem Rashid, a security researcher
  • Date of publication of the fix by Ledger: April 3, 2018

Scenarios of hacker attacks

  • Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to connect the device to a computer and install the malicious firmware on it. The attacker can then use the device to access the user’s funds or falsify their transactions.
  • Scenario of remote access: The attacker needs to trick the user into installing the malicious firmware on their device, either by sending a fake notification, a phishing email, or a malicious link. The attacker then needs to communicate with the device and send the user’s private keys or modify their transactions.

Sources

: [Breaking the Ledger Security Model – Saleem Rashid] published on March 20, 2018.

: [Ledger Nano S Firmware 1.4.1: What’s New? – Ledger Blog] published on March 6, 2018.

Ledger Security Incidents: The Printed Circuit Board Modification Attack (November 2018)

The printed circuit board is the hardware part of the device, which contains the electronic components. It must be protected against malicious modifications, which could compromise the security of the device. In November 2018, a security researcher named Dmitry Nedospasov discovered a breach in the Ledger Nano S, which allowed an attacker with physical access to the device to modify the printed circuit board and install a listening device, capable of capturing the private keys or modifying the transactions.

How did hackers exploit the breach?

The attack consisted of removing the case of the device, and soldering a microcontroller on the printed circuit board. This microcontroller could intercept the communications between the secure processor and the non-secure processor of the Ledger Nano S, and transmit them to the attacker via a wireless connection. The attacker could then access the user’s private keys, or modify the transactions displayed on the device screen.

Simplified diagram of the attack

figure Ledger Security Incidents: The Printed Circuit Board Modification Attack (November 2018)

Statistics on the breach

  • Number of potentially affected users: unknown
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: November 7, 2019
  • Author of the discovery of the breach: Dmitry Nedospasov, a security researcher
  • Date of publication of the fix by Ledger: December 17, 2020

Scenarios of hacker attacks

  • Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to remove the case of the device and solder the microcontroller on the printed circuit board. The attacker can then use the wireless connection to access the user’s funds or modify their transactions.
  • Scenario of remote access: The attacker needs to compromise the wireless connection between the device and the microcontroller, either by using a jammer, a repeater, or a hacker device. The attacker can then intercept the communications between the secure processor and the non-secure processor, and access the user’s funds or modify their transactions.

Sources

  • [Breaking the Ledger Nano X – Dmitry Nedospasov] published on November 7, 2019.
  • [How to Verify the Authenticity of Your Ledger Device – Ledger Blog] published on December 17, 2020.

Ledger Security Breaches: The Connect Kit Attack (December 2023)

The Connect Kit is a software that allows users to manage their cryptocurrencies from their computer or smartphone, by connecting to their Ledger device. It allows to check the balance, send and receive cryptocurrencies, and access services such as staking or swap.

The Connect Kit breach was discovered by the security teams of Ledger in December 2023. It was due to a vulnerability in a third-party component used by the Connect Kit. This component, called Electron, is a framework that allows to create desktop applications with web technologies. The version used by the Connect Kit was not up to date, and had a breach that allowed hackers to execute arbitrary code on the update server of the Connect Kit.

How did hackers exploit the Ledger Security Breaches?

The hackers took advantage of this breach to inject malicious code into the update server of the Connect Kit. This malicious code was intended to be downloaded and executed by the users who updated their Connect Kit software. The malicious code aimed to steal the sensitive information of the users, such as their private keys, passwords, email addresses, or phone numbers.

Simplified diagram of the attack

Figure Ledger Security Breaches The Connect Kit Attack (December 2023)

Statistics on the breach

  • Number of potentially affected users: about 10,000
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: December 14, 2023
  • Author of the discovery of the breach: Pierre Noizat, director of security at Ledger
  • Date of publication of the fix by Ledger: December 15, 2023

Scenarios of hacker attacks

  • Scenario of remote access: The hacker needs to trick the user into updating their Connect Kit software, either by sending a fake notification, a phishing email, or a malicious link. The hacker then needs to download and execute the malicious code on the user’s device, either by exploiting a vulnerability or by asking the user’s permission. The hacker can then access the user’s information or funds.
  • Scenario of keyboard: The hacker needs to install a keylogger on the user’s device, either by using the malicious code or by another means. The keylogger can record the keystrokes of the user, and send them to the hacker. The hacker can then use the user’s passwords, PIN codes, or seed phrases to access their funds.
  • Scenario of screen: The hacker needs to install a screen recorder on the user’s device, either by using the malicious code or by another means. The screen recorder can capture the screen of the user, and send it to the hacker. The hacker can then use the user’s QR codes, addresses, or transaction confirmations to steal or modify their funds.

Sources

Ledger Security Breaches: The Data Leak (December 2020)

The database is the system that stores the information of Ledger customers, such as their names, addresses, phone numbers and email addresses. It must be protected against unauthorized access, which could compromise the privacy of customers. In December 2020, Ledger revealed that a breach in its database had exposed the personal data of 292,000 customers, including 9,500 in France.

How did hackers exploit the breach?

The breach had been exploited by a hacker in June 2020, who had managed to access the database via a poorly configured API key. The hacker had then published the stolen data on an online forum, making them accessible to everyone. Ledger customers were then victims of phishing attempts, harassment, or threats from other hackers, who sought to obtain their private keys or funds.

Simplified diagram of the attack :

Statistics on the breach

  • Number of affected users: 292,000, including 9,500 in France
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: June 25, 2020
  • Author of the discovery of the breach: Ledger, after being notified by a researcher
  • Date of publication of the fix by Ledger: July 14, 2020

Scenarios of hacker attacks

  • Scenario of phishing: The hacker sends an email or a text message to the user, pretending to be Ledger or another trusted entity. The hacker asks the user to click on a link, enter their credentials, or update their device. The hacker then steals the user’s information or funds.
  • Scenario of harassment: The hacker calls or visits the user, using their personal data to intimidate them. The hacker threatens the user to reveal their identity, harm them, or steal their funds, unless they pay a ransom or give their private keys.
  • Scenario of threats: The hacker uses the user’s personal data to find their social media accounts, family members, or friends. The hacker then sends messages or posts to the user or their contacts, threatening to harm them or expose their cryptocurrency activities, unless they comply with their demands.

Sources:
– [Ledger Data Breach: A Cybersecurity Update – Ledger Blog] published on January 29, 2021.

Comparison with other crypto wallets

Ledger is not the only solution to secure your cryptocurrencies. There are other options, such as other hardware wallets, software wallets, or exchanges. Each option has its advantages and disadvantages, depending on your needs and preferences. For example, other hardware wallets, such as Trezor or Keepser, offer similar features and security levels as Ledger, but they may have different designs, interfaces, or prices. Software wallets, such as Exodus or Electrum, are more convenient and accessible, but they are less secure and more vulnerable to malware or hacking. Exchanges, such as Coinbase or Binance, are more user-friendly and offer more services, such as trading or staking, but they are more centralized and risky, as they can be hacked, shut down, or regulated. Another option is to use a cold wallet, such as SeedNFC HSM, which is a patented HSM that uses NFC technology to store and manage your cryptocurrencies offline, without any connection to the internet or a computer. It also allows you to create up to 100 cryptocurrency wallets and check the balances from this NFC HSM.

Technological, Regulatory, and Societal Projections

The future of cryptocurrency security is uncertain and challenging. Many factors can affect Ledger and its users, such as technological, regulatory, or societal changes.

Technological changes

It changes could bring new threats, such as quantum computing, which could break the encryption of Ledger devices, or new solutions, such as biometric authentication or segmented key authentication patented by Freemindtronic, which could improve the security of Ledger devices.

Regulatory changes

New rules or restrictions could affect Cold Wallet and Hardware Wallet manufacturers and users, such as Ledger. For example, KYC (Know Your Customer) or AML (Anti-Money Laundering) requirements could compromise the privacy and anonymity of Ledger users. They could also ban or limit the use of cryptocurrencies, which could reduce the demand and value of Ledger devices. On the other hand, other manufacturers who have anticipated these new legal constraints could have an advantage over Ledger. Here are some examples of regulatory changes that could affect Ledger and other crypto wallets:

  • MiCA, the proposed EU regulation on crypto-asset markets, aims to create a harmonized framework for crypto-assets and crypto-asset service providers in the EU. It also seeks to address the risks and challenges posed by crypto-assets, such as consumer protection, market integrity, financial stability and money laundering.
  • U.S. interagency report on stablecoins recommends that Congress consider new legislation to ensure that stablecoins and stablecoin arrangements are subject to a federal prudential framework. It also proposes additional features, such as limiting issuers to insured depository institutions, subjecting entities conducting stablecoin activities (e.g., digital wallets) to federal oversight, and limiting affiliations between issuers and commercial entities.
  • Revised guidance from the Financial Action Task Force (FATF) on virtual assets and virtual asset service providers (VASPs) clarifies the application of FATF standards to virtual assets and VASPs. It also introduces new obligations and recommendations for PSAVs, such as the implementation of the travel rule, licensing and registration of PSAVs, and supervision and enforcement of PSAVs.

These regulatory changes could have significant implications for Ledger and other crypto wallets. They could require them to comply with new rules and standards, to obtain new licenses or registrations, to implement new systems and processes, and to face new supervisory and enforcement actions.

Societal changes

Societal changes could influence the perception and adoption of Ledger and cryptocurrencies, such as increased awareness and education, which could increase the trust and popularity of Ledger devices, or increased competition and innovation, which could challenge the position and performance of Ledger devices. For example, the EviSeed NFC HSM technology allows the creation of up to 100 cryptocurrency wallets on 5 different blockchains chosen freely by the user.

Technological alternatives

Technological alternatives are already available, such as EviCore NFC HSM, EviCore HSM OpenPGP, EviCore NFC HSM Browser Extension and the NFC HSM devices that work without contact, developed and manufactured by Freemindtronic in Andorra. These are new cyber security and safety technologies that use HSMs with or without NFC. They offer a wide range of security features to manage your cryptocurrencies and other digital assets. These technologies also offer the hardware management of complex and complicated passwords by EviPass NFC HSM, OTP (2FA) keys by EviOTP NFC HSM, Seed Phrases by EviSeed NFC HSM, and the creation of multiple cryptocurrency wallets on the same device.

Conclusion

Ledger, the French leader in cryptocurrency security, has faced several security breaches since 2017. As a result of these breaches, hackers could steal the private keys and funds of Ledger users. In response to these threats, Ledger reacted by publishing security updates, informing its users, and strengthening its protection measures. However, Ledger users must be vigilant and follow the recommendations of Ledger to protect themselves from these attacks. Despite these challenges, Ledger remains a reliable and secure device to manage cryptocurrencies, as long as the best practices of digital hygiene are respected. If you want to learn more about Ledger and its products, you can visit their official website or read their blog. Additionally, you can also check their security reports and their help center for more information.

2023, Digital Security, Phishing

BITB Attacks: How to Avoid Phishing by iFrame

Posted on by FMTAD
BITB attacks Browser-In-The-Browser remove delete destroy by IRDR Ifram Redirect Detection Removal since EviCypher freeware web extension open-source from Freemindtronic in Andorra
10
May
BITB attacks by Jacques Gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.

Beware of BitB phishing attacks by iframe!

Phishing by iframe is a malicious technique that inserts a fake web page into a legitimate one, to trick users and steal their personal or financial information. This method often targets cryptocurrency holders, especially BitB users. Learn how to spot and avoid BitB phishing attacks by iframe with Freemindtronic.

Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon: Protecting Government Communications from Cyber Threats
November 14, 2024
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know
October 15, 2024
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat
September 3, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat
August 20, 2024
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks
August 12, 2024
Hacker accessing a laptop displaying Google Workspace with a security breach notification.

2024 Digital Security

Google Workspace Vulnerability Exposes User Accounts to Hackers
August 1, 2024
Multiple computer screens displaying data breach alerts in a dark room, with the Pentagon in the background.

2024 Digital Security

Leidos Holdings Data Breach: A Significant Threat to National Security
July 25, 2024

BITB Attacks: How to Avoid Phishing by iFrame

We have all seen phishing attacks aren’t uncommon, and they demand urgent attention with fake emails and messages at least once.. However, there’s much more in the cybersecurity landscape than just conventional email practices when it comes to phishing. Enterprises that don’t take the necessary precautions can suffer a death blow from a phishing attack. The top line is affected, but the brand’s image and trust can be obliterated if news of a data breach reaches the public.

The latest form of phishing scam is the browser in the browser attack (BITB) that simulates a browser window within a web browser and steals sensitive user information. A fraudulent pop-up window caters to the user and asks for their credentials to sign into the website in the previous web browser window, leading to identity theft.

This article explains what BITB attacks are and how they work, what the risks and consequences of BITB attacks are, how to prevent and protect yourself from BITB attacks using EviBITB technology, and how to install EviBITB on your web browser.

What are BITB attacks and how do they work?

BITB stands for Browser-In-The-Browser. This phishing technique creates a fake browser window within your web browser using HTML and CSS code. An iFrame of redirection, which is an invisible element that loads content from another URL, is displayed by this fake window. The iFrame of redirection mimics the appearance and functionality of a legitimate site, such as Google, Facebook, or Outlook, and asks you to enter your authentication information.

This fake window shows a legitimate URL in the address bar, as well as the icon and the title of the original site. That is the problem. Most users rely on checking the URL to verify the authenticity of a site. This makes it very difficult to detect the phishing attempt. This attack can affect you even if you use a secure connection (https).

BITB attacks can bypass many security measures that are designed to prevent phishing. That is why they are very dangerous. For example:

  • BITB attacks do not involve malicious links or domains. Anti-phishing software may fail to detect them because of that.
  • BITB attacks do not intercept your verification codes or tokens. Two-factor authentication may not protect you from them because of that.
  • Password managers may autofill your credentials on the fake window. They may not protect you from BITB attacks because of that.

Therefore, BITB attacks can allow hackers to access your accounts, steal your data, or even take over your identity. They pose a serious threat to your online security and privacy because of that.

How do BITB attacks work?

Two features of modern web development enable BITB attacks: single sign-on (SSO) options and iFrames.

Many websites embed SSO options that allow you to sign in using an existing account from another service, such as Google, Facebook, Apple, or Microsoft. This option is convenient because you do not need to create a new account or remember a new password for each website you visit.

iFrames are elements that can load content from another URL within a web page. They are often used for embedding videos, maps, ads, or widgets on websites.

The attackers do the following steps:

  • They make a phishing website with SSO options.
  • On their phishing website, they embed an iFrame of redirection that leads to their own server with a fake SSO window.
  • Using HTML and CSS code, they design their fake SSO window to imitate a browser window inside the browser.
  • They make their fake SSO window appear when you click on an SSO option on their phishing website.
  • With JavaScript code, they show a legitimate URL in the address bar of their fake SSO window.
  • Using OAuth methods, they request you to enter your credentials on their fake SSO window.
  • To their server, they send your credentials and then redirect you to the real website.

As you can see, BITB attacks are very deceptive and convincing. They can fool even savvy users who check the URL before entering their credentials.

What are the risks and consequences of BITB attacks?

BITB attacks are a serious threat. They can compromise data and identity for users and businesses. Users who fall victim to BITB attacks face these risks and consequences:

  • Their SSO account can be hijacked and all linked services accessed by the attacker.
  • Their personal and financial information can be stolen and used for identity theft, fraud or blackmail.
  • Their devices can be infected by malware or ransomware and their files damaged or encrypted.
  • Their online reputation can be tarnished by spamming or posting malicious content.

Businesses that offer SSO options are also vulnerable to BITB attacks. They can lose trust and loyalty from their customers or employees. Businesses that suffer a data breach due to BITB attacks face these risks and consequences:

  • Their customer or employee data can be exposed, exploited or sold by the attacker or the dark web.
  • Their brand image and reputation can be damaged by negative publicity and customer complaints.
  • Their legal and regulatory compliance can be violated by data protection laws and regulations.
  • Their revenue and profitability can be reduced by customer churn, lawsuits and fines.

Recent Examples of BITB Attacks

BITB attacks are not new, but they have become more sophisticated and widespread in recent years. Here are some examples of BITB attacks that targeted governmental entities:

  • In February 2020, Zscaler revealed a campaign of phishing BitB targeting users of Steam, a video game digital distribution service. The hackers created fake Counter-Strike: Global Offensive (CS: GO) websites that offered free skins or weapons for the game. These websites displayed a fake pop-up window that asked users to sign in with Steam. If users entered their credentials, they were sent to the hackers who could then access their Steam accounts and steal their items.
  • In March 2020, Bitdefender reported a campaign of phishing BitB targeting users of Office 365, a cloud-based suite of productivity applications. The hackers sent emails that pretended to be from Microsoft and asked users to update their Office 365 settings. These emails contained a link that led users to a fake Office 365 website that displayed a fake pop-up window that asked users to sign in with Office 365. If users entered their credentials, they were sent to the hackers who could then access their Office 365 accounts and steal their data.
  • In September 2020, Proofpoint uncovered a campaign of phishing BitB targeting users of Okta, a cloud-based identity and access management service. The hackers sent emails that pretended to be from various organizations and asked users to verify their Okta account. These emails contained a link that led users to a fake Okta website that displayed a fake pop-up window that asked users to sign in with Okta. If users entered their credentials, they were sent to the hackers who could then access their Okta account and compromise their other connected applications.

These examples show that BITB attacks can target any SSO provider and any website or web application that uses SSO. They also show that hackers can use various methods to lure users into clicking on malicious links or entering their credentials on fake windows.

What are some statistics on BITB attacks?

BITB attacks use iFrames to deceive users with fake SSO windows. Here are some statistics on BITB attacks:

  • According to Statista, the number of unique phishing sites detected worldwide reached 2.11 million in the third quarter of 2020, an increase of 10% from the previous quarter.
  • According to The Hacker News, BITB attacks can exploit third-party SSO options embedded on websites such as “Sign in with Google” (or Facebook, Apple, or Microsoft) to create fake browser windows within the browser and spoof legitimate domains.
  • According to Zscaler, BITB attacks have been used in the wild at least once before, in February 2020, to target Steam users by means of fake Counter-Strike: Global Offensive (CS: GO) websites.
  • According to NetSPI, the volume of successful phishing attacks on organizations worldwide in 2021 was highest in Brazil (25%), followed by India (17%), and Mexico (14%).
  • According to DZone, the most targeted industry sectors by phishing attacks as of the third quarter of 2020 were SaaS/Webmail (33%), Financial Institutions (22%), and Payment Services (14%).

How to effectively fight against BITB attacks?

BITB attacks are very hard to detect, but not impossible. There are some signs that can help you spot them and some measures that can help you prevent them. Here are some tips:

  • Always check the URL of the site before entering your credentials. Make sure it matches the domain of the site or the SSO provider that you want to use. Do not rely on the URL displayed on the pop-up window, as it can be fake.
  • Always check the SSL certificate of the site before entering your credentials. Make sure it is valid and issued by a trusted authority. Do not rely on the padlock icon displayed on the pop-up window, as it can be fake.
  • Always use an updated antivirus software and browser extension that can detect and block malicious sites and scripts. They can help you avoid landing on phishing pages or loading fake windows.
  • Always use strong and unique passwords for each site or application that you use. Do not reuse the same password for different accounts, as it can increase the risk of compromise if one of them is breached.
  • Always use two-factor authentication (2FA) for your accounts, especially those that you use for SSO. 2FA adds an extra layer of security by requiring a second factor (such as a code sent to your phone or email) to verify your identity. Having your username and password is less useful for hackers if they need your device or access to your email account too.

How to prevent and protect yourself from BITB attacks using EviBITB technology?

The best way to prevent and protect yourself from BITB attacks is to use EviBITB technology, a technology that allows you to detect and remove redirection iframes from web pages. EviBITB is integrated for free in the free and paid extensions of Freemindtronic that are compatible with NFC HSM devices that use a smartphone or an NFC HSM device. The latter stores encrypted multiple authentication information (username, password, otp) for secure authentication for any website on the internet or intranet.

EviBITB technology also has a system of automatic backup of the URL of connection to the account using a web browser to connect to an online account on the internet or intranet. This extension is paired with the NFC android phone which is itself paired with an NFC HSM where encrypted detailed authentication information such as username, password, and secret keys OTP (TOP or HOTP) are stored. Thus, before authorizing auto-filling of connection fields or auto-connection to an online account, the phone will check beforehand if the connection URL is compliant (sandbox technique). This system adds to EviBITB protection.(click here to learn more about EviBITB)

By using EviBITB technology, you can enjoy many benefits:

  • You can avoid falling victim to BITB attacks that can steal your data or compromise your identity.
  • You can reduce the risk of keylogging or malware infections that can capture your keystrokes or spy on your online activity.
  • You can save time and hassle by using your smartphone or NFC HSM card as an authentication key instead of creating or remembering passwords for each website you visit.
  • You can enjoy a seamless and user-friendly experience by accessing websites with just a tap of your smartphone or NFC HSM card on your computer screen.
  • You can protect your privacy by controlling what data you share with each website you visit, such as your name, email, or profile picture.

By using EviBITB technology, you can be sure that the web page you see is the one you want to see, and that you do not give away your data to hackers.

How can EviBITB protect you from BITB attacks?

EviBITB is a technology that enhances your online security. It is implemented in the freemindtronic extensions that allow secure end-to-end autofill and auto-login from an NFC HSM. It also detects and removes phishing iFrames from your web browser.

EviBITB works with an application installed on an NFC Android phone that is paired with an NFC HSM. The application has a sandbox that checks if the origin URLs saved automatically during the first login are compliant. If they are, it transfers encrypted authentication information to the extension.

EviBITB also analyzes the web page source code and detects any possible BITB iFrames. It looks for hidden elements, suspicious URLs, or mismatched styles that indicate a fake browser window.

When EviBITB detects a BITB iFrame, it alerts you by showing a warning window on your computer screen. This window shows you the redirection iFrame URL and asks you to check if you trust this URL before entering any sensitive information.

How EviBITB technology can improve your browsing experience?

EviBITB technology is a security, performance and privacy enhancer. It removes redirection iframes and improves your browsing experience in several ways:

  • It speeds up web page loading, by avoiding requests to third-party sites.
  • It reduces bandwidth consumption, by saving data transferred to or from iframes.
  • It limits exposure to ads and pop-ups, by blocking their sources in iframes.
  • It prevents online activity tracking, by deleting cookies and data stored by iframes.
  • It enhances readability and usability of web pages, by removing distracting elements from iframes.
  • It increases compatibility and accessibility of web pages, by avoiding conflicts or errors caused by iframes.

With EviBITB technology, you can enjoy a faster, smoother and more private browsing experience, without compromising security or convenience.

How to use EviBITB to protect yourself from BITB attacks?

EviBITB is a technology that detects and removes malicious iFrames that expose you to BITB attacks. These attacks simulate a browser window in a web page to prompt you to enter credentials on a fraudulent site.

When EviBITB detects a suspicious iFrame, it shows a warning window that informs you of the risk. This window also gives you five buttons to act on the BITB iFrame:

  • Close Warning: this button closes the warning window without acting on the BITB iFrame. You can use it if you trust the iFrame URL or want to ignore it.
  • Never Show Warnings On This Site: this button adds the website URL to a list of trusted sites. EviBITB will not alert you of BITB iFrames on these sites. You can use it if you are sure the website is safe and has no malicious iFrames.
  • Destroy: this button deletes the BITB iFrame from the web page source code. You can use it if you do not trust the iFrame URL or want to remove it.
  • Clean Storage: this button clears the data stored by the BITB iFrame in the browser. You can use it if you have been exposed to phishing by iFrame and want to erase any traces.
  • Read More: this button redirects you to a page with more information about EviBITB and its benefits. You can use it if you want to learn more about how EviBITB works and protects you from hackers.

Why you should use EviBITB to secure your online access?

EviBITB is a technology that allows you to use your smartphone or your NFC HSM card as a secure authentication key for any website. With EviBITB, you enjoy many benefits:

  • You avoid BITB attacks that can steal your data or impersonate your identity.
  • These attacks simulate a browser window in a web page to prompt you to enter your credentials on a fraudulent site.
  • You reduce the risk of keylogging or malware infections that can capture your keystrokes or spy on your online activity.
  • You save time and hassle by using your smartphone or NFC HSM card as an authentication key instead of creating or remembering passwords for each website you visit.
  • You enjoy a seamless and user-friendly experience by accessing websites with just a tap of your smartphone or NFC HSM card on your computer screen.
  • You protect your privacy by controlling what data you share with each website you visit, such as your name, email, or profile picture.

By using EviBITB, you can be sure that the web page you see is the one you want to see, and that you do not give away your data to hackers.

How EviBITB can improve your browsing experience?

EviBITB is not only a security tool, but also a performance and privacy enhancer. By removing redirection iframes, EviBITB can improve your browsing experience in several ways:

  • It can speed up the loading of web pages, by avoiding unnecessary or malicious requests to third-party sites.
  • It can reduce the bandwidth consumption, by saving the data that would otherwise be transferred to or from the iframes.
  • It can limit the exposure to ads and pop-ups, by blocking the sources that display them in the iframes.
  • It can prevent the tracking of your online activity, by deleting the cookies and other data that the iframes may store in your browser.
  • It can enhance the readability and usability of web pages, by removing distracting or irrelevant elements from the iframes.
  • It can increase the compatibility and accessibility of web pages, by avoiding potential conflicts or errors caused by the iframes.

By using EviBITB, you can enjoy a faster, smoother and more private browsing experience, without compromising your security or convenience.

How to get started with EviBITB?

Getting started with EviBITB is easy and fast. You just need to follow these steps:

  • Download the EviBITB extension for your web browser based on Chromium or Firefox from Freemindtronic’s official website: https://freemindtronic.com/evibitb-stop-bitb-phishing-attacks/
  • Install the extension on your web browser and follow the instructions to set it up.
  • Get a smartphone or an NFC HSM card compatible with the extension. You can find more information about these devices on Freemindtronic’s website: https://freemindtronic.com/how-does-evibitb-work-detailed-guide/
  • Pair your smartphone or NFC HSM card with your computer using Bluetooth or NFC technology.
  • Start browsing the web securely with EviBITB. Whenever you visit a website that offers SSO options, you will see a green icon on the address bar indicating that EviBITB is active. You can then tap your smartphone or NFC HSM card on your computer screen to authenticate yourself and access the website.

What are some videos on BITB attacks and EviBITB?

If you want to learn more about BITB attacks and EviBITB technology, you can watch some videos on these topics:

  • A video demonstration of a BITB attack by mrd0x:

In conclusion

BITB attacks are a new and sophisticated form of phishing that can steal your credentials by simulating a browser window within your browser. They can bypass many security measures that are designed to prevent phishing and compromise your online security and privacy.

EviBITB is a free technology that detects and removes phishing iFrames from your web browser. It also offers other features to enhance your online security, such as authentication via NFC HSM devices that secure your credentials without typing them on your keyboard.

If you want to benefit from EviBITB technology, you just need to download the extension corresponding to your web browser on Freemindtronic’s official website:

You will also need a smartphone or an NFC HSM card compatible with the extension. You can find more information about these devices on Freemindtronic’s website.

https://freemindtronic.com/evibitb-stop-bitb-phishing-attacks/ :

Don’t wait any longer and try EviBITB now!

Hashtags: #EviBITB #Phishing #Cybersecurity #NFC #HSM

Articles, Digital Security, Phishing

Snake Malware: The Russian Spy Tool

Posted on by FMTAD
Snake malware: The Russian that steals sensitive information for 20 years
10
May

Snake malware by Jacques gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.  

Snake: The Russian malware that steals sensitive information for 20 years

Snake is a malware that allows Russian intelligence services to collect and transmit sensitive information from hundreds of infected computers across 50 countries. It is a very sophisticated espionage tool, designed and used by Center 16 of the Federal Security Service of the Russian Federation (FSB) for long-term operations on strategic targets.

Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon: Protecting Government Communications from Cyber Threats
November 14, 2024
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know
October 15, 2024
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat
September 3, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat
August 20, 2024
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks
August 12, 2024
Hacker accessing a laptop displaying Google Workspace with a security breach notification.

2024 Digital Security

Google Workspace Vulnerability Exposes User Accounts to Hackers
August 1, 2024
Multiple computer screens displaying data breach alerts in a dark room, with the Pentagon in the background.

2024 Digital Security

Leidos Holdings Data Breach: A Significant Threat to National Security
July 25, 2024

An example of technical analysis of Snake malware

To illustrate how Snake malware works in detail, we will use an example of technical analysis conducted by FortiGuard Labs on a fresh variant of Snake keylogger malware. This variant was captured in November 2021 and was delivered as an Excel file with malicious macro code. The main payload of Snake keylogger malware was an executable file named “Requests07520000652.exe”, which the macro code downloaded and executed

Snake malware’s core component

Several embedded resources were contained in the main payload, which was a .NET assembly file. Reflection loaded another .NET assembly file named “Guna.UI2.dll” into memory, which was one of theml”, which was loaded into memory by reflection. This file contained the core functionality of Snake keylogger malware, such as stealing information, taking screenshots, capturing clipboard data, and communicating with a command and control (C2) server.

How Snake malware steals sensitive data

The information stealing module was responsible for collecting various types of sensitive information from the infected system, such as:

  • System information: computer name, user name, operating system version, processor architecture, etc.
  • Saved credentials: passwords stored in browsers (Chrome, Firefox, Edge), email clients (Outlook), FTP clients (FileZilla), etc.
  • Keystrokes: keyboard input from various applications (browsers, email clients, chat programs, etc.)
  • Screenshots: images of the desktop or active window at regular intervals
  • Clipboard data: text or images copied to the clipboard

Snake stored the collected information in a temporary folder with random names and encrypted it with AES.

How Snake malware communicates with its operators

After the previous subsection, you can add this subsection:

The communication module was responsible for sending the encrypted information to a C2 server and receiving commands from it. The C2 server used a domain name that was generated by an algorithm based on the current date. The communication protocol used HTTP POST requests with custom headers and parameters. Snake encoded the data with Base64 and encrypted it with AES.

Some of the commands that the C2 server could send to the malware were:

  • GetInfo: request system information from the malware
  • GetLogs: request keystroke logs from the malware
  • GetClipboard: request clipboard data from the malware
  • GetScreen: demander des captures d’écran du malware
  • Mise à jour : téléchargez et exécutez une version mise à jour du malware
  • Désinstaller: supprimer le malware du système
Find out more :
1. cybereason.com2. cisa.gov3. media.defense.gov

What is the impact of Snake on governments, NGOs, press and other sensitive activities?

The impact of Snake on governments, NGOs, press and other sensitive activities can be severe, depending on the type and level of information stolen by the malware. These entities may face:

  • Loss of sovereignty and national security by exposing their secrets and strategies to a foreign adversary.
  • Loss of credibility and influence by exposing their diplomatic communications and international relations documents to public scrutiny or manipulation.
  • Loss of human rights and democracy by exposing their activists, journalists and dissidents to harassment, intimidation or persecution.
  • Loss of public trust and accountability by exposing their corruption, fraud or misconduct to whistleblowers or watchdogs.
  • Legal and ethical issues by exposing their confidential sources, informants or witnesses to danger or retaliation.

For example, Snake was used by the FSB to target government networks in NATO member countries, as well as media and educational organizations in the United States1. These targets may have suffered serious consequences for their security, reputation and integrity.

How does Snake spread precisely?

Snake spreads precisely by using different techniques to infect systems and networks. Some of these techniques are:

How to protect yourself from Snake malware?

To protect yourself from Snake malware, you should follow some best practices in terms of computer security. These include:

  • Regularly update your operating systems and applications with the latest security patches.
  • Use effective antivirus and antimalware solutions and keep them up to date.
  • Enable firewall and configure strict rules to limit incoming and outgoing traffic.
  • Apply the principle of least privilege and limit access to sensitive data to only authorized users.
  • Educate yourself and your users on the risks related to unsolicited or suspicious emails and attachments.
  • Perform regular backups of your important data and store them offline or in a secure location.
  • Monitor for anomalies or suspicious activities on your networks and report any potential incident.

find out more :
For more information on Snake and how to protect yourself from it, you can consult the joint warning issued by intelligence and cybersecurity agencies1 or the threat analysis report published by Cybereason2.

How to protect against Snake ransomware

After the previous subsection, you can add this subsection:

To protect against Snake ransomware, organizations should follow the same mitigation recommendations as for Snake malware. In addition, they should:

  • Implement regular backups of important data and store them offline or in a separate network
  • Use antivirus software and scan for ransomware indicators
  • Avoid opening suspicious email attachments or links
  • Disable macros in Microsoft Office documents
  • Use network segmentation and isolation to limit the spread of ransomware
  • Report any ransomware incidents to CISA or law enforcement

How to remove Snake from your system?

To remove Snake from your system, you should follow some steps:

  • Disconnect your system from the network to prevent further communication with Snake infrastructure.
  • Scan your system with updated antivirus or antimalware tools to detect and remove any traces of Snake components.
  • Restore your system to a previous clean state using backups or restore points.
  • Change the passwords of any accounts that may have been compromised by Snake.
  • Report the incident to relevant authorities and seek professional help if needed.

Alternatively, you can use a tool developed by the FBI called Perseus that forces Snake to self-destruct on your system. This tool was used in an operation called Medusa to neutralize the network of Snake in the United States in May 20231.

What is the impact of Snake on businesses and governments?

The impact of Snake on businesses and governments can be significant, depending on the type and level of information stolen by the malware. These entities may face:

  • Loss of competitive advantage and innovation by stealing their intellectual property and trade secrets.
  • Loss of market share and customers by stealing their business plans and customer data.
  • Loss of revenue and profit by stealing their financial information and disrupting their operations.
  • Loss of reputation and trust by stealing their confidential information and damaging their brand image.
  • Legal and regulatory compliance issues by stealing their sensitive information and violating their obligations.
  • Loss of sovereignty and national security by exposing their secrets and strategies to a foreign adversary.
  • Loss of credibility and influence by exposing their diplomatic communications and international relations documents to public scrutiny or manipulation.
  • Loss of human rights and democracy by exposing their activists, journalists and dissidents to harassment, intimidation or persecution.
  • Loss of public trust and accountability by exposing their corruption, fraud or misconduct to whistleblowers or watchdogs.

For example, Snake was used by the FSB to target government networks in NATO member countries, as well as media and educational organizations in the United States1. These targets may have suffered serious consequences for their security, reputation and integrity. The FSB also used Snake to access and exfiltrate sensitive international relations documents, as well as other diplomatic communications, from a victim in a NATO country1. This could have serious implications for foreign policy and security of the alliance. In May 2023, the FBI led an operation called Medusa to dismantle the network of Snake in the United States, in collaboration with several partner agencies2. The operation involved using a digital tool called Perseus that forced Snake to self-destruct on infected systems. The FBI attributed the operations using Snake to a known unit within Center 16 of the FSB2.

Articles, Cryptocurrency, Digital Security, Phishing

ViperSoftX How to avoid the malware that steals your passwords

Posted on by FMTAD
ViperSoftX How to avoid the malware that steals your passwords
07
May

ViperSoftX malware by Jacques gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.  

ViperSoftX: The malware that steals your passwords and cryptocurrencies

Do you use password managers or cryptocurrency wallets to secure your online data? Beware, you could be the target of a malware named ViperSoftX, which infiltrates your computer and steals your sensitive information. Find out how it works, how to detect it and how to protect yourself from it in this article.

Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon: Protecting Government Communications from Cyber Threats
November 14, 2024
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know
October 15, 2024
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat
September 3, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat
August 20, 2024
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks
August 12, 2024
Hacker accessing a laptop displaying Google Workspace with a security breach notification.

2024 Digital Security

Google Workspace Vulnerability Exposes User Accounts to Hackers
August 1, 2024
Multiple computer screens displaying data breach alerts in a dark room, with the Pentagon in the background.

2024 Digital Security

Leidos Holdings Data Breach: A Significant Threat to National Security
July 25, 2024

ViperSoftX: The Malware that Steals Your Cryptocurrencies and Passwords

ViperSoftX is a malware that steals sensitive information from infected computers, including data related to cryptocurrencies and passwords. It was first discovered in 2020 as a JavaScript-based remote access trojan and cryptocurrency hijacker. Since then, it has evolved to become more sophisticated and stealthy, using innovative arrival and execution techniques, enhanced encryption and a malicious extension for web browsers. In this article, we will examine the features, targets and consequences of ViperSoftX malware, as well as how to protect yourself from it.

Global impact of ViperSoftX malware

This is not a regional threat, but a global one. The malware is mostly spread via torrents and software-sharing sites, which attract users from all over the world. According to Avast, the most impacted countries by ViperSoftX in 2022 were India, USA, Italy, and Brazil. However, Trend Micro reported that the malware also affected a significant number of victims in Australia, Japan, Taiwan, Malaysia and France in 2023. Both enterprises and consumers are at risk of losing their sensitive data and cryptocurrencies to this stealthy malware. Therefore, it is important to raise awareness about the dangers of ViperSoftX and how to prevent its infection.

How to avoid ViperSoftX, the malware that steals your sensitive data

This is malware is dangerous malware that targets Chrome and other browsers, and can steal your passwords from virtual password managers like 1Password or KeePass 2 and virtual cryptocurrency wallets. In this article, you will learn how it works and how to prevent it from infecting your device.

Features of ViperSoftX malware

ViperSoftX is a malware that stands out for its innovative arrival and execution techniques, enhanced encryption and malicious extension for web browsers. VipersoftX is a malware that steals information from infected computers.

What is ViperSoftX and how does it work?

ViperSoftX is a type of malware called infostealer, which means it is designed to steal the data from a device. It was first discovered in 2020 by Fortinet1, and has since evolved to become more sophisticated and stealthy.

ViperSoftX mainly targets the users of Chrome and other browsers, such as Firefox, Opera, Brave and Microsoft Edge. It installs a malicious extension called VenomSoftX on the browser, which can access and extract sensitive information such as browser login data, cryptocurrency wallets, stored credit card information, passwords and more2.

It is a JavaScript-based Remote Access Trojan (RAT) that allows attackers to remotely control the compromised machine and execute various malicious actions. VipersoftX uses advanced obfuscation techniques to hide itself and evade detection from security software, It uses 8 layers of code obfuscation before executing its actual payload. It uses 3 types of obfuscation techniques: AES decryption, character array conversion, and UTF-81 decoding,

It establishes its persistence by copying itself to %APPDATA% and creating a shortcut in the startup directory to invoke it. It uses seemingly legitimate names to disguise itself, such as v pn_port.dll, reg.converter.sys, install.sig, and install.db

The main features of the malware

These features make ViperSoftX malware a serious threat to the security of users and organizations that use cryptocurrencies or password managers.

  • Arrival technique by cracked software: The malware usually poses as a cracked software, an activator or a key generator, which hides the malicious code in the overlay. The malware uses non-malicious files as carriers of the malicious code, such as gup.exe from Notepad++, firefox.exe from Tor or ErrorReportClient.exe from Magix. These files are accompanied by a DLL file that serves as a decryptor and loader of the malicious code. This technique aims to deceive users who are looking for illegal versions of software and to avoid detection by security solutions.
  • Enhanced encryption by byte remapping: The malware uses a sophisticated encryption method that consists of remapping the bytes of the malicious code according to a specific byte map. Without the correct byte map, the encrypted malicious code, including all components and relevant data, cannot be correctly decrypted, making the decryption and analysis of the code longer and more difficult for analysts. The malware also changes its byte map every month, which makes it even harder to track the malicious code.
  • Monthly change of command and control server: The malware communicates with a command and control (C&C) server to send the stolen information and receive instructions. The C&C server also changes every month, according to a predictable algorithm based on the current date. The C&C server uses the HTTPS protocol to encrypt the communication with the malware.
  • Ability to steal data from various cryptocurrency wallets and web browsers: The malware mainly aims to steal data related to cryptocurrencies, such as private keys, passwords and addresses of wallets. The malware targets more than 20 different cryptocurrency wallets, such as Blockchain, Binance, Coinbase, MetaMask or Ledger Live. The malware also installs a malicious extension named VenomSoftX on Chrome, Brave, Edge, Opera and Firefox web browsers. This extension can intercept and modify cryptocurrency transactions made on web browsers. The malware can also steal other sensitive data stored on web browsers, such as cookies, history, bookmarks or autofill data.
  • Detection of two password managers, KeePass 2 and 1Password: The malware checks for files associated with two popular password managers, KeePass 2 and 1Password, on the infected computer. It also tries to steal data stored in the browser extensions of these password managers. It is not clear whether the malware exploits a known vulnerability of the password managers or whether it uses another method to access the saved passwords.

Consequences of information theft by ViperSoftX malware

ViperSoftX is a malware that can cause serious damage to the users and organizations whose data it steals. The consequences of information theft by ViperSoftX malware can include:

  • Loss of money: The malware can steal data related to cryptocurrencies, such as private keys, passwords and addresses of wallets. This can result in the loss of funds stored in these wallets, or the redirection of transactions to the attacker’s accounts. The malware can also steal data related to online banking, credit cards or other payment methods, which can enable the attacker to make fraudulent purchases or transfers using the victim’s identity.
  • Loss of identity or confidentiality: The malware can steal data related to personal or professional identity, such as passport numbers, driver’s license numbers, social security numbers, medical records, online subscriptions, etc. This can result in identity theft, where the attacker can use the victim’s identity to access secure accounts, set up credit cards, apply for loans, or commit other crimes. The malware can also steal data related to confidential or proprietary information, such as software code, algorithms, processes or technologies. This can result in the loss of intellectual property, competitive advantage or trade secrets.
  • Risks for the consumer and enterprise sectors: The malware targets both individual users and organizations that use cryptocurrencies or password managers. For individual users, the malware can compromise their privacy and security, as well as expose them to financial losses or legal liabilities. For organizations, the malware can compromise their reputation and customer trust, as well as expose them to lawsuits, ransomware demands, recovery costs, regulatory fines or penalties

Victims of the ViperSoftX malware and statistics

The ViperSoftX malware has made many victims around the world, especially in France. Some users have lost large amounts of cryptocurrencies due to the theft of their wallet addresses. Others have seen their online accounts hacked due to the theft of their passwords. Here are some testimonies collected from forums or social networks:

  • “I was infected by ViperSoftX two weeks ago. I only realized it when I wanted to make a transfer of bitcoins to another wallet. The address I had copied had been replaced by another one in the clipboard. I lost 0.5 bitcoin, which is about 20,000 euros.”
  • “I got caught by ViperSoftX by downloading a cracked software from a torrent site. The malware installed a malicious extension on my Firefox browser and stole my passwords stored in KeePass. I had to change all my passwords and disinfect my computer with an antivirus.”
  • “ViperSoftX caused me a lot of problems. The malware accessed my personal and professional data by going through the extension of 1Password on Chrome. It used my Gmail account to send spam to my contacts and my PayPal account to make fraudulent purchases.”

According to TrendMicro, the ViperSoftX malware has infected more than 10,000 computers worldwide since its appearance in 2020. The number of victims could be even higher, as the malware is difficult to detect by antivirus.

How does ViperSoftX spread?

The malware also checks if the device has virtual password managers installed, such as 1Password or KeePass 2. These are applications that help users store and manage their passwords securely. ViperSoftX exploits a vulnerability called CVE-2023-24055 to access the data stored by these password managers through their browser extensions3.

ViperSoftX also steals users’ cryptocurrency by attacking wallets and exchanges. It targets the following wallets in particular: Armory, Atomic Wallet, Binance, Bitcoin, Blockstream Green, Coinomi, Delta, Electrum, Exodus, Guarda, Jaxx Liberty, Ledger Live, Trezor Bridge, Coin98, Coinbase and MetaMask.

The stolen data is then sent to a command-and-control (C2) server controlled by the attackers, who can use it for financial gain or sell it to other hackers.

How to protect yourself from ViperSoftX malware

ViperSoftX is a stealthy and dangerous malware that can cause serious damage to your computer and your data. Therefore, you should take some preventive measures to avoid being infected by this malware. Here are some tips to help you protect yourself from ViperSoftX:

  • Avoid cracked software: The malware often arrives as cracked software, an activator or a key generator, which hides the malicious code in the overlay. Avoid downloading or using illegal versions of software or games, as they may contain malware. Only download software from trusted sources and verify their authenticity.
  • Use security software: Use a robust antivirus software that can detect and remove malware from your device. Keep your security software updated and perform regular scans of your device. You can also use a firewall to block unauthorized network connections and a VPN to encrypt your online traffic.
  • Update your browsers and password managers: The malware installs a malicious extension named VenomSoftX on web browsers and steals data from them. It also checks if the device has security software installed, such as Windows Defender or ESET, and activates its camouflage mechanisms accordingly. Update your browsers and password managers regularly to fix any security vulnerabilities. Also, only install extensions from trusted sources and check their permissions and reviews.
  • Backup your data: The malware can steal or encrypt your data, making it inaccessible or unusable. Backup your data regularly to an external storage device or a cloud service, so you can restore it in case of a malware attack. You can also use encryption tools to protect your data from unauthorized access.
  • Be careful with email attachments and links: The malware can also arrive through phishing emails that trick you into clicking on a link or opening an attachment. Be wary of emails that ask you to provide personal or financial information, or that seem to be from unknown or suspicious senders. Also, avoid clicking on links or attachments that look suspicious or irrelevant.
  • Use strong and unique passwords: The malware can steal your passwords for your online accounts, especially for your cryptocurrency wallets and exchange platforms. Use strong and unique passwords for each account, and avoid using the same password for multiple accounts. You can use a password generator or a password manager to create and store strong passwords.
  • Enable two-factor authentication (2FA): The malware can use your stolen passwords to access your accounts and perform fraudulent transactions. Enable two-factor authentication (2FA) whenever possible, which adds an extra layer of security to your login process. 2FA requires you to enter a code sent to your phone or email, or generated by an app, in addition to your password.
  • Avoid downloading and installing software or documents from untrusted sources: The malware often hides behind cracked versions of popular software or games, which are offered on torrent or illegal download sites.
  • Keep your browser and password manager updated: with the latest security patches, and use strong and unique passwords for each account.

How to remove ViperSoftX from your system

ViperSoftX is a malware that can infect your computer and steal your data. If you suspect or know that your computer is already infected by ViperSoftX, you should act quickly to remove it and prevent further damage. Here are some steps to help you remove ViperSoftX from your system:

  • Uninstall malicious programs from Windows: ViperSoftX may have installed some malicious programs on your computer that can interfere with your removal process. To uninstall them, go to Control Panel > Programs > Uninstall a program and look for any suspicious programs that you do not recognize or that you did not install yourself. Select them and click Uninstall.
  • Reset browsers back to default settings: ViperSoftX may have modified your browser settings and installed a malicious extension named VenomSoftX that can steal your data. To reset your browser settings, go to your browser settings and look for an option to reset your browser to its default state. This will remove any malicious extensions, cookies, history, passwords, and other data that ViperSoftX may have added or modified.
  • Use Rkill to terminate suspicious programs: ViperSoftX may have some processes running in the background that can prevent you from removing it. To stop them, use Rkill, a free tool that can terminate any suspicious processes that are running on your computer. Download Rkill from here and run it as administrator. Wait for it to finish scanning and killing any suspicious processes.
  • Use Malwarebytes to remove Trojans and unwanted programs: ViperSoftX is a Trojan malware that can hide itself from antivirus detection by using camouflage mechanisms. It also checks if the device has security software installed, such as Windows Defender or ESET, and activates its camouflage mechanisms accordingly. To remove it, use Malwarebytes, a powerful anti-malware software that can detect and remove ViperSoftX and other threats from your computer. Download Malwarebytes from here and install it. Run a full scan and follow the instructions to quarantine or delete any detected threats.
  • Use HitmanPro to remove rootkits and other malware: ViperSoftX may have some hidden malware components that may have escaped Malwarebytes. To find and remove them, use HitmanPro, a second-opinion scanner that can find and remove any hidden malware that may be on your computer. Download HitmanPro from here and run it. Follow the instructions to scan your computer and remove any remaining malware.
  • Use AdwCleaner to remove malicious browser policies and adware: ViperSoftX may have changed some browser policies or installed some adware on your computer that can display unwanted ads or pop-ups. To clean your browser from them, use AdwCleaner, a free tool that can remove any unwanted policies, extensions, toolbars, ads, or pop-ups that may have been installed by ViperSoftX or other adware. Download AdwCleaner from here and run it. Click Scan Now and then Clean & Repair to remove any detected threats.
  • Perform a final check with ESET Online Scanner: To make sure that your computer is completely free of malware infections, perform a final check with ESET Online Scanner, a free online tool that can scan your computer for any remaining malware infections. It can detect and remove viruses, Trojans, spyware, phishing and other internet threats. To use ESET Online Scanner, go to this website and click Start Scan Now. Accept the terms of use and click Enable ESET LiveGrid feedback system. This will allow ESET to collect anonymous data about detected threats and improve its detection capabilities. Wait for the scan to complete and follow the instructions to delete any detected threats.”

By following these steps, you should be able to remove ViperSoftX from your computer completely. However, you should also change your passwords for your online accounts, especially for your cryptocurrency wallets and exchange platforms

ViperSoftX is a very stealthy malware that can evade antivirus detection by using various techniques. It also checks if the device has security software installed, such as Windows Defender or ESET, and activates its camouflage mechanisms accordingly4.

How to secure your passwords and cryptocurrencies with modern authentication methods?

One of the best ways to protect your passwords and cryptocurrencies from ViperSoftX and other malware is to use modern authentication methods that rely on hardware devices instead of software. These devices are called hardware password managers or cold wallets.

Hardware password manager

A hardware password manager is a device that stores and manages your passwords securely. Unlike a virtual password manager, which runs on your computer or smartphone, a hardware password manager is a separate device that you can carry with you. This way, you can avoid storing your passwords on potentially compromised devices or online services.

A hardware password manager generates and stores strong passwords for your online accounts, which you can access with one master password. To log in to an online service, you can either type the password manually or use the NFC feature of the device to transmit the password to your computer or smartphone.

NFC

NFC (Near Field Communication) is a wireless technology that allows devices to communicate over short distances. You can use NFC for various purposes, such as contactless payments, smart cards, and authentication. By using NFC, you can log in to your online accounts with a simple tap of your hardware password manager on your device.

Some of the benefits of using NFC are:

  • It is fast and convenient: you do not need to type long passwords or scan QR codes.
  • It is secure: NFC uses encryption and authentication protocols to prevent eavesdropping or tampering.
  • It is compatible: NFC works with most:

Cold wallet

A cold wallet is a device that stores your cryptocurrencies offline. Unlike a hot wallet, which is connected to the internet and vulnerable to hacking, a cold wallet is isolated and protected from unauthorized access. To use a cold wallet, you need to transfer your cryptocurrencies from an online platform to the device and vice versa.

A cold wallet generates and stores private keys for your cryptocurrency accounts. A private key is a secret code that allows you to access and control your cryptocurrency funds. You should never share or lose your private key, as it is the only way to access your funds.

Some of the advantages of using a cold wallet are:

  • It is safe and reliable: you do not have to worry about hackers, malware, or phishing attacks.
  • It is easy and convenient: you can manage your funds with a simple interface and a few clicks.
  • It is versatile and compatible: you can store different types of cryptocurrencies on the same device.

One example of a cold wallet that uses NFC technology is the NFC Cold Wallet with EviVault technology from Freemindtronic Andorra. This device allows you to store and manage your cryptocurrencies securely and conveniently with your smartphone.

EviVault Cold Wallet & Hardware Wallet

EviVault is a patented technology that enhances the security and performance of NFC devices. It uses a combination of hardware and software features to protect your data from physical and logical attacks.

Some of the features of EviVault are:

  • It encrypts and authenticates your data with AES-256 and HMAC-SHA256 algorithms.
  • It prevents cloning, tampering, or replay attacks with anti-counterfeiting and anti-replay mechanisms.
  • It detects and blocks brute force attacks with auto unpairing functions traced in a black box.
  • It optimizes the speed and reliability of NFC communication with error correction and data compression techniques.

With EviVault, you can enjoy the benefits of NFC technology without compromising your security or privacy.

The impact of the ViperSoftX malware on businesses

The ViperSoftX malware does not only target individuals, but also businesses. Indeed, the malware can compromise the security of professional data by stealing the passwords of employees or customers. It can also infect the computer network of the company and spread other malware, such as ransomware or cryptominers.

To protect themselves from the ViperSoftX malware, businesses must take several measures:

  • Educate employees about the risks associated with downloading software or documents from unofficial or illegal sources.
  • Use up-to-date and effective antivirus software to detect and remove the malware.
  • Choose secure and reliable password managers, which do not store sensitive data in browser extensions.
  • Check regularly the transactions in cryptocurrencies and the addresses of the wallets.

In conclusion

ViperSoftX is a dangerous malware that can steal your passwords and cryptocurrencies from your virtual password managers and online platforms. To protect yourself from ViperSoftX, you should be careful about what you download and install on your device, keep your software updated and secure, avoid installing unknown or suspicious extensions and backup your data regularly.

To secure your passwords and cryptocurrencies with modern authentication methods, you can use hardware password managers or cold wallets that rely on hardware devices instead of software. These devices use NFC technology to offer you a high level of security and convenience for your online accounts. However, you should also follow some best practices, such as keeping your devices updated and secure, using strong passwords and two-factor authentication, and storing only small amounts of cryptocurrency on online platforms.

Articles, Phishing

Protect Your Data from AMOS Malware

Posted on by FMTAD
AMOS malware protection with Keepser NFC Cold Xallet
04
May


AMOS Malware Protection by Jacques gascuel
This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Related topic : CryptBot malware

Protect Your Mac from AMOS Malware

Are you worried about the threat of AMOS malware on your Mac? Keep your data safe with Keepser Cold Wallet. Learn how this technology can protect your sensitive information from this dangerous malware.

White background image illustrating the ePrivacy Regulation with a secure lock symbol, digital icons for encryption and consent, and the European Union flag subtly integrated.

2024 Cyberculture Legal information

ePrivacy Regulation: Transforming Messaging Privacy in 2025
November 26, 2024
Laptop and smartphone displaying 2FA MFA security features with OATH initiative, key management solutions for 2024.

2024 Articles Technical News

Best 2FA MFA Solutions for 2024: Focus on TOTP & HOTP
October 8, 2024
Flags of France and the European Union on a white background representing ANSSI cryptography authorization

2024 Articles Cyberculture Legal information

ANSSI Cryptography Authorization: Complete Declaration Guide
October 7, 2024
laptop displaying Microsoft Uninstallable Recall feature, highlighting TPM-secured data and uninstall option, with a user's hand interacting, on a white background.

2024 Articles Technical News

New Microsoft Uninstallable Recall: Enhanced Security at Its Core
October 3, 2024
Ultra-realistic image illustrating Andorra's shared EAN code with Spain, featuring a barcode starting with 84 and a map connecting Andorra and Spain.

2024 Articles Cyberculture

EAN Code Andorra: Why It Shares Spain’s 84 Code
September 9, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Balance scale showing the balance between privacy and law enforcement in EU regulation of end-to-end encrypted messaging.

2024 Articles Cyberculture legal Legal information News

End-to-End Messaging Encryption Regulation – A European Issue
June 10, 2024
Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2024 Articles Cardokey EviSwap NFC NDEF Technology GreenTech Technical News

NFC vCard Cardokey: Revolutionizing Digital Networking
March 25, 2024

AMOS Malware Protection with Keepser Cold Wallet

The Threat of AMOS Malware on macOS

AMOS malware is a growing threat to macOS users. Hackers are marketing a new malware for the macOS operating system. Named Atomic Macos Stealer or AMOS, this malicious software is designed to steal user data for $1,000 per month. It extracts passwords from the keychain, steals files on disks, cookies, as well as cards and identification information stored in the browser and tries to extract data from 50 different cryptocurrency wallets. Buyers also benefit from a complete web dashboard to brute force MetaMask.

How AMOS Malware Works

AMOS is capable of accessing iCloud keychain passwords, system information, files from the desktop and documents folder, as well as the Mac password. It is able to infiltrate applications such as Chrome and Firefox and extract autofill information, passwords, cookies, wallets and credit card information. Cryptocurrency wallets such as Electrum, Binance and Atomic are specific targets.

The malware is being propagated using an unsigned disk image file called Setup.dmg. Once executed, the file prompts the victim to enter their system password on a bogus prompt. This allows the malware to escalate privileges and carry out its malicious activities. This technique is similar to that used by other macOS malware, such as MacStealer.

How to Protect Against AMOS Malware

The increase in the deployment of macOS stealer malware by non-state actors highlights the need for users to be cautious when downloading and installing software. The cybersecurity industry recommends that users only download and install software from trustworthy sources, enable two-factor authentication, review app permissions, and refrain from opening suspicious links received via email or SMS messages.

The Solution: Keepser Cold Wallet with EviVault Technology

However, there is a solution to protect your sensitive data against AMOS malware. For only €387, you can purchase two NFC Cold Wallet Keepser from Keepser Group with EviVault technology from Freemindtronic SL. These wallets allow you to store offline and physically externalized from macOS and/or PC computers the private keys and/or seed phrases of cryptocurrency wallets as well as identifier and password pairs. Thus, it will simply be impossible to extract sensitive data from a computer that is not physically present in these computers, even for this AMOS malware.

By using EviVault NFC Cold Wallet technologies from Freemindtronic embedded in Keepser products, you can protect your sensitive data against malware attacks such as AMOS or Cryptbot. These wallets also work on macOS, providing additional protection to Mac users.

The Benefits of EviVault Technology

Thanks to EviVault technology developed by Freemindtronic, the Keepser Cold Wallet is a unique ultra-secure cold storage solution for cryptocurrency wallets, offering anonymous, offline and contactless use via NFC technology, as well as compatibility with NFC Android phones and computer systems via a browser extension.

It’s like they say: “Why pay €1,000 per month to steal sensitive data when you can pay €387 one shot for AMOS malware protection without subscription to protect against it (and other malware like Cryptbot)!” 😉

It is important to take seriously the threats posed by malware such as AMOS and to take the necessary measures to protect your sensitive data. By using advanced technologies such as EviVault NFC Cold Wallet from Freemindtronic embedded in Keepser products, you can ensure that your data is secure.

Articles, EviVault Technology, Phishing

Cryptbot malware steals data cryptocurrencies

Posted on by FMTAD
CryptBot: the malware that targets your data and crypto on Chrome
01
May
CryptBot malware By Jacques gascuel
This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Article updated on May 3, 2023
Related topic : Amos malware
 

CryptBot: A Threat to Chrome Users

Cryptbot is a malware that targets Chrome users who store or trade cryptocurrencies. It can steal your data and virtual wallets. Google says it infected 670,000 people in 2022. This article tells you how Cryptbot works, how to detect and remove it, and how to prevent future attacks.

Digital world map showing cyberattack paths with Midnight Blizzard, Microsoft, HPE logos, email symbols, and password spray illustrations.

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?
March 10, 2024
google account security flaw how to protect yourself from hackers digital artwork that conveys the concept of a security breach in online services due to persistent cookies attacks

2024 Articles Digital Security News Phishing

Google OAuth2 security flaw: How to Protect Yourself from Hackers
January 8, 2024
Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers

Articles Crypto Currency Cryptocurrency Digital Security EviPass Technology NFC HSM technology Phishing

Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers
December 16, 2023
BITB attacks Browser-In-The-Browser remove delete destroy by IRDR Ifram Redirect Detection Removal since EviCypher freeware web extension open-source from Freemindtronic in Andorra

2023 Digital Security Phishing

BITB Attacks: How to Avoid Phishing by iFrame
May 10, 2023
Snake malware: The Russian that steals sensitive information for 20 years

Articles Digital Security Phishing

Snake Malware: The Russian Spy Tool
May 10, 2023
ViperSoftX How to avoid the malware that steals your passwords

Articles Cryptocurrency Digital Security Phishing

ViperSoftX How to avoid the malware that steals your passwords
May 7, 2023
AMOS malware protection with Keepser NFC Cold Xallet

Articles Phishing

Protect Your Data from AMOS Malware
May 4, 2023
CryptBot: the malware that targets your data and crypto on Chrome

Articles EviVault Technology Phishing

Cryptbot malware steals data cryptocurrencies
May 1, 2023

Understanding Cryptbot Malware: A Comprehensive Guide to the Threats and Risks

Cryptbot malware is a serious concern for Chrome users, as it surreptitiously steals their confidential information and digital currencies by hiding in malicious extensions that are installed in the browser without their knowledge. Once installed, it can compromise sensitive information such as passwords, banking logins, private keys of cryptocurrencies and browsing history. Moreover, Cryptbot malware can add malicious code in the web pages to misappropriate cryptocurrencies from the users’ wallets or exchanges. Hence, the security threat posed by this malware is severe and requires immediate attention.

Cryptbot Malware: How it Steals Sensitive Data, Including Cryptocurrency Wallets, from Chrome Users

This type of Trojan malware was first detected in December 2019 and is known for disguising itself as authentic software such as Google Chrome or Google Earth Pro and can be downloaded from counterfeit websites. Upon download and installation, the computer gets infected with Cryptbot along with another Trojan, Vidar, both of which are created to identify and steal sensitive data of Chrome users like:

  • Username and password that are saved in Chrome browser
  • Browser cookies that may contain session or preference information
  • Cryptocurrency wallet data, like Ethereum or Bitcoin
  • Credit card information saved in the browser
  • Desktop or window screenshots

The data that is collected can often be sold to other hackers who may use it for extortion campaigns or data breaches. Moreover, this malware is capable of taking screenshots of active windows or desktop, exposing even more confidential information. Therefore, Cryptbot malware endangers your privacy and security while putting online accounts, identity, money and personal safety at risk. It may also lead to further malware infections or phishing attempts. Hence, safeguarding against Cryptbot malware is essential, and it should be removed if detected.

CryptBot Malware: How It Spreads Through Fraudulent Websites and Phishing Campaigns, and Its Command and Control Server

CryptBot mainly spreads through fraudulent websites that offer modified or pirated versions of legitimate software such as Google Chrome or Google Earth Pro. These websites encourage users to download and run malicious files, which then install CryptBot on their computer.

This malware can also be distributed through phishing campaigns, which involve sending misleading emails to users, impersonating trusted entities such as Google or Microsoft. These emails often contain links or attachments infected.

Once installed on the victim’s computer, CryptBot connects to a command and control (C&C) server, which gives it instructions on the data to collect and send. CryptBot can automatically update itself to avoid detection and stay hidden on the victim’s computer.

Removing CryptBot Malware from Chrome

If you suspect that your Chrome browser is infected with CryptBot malware, you should take immediate action to remove it. Here are some steps you can follow to detect and remove CryptBot:

  • Suspicious Extension Check: Open Chrome and click on the three dots icon on the top right corner. Go to More Tools > Extensions and look for any suspicious extensions that you do not recognize or do not remember installing. Remove them by clicking on the Remove button.
  • Anti-Malware Software Use: Download and install a reputable anti-malware software such as Malwarebytes or Norton. Run a full system scan to detect and remove CryptBot malware from your computer.
  • Chrome Settings Reset: Go to Chrome Settings > Advanced > Reset and clean up > Restore settings to their original defaults. This will reset your browser settings to their default state and remove any unwanted changes made by CryptBot.
  • Password Change: If CryptBot has stolen your passwords, you should change them immediately for all affected accounts.

Detecting CryptBot Malware on Your Computer

It is not always easy to detect the presence of CryptBot on your computer, as it is a discreet and silent malware. However, there are some signs that can alert you:

  • Your computer becomes slower or more unstable
  • Your Chrome browser displays unwanted ads or redirects you to suspicious websites
  • You receive security alerts or password reset requests from your online accounts
  • You notice unusual or unauthorized transactions on your bank accounts or cryptocurrency wallets

If you notice any of these symptoms, it is possible that you are infected by CryptBot. In this case, it is recommended to scan your computer with a reliable and up-to-date antivirus, such as Bitdefender or Malwarebytes. If the scan detects the presence of CryptBot or other threats, follow the instructions to remove them.

Tips for Avoiding CryptBot Malware on Chrome

Best Practices for Computer Security

To avoid being infected by CryptBot malware on Chrome, it is recommended to follow these tips. For this, you need to adopt some good practices of computer security:

  • Only download software from official and verified sources
  • Update your applications and operating system regularly
  • Do not open attachments or links in emails you receive, especially if they come from unknown or unsolicited senders
  • Use a firewall and security software, such as an antivirus or anti-malware. Update them regularly and run full scans of your system
  • Follow email best practices, such as not responding to messages that ask for personal or financial information, or that offer deals that are too good to be true
  • Deploy email security gateways, which filter incoming messages and block those that contain spam, phishing or malware
  • Avoid links and ads that appear on websites you visit, especially if they promise gifts, discounts or free downloads
  • Implement access control, which limits access to sensitive resources and data of your company to authorized people only
  • To enhance the security of your online accounts, enable two-factor or multi-factor authentication which adds an extra layer of protection by requiring a second factor of verification such as a code sent by SMS or a fingerprint..
  • Use the principle of least privilege, which limits the rights and permissions of users to what is strictly necessary to accomplish their tasks
  • Use strong and unique passwords: Use strong and unique passwords for each account, and avoid using the same password for multiple accounts.

Enhancing Protection Against CryptBot Malware on Chrome with EviVault’s End-to-End NFC Cold Wallet Technology

Adopting the best practices for computer security, such as downloading software only from official sources, updating applications, avoiding suspicious links and emails, and using a firewall and anti-malware, can help you avoid CryptBot malware and protect your sensitive data and cryptocurrency. In addition to these tips, you can further enhance your protection by using Freemindtronic’s EviVault technology, which provides end-to-end NFC Cold Wallet protection for your crypto assets. This patented solution adds an extra layer of security against threats like CryptBot malware on Chrome.

Google’s Legal Action Against CryptBot Malware and Its Importance in Protecting Chrome Users

Google has successfully obtained a court order to remove current and future domains linked to the distribution of CryptBot, a malware that poses a threat to Chrome users. Google believes that legal action against such security threats, which abuse legitimate software like Chrome, can be effective. The company used a similar strategy against the alleged operators of the Russian botnet Glupteba in 2021, which resulted in a 78% reduction in Glupteba infections.

However, this court order does not mean that the danger of CryptBot is completely eliminated. The malware is constantly evolving and can still infect systems if users are not careful. It is strongly recommended to follow the advice here, including updating applications and operating systems, downloading software from reliable sources, and regularly checking for the presence of CryptBot.

Click here for download US Court Decision in Google LLC vs CryptBot Case

If you want to review the court decision issued by Judge Valerie Figueredo of the Southern District Court of New York in response to Google LLC’s (“Google”) lawsuit against CryptBot infrastructure and distribution networks, which aimed to reduce the number of victims whose sensitive information, such as usernames, passwords, and cryptocurrencies, the malicious software steals, click on the following link to download the document.

Through this legal action, Google sought to reduce the number of victims who fall prey to CryptBot’s theft of sensitive information. This court decision is a crucial step in the fight against sophisticated and difficult-to-detect malware attacks such as CryptBot.

In the next section, we will delve deeper into CryptBot and its inner workings

Malware Targeting Chrome Users: Understanding the Inner Workings of CryptBot

CryptBot is a type of malware that targets Chrome users by stealing their personal data, including cryptocurrency. But how does this malware infiltrate Chrome and avoid detection by antivirus software, and how does it communicate with its command server? Below is a brief technical explanation of CryptBot for those interested in the details:

  • CryptBot is primarily spread through phishing campaigns that offer a fake Chrome update or other legitimate software that contains a hidden virus. Once installed, the virus creates four files in the %TEMP% folder and activates a disguised BAT file that injects CryptBot into Chrome’s legitimate process. This allows the malware to access and encrypt the user’s data using the AES algorithm before sending it to its command server via an HTTP POST request.
  • In addition to stealing data, CryptBot can receive instructions from the command server via a JSON and AES-based communication protocol. These instructions can include downloading additional malware, updating the configuration settings, or deleting itself as needed.
  • Although CryptBot is a dangerous form of malware, understanding how it works can help users protect themselves from future attacks.

In conclusion, the threat CryptBot poses to the security of your data and cryptocurrencies on Chrome is real, but there are steps you can take to protect yourself. By following the advice we have shared and using Freemindtronic’s EviVault technology embedded in cold wallets such as Keepser, you can strengthen the security of your computer and protect your cryptographic assets from hackers. Don’t forget to share this article with your friends and sign up for our newsletter to receive the latest news on computer security and cryptocurrencies.

Articles, Digital Security, Phishing

Kevin Mitnick’s Password Hacking with Hashtopolis

Posted on by FMTAD
Kevin Mitnick and his Hashtopolis: The Ultimate Password Cracking Tool
27
Apr


password hacking with Hashtopolis by Jacques gascuel
This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Related topic : ******

How Kevin Mitnick hacked passwords with Hashtopolis

Learn about password hacking using Hashtopolis, a powerful tool that can crack any hash in minutes using multiple machines equipped with GPUs. Famous hacker Kevin Mitnick used it to demonstrate the tool’s capabilities. Discover the advantages and disadvantages of using such a tool, as well as ethical and legal implications of password hacking. Get tips on how to protect your online accounts with strong passwords. Keep reading to find out more!

White background image illustrating the ePrivacy Regulation with a secure lock symbol, digital icons for encryption and consent, and the European Union flag subtly integrated.

2024 Cyberculture Legal information

ePrivacy Regulation: Transforming Messaging Privacy in 2025
November 26, 2024
Laptop and smartphone displaying 2FA MFA security features with OATH initiative, key management solutions for 2024.

2024 Articles Technical News

Best 2FA MFA Solutions for 2024: Focus on TOTP & HOTP
October 8, 2024
Flags of France and the European Union on a white background representing ANSSI cryptography authorization

2024 Articles Cyberculture Legal information

ANSSI Cryptography Authorization: Complete Declaration Guide
October 7, 2024
laptop displaying Microsoft Uninstallable Recall feature, highlighting TPM-secured data and uninstall option, with a user's hand interacting, on a white background.

2024 Articles Technical News

New Microsoft Uninstallable Recall: Enhanced Security at Its Core
October 3, 2024
Ultra-realistic image illustrating Andorra's shared EAN code with Spain, featuring a barcode starting with 84 and a map connecting Andorra and Spain.

2024 Articles Cyberculture

EAN Code Andorra: Why It Shares Spain’s 84 Code
September 9, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Balance scale showing the balance between privacy and law enforcement in EU regulation of end-to-end encrypted messaging.

2024 Articles Cyberculture legal Legal information News

End-to-End Messaging Encryption Regulation – A European Issue
June 10, 2024
Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2024 Articles Cardokey EviSwap NFC NDEF Technology GreenTech Technical News

NFC vCard Cardokey: Revolutionizing Digital Networking
March 25, 2024

Password hacking tool: how it works and how to protect yourself

Password hacking is a practice that consists of finding the secret code that protects access to an account or a file. There are specialized tools to perform this operation, such as the one used by Mitnick Security Consulting. In this article, we will present the features of this tool, its advantages and disadvantages, as well as the ways to protect yourself from password hacking.

Introduction

Password hacking is a practice that consists of finding the secret code that protects access to an account or a file. It can be done for various purposes, such as testing the security of a system, recovering a forgotten password, or stealing personal or professional data.

There are specialized tools to perform password hacking, such as the one used by Mitnick Security Consulting. This company is led by Kevin Mitnick, a famous hacker who was arrested in 1995 for hacking dozens of computer systems, including those of the Pentagon, NASA and FBI. Today he has become a security expert and consultant who helps companies protect themselves from cyberattacks.

The main purpose of this article is to present the features, advantages and disadvantages of the password hacking tool used by Mitnick Security Consulting, as well as the ways to protect yourself from password hacking. We will first explain how the tool uses a large number of GPUs to speed up the hacking process. Then we will discuss the benefits and drawbacks of using such a tool in terms of energy consumption and privacy concerns. Next we will address the ethical and legal implications of password hacking. After that we will summarize some user reactions to password hacking. Finally we will provide some tips on how to protect your online accounts with strong passwords.

Features of the password hacking tool

The password hacking tool used by Mitnick Security Consulting uses a large number of GPUs to speed up the hacking process. According to the information shared by Mitnick, the tool uses 24 GPU 4090s and 6 GPU 2080s, all clustered and running with Hashtopolis. This allows the tool to hack passwords at an impressive speed, reaching 6.2 trillion per second for NTLM (New Technology LAN Manager).

Hashtopolis is an open source software that allows to distribute the password hacking work across multiple machines equipped with GPUs. It uses a web interface to manage the agents, tasks and passwords found. It supports several types of hashes, such as NTLM, MD5, SHA1, SHA256, SHA512, WPA/WPA2 and even BitLocker.

A hash is a mathematical function that transforms a password into a random string of characters. For example, the password “password” hashed with MD5 would be “5f4dcc3b5aa765d61d8327deb882cf99”. Hashing is used to store passwords securely without revealing them in plain text.

To crack a password, one has to find the original password that corresponds to a given hash. This can be done by using different methods, such as bruteforce, dictionary or mask.

Bruteforce is a method that tries all possible combinations of characters until finding the right one. For example, if the password is four digits long, it would try 0000, 0001, 0002… until 9999.

Dictionary is a method that tries words from a predefined list or a common language dictionary. For example, if the password is a word in English, it would try apple, banana, carrot… until finding the right one.

Mask is a method that tries combinations based on a known pattern or structure. For example, if the password is composed of two words separated by an underscore (_), it would try word_word, name_name… until finding the right one.

Advantages and disadvantages of the password hacking tool

The use of such a tool has advantages and disadvantages. On one hand, it allows the company to quickly test the security of the passwords used by its clients and detect vulnerabilities. This can help prevent unauthorized access and data breaches. It can also help users improve their password habits and choose stronger passwords.

On the other hand, it consumes a considerable amount of energy and generates heat. This can have a negative impact on the environment and increase the carbon footprint of the company. It can also raise privacy concerns, as the tool can be used for malicious purposes, such as hacking online accounts or sensitive data. This can result in identity theft, industrial espionage or sabotage.

It is important to note that even with such a powerful tool, there are limits to what can be achieved in terms of password hacking. Long and complex passwords, stored using secure hashing algorithms such as bcrypt or PBKDF2, can be very difficult to hack even with powerful tools. These algorithms use a large number of iterations to significantly slow down the hashing process, making brute force hacking much more difficult.

In addition to the number of iterations, these algorithms have other features that make them more resistant to GPU or specialized hardware attacks. Bcrypt uses an encryption function based on Blowfish, which is designed to be costly in memory and random access. This makes it difficult to parallelize bcrypt on multiple GPUs. PBKDF2 uses an internal hash function, such as SHA-256 or SHA-512, which can be optimized for GPUs, but which also requires a lot of calculations. This makes the cost of the attack proportional to the number of iterations. According to a 2015 study, it would take about 4 days to crack an 8-character alphanumeric password with bcrypt and 10 iterations, compared to about 5 hours with PBKDF2 and 10,000 iterations.

Ethical and legal implications of password hacking

The use of such a powerful password hacking tool raises ethical and legal questions. On one hand, it can serve to strengthen the security of computer systems by demonstrating their vulnerability and encouraging users to choose stronger passwords. This can be seen as a form of ethical hacking or penetration testing, which aims to improve the security of a system by finding and reporting its weaknesses.

On the other hand, it can be used for malicious purposes, such as hacking online accounts or sensitive data. This can be seen as a form of illegal hacking or cybercrime, which aims to harm or exploit a system by exploiting its weaknesses.

Therefore, some ethical and legal rules must be respected when using a password hacking tool. For example:

  • The tool should only be used with the consent and authorization of the owner or administrator of the system.
  • The tool should only be used for legitimate purposes, such as testing the security of passwords or recovering a forgotten password.
  • The tool should not be used to access or disclose confidential or personal information without permission.
  • The tool should not be used to cause damage or disruption to the system or its users.

To give you an idea of how long it would take to crack a password using high-performance GPUs, a machine equipped with eight RTX 4090 GPUs, the most powerful on the market today and very popular among gamers and creators, could go through all possible combinations of an 8-character password in just 48 minutes using brute force methods. For comparison, it would take about 3 hours and 20 minutes with eight RTX 3090 Ti GPUs.

User reactions to password hacking

Kevin Mitnick’s post sparked many positive comments from computer security experts, who praised the power and speed of his password hacking tool. Some even asked for technical details on how Hashtopolis works and what types of hashes it can crack.

For example, one comment said: “This is amazing! I would love to see how Hashtopolis works and what kind of hashes it can crack. Can you share some screenshots or videos of the tool in action?”

Another comment said: “Wow, this is impressive! I wonder how long it would take to crack a password with bcrypt or PBKDF2 using this tool. Do you have any benchmarks or comparisons?”

However, some negative comments from Internet users also expressed concerns about the environmental impact and privacy issues of password hacking.

For example, one comment said: “This is terrible! Do you realize how much electricity and heat this tool consumes? You are contributing to global warming and climate change with your irresponsible hacking. You should plant some trees or use renewable energy to offset your carbon footprint.”

Another comment said: “This is scary! How can we trust you with our passwords and data? You could hack into our accounts or steal our information without our consent. You are violating our privacy and security with your unethical hacking. You should respect the law and the rights of others.”

In conclusion

The new password hacking tool used by Mitnick Security Consulting is impressive in terms of power and speed. It can crack passwords at an astonishing rate, reaching 6.2 trillion per second for NTML. It uses Hashtopolis, an open source software that allows to distribute the password hacking work across multiple machines equipped with GPUs. It supports several types of hashes and methods to crack them.

However, the use of such a tool also raises concerns about energy and privacy. It consumes a considerable amount of electricity and generates heat, which can have a negative impact on the environment. It can also be used for malicious purposes, such as hacking online accounts or sensitive data, which can result in identity theft, industrial espionage or sabotage.

As Internet users, it is important to be aware of the risks associated with weak passwords and use secure methods to protect our online accounts. Some tips to do so are:

  • Use long and complex passwords that contain letters, numbers and symbols.
  • Use a password manager to store and generate secure passwords.
  • Use a random password generator or a secret phrase that is easy to remember but hard to guess.
  • Use multi-factor authentication that requires a code sent by SMS or email to access an account.

Password hacking is a practice that can have positive or negative consequences depending on how it is used. It is therefore necessary to be vigilant and adopt good practices to protect ourselves from hackers like Kevin Mitnick.

I hope this article has helped you understand how password hacking works and how to protect yourself from it. If you want to learn more about password hacking, you can check out these sources:

  • Cracking Passwords at 7.25 TRILLION Hashes per second?
  • How Secure Is My Password?
  • How To Create A Strong Password

Sources :

(1) hash – What is the specific reason to prefer bcrypt or PBKDF2 over …. https://security.stackexchange.com/questions/133239/what-is-the-specific-reason-to-prefer-bcrypt-or-pbkdf2-over-sha256-crypt-in-pass.

(2) Password Storage – OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html.

(3) Do any security experts recommend bcrypt for password storage?. https://security.stackexchange.com/questions/4781/do-any-security-experts-recommend-bcrypt-for-password-storage.

(4) Password Hashing: PBKDF2 (using sha512 x 1000) vs Bcrypt. https://stackoverflow.com/questions/4433216/password-hashing-pbkdf2-using-sha512-x-1000-vs-bcrypt.

2021, Cyberculture, Digital Security, Phishing

Phishing Cyber victims caught between the hammer and the anvil

Posted on by FMTAD
Phishing: Cyber victims caught between the hammer and the anvil
17
May

Phishing Cyber Victims by Jacques Gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.

Phishing: how cyber-victims are caught between scam and blackmail

Have you ever received an email or a message that looked like an official communication from a trusted organization, such as your bank, your phone operator or your social network? Did it ask you to confirm your personal or financial information, to pay a fine or to update your software? If so, you may have been targeted by a phishing attack.

Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon: Protecting Government Communications from Cyber Threats
November 14, 2024
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know
October 15, 2024
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat
September 3, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat
August 20, 2024
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks
August 12, 2024
Hacker accessing a laptop displaying Google Workspace with a security breach notification.

2024 Digital Security

Google Workspace Vulnerability Exposes User Accounts to Hackers
August 1, 2024
Multiple computer screens displaying data breach alerts in a dark room, with the Pentagon in the background.

2024 Digital Security

Leidos Holdings Data Breach: A Significant Threat to National Security
July 25, 2024

Discover our other articles on digital security

Phishing is a fraudulent technique that aims to deceive internet users and to steal their information, money or identity. Phishing is a major threat for the security of individuals and organizations, as it can lead to financial losses, identity theft, extortion or malware infections. In this article, I will explain to you what phishing is, how to protect yourself from it, what to do if you fall victim to it and what are the current trends of this phenomenon.

What is phishing?

Phishing is a form of social engineering that exploits the human factor rather than the technical factor. In other words, phishing relies on manipulating people’s emotions, such as fear, curiosity or greed, rather than hacking their devices or systems.

Phishing usually involves sending emails or messages that mimic the appearance and content of official communications from legitimate organizations. These messages often contain a link or an attachment that directs the recipients to a fake website or a malicious file. The goal of phishing is to trick the recipients into revealing their personal, financial or confidential information, such as their passwords, their bank account numbers or their credit card details. Alternatively, phishing can also persuade the recipients to make fraudulent payments or to download malware on their devices.

Phishing can target anyone who uses the internet, whether they are individuals or organizations. However, some groups are more vulnerable than others, such as seniors, students or employees. According to a report by Verizon (https://enterprise.verizon.com/resources/reports/dbir/), phishing was involved in 36% of data breaches in 2020.

How to protect yourself from phishing?

To protect yourself from phishing, you need to be able to recognize the signs that can indicate that a message is fraudulent. Here are some examples of signs to watch out for:

  • Spelling or grammar mistakes in the message.
  • Suspicious addresses or links that do not match the supposed organization behind the message.
  • Urgent or unusual requests, such as confirming your bank details, paying a fine or updating your software.
  • Attachments or links that invite you to download or open a file.

If you receive a suspicious message, do not click on the links, do not open the attachments and do not reply to the message. Instead, check the source of the message by looking at the sender’s address, hovering over the links with your mouse to see their real destination or contacting directly the organization supposed to be behind the message by another means (phone, official website, etc.).

You can also use some tools and practices to enhance your security online, such as:

  • Installing an antivirus software and keeping it updated.
  • Using strong and unique passwords for each site and service you use.
  • Enabling two-factor authentication whenever possible.
  • Avoiding public Wi-Fi networks or using a VPN (Virtual Private Network) when accessing sensitive sites.
  • Educating yourself and others about cyber threats and how to prevent them.

What to do if you are a victim of phishing?

If you have clicked on a link, opened an attachment or disclosed personal or financial information following a fraudulent message, you may be a victim of phishing. In this case, it is important to act quickly to limit the consequences. Here are some tips to follow:

  • Change your passwords on all sites and services you use, especially those related to your bank accounts, your social networks or your email accounts.
  • Contact your bank or your phone operator to report the incident and block your cards or lines if necessary.
  • File a complaint with the competent authorities, such as the police, the FTC (Federal Trade Commission) or the IC3 (Internet Crime Complaint Center).
  • Report the fraudulent message to the concerned organizations, such as https://www.antiphishing.org/ or https://www.us-cert.gov/report-phishing. These sites also offer you information and services to help you cope with the consequences of phishing.

What is the new bill on justice and why is it raising concerns about privacy?

The bill on justice is a legislative project. It aims to modernize and simplify justice in France. It covers civil, criminal, administrative and digital justice. It also strengthens the investigation and prosecution of serious offenses, such as terrorism and organized crime.

One measure authorizes remote activation of phones by the police for some investigations. Article 3 “An unfailing commitment to better prevent radicalization and fight against terrorism” of the bill includes this measure. It modifies article 706-102-1 of the code of criminal procedure. This article defines how to activate remotely any electronic device that can emit, transmit, receive or store data.

This measure raises privacy concerns because it lets the police access personal or professional data in phones without the owners’ or possessors’ consent or knowledge. It also lets the police locate, record or capture sounds and images from phones without notification or justification. This measure may violate fundamental rights and freedoms, such as privacy, confidentiality, dignity, presumption of innocence and right to a fair trial.

What is remote activation of phones and how does it work?

Remote activation of phones by the police is an intelligence technique that allows law enforcement agencies to access data or record sounds and images from phones without the consent or knowledge of the phone users. This technique can be used for criminal investigations or national security purposes.

To remotely activate phones, law enforcement agencies need three factors: compatibility, connectivity, and security of the phones. They need to be compatible with the software or hardware that enables remote activation. They need to be connected to a network or a device that allows remote access. They need to have security flaws or vulnerabilities that can be exploited or bypassed.

Law enforcement agencies can remotely activate phones by three methods: exploiting vulnerabilities, installing malware, or using spyware on phones. Exploiting vulnerabilities means taking advantage of security flaws or weaknesses in the phone’s operating system, applications, or protocols. Installing malware means putting malicious software on the phone that can perform unauthorized actions or functions. Using spyware means employing software or hardware that can monitor or control the phone’s activity or data.

By remotely activating phones, law enforcement agencies can access data such as contacts, messages, photos, videos, location, browsing history, or passwords. They can also record sounds and images such as conversations, ambient noises, or camera shots. They can do this in real time or later by retrieving the data from the phone’s memory or storage.

What is the French bill on remote activation of phones by the police and what are its implications?

The French bill on remote activation of phones by the police is a legislative text that was promulgated on 25 May 2021. It is part of the justice orientation and programming bill for 2023-2027, which aims to modernize the justice system and reinforce its efficiency and independence.

The bill introduces a new article in the code of criminal procedure, which allows the judge of liberties and detention (at the request of the prosecutor) or the examining magistrate to order the remote activation of an electronic device without the knowledge or consent of its owner or possessor for the sole purpose of locating it in real time. This measure can be applied for crimes or misdemeanors punishable by at least five years’ imprisonment, a fairly broad criterion.

The bill also allows the judge of liberties and detention (at the request of the prosecutor) or the examining magistrate to order the remote activation of an electronic device without the knowledge or consent of its owner or possessor for the purpose of recording sounds and images from it. This measure can be applied only for crimes relating to organized crime and terrorism.

These measures cannot concern parliamentarians, journalists, lawyers, magistrates and doctors, nor the defendants when they are in the judge’s office or with their lawyer.

The bill also specifies that the remote activation of an electronic device must be done in a way that does not alter its functioning or data, and that the data collected must be destroyed within six months after their use.

The bill aims to provide law enforcement agencies with more tools and information to prevent, investigate and prosecute crimes, especially in cases where phones are encrypted, hidden or destroyed. It also aims to harmonize the French legislation with other countries that have used or considered this technique, such as the United States, Germany, Italy, Israel, Canada, China, France, and the United Kingdom.

However, the bill also raises ethical and social challenges, as it involves a trade-off between security and privacy, as well as between effectiveness and legitimacy. It may undermine the right to respect for private life and the right to a fair trial, which are guaranteed by the European Convention on Human Rights and the French Constitution. It may also expose law enforcement agencies to legal or technical challenges or dangers, such as encryption technologies that can prevent or hinder remote activation. It may also create distrust or resistance among phone users or providers, who may use encryption technologies or legal remedies to protect their data or communications.

The bill has been criticized by several actors, such as lawyers, human rights defenders, digital rights activists, journalists and academics. They have denounced its lack of proportionality, necessity and oversight. They have also questioned its effectiveness and legitimacy. They have called for its withdrawal or amendment.

The bill is still subject to constitutional review by the Constitutional Council before its final promulgation.

How did the Senate vote on the bill and where to find the official sources?

The Senate adopted this measure on October 20, 2021, with some amendments. The Senate voted in favor of this measure by 214 votes against 121. The Senate also added some safeguards to this measure, such as limiting its duration to four months renewable once and requiring prior authorization from an independent judge.

The National Assembly still has to examine the bill before adopting it definitively. The National Assembly may approve, reject or modify this measure. The final text may differ from the one that the Senate voted.

The examination of the bill by the National Assembly will start on December 6, 2021. You can follow the progress of the bill on the website of the National Assembly. You can also find the official text of the bill and the report of the Senate on their respective websites. You can also consult the website of the Ministry of Justice for more information on the bill and its objectives.

What are the benefits and risks of remote activation of phones?

This technique can affect citizens’ and suspects’ behavior in different ways.

On one hand, it can deter people from serious offenses. It exposes them to a higher risk of detection and identification. It reduces their incentives for criminal activities.

On the other hand, it can also make people more cautious or paranoid. It increases their uncertainty and fear. It leads them to avoid electronic devices, encrypt their communications, or use countermeasures such as jamming devices.

This technique can also impact public safety and security positively and negatively.

On one hand, it can improve the efficiency and effectiveness of law enforcement agencies. It provides them with more information and evidence. It helps them prevent, investigate and prosecute crimes.

On the other hand, it can also pose risks for human rights and civil liberties. It allows intrusive and covert surveillance. It violates privacy, confidentiality and dignity. It can also be subject to abuse, misuse or error by law enforcement agents or hackers.

Finally, it can create a feeling of insecurity and mistrust towards institutions, which can access personal or professional data in phones. It can also harm respect for presumption of innocence by placing permanent suspicion on people targeted by this technique. It can also infringe on protection of journalistic sources or right to information by discouraging whistleblowers or witnesses from speaking freely. It can finally encourage people concerned to adopt avoidance or circumvention strategies, such as changing phones regularly, using encrypted applications or switching to airplane mode.

These strategies can reduce the actual effectiveness of this technique for preventing terrorism and organized crime.

What are the arguments in favor of remote activation of phones?

Some people support this technique because they think it has several advantages for law enforcement and public security.

How can remote activation of phones violate privacy and data protection?

One of the main arguments against this technique is that it can violate privacy and data protection for individuals and groups. Privacy and data protection are fundamental rights recognized by international standards and laws. They ensure human dignity and autonomy.

Remote activation of phones violates privacy and data protection by letting law enforcement agencies access personal or professional data without the owners’ or possessors’ consent or knowledge. It also lets law enforcement agencies access sensitive or confidential data without notification or justification. It also lets law enforcement agencies access excessive or irrelevant data without limitation or proportionality.

For example, remote activation of phones could let the police access medical records, financial transactions, political opinions, religious beliefs, sexual preferences, or other intimate information on a device or a communication. It could also let the police access information that is not related to the investigation or that is out of scope on a device or a communication. It could also let the police access information that is not necessary or appropriate for the investigation or that is disproportionate to the seriousness of the offense on a device or a communication.

How can remote activation of phones improve access to justice and evidence?

Another argument in favor of this technique is that it can improve access to justice and evidence for law enforcement agencies and victims of crimes. Justice and evidence ensure the rule of law and the protection of rights.

Remote activation of phones improves access to justice and evidence by letting law enforcement agencies obtain information that is otherwise inaccessible or difficult to obtain. It also lets law enforcement agencies obtain information that is more reliable and accurate than other sources. It also lets law enforcement agencies obtain information that is timelier and more relevant than other sources.

For example, remote activation of phones could help the police access data that is encrypted or password-protected on a device or a communication. It could also help the police access data that is authentic and verifiable on a device or a communication. It could also help the police access data that is up-to-date and pertinent on a device or a communication.

What are the arguments against remote activation of phones?

Some people oppose this technique because they think it has several disadvantages for human rights and civil liberties.

How can remote activation of phones violate privacy and data protection?

One of the main arguments against this technique is that it can violate privacy and data protection for individuals and groups. Privacy and data protection are fundamental rights recognized by international standards and laws. They ensure human dignity and autonomy.

Remote activation of phones violates privacy and data protection by letting law enforcement agencies access personal or professional data without the owners’ or possessors’ consent or knowledge. It also lets law enforcement agencies access sensitive or confidential data without notification or justification. It also lets law enforcement agencies access excessive or irrelevant data without limitation or proportionality.

For example, remote activation of phones could let the police access medical records, financial transactions, political opinions, religious beliefs, sexual preferences, or other intimate information on a device or a communication. It could also let the police access information that is not related to the investigation or that is out of scope on a device or a communication. It could also let the police access information that is not necessary or appropriate for the investigation or that is disproportionate to the seriousness of the offense on a device or a communication.

How can remote activation of phones undermine the presumption of innocence and the right to a fair trial?

Another argument against this technique is that it can undermine the presumption of innocence and the right to a fair trial for individuals and groups. The presumption of innocence and the right to a fair trial are fundamental rights recognized by international standards and laws. They ensure justice and accountability.

Remote activation of phones undermines the presumption of innocence and the right to a fair trial by letting law enforcement agencies access data that they can use against individuals or groups without any legal basis or due process. It also lets law enforcement agencies access data that they can manipulate or falsify by law enforcement agents or hackers. It also lets law enforcement agencies access data that individuals or groups can challenge or contest.

For example, remote activation of phones could let the police access data that they can incriminate individuals or groups without any warrant or authorization from a judge. It could also let the police access data that they can alter or corrupt by law enforcement agents or hackers. It could also let the police access data that individuals or groups can dispute or refute.

How can remote activation of phones create a risk of abuse and misuse by the authorities?

Another argument against this technique is that it can create a risk of abuse and misuse by the authorities for individuals and groups. Abuse and misuse are illegal or unethical actions that violate rights and obligations. They damage trust and legitimacy.

Remote activation of phones creates a risk of abuse and misuse by the authorities by letting law enforcement agencies access data that they can use for purposes other than those authorized or intended. It also lets law enforcement agencies access data that they can share or disclose to third parties without any oversight or control. It also lets law enforcement agencies access data that they can retain or store for longer than necessary or permitted.

For example, remote activation of phones could let the police access data that they can use for political, personal, commercial, or other interests on a device or a communication. It could also let the police access data that they can transfer or leak to other agencies, organizations, media, or individuals on a device or a communication. It could also let the police access data that they can keep or archive for indefinite periods on a device or a communication.

What are the alternatives and safeguards for remote activation of phones?

Some people suggest that there are alternatives and safeguards for remote activation of phones that can balance security and privacy.

What are the existing legal tools to access phone data with judicial authorization?

One of the alternatives for remote activation of phones is to use existing legal tools to access phone data with judicial authorization. Judicial authorization is a legal requirement that ensures respect for rights and obligations. An independent and impartial judge grants it after evaluating the necessity and proportionality of the request.

Existing legal tools to access phone data with judicial authorization include search warrants, wiretaps, geolocation orders, data requisitions, and international cooperation agreements. These tools let law enforcement agencies obtain information from phones in a lawful and transparent manner. They also provide legal protection and recourse for individuals and groups.

For example, search warrants let law enforcement agencies physically seize phones and extract data from them with judicial authorization. Wiretaps let law enforcement agencies intercept calls and messages from phones with judicial authorization. Geolocation orders let law enforcement agencies track the location of phones with judicial authorization. Data requisitions let law enforcement agencies request data from phone operators or service providers with judicial authorization. International cooperation agreements let law enforcement agencies exchange data with foreign authorities with judicial authorization.

What are the principles and conditions for remote activation of phones according to the bill?

One of the safeguards for remote activation of phones is to follow the principles and conditions for remote activation of phones according to the bill. The bill on justice sets some rules and limits for this technique to prevent abuse and misuse.

The principles and conditions for remote activation of phones according to the bill include:

  • The technique can only be used for terrorism and organized crime investigations.
  • An independent judge who authorizes it must supervise the technique. The technique can only last for four months renewable once.
  • The technique must respect necessity, proportionality, subsidiarity, and legality.
  • Parliament and independent authorities must oversee and control the technique.
  • Experts and stakeholders must evaluate and review the technique.

These principles and conditions aim to ensure a reasonable and accountable use of this technique. They also aim to protect the rights and interests of individuals and groups.

What are the possible ways to limit or challenge remote activation of phones?

Another safeguard for remote activation of phones is to use possible ways to limit or challenge remote activation of phones by individuals or groups. These ways can help protect rights and interests, as well as ensure accountability and transparency.

Some of the possible ways to limit or challenge remote activation of phones are:

  • Using encryption technologies:

    Encryption technologies can make data on phones unreadable or inaccessible to law enforcement agencies, even if they remotely activate them. Encryption technologies can also protect communications from law enforcement agencies’ interception or recording. For example, using end-to-end encryption apps, such as Signal or WhatsApp, can prevent law enforcement agencies from accessing messages or calls on phones.

  • Using security features:

    Security features can prevent law enforcement agencies from installing or activating software or applications on phones that enable remote activation. Security features can also detect or remove software or applications that enable remote activation. For example, using antivirus software, firewalls, passwords, biometrics, or VPNs can prevent law enforcement agencies from accessing phones.

  • Using legal remedies:

    Legal remedies can let individuals or groups contest or oppose remote activation of phones by law enforcement agencies. Legal remedies can also let individuals or groups seek compensation or redress for damages caused by remote activation of phones. For example, using judicial review, administrative appeals, complaints, lawsuits, or human rights mechanisms can challenge law enforcement agencies’ actions or decisions regarding remote activation of phones.

How does this technique compare with other countries?

Law enforcement agencies in other countries, such as the United States, Germany, Italy, Israel, Canada, China, France, and the United Kingdom, have used or considered remote activation of phones by the police. This technique is not new or unique. However, the legal framework, the technical methods, and the ethical and social implications of this technique vary from country to country..

How does remote activation of phones by the police work in different countries?

Remote activation of phones by the police is an intelligence technique that varies from country to country. It depends on the legal framework, the technical methods and the ethical issues of each country. Here are some examples of how it works in different countries.

  • In the United States, this technique is known as “roving bugs” or “mobile device tracking”. The Foreign Intelligence Surveillance Act (FISA) authorizes it for national security purposes and Title III of the Omnibus Crime Control and Safe Streets Act for criminal investigations. It requires a court order based on probable cause and limited in scope and duration. It can locate or record sounds and images from phones. It can be done by installing malware or exploiting vulnerabilities on phones.
  • In Germany, this technique is known as “Quellen-TKÜ” or “source telecommunications surveillance”. The Code of Criminal Procedure and the Telecommunications Act regulate it for criminal investigations and the Federal Intelligence Service Act for national security purposes. It requires a court order based on reasonable suspicion and proportionality. It can intercept communications from phones. To do so, it installs software or uses spyware on phones.
  • In Italy, this technique is known as “Trojan horse” or “spyware”. The Code of Criminal Procedure and the Data Protection Code regulate it for criminal investigations. It requires a court order based on serious indications of guilt and necessity. It can access data or record sounds and images from phones. To do so, it installs software or uses spyware on phones.
  • In Israel, this technique is known as “IMSI catchers” or “stingrays”. The Wiretapping Law and the Privacy Protection Law regulate it for criminal investigations and the Security Service Law for national security purposes. It requires a court order based on reasonable grounds and proportionality. It can locate or intercept communications from phones. To do so, it uses devices that mimic cell towers and trick phones into connecting to them.
  • In Canada, this technique is known as “cell site simulators” or “IMSI catchers”. The Criminal Code and the Charter of Rights and Freedoms regulate it for criminal investigations. It requires a court order based on reasonable grounds and proportionality. It can locate or intercept communications from phones. To do so, it uses devices that mimic cell towers and trick phones into connecting to them.
  • In China, this technique is known as “network interception” or “remote control”. The Criminal Procedure Law and the Cybersecurity Law regulate it for criminal investigations and national security purposes. It does not require a court order but only an approval from a higher authority. It can access data or record sounds and images from phones. To do so, it installs software or uses spyware on phones.
  • In France, real-time geolocation is regulated by the Criminal Procedure Code and the Intelligence Law for criminal and national security investigations. Article 706-102-1 of the Criminal Procedure Code allows police officers and agents to use a technical device to access, record, store and transmit computer data without the consent of the persons concerned. This requires a court order based on serious reasons and proportionality. Article 230-32 of the Criminal Procedure Code states that “Any technical means for real-time location, throughout the national territory, of a person, without his consent, a vehicle or any other object, without the consent of its owner or possessor, may be used if this operation is required by necessity: “. This also requires a court order based on serious reasons and proportionality.
  • In the United Kingdom, this technique is known as “equipment interference” or “hacking”. The Investigatory Powers Act regulates it for criminal investigations and national security purposes. It requires a warrant based on necessity and proportionality. It can access data or record sounds and images from phones. To do so, it installs software or uses spyware on phones.

How does remote activation of phones by the police raise ethical and social challenges?

Remote activation of phones by the police raises ethical and social challenges in different contexts and situations because it involves a trade-off between security and privacy, as well as between effectiveness and legitimacy.

Security versus privacy

On one hand, remote activation of phones by the police can enhance security by providing law enforcement agencies with more information and evidence to prevent, investigate, and prosecute crimes. It can also deter criminals from using phones to plan or commit crimes.

On the other hand, remote activation of phones by the police can undermine privacy by letting law enforcement agencies access personal or professional data without consent or knowledge. It can also violate human rights and civil liberties by letting law enforcement agencies monitor or record sounds and images without notification or justification.

Effectiveness versus legitimacy

On one hand, remote activation of phones by the police can be effective by increasing the chances of finding relevant information or evidence on phones that may be encrypted, hidden, or destroyed. It can also be efficient by reducing the costs and risks of physical surveillance or interception.

On the other hand, remote activation of phones by the police can be illegitimate by violating the legal framework, the technical methods, or the oversight and control mechanisms that regulate this technique in each country. It can also be counterproductive by creating distrust or resistance among phone users or providers, who may use encryption technologies or legal remedies to protect their data or communications.

The ethical and social challenges of remote activation of phones by the police depend on the legal framework, the technical methods, and the oversight and control mechanisms that regulate this technique in each country. They also depend on the cultural and political values, the public opinion, and the media coverage that shape the perception and acceptance of this technique in each country.

Some of the ethical and social challenges of remote activation of phones by the police are how to :

  • balance security and privacy in the use of this technique?
  • ensure compliance with fundamental rights and freedoms in the use of this technique?
  • prevent abuse, misuse, or error in the use of this technique?
  • provide legal protection and recourse for individuals or groups affected by this technique?
  • ensure accountability and transparency in the use of this technique?
  • evaluate the effectiveness and legitimacy of this technique?
  • foster trust and cooperation between law enforcement agencies and phone users in the use of this technique?

What is the impact of encryption technologies on this technique?

Encryption technologies are methods or systems that make data unreadable or inaccessible to unauthorized parties. Encryption technologies can have a significant impact on remote activation of phones by the police, as they can make this technique more difficult, risky, or controversial.

How can encryption technologies make remote activation of phones by the police more difficult or impossible?

Encryption technologies can make remote activation of phones by the police more difficult or impossible by preventing law enforcement agencies from accessing data or communications on phones, even if they remotely activate them. Encryption technologies can also protect phones from malware or spyware that enable remote activation.

For example, end-to-end encryption, which some apps such as Signal or WhatsApp use, can prevent law enforcement agencies from intercepting or reading messages or calls on phones, as only the sender and the receiver have the keys to decrypt them. Device encryption, which some operating systems such as iOS or Android use, can prevent law enforcement agencies from extracting or viewing data on phones, as they require a password or a biometric authentication to unlock them.

How can encryption technologies make remote activation of phones by the police more risky or harmful?

Encryption technologies can make remote activation of phones by the police more risky or harmful by exposing law enforcement agencies to legal or technical challenges or dangers. Encryption technologies can also harm phone users by compromising their security or privacy.

For example, breaking encryption, which law enforcement agencies sometimes do to access data or communications on phones, can expose them to legal challenges, as it may violate laws or regulations that protect encryption or privacy. It can also expose them to technical dangers, as it may weaken the security of phones or networks and create vulnerabilities for hackers or criminals. Hacking encryption, which law enforcement agencies sometimes do to install malware or spyware on phones, can harm phone users by compromising their security or privacy, as it may allow unauthorized access to their data or functions.

How can encryption technologies make remote activation of phones by the police more controversial or unacceptable?

Encryption technologies can make remote activation of phones by the police more controversial or unacceptable by raising ethical and social issues or debates. Encryption technologies can also create conflicts or tensions between law enforcement agencies and phone users or providers.

For example, undermining encryption, which law enforcement agencies sometimes request to facilitate remote activation of phones, can raise ethical and social issues or debates, as it may affect human rights and civil liberties, such as privacy, confidentiality, dignity, presumption of innocence, and right to a fair trial. It can also create conflicts or tensions between law enforcement agencies and phone users or providers. They may have different interests or values regarding encryption and security.

How does EviCore NFC HSM technology developed by Freemindtronic offer a high level of protection for phone users?

Remote activation of phones by the police can be facilitated by exploiting security flaws, installing malware, or requesting backdoors in encryption technologies. However, some encryption technologies may be resistant to these measures and offer a higher level of protection for phone users. One of them is the EviCore NFC HSM technology developed by Freemindtronic.

This technology lets users create their own encryption keys in a random way and store them in a physical device that communicates with the phone via NFC (Near Field Communication). The device also lets users define their own trust criteria that must be met to use the keys or their segments. The encryption is done in Quantum-Safe AES-256 mode from either a device compatible with the EviCore NFC HSM technology or from an encrypted enclave in the phone created in the Key chain (Apple) or the Key store (Android) via the EviCore HSM OpenPGP technology. The encryption keys are segmented and superior to 256 bits. Moreover, they are physically externalized from computer systems. Everything is designed by Freemindtronic to effectively fight against espionage and corruption of telephone, computer, communication and information systems. Finally, without a server, without a database, even in air gap and airplane mode works EviCore NFC HSM or EviCore HSM OpenPGP technology. Everything is designed to work in volatile memory to leave no trace in telephone and computer systems.

This technology offers a high level of security and privacy for phone users who want to protect their data from unauthorized access, including by the police. It also offers a high level of performance and usability for phone users who want to encrypt or over-encrypt all types of messaging in the world, including SMS and MMS. It also works with other applications that use encryption, such as email, cloud storage or blockchain.

Furthermore, this technology is designed to be totally anonymous, autonomous, unconnected, without a database, without collecting any information of any kind on the identity of the user, nor on the hardware, nor on the terminals used. The technology is designed to be totally isolated and totally independent of the security of the terminal used whether it is connected or not. Freemindtronic does not keep the unique pairing keys for each NFC HSM device. And even if it did, the user at installation will automatically generate segmented complementary keys for encryption with administrator and user passwords. Each NFC device has a unique 128-bit signature dedicated to fighting against counterfeiting of NFC devices. It is also used as a key segment. The secret stored in eprom memories or in enclaves of the phone and/or computer can be individually secured by other segmented keys characterized by additional trust criteria such as a geozone, a random hexadecimal code via an existing or generated QR code or Bar Code via EviCore HSM. It is therefore physically impossible for Freemindtronic but under judicial assignment to decrypt data encrypted via EviCore HSM technologies even with a quantum computer.

In conclusion, remote activation of phones by the police is an intelligence technique. It aims to fight terrorism and crime by accessing data or sounds and images from phones without consent or knowledge. Law enforcement agencies in various countries have used or considered this technique. For example, France, the United States, Germany, Italy, Israel, Canada, China, and the United Kingdom. However, this technique raises technical, legal, ethical, and social challenges. They need to be addressed.

On the technical side, remote activation of phones by the police depends on three factors: compatibility, connectivity, and security of the phones. It can be done by three methods: exploiting vulnerabilities, installing malware, or using spyware on phones.For example, EviCore NFC HSM technology developed by Freemindtronic protects data and communications on phones from remote activation by the police. Encryption technologies can make this technique more difficult or impossible by preventing law enforcement agencies from accessing data or communications on phones, even if they remotely activate them.

On the legal side, remote activation of phones by the police requires a legal framework that regulates its use and scope. Laws or regulations can authorize it and specify the conditions and criteria for its application. Legal remedies can also challenge it and contest or oppose its validity or legality.

On the ethical side, remote activation of phones by the police involves a trade-off between security and privacy, as well as between effectiveness and legitimacy. It can enhance security by providing more information and evidence to law enforcement agencies to prevent, investigate, and prosecute crimes. It can also undermine privacy by letting law enforcement agencies access personal or professional data without notification or justification.

On the social side, remote activation of phones by the police raises issues or debates that affect human rights and civil liberties. For example, privacy, confidentiality, dignity, presumption of innocence, and right to a fair trial. It can also create conflicts or tensions between law enforcement agencies and phone users or providers, as they may have different interests or values regarding encryption and security.

Therefore, remote activation of phones by the police is a complex and controversial technique that requires a careful and balanced approach that respects the rights and interests of all parties involved. The French bill on remote activation of phones by the police and the EviCore NFC HSM Open PGP technology developed by Freemindtronic illustrate the complex and evolving relationship between intelligence and encryption in the digital age. They raise questions about finding a balance. It is between security and privacy, between public interest and individual rights, between innovation and regulation.

: According to Okta, privacy is the right to control how your information is viewed and used, while security is protection from threats or dangers (https://www.okta.com/identity-101/privacy-vs-security/).

: According to Carnegie Endowment for International Peace, finding a balance between security and privacy requires addressing technical, legal, and social questions (https://carnegieendowment.org/2019/09/10/moving-encryption-policy-conversation-forward-pub-79573).

: According to Springboard, finding a balance between innovation and regulation requires cooperation among stakeholders and respect for human rights (https://www.springboard.com/blog/cybersecurity/privacy-vs-security-how-to-balance-both/).

Phishing: Cyber victims caught between the hammer and the anvil

Responsibility for Phishing, SMiShing, typosquatting, ransomhack, spear phishing, sim swapping, vishing, email and web Spoofing cybervictims is engaged.

There can no longer be any doubt, the responsibility of the Internet user is legally engaged with almost no recourse for the victims to obtain any refund!

Note that we most often find the English term “phishing” which translates “phishing” into French, as well as for the typosquatting that comes from the English “typosquatting” or spear phishing targeted phishing via social engineering techniques or Spoofing technique of spotting.

Following the 2015/2366 directive of the European Parliament and the Council of 25 November 2015, Order No. 2017-1252 of 9 August 2017 makes amendments to Articles L133-16 and L.133-19 of the Monetary and Financial Code for victims of bank card phishing.

Article L133-16 of the Monetary and Financial Code (below) states: “As soon as he receives a payment instrument, the user of payment services takes all reasonable measures to preserve the security of his custom security devices. It uses the payment instrument in accordance with the conditions governing its issuance and use. »

https://www.legifrance.gouv.fr/affichCodeArticle.do?cidTexte=LEGITEXT000006072026&idArticle=LEGIARTI000020860774&dateTexte=&categorieLien=cid

Article L.133-19 of the Monetary and Financial Code (below) states in paragraph IV: “The payer bears all losses caused by unauthorized payment transactions if these losses result from fraudulent conduct on his part or if he did not intentionally or grossly negligently satisfy the obligations referred to in Articles L.133-16 and L.133-17 of the Monetary and Financial Code.”

https://www.legifrance.gouv.fr/affichCodeArticle.do?idArticle=LEGIARTI000020861589&cidTexte=LEGITEXT000006072026

The judgment of the Court of Cassation of 25 October 2017 and that of 28 March 2018 form a case law on the liability of the Internet user victim of phishing by telephone via identity theft and/or via a fake website and/or a fake email.

The judgment of October 25, 2017, (cases of 25.10.17, No. 16-11 644)

https://www.legifrance.gouv.fr/affichJuriJudi.do?idTexte=JURITEXT000035925298&fastReqId=1348908414&fastPos=5&oldAction=rechJuriJudi

Monde.fr press article: http://sosconso.blog.lemonde.fr/2017/10/26/elle-avoue-a-sa-banque-avoir-ete-victime-de-phishing

The judgment of March 28, 2018, (cases. of 28.3.18, No. 16-20 018)

https://www.legifrance.gouv.fr/affichJuriJudi.do?oldAction=rechJuriJudi&idTexte=JURITEXT000036780076&fastReqId=1780826332&fastPos=1

The cassation courts reinforce the obligation of caution of Internet users in the face of phishing attacks that can be telephone, via SMS or e-mail, relating to the use of its bank cards or confidential codes.

  • The March 28, 2018 ruling deepens the liability framework for the Internet user by stating that the failure, by gross negligence, to take any reasonable measures to preserve the safety of its personalised security devices.
  • The user of a payment service who discloses the personal data of this security device in response to an email that contains clues allowing a normally attentive user to doubt its provenance is held solely responsible
  • The bank is not required to inform its customers of the risks of phishing.

How do cybercriminals circumvent 3D Secure code authentication?

Step  1:    The cybercriminal must obtain from his next victim the identifiers and passwords of his phone operator.

What for? To enable the cybercriminal to set up telephone referrals of messages received in particular from his bank. It’s easier than stealing the phone. Hence the importance of regularly changing your passwords from your operator’s account. This point becomes more and more crucial since the smartphone is a mobile payment and/or access control terminal.

Step2:    The cybercriminal must now obtain all the information from the bank card. Several possibilities; or phishing by email, SMS, blackmail, phone by impersonation by an agent of the operator. The victim overconfidence gives him his information. She is not aware that the 3D Secure will also be sent to cybercriminals.

The cybercriminal only has to make the payment that he can validate himself instead of the victim.

The victim informed at the same time as the cybercriminal that there is a request to validate a purchase via his bank card thinks, since she has not validated the payment, that she is safe. She can object to her credit card. Only it’s already too late. The payment is irrevocable and the bank’s liability is cleared. This is the judgment of October 25, 2017.

In another case, the theft of the smartphone with the bank card may have the same result. In the same way when you pay physically with your bank card where you can see in clear the CCV or CVC composed of 3 to 4 digits used for payments on the internet.

It is advisable to use   Freemindtronic  Andorra  EviAlpha technologies for personal use and  EviToken  or  EviCypher  for professional use that allow, after you have physically removed the CCV or CVC code, to make payments on the internet safely. In case of bank card theft, the cybercriminal does not physically have access to the CCV or CVC, the protection with Fullsecure solutions is immediate. This solution is not dependent on the time factor associated with reporting loss or theft for use on the internet. In addition, this solution is capable of managing multiple bank cards and is compatible with any type of bank card internationally, at no additional cost or financial commitment.

There are CCVs or CVCs that change dynamically several times a day. A new security that has an additional annual cost. Used for physical payments, the CCV or CVC is visible. The cybercriminal has only a very short interval of time to rob his victims before the automatic change of the CCV or CVC. In case of theft of this type of bank card, the time depends on the time and date of the declaration of the theft as for other bank cards.

Sim swapping: What does the Monetary and Financial Code say about Secure?sim swapping 3D codes

According to Article L133-23 of the Monetary and Financial Code, it is up to the bank to provide proof of the registration of this type of authentication which makes it possible to presume that the payment has been validated by the rightful holder. Failing that, according to Article L133-18, the transaction is deemed “unauthorized”, the bank is obliged to repay.

The 3D Secure code was developed by Visa and MasterCard to combat the risks of Internet fraud. This code is therefore sent by visa or Master Card’s digital services and is not known to the user until it is received. In fact, it cannot communicate it to a cybercriminal unless the latter has stolen the smartphone, managed to make a copy of the SIM and the most common access to the customer’s accounts of the telephone operator to make a call return to obtain the 3D Secure Code.

What is vishing?

Vishing is a form of phishing that uses the phone as a means of deceiving victims. The term comes from the combination of “voice” and “phishing”. Vishing involves calling victims and pretending to be a trusted person or organization, such as a bank, a public service or a phone operator, and asking them for personal, financial or confidential information. For example, a scammer may claim that the victim’s bank card has been compromised and ask them to confirm their card number and PIN. Vishing can also be used to persuade victims to make fraudulent payments or to download malicious software on their phone.

Vishing is a growing threat, as it exploits the trust that people have in the phone and their lack of vigilance against unsolicited calls. Moreover, scammers use sophisticated techniques to make their calls more credible, such as spoofing, which consists of falsifying the phone number displayed on the recipient’s screen. To protect themselves from vishing, it is important to never disclose personal or financial information over the phone, to verify the identity of the caller by calling back the official number of the organization they claim to represent, and to report any suspicious call to the relevant authorities.

How phishing detection ?

The Internet user must become an expert in phishing detection and typosquatting in the face of the ingenuity of cybercriminals.

According to the case law, the Internet user must carry out a “watchful examination of the correspondent’s changing internet addresses or certain clues, such as misspellings…   which should provide clues  “of a sufficient nature to appeal to the Internetuser.”

However, the criteria adopted by the case law since 2015 are already obsolete because of the quality of counterfeiting of websites in perpetual increase, but not only.

Indeed, the only test to detect a“changing address”has become complex for #cybervictimes. These ingenious cyber criminals find many solutions to deceive their vigilance, especially by the use of special characters in the domain name.

Jurisprudential obsolescence in the face of the evolution of phishing by Unicode

Cyber criminals use special characters similar to the Latin alphabet, theunicode E100. They have more than 26 characters at their disposal  (Ḁ ḁ Ḃ ḃ Ḅ Ḇ ḇ Ḉ ḉ Ḋ ḋ ‘Ḏ ḏ Ḑ ḑ Ḓ ḓ Ḕ’, ‘Ḏ ḏ Ḑ ḑ Ḓ ḓ Ḕ’,  ‘Ṟ’, ṟ, ‘, ‘ Ṯ’, ṯ, Ṱ, ṱ’. All they have to do is buy a domain name similar to the original, and replace one of the characters with a unicode character, as similar as possible, with for example a dot below the character.

For example, we will use the websites of telephone operators and banks, just by replacing the letter “r” with“O”it can give this “f-ee.fr”orby replacing “b” with “ḅ” “ḅouyguestelecom.fr” or “ḅanquepopulaire.fr”.

A perverse new game that would be imposed by the jurisprudence that involves the Cyber-Victim to detect the hidden difference in the URL (address).

Are cyber criminals responding to my request? Indeed I had suggested to them in order to help the #cybervictimes to change their modus operandi to help them in the face of jurisprudence. “Please  don’t make any more spelling mistakes, and if it’s not grammatically correct, make sure that the simple review of the changing address is not obvious on the exam  alone.”

With the fake URL and once the counterfeit site is identical to the original, the trap is activated to capture future #cybervictimes.

Smishing (SMS Phishing)

A cybercriminal sends you an SMS (i.e. a text message) asking you to click on a link. If you click on the link in the message, you will be redirected to a fake website asking you to provide your information in a phishing form.

The cybercriminal attempts to obtain your sensitive information through a text message (i.e. SMS). They will ask you to provide personal information such as a social security number, credit card or health insurance information. He claims that you must give this information or something bad will happen to you (e.g. your electricity is cut off, your credit card is blocked or your online account is terminated). To learn more about Smishing, click HERE.

Typosquatting another form of phishing

Almost identical to phishing, fake site, fake URL, with the big difference that the cybercriminal bets on the typos of #cybervictimes when the user informs the internet address. Examples include “fri.fr” without (ee) or “bouyguetelecom.fr” without (s) or “banque-populaire.fr” with the addition of a hyphen or “free.com” by changing the extension (.fr).

A new playground for cyber criminals, a fake address bar on Android phones that use the Chrome browser.

Google Chrome on Android smartphone only shows the title of the site visited rather than displaying the full address bar with the URL. A new feature for user comfort to make more room for content to be played. This allows the cybercriminal to pass a phishing page as a legitimate web page.

Spoofing over domain name extension makes many cyber victims, especially for domains in .com. The cybercriminal buys a .co domain name with a name identical to that of a known site, an example “www.amazon.co”. The cyber victim receives an email that appears to be from the original site. She is invited to log in via a link to the “www.amazon.co” mirror site. She’s not going to be careful that she’s not on the original site with a .co extension instead of .com. It is therefore with confidence that the cyber victim will enter personal information, especially his login ID and password.

How will the case law evolve to determine the threshold that will qualify the Cyber victim as “negligent”?

Natural protection against phishing and typosquatting

There is a barrier to phishing when the domain name extension is proprietary. This is the case, for example, of the extension of the BNP Paribas bank with its own extension “.bnpparibas” of the website “www.mabanque.bnpparibas”. In this case, it is a cost of around $185,000 and a binding procedure to obtain fromICANN  its custom domain name extension that establishes a natural barrier against this type of attack. However, users of these sites still need to be informed of this distinction. Otherwise, the case law is unequivocal and will be imposed on cyber-victims. Indeed, it is difficult to explain that they did not see the different extension.

Learn more about custom extension

https://www.prodomaines.com/extension-personnalisee

Is the overall level of computing so linear among Internet users that they are all able to carry out such a review?

I doubt it very much.

In the same way, to think that only insiders are safe from phishing seems to me a very risky shortcut.

It is becoming more and more difficult for the Internet user to differentiate between the true and the false.

Shouldn’t case law or a revision of the law take into account the quality of the forger as for the currency, to exonerate the responsibility of the victim?

Instant transfer payment, a new eldorado of cybercriminals?!

What will cybercriminals imagine to create new victims following the new implementation initiated by the ECB with the instant transfer payment system, in less than 10 seconds, irrevocably, achievable with a simple telephone number?

How does it work? (Source the tribune)

It is a transfer in euros that is initiated from the website of his bank or his mobile banking application by choosing the instant mode. Simply enter the IBAN or, less tedious, its mobile phone number (converted to IBAN by the bank), or even scan a QR code to send the money. The account is credited in less than 10 seconds and payment confirmation is sent by SMS within 20 seconds. The transfer is irrevocable. The service is usable 24 hours a day, 365 days a year. A ceiling of 15,000 euros has been decided at European level (the Netherlands has abolished it).

I predict an increase in cybercrime on this new SEPA Express system, if the security system is not equal to or greater than that of bank cards!

Innovation goes further and further to allow the machine to gradually substitute for human physical consent since currents of thought believe that man is more failing than the machine.

To this day, we cannot assign a machine to court. In fact, no one is safe from being between the hammer and the anvil.

‘Ransomhack’: blackmail to non-compliance RGPD

Cyber criminals also use phishing to steal private data, known asransomhack. Taken hostage, this data is being blackmailed by using the new European regulations (RGPD) to put pressure on victims. The goal is to get the ransom faster. It is enough to threaten the victim to make public the data if the ransom is not paid, weighing the risk of strong criminal and civil penalties incurred in the event of non-reporting to the CNIL of the theft of data.

Once again the technique of hammer and anvil becomes a formidable weapon in the face of the fear of double punishment, victim and criminally and civilly litigant.

The phishing technique is no longer the preserve of cyber criminals: it may be more or less legal!

It is difficult to establish statistics, as victims do not file complaints. It is very likely that many of you will recognize yourself in this situation.

What for?

Despite the new provisions imposed by the RGDP, online sites selling goods and/or services have found a way to obtain their customers’ bank card information. However, there is no reason for the client to provide this type of information.

Only here, it takes on a legal appearance, to get this valuable information from bank cards. In principle, legally you have the right to request their removal.

Now that we’re done with the theory, let’s move on to practice

As we have seen before, giving the information of bank cards is under the full responsibility of the Internet user.

Similarly, it is common knowledge that cyber criminals regularly steal private data, including bank cards from the databases of merchant sites.

According to the principle of prudence established by the Court of Cassation, could it not be taken up against the victim? Could the Court not consider that there is no need to inform the Internet user that there is a risk that his credit card information will be derogating? That he is in fact the only one responsible for the information he transmits!

Why do online sales sites need this credit card information? What do they really do with it?

I believe that in terms of the RGPD, you would be entitled to ask the question.

There are many good reasons that will be invoked, but these are not for the customer but for the service provider, especially when the service provider has a recurring payment system in place.

This credit card information becomes valuable for the quality of the outstanding accountable or EENE. If you want to know more(https://comptabilite.ooreka.fr/astuce/voir/609429/effet-escompte-non-echu).

What to remember: The expected effect is passed on to another creditor or bank. The higher the quality of the debt, the less expensive the cost of the discount. Even if rates are low, it is a gain.

Another interest is the forgetting and withdrawal of small sums that often go under the radar of customers. Agreements are established that provide for automatic renewal and anniversary dates with a minimum period of time to report the contract.

New: drown the fish under the guise of updates to the terms and conditions of sale! The service contract for which you consented is unilaterally amended. The trick is the criterion of trust. You are made to accept new conditions that cancel the previous ones.

Let us go even further in the violation of the rules of law.

If you cannot be accepted for a new document, a principle of law that does not exist in contractual matters is used. Just as a contract cannot be changed unilaterally, either by adhesion or synallagmatically, without the consent of the co-contractor.

Silence is not worth acceptance!

However, many service companies send you emails informing you that if you do not respond within a certain period of time, the contract will be considered accepted. If you refuse, you lose the service for which the provider had committed. However, the commitment may also include back-doors such as the subject of an update of general terms of sale.

The hammer and anvil method is activated!

This is a form of blackmail that is illegal, done digitally but does not rank in cyber crimes.

What for?

A beginning of response trail, because they act overdrawn and they are legally registered in corporate registers but not cyber criminals in principle.

The deterrent force of a recourse by the Internet user!

They also have a master asset, the cost of a civil or criminal action procedure in relation to the small amounts involved. The cost of obtaining a court order, such as legal fees, legal fees, time spent and the uncertainty of obtaining redress, is enough to make any desire for prosecution give up.

Even if the civil and/or criminal dol can be qualified, no one will ever know that you are also the victim of phishing by deception of the co-contractor to obtain the information of bank cards or private data.

However, when you show the teeth against cybercriminals, they trade without resisting too much. It will also depend on who you are in the fuse position. Ane  against measure of the Internet user. This will also depend on the caller in the fuse position.

The balance of power through blackmail can be balanced. The risk of bad publicity on social networks, the CNIL Pro  or  Private,can have morecostly consequences than the sums incurred. In the same way if the Internet user has insurance that pays for legal and procedural costs. In this hypothesis the blackmail is reversed by the Internet user. The latter is no longer between the hammer and the anvil.

In the end, the amicable arrangement is better than a long trial. As a result, the risk of bad publicity on social networkscan have  more costly consequences than the sums incurred. In this case, this form of threat may allow the Internet user to no longer be between the hammer and the anvil.

What are the current trends of phishing?

Phishing is a constantly evolving phenomenon, which adapts to new technologies and new behaviors of internet users. According to the statistics provided by https://www.phishing.org/phishing-statistics/ or https://www.kaspersky.com/resource-center/threats/phishing-statistics-report, phishing increased significantly in 2020 and 2021, especially because of the Covid-19 pandemic that favored remote work and online shopping. Phishing accounts for about 80% of cyberattacks and affects both individuals and businesses.

Moreover, phishing diversifies and takes new forms, such as vishing, smishing or spear phishing. Vishing is a form of phishing that uses phone calls to trick victims. Smishing is a form of phishing that uses SMS or instant messages. Spear phishing is a form of phishing that targets specific individuals or organizations using personalized information. These new forms of phishing are harder to detect and prevent, as they exploit the trust and emotion of victims.

To conclude, phishing is a major risk for the security of internet users and organizations, which requires vigilance and prevention. By following the tips that I gave you in this article, you can protect yourself from phishing and reduce the chances of being a victim.

You want to know more about the deception of the co-contractor from a legal point of view.

https://www.superprof.fr/ressources/droit/droit-general/droit-des-obligations/faute-et-nullite-du-contrat.html

Having the freedom not to give credit card information outside of a single transaction and under the exclusive control and consent of the payer, should not be a right to defend. Freemindtronic technologies  such as  EviToken  or  EviCypher  with web browser extensions protect bank card information and counter phishing attacks. It is above all a tool to exercise this right to no longer give his credit card information on the internet to be saved.

To learn more about our credit card protection solutions, you can read the following articles on Linkedin:

Why are Freemindtronic’s #NFC Offline electronic safes already in compliance with the decree that will come into effect on 01/01/19?

https://www.linkedin.com/pulse/pourquoi-les-coffres-forts-%C3%A9lectroniques-nfc-offline-de-gascuel/

A new cloud-free individual security service with anti-phishing to protect all types of bank cards from start to finish

https://www.linkedin.com/pulse/un-nouveau-service-de-s%C3%A9curit%C3%A9-individual-without-cloud-with-gascuel/

https://www.linkedin.com/pulse/victimes-dhame%C3%A7onnage-impunity%C3%A9-of-cybercriminals-jacques-gascuel/

This site uses cookies to offer you a better browsing experience. By browsing this website, you agree to our use of cookies.
More info Accept