On May 11, 2022, the EU will publicize a proposal for a law on mandatory chat control. Privacy advocates aren't happy.
The post Client side scanning may cost more than it delivers appeared first on Malwarebytes Labs.

On May 11, 2022, the EU will publicize a proposal for a law on mandatory chat control. The European Commission wants all providers of email, chat and messaging services to search for suspicious messages in a fully automated way and forward them to the police in the fight against child pornography.

**History**

In 2020, the European Commission initiated temporary legislation which allows the searching of all private chats, messages, and emails for illegal depictions of minors and attempted initiation of contact with minors. This allows the providers of Facebook Messenger, Gmail, et al, to scan every message for suspicious text and images.

A majority of the Members of the European Parliament adopted the chat control regulation on July 6, 2021, allowing providers to scan communications voluntarily. So far, only some unencrypted US services such as Gmail, Meta/Facebook Messenger, and X-Box apply chat control voluntarily.

The European Commission announced that it will propose follow-up legislation that will make the use of chat control mandatory for all email and messenger providers. This legislation will be presented tomorrow, May 11, 2022 and would also apply to communications services that are end-to-end (E2E) encrypted.

It is important to note that the European Parliament has already pointed out that even voluntary scanning, which is currently permitted by the short-term law, lacks a legal basis and would probably be invalidated if it were taken to court.

**Privacy advocates**

Needless to say that many privacy advocates are ready to storm the barricades to prevent this law from being approved. Not only does this violate our basic human right to privacy, but encrypted messaging has been a boon to activists, dissidents, journalists, whistleblowers, and marginalized groups around the world.

Privacy advocates argue it brings the EU closer to the surveillance state that many see in other countries and that is a frightful image. It is also a step back when it comes to cybersecurity. What do we call software that eavesdrops on what we are doing on our devices and sends it to a third party? Spyware! And what happens to servers that accumulate large amounts of private data? They become targets for cybercriminals.

**The goal**

Similar developments are taking place in the US and the supporting narrative has expanded from domestic terrorism to other illegal content and activity, such as child sexual exploitation and abuse, terrorism, foreign adversaries‚ and attempts to undermine democratic values and institutions.

What most, if not all, of these activities have in common is that you usually won’t see the criminals using the same platforms as those of us that want to stay in touch with friends and relatives. They are already conducting their “business” in illegal marketplaces on the Dark Web, or they are using encrypted phone services.

**Client side scanning**

What does client side scanning mean exactly, some may wonder. Client side scanning broadly refers to systems that scan message contents for matches against a database of objectionable content before the message is sent to the intended recipient.

In this case, it means that the EU wants to force all providers of email, messaging, and chat services to comprehensively search all private messages, even in the absence of any suspicion. That makes the contents of messages no longer private between the sender and receiver, and client-side scanning breaks the E2E encryption trust model.

**Pitfalls**

As we have seen in the US, once the trend has been set, the number of targets can quickly expand from child abuse to other areas. As some of the privacy advocates noted, it’s a slippery slope.

It’s building a database of objectionable content. Given the amount of data you will need something to make a first selection. Machine Learning and Artificial Intelligence will undoubtedly be put to use. These systems can be manipulated and led astray, where static databases are too easy to circumvent.

False positives are a risk to keep in mind. What happens to a sender, or receiver for that matter, that gets tied to several flagged messages? I’m asking for me. Once an interest in cybercrime, vulnerabilities, and other related areas get added to the areas of government interest, my search queries alone would be enough to get me in trouble. On a lighter note, how hard will it be to explain that autocorrect is responsible for your message getting flagged? And will my reputation accompany me on my travels? In other words, will the US know if the EU thinks I’m involved in something shady?

The complexity of breaking the chain of E2E encryption could also limit the reliability of a communications system, and potentially stop legitimate messages from reaching their intended destinations.

So far, for every method that has been devised to limit the amount of private data that gets shared and scrutinized after the first selection, a downside has been brought up. And the stage in which these messages are unencrypted to be reviewed offers a target area where criminals can exfiltrate a lot of valuable information.

Since client-side scanning technologies may represent the most powerful surveillance system ever imagined, it is imperative that we find a way to make them abuse-resistant and auditable before we decide to start using them. Failures from the past have taught us that it’s often the other way around. We learn from our mistakes, but how costly are they?

It is also important to realize that the criminals we are trying to catch will simply move away from the platforms we decide to subject to client side scanning. So in the end, we are monitoring the communications of innocent citizens, for what exactly?

Client side scanning may cost more than it delivers

An email warning of supposed chemical attacks that delivers Jester Stealer malware is being sent to people in Ukraine.
The post “Chemical attack” email warnings deliver Jester Stealer malware appeared first on Malwarebytes Labs.

Jester Stealer, a malicious file capable of large amounts of data theft, is on the prowl again. The Ukrainian Computer Emergency Response Team (CERT-UA) has warned of a large distribution campaign abusing a “chemical attack” theme. Receiving an email like this in the invasion-affected regions of Ukraine is likely to cause huge alarm.

**From bogus attack warnings to data theft malware**

As per Bleeping Computer, the mail reads as follows:

> _“Today the information was received that chemical weapons will be used at 01.00 at night, the authorities are trying to hide it in order not to panic the population. Urgently get acquainted with the places where chemical weapons will be used and the places of special shelters where we will be safe._
> 
> _Help us to disseminate the information attached to the document in the letter as much as possible. map of the zone of chemical damage._
> 
> _We need to save as many lives as possible!”_

Source: CERT-UA

Although the mail is being described as phishing, there is no direct request for passwords or logins linked to in the mail itself. Instead, there’s a link to an Excel document which has been booby-trapped with harmful macros.

A rogue file called JesterStealer is downloaded to the victim’s PC and executes when the document is opened with macros enabled. At this point, the device is infected. CERT-UA notes that the infection files are being hosted on “compromised web resources”. When organisations don’t keep their services updated and vulnerabilities patched, this is the unfortunate knock-on effect.

**Impact on affected systems**

Once infected, the system is at serious risk of data theft. The list of potential target areas includes:

*   Internet browsers
*   MAIL/FTP/VPN clients
*   Cryptocurrency wallets
*   Password managers
*   Messengers
*   Game programs

Jester Stealer is also capable of swiping screenshots and stealing network passwords.

There’s some anti virtual machine/debug/sandbox tactics in play to hamper researchers analysing the file. The malware also removes itself once closed, helping attackers evade suspicion from those affected as they may well never realise the malware was present.

**Tips for avoiding this attack**

1.  Stick to official news sources for breaking information in affected areas. You’re more likely to see a genuine warning on the President’s page, or similar messaging from official sources on Twitter, than from random emails.
2.  Think carefully about attachment types in emails. Does it make much sense that a warning like this requires an Excel spreadsheet? Why not just put the full warning in the email? If it’s urgent, breaking information, people need everything in one place. Having to open up websites to download, and open files seems a long-winded and very odd way to accomplish this goal.
3.  Macros in Office files have been a long running problem. Microsoft has made several changes to try and minimise the risk of harm. Downloading macros from the internet results in an automatic block with regard to being able to run. Some individuals and organisations will always need macros available to some degree. This is why the “learn more” button will ultimately allow you to enable if you definitely need them.

**What Microsoft has to say about enabling macros**

Microsoft’s advice for this is very good. Here’s what it suggests in relation to macros:

*   **Were you expecting to receive a file with macros?** Never open a file attachment you weren’t expecting, even if it appears to come from somebody you trust. Phishing attacks often appear to come from a person or organization you trust in an effort to get you to open them.
*   **Are you being encouraged to enable content by a stranger?** A common tactic of attackers is to create some pretense such as cancelling an order or reading a legal document. They’ll have you download a document and try to persuade you to allow macros to run. No legitimate company will make you open an Excel file to cancel an order and you don’t need macros just to read a document in Word.
*   **Are you being encouraged to enable content by a pop-up message?** If you downloaded the file from a website, you may see pop-ups or other messages encouraging you to enable active content. Those are also common tactics of attackers and should make you suspicious that the file is actually unsafe.

Think carefully about enabling macros from random documents sent your way, and follow the tips above. Rogue mails which do nothing but compromise or damage your computer may make it more difficult to receive genuine alerts, and that’s definitely an additional problem you can do without.

“Chemical attack” email warnings deliver Jester Stealer malware

Costa Rica is doing everything it can to ward off persistent and overwhelming attacks from the Conti Ransomware group.
The post Costa Rica continues defence against sustained Conti ransomware attacks appeared first on Malwarebytes Labs.

It’s not been plain sailing recently for Conti ransomware, the Ransomware as a Service (RaaS) group with several major attacks under its belt. In August last year, a pen tester leaked valuable manuals and documents related to the operation. These leaks continued as the Conti gang expressed support for the Russian Government in the midst of their invasion.

Elsewhere, researchers gained access to a ransomware server and the owners eventually pulled Conti’s infrastructure offline for two days. To top it off, an offshoot based on leaked source code is targeting Russian organisations with this rather unambiguous message:

> _By now it’s probably painfully apparent that your environment has been infected with ransomware. You can think Conti for that…your President should not have committed war crimes. If you’re searching for someone to blame for your current situation look no further than Vladimir Putin._

In short, it’s quite the volatile situation. As offshoots butt heads against the public support for Russia coming from the Conti gang, the ransomware organisation is increasingly becoming the digital public enemy number one in Costa Rica.

**Going toe to toe with Conti**

Conti ransomware has been causing major problems in Costa Rica since at least April, with several important agencies impacted by outbreaks, which according to Bleeping Computer includes:

*   Costa Rican Social Security Fund
*   Administrative Board of the Electrical Service of the province of Cartago
*   Radiographic Costarricense
*   The Ministry of Science, Innovation, Technology, and Telecommunications
*   National Meteorological Institute

On top of this, there also exists a 672GB dump of data which may include data from multiple compromised Government agencies. The message accompanying the leak reads as follows:

> _It is impossible to look at the decisions of the administration of the President of Costa Rica without irony, all this could have been avoided by paying you would have made your country really safe, but you will turn to Biden and his henchmen…no government of other countries has finalised this attack, everything was carried out by me with a successful affiliate. The purpose of this attack was to earn money, in the future I will definitely carry out attacks of a more serious format with a larger team._

Little wonder, with all of this happening, that Costa Rica is on high alert.

**Embattled services struggle with outbreaks**

As this article points out, the Treasury alone has been without any form of digital service for three weeks. It’s also unclear at this time if tax payer information has been stolen. This has meant a return to physical procedures as opposed digital. As we’ve seen previously where Conti is concerned, any move away from digital to physical can result in all manner of problems.

**Counting the cost**

Make no mistake, the attacks have been varied and relentless. Last month, the administrative systems of a government agency managing electricity in Cartago were encrypted and rendered useless. That’s roughly 160,000 people potentially impacted in one go. A cool $10m was demanded as a ransom during the attack on the finance ministry. This attack is claimed to have caused losses of $200m.

Little wonder, then, that the US State Department has offered up to $10m for information on the Conti group. If you’re able to identify key individuals in the group, you may well be in for a significant payday. On top of that, there’s an additional $5m in relation to arrests/convictions for affiliates.

As the release notes:

> _The FBI estimates that as of January 2022, there had been over 1,000 victims of attacks associated with Conti ransomware with victim payouts exceeding $150,000,000, making the Conti Ransomware variant the costliest strain of ransomware ever documented. In April 2022, the group perpetrated a ransomware incident against the Government of Costa Rica that severely impacted the country’s foreign trade by disrupting its customs and taxes platforms. In offering this reward, the United States demonstrates its commitment to protecting potential ransomware victims around the world from exploitation by cyber criminals._

It appears the game is most definitely afoot. Will anyone actually be able to bring the group and affiliates to justice before another major attack? Based on what we’ve seen so far, the answer for the time being is almost certainly not.

Costa Rica continues defence against sustained Conti ransomware attacks

Only a few days after the release of the patch for a vulnerability in F5 BIG-IP, exploits were developed and are now being deployed.
The post Update now! F5 BIG-IP vulnerability being actively exploited appeared first on Malwarebytes Labs.

The Australian Cyber Security Centre (ACSC) has announced it is aware of the existence of Proof of Concept (PoC) code exploiting a F5 Security Advisory Addressing Multiple Vulnerabilities in its BIG-IP Product Range.

The vulnerability listed as CVE-2022-1388 allows attackers to bypass authentication on internet-exposed iControl interfaces, potentially executing arbitrary commands, creating or deleting files, or disabling services.

**F5 BIG-IP**

The BIG-IP platform by F5 is a family of products covering software and hardware designed around application availability, access control, and security solutions. It is used for various applications like load balancing and application delivery.

On May 4, 2022 F5 notified users of the existence of a vulnerability in BIG-IP iControl REST where undisclosed requests could bypass iControl REST authentication. F5 stated that the vulnerability could allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. The attacker, in other words, could gain complete control over the affected device.

**The vulnerability**

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) database. Its goal is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services). This vulnerability is listed as CVE-2022-1388 and received a CVSS score of 9.8 out of 10.

F5 added that there is no data plane exposure; this is a control plane issue only. So, not much of a problem if the management plane is not exposed to the public Internet, you would think. But since F5 BIG-IP devices are commonly used in enterprises, this vulnerability is a significant risk as it would allow threat actors to exploit the bug to gain initial access to networks and then spread laterally to other devices. And experts estimate based on online searches there are some 2,500 devices exposed to the Internet.

**Exploits**

Soon after the patch, two separate groups of researchers announced on Twitter that they had developed exploits and would publish them soon. Other researchers noticed online scanning was ongoing for BIG IP.

Exploits are often found by reverse engineering the changes made by the patch, which is one of the reasons why patches should be applied as soon as possible. Besides assumed reputation damage, this is a reason why vendors and open source maintainers are often hesitant to request a CVE.

The researchers that created the exploits warned that all admins should immediately update their devices as soon as possible due to the trivial nature of the exploit. Now the ACSC has warned about the existence of a proof of concept, and attempts by malicious actors to exploit this vulnerability on Australian networks.

**Mitigation**

A list of vulnerable products and versions can be found in the F5 KB article. Experts recommend to take Internet-facing devices offline and check if they are safe first, before applying the patches. If an attacker has already planted a backdoor, they can still control the product even after patching.

Until it is possible to install a fixed version, you can use the following sections as temporary mitigations. These mitigations restrict access to iControl REST to only trusted networks or devices, thereby limiting the attack surface.

*   Block iControl REST access through the self IP address
*   Block iControl REST access through the management interface
*   Modify the BIG-IP httpd configuration

For future use, this F5 BIG-IP Security Cheatsheet is a great resource to make sure your product is configured securely, and that attackers will not have access to the management interface from the Internet.

Please note that BIG-IP 11 and 12 are vulnerable as well but these are too old to be patched.

Stay safe, everyone!

Update now! F5 BIG-IP vulnerability being actively exploited

This week on Lock and Code, we speak with Cindy Liebes about the financial and emotional damage caused by romance scams and how to spot them.
The post Recovering from romance scams with Cindy Liebes: Lock and Code S03E10 appeared first on Malwarebytes Labs.

Earlier this year, many members of the public were introduced to the facets of a long-ignored crime in cyberspace: The romance scam. A flashy documentary called The Tinder Swindler had premiered on Netflix, and in it, filmmakers documented the efforts of one man to manipulate several women into giving him tens of thousands of dollars after sometimes convincing them that he was their one true love.

Immediately after the documentary premiered, viewers judged the victims. Some viewers blamed the women in the documentary for falling for what looked, externally, like an obvious scam. Others asked how the women could be swept off their feet with so many red flags present? Others blamed the victims for not doing better research into the man, who had worked tirelessly to build fraudulent websites that claimed he was the son of a billionaire diamond miner.

But according to Cindy Liebes, Chief Cybersecurity Evangelist for Cybercrime Support Network, this public perception misses a lot, particularly in how skilled these scammers can be in their work.

> “These people are professional criminals… and I think a lot of times, for those who may say, ‘Well I would never fall for this’—they don’t realize how professional these people are.”
> 
> Cindy Liebes, Chief Cybersecurity Evangelist for Cybercrime Support Network

This week on the Lock and Code podcast with host David Ruiz, we speak with Liebes about the facts behind romance scams: How prevalent they are, the types of damage they cause beyond financial ruin, and how you can spot a romance scam as it is happening.

Tune in to hear all this and more on this week’s Lock and Code podcast by Malwarebytes Labs.

This video cannot be displayed because your _Functional Cookies_ are currently disabled.

To enable them, please visit our _privacy policy_ and search for the Cookies section. Select _“Click Here”_ to open the Privacy Preference Center and select _“Functional Cookies”_ in the menu. You can switch the tab back to _“Active”_ or disable by moving the tab to _“Inactive.”_ Click _“Save Settings.”_

You can also find us on Apple Podcasts, Spotify, and Google Podcasts, plus whatever preferred podcast platform you use.

_Show notes and credits:_

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)  
Licensed under Creative Commons: By Attribution 4.0 License  
http://creativecommons.org/licenses/by/4.0/  
Outro Music: “God God” by Wowa (unminus.com)

Recovering from romance scams with Cindy Liebes: Lock and Code S03E10

Google and all its products can dominate the average person's life. Here's an in-depth guide on how to remove yourself from their ecosystem.
The post How to remove Google from your life appeared first on Malwarebytes Labs.

Swearing off a company used to be easier. Rude customer service, an unfortunate bout of food poisoning, even standing up for workers’ rights against the alleged involvement of a private company to order a country’s military to brutally quash a strike—almost every facet of an individual boycott could be satisfied by simply refusing to purchase a company’s products.

But such a move can be far more difficult to accomplish today, especially when you’re trying to sever your relationship with an Internet conglomerate. Tired of Facebook? Be sure to jump off Instagram and WhatsApp, too, which are both owned by the social media giant. Over Amazon? Good luck trying to navigate the web without landing on at least one site hosted by Amazon Web Services.

And what about Google?

The online behemoth has become so much more than a search engine, as it owns and produces hardware like Android phones, Google Pixel phones, Nest thermostats, and FitBit devices, while also operating Google Chrome, Google Mail, Google Calendar, Google Hangouts, YouTube, and Waze.

Saying goodbye to Google, then, isn’t as easy as refusing to buy an Android phone. It means likely changing several aspects of your life, including some that will affect the people around you.

Thankfully, this daunting task has already been taken on by the cybersecurity evangelist Carey Parker, who spoke recently on the Lock and Code podcast from Malwarebytes. According to Parker, it isn’t that he wanted to remove Google because he “hates” its products—if anything, he’s a fan. Instead, he wanted to start supporting other companies that will respect him and his data privacy.

“Google knows so much about us,” Parker said, explaining that Google makes the overwhelming majority of its revenue from online advertising, which it can only do because of how much data it collects from its users. “For me, it was about limiting as best I could how much information Google knows about me, removing as much as I can for things they already know about me, and then wanting to support companies who put privacy first.”

For anyone who has wanted to take a similar plunge into a Google-less life, here are some of the tips that Parker shared with us.

****Start with the individual—Search, Chrome, and Android****

Getting rid of everything Google product all at once could be a disaster, as there are simply too many services and products to track. Instead, Parker began the first steps of his experiment by only removing the products that directly affected him.

“I started with the easiest things—at least I think the easiest things,” Parker said. “The ones that have maybe the least tendrils into other things. They don’t affect anybody but yourself.”

For Parker, that meant removing and finding new providers for Google Search and the web browser Google Chrome. When it comes to stepping away from Android devices, Parker found that easy—he’s been using iPhones for years.

In finding an alternative to Google Search, Parker offered two suggestions: DuckDuckGo and the search engine Startpage, both of which claim to refuse any user data tracking for revenue purposes. Instead, the companies say they serve purely contextual ads based on the searches themselves—like showing ads for Nike and Adidas for anyone looking for shoes—and they do not record or keep data on users’ specific searches. In fact, Parker said, Startpage actually works with Google to deliver search results, but the company tells users that it refuses to collect user IP addresses, device information, and browsing history.

“You don’t have to track people to make money,” Parker said, “and Startpage is proof of that.”

In looking for a different, privacy-focused browser, Parker suggested his personal choice, Mozilla’s Firefox, and also the up-and-coming browser Brave.

****Bigger shifts with Gmail and GCal****

Having found different solutions for searching and browsing the Internet, Parker said he then focused his attention on finding alternatives to Google services that impact those around him.

“\[Google Search and Google Chrome were\] the first tier, and then, the next one, which is harder—a lot harder, because it involves other people—are Google email and Google calendar, Gmail and Gcal,” Parker said, “I’ve got shared calendars with my family and I am not going to expect them to drop Google like I am trying to do, so for that reason, I’m going to be stuck there for a little while, but I can minimize it.”

After researching the many options out there, Parker found two email providers—one that fulfills much of Google’s functionality and integration with a calendar function, and another that provides end-to-end encryption on messages sent and received between users of the same program.

The first suggestion is Fastmail. Fastmail, Parker said, is a for-profit email provider that users pay to use through a monthly subscription. The email provider also has a calendar solution that works directly with its main product. Even better, Parker said, is that Fastmail respects its users’ data.

“\[Fastmail\] explicitly say they don’t mine your data, and they are privacy-focused even if they’re not end-to-end encrypted by default,” Parker said. “It’s a really great service and it has the full suite of email, calendar and contacts, among other things. I use it for all my business stuff and some personal stuff.”

For user who wish to prioritize security, Parker suggested ProtonMail, which, by default, provides end-to-end encryption for all emails sent between ProtonMail users. That means that even if your emails get intercepted by a third party along route, those emails cannot be read by anyone other than you and your intended recipient.

****More complexity with Google Drive and Google Docs****

For users who want to take even more data out of Google’s view, there are just a couple final products to remove from the daily workflow. Those are the cloud storage service Google Drive and the cloud-based word processor Google Docs.

For each product, Parker encountered headaches and obstacles, but he managed to find alternatives that both respected his privacy and provided similar feature sets and functionality.

In finding a proper cloud storage platform, Parker recognized that some of the major players, such as Box and Dropbox, did not provide meaningful encryption for users’ data that would prevent the companies from scanning and gleaning information from user files.

Parker offered several suggestions depending on what users want most. If a user wants to securely send a private file to someone else, he recommended the online services Swiss Transfer and Mega, which can give users the option to set certain parameters on how they share a file, including how long a shareable link is active and whether the file requires a password to access.

For pure storage options, Parker recommended the service Sync.com because of its client-side encryption. Many of the cloud storage providers today, Parker explained, will promise to keep your data secure, but they will also hold the decryption keys to anything that you store on their servers.

“Machines will review the files that you have stored on these drives, either for advertising purposes or, a lot of times it’s for copyright violations,” Parker said. “They’ll look and see—are you trading movies or music with other people? And they’ll flag that and give you grief.”

But after extensive research, Parker found that Sync.com actually provided users with a type of encryption that the company cannot work around.

“\[Sync.com is\] end-to-end encrypted,” Parker said, “meaning that, even if behind the scenes, Sync.com uses Amazon Web Services, Amazon can’t see what my files are.”

As to finding an alternative to Google Docs, Parker said he struggled a great deal, simply because Google Docs works so well. After first trying to adopt a solution that Parker said is “secure, it’s private, it’s end-to-end encrypted—as far as checking boxes, it checks them,” Parker grew disappointed with the solution’s interface and its sluggish response time. Then, a second option called OnlyOffice was, as Parker put it, “not for the faint of heart” because of a high technical bar which could require renting out cloud servers.

The best, most accessible alternative, then, Parker said, is Skiff, which has an easy-to-use interface, but which only has a replacement for Google Docs, and not for the other, related tools, like Google Spreadsheets or Google Slides. Skiff’s tool can be found at Skiff.org.

****Step by step****

Taking Google out of your life can be a long and complex process, but it doesn’t have to be hard at the very beginning. And remember, if you ever start to doubt what you’re doing, think about what made you want to start the process. If you’re anything like Parker, you’re motivated to keep your data private and out of the hands of a company that is making money off of you and your browsing habits.

“At the end of the day, we are in an age of surveillance capitalism,” Parker said, “and Google is a publicly traded company with a fiduciary responsibility to maximize profits for their shareholders. Absent privacy regulations in the United States, the financial incentives are just too great to ignore. That’s money off the table.”

Parker emphasized that until Google creates—and there’s no evidence this will happen—a version of its products that users can pay for with their own funds rather than with their own privacy, that users should assume that “at any moment, any Google product unfortunately can and probably will, somehow, monetize your data.”

As the saying goes, Parker said, “if the product is free, then you are probably the product.”

You can listen to our full conversation with Parker on the Lock and Code podcast below.

This video cannot be displayed because your _Functional Cookies_ are currently disabled.

To enable them, please visit our _privacy policy_ and search for the Cookies section. Select _“Click Here”_ to open the Privacy Preference Center and select _“Functional Cookies”_ in the menu. You can switch the tab back to _“Active”_ or disable by moving the tab to _“Inactive.”_ Click _“Save Settings.”_

How to remove Google from your life

A specialized banking browser was introduced by a major German bank. While that sounds like a good idea, it looks like they are overestimating what it can do.
The post A special browser designed for online banking. Good idea, or not so much? appeared first on Malwarebytes Labs.

The German Sparkasse bank has launched a browser that is especially designed to do your online banking. The browser called S-Protect is available for macOS and Windows users.

The idea is interesting, since having a separate browser for banking can certainly add an extra layer of security.

**Separate browsers**

Unfortunately there is a low correlation factor between what most people find the best browsers and what are the best browsers when it comes to privacy and security. If you look at the market share of the most popular browsers, there is one browser that steals the crown without a lot of competition: Google’s Chrome. But as we all know there are more secure and privacy oriented browsers available.

I have personally advocated for using different browsers for different things in the past and I still use that method myself, but using a browser that is designed for banking alone? Why not use the app instead? What’s the difference?

**S-Protect**

According to the Sparkasse’s website \[in German\] S-Protect is a so-called ‘hardened banking’ browser. You can best think of it as an additional protective screen for online banking. S-Protect prevents Trojans and other malicious programs that may have hidden on your computer from spying on or manipulating online banking. Setting up and using S-Protect is child’s play and gives you a great security advantage in all financial transactions.

The browser has been built for Sparkasse by Coronic GmbH who has built a “protect browser” for other clients and who add that:

> “with PROTECT you can work securely on any PC and smart device – even if the computer is already compromised. Malware and hackers don’t stand a chance. Banking and payment remain secure. This helps bank customers who are still reluctant to do online banking.”

**Advantages**

Your advantages with S-Protect would be:

*   Additional protection against data theft, phishing attacks, fake websites
*   Easy handling, no installation or configuration
*   Automatic login function
*   No interference with other security procedures

Access to third-party websites, like manipulated or fake banking sites will be automatically blocked, because the browser is based on the “know your friends” principle, which limits the sites it can visit to that of the bank and their partners.

**Phishing**

In addition, the browser checks the security certificates of the pages to ensure their authenticity. However, if a user clicked on a phishy link in their email client then the URL will be opened in their default browser. If that default browser is not S-Protect—and why would it be, given its limited reach—the phishing site will be opened. That’s not S-Protect’s fault, but it just means that users will still need to keep their wits about them to make sure they’re using the correct browser.

**Infected system**

Sparkasse claims that the browser can be safely used for banking on an infected system, but we would advice very strongly against doing this. We also could not find any information about how the browser is hardened. For example, S-Protect claims to block screenshots of the browser, but would it stop a keylogger from being able to intercept what you are doing?

**Disclaimer**

Even though the idea deserves merit, I think we should be careful and not expect miracles to happen. Many browsers already have sandboxing in place. Sandboxing is the practice where an application, a web browser, or a piece of code is isolated inside a safe environment against any external security threat. That will stop malware from escaping the browser onto the system or the network. But none have demonstrated a good level of the other way around—stopping malware on the system affecting the browser—however hardened the browser may be. I can only hope Coronic will prove me wrong.

I would have loved to try some of the features of this browser, but I was unable to install S-Protect on my Windows 7 VM so the testing ended there for me.

Stay safe, everyone!

A special browser designed for online banking. Good idea, or not so much?

We take a look at continued reports of fake car wrap scams sent by SMS, mail, and phonecall. How does this one work?
The post $600 a week to wrap your car? It’s a scam appeared first on Malwarebytes Labs.

A friend of mine recently received a text message which they described as “intriguing, but nonsensical”. They were convinced it was some sort of scam, but they weren’t sure what the scammers were up to. Would it turn out to be some sort of phishing attempt? A telephone scam? Banking fraud? That one in a million opportunity to get rich quick?

They had no idea, and passed it along to me. What I can say for sure is that it definitely isn’t the last one in the list.

**The set up**

My friend is based in the US, and this piece of fraud seems quite popular there, occurring via text, mail, and even phone calls. This is the text message they received:

> _If you drive around with one of our stickers on your car, we will pay you $600 every week. There is no mileage requirement, and you will be paid $600 every week. Please provide the following information to get started. Name, address, city, state, and zip code are all necessary, as well as vehicle model and phone number. Thanks_

Definitely one of the stranger things I’ve seen. Stickers? Driving around in a car? What?

The ruse here is to make you think you’re going to generate money out of thin air, like some vehicular based Bitcoin farm with an air freshener. In the current climate, a lot of people will leap at the chance of pulling in $600 a week just for driving round in their car with a promotional sticker on the bumper.

What could possibly go wrong, I hear you cry. Quite a bit, as it turns out.

**The pay off**

Long before anybody shows up to put a sticker on your car, the next phase kicks into life should you respond. To get things moving, the scammers will ask for banking details of one form or another. You receive a cheque which may total quite a few thousand dollars and they ask you to cash it as some form of business advance.

If you’ve read some of our other blogs on business fraud, your spidey-sense may be tingling already. It would be quite correct to do so.

At roughly the same time the scammer asks you to cash the cheque, they’ll also ask you to send _them_ some funds back. This will be to cover the cost of whoever is turning up to your house to fit the stickers to your vehicle. This is the biggest glaring flaw of the entire enterprise: why send you all of the money, instead of just paying you and the decal person separately?

In terms of how much is going to be sent and asked for, this could vary wildly. I’ve seen people mention being sent cheques for around $10,000 from scammers, and then being asked to give back roughly $3,000 for car work costs.

What do you think happens next? If your guess is that their cheque bounces and you end up sending fraudsters a cool $3,000 without ever receiving the $10,000, you’d be absolutely right. This is an awful and very surreal way to lose a lot of money.

**Brands galore used by fake wrap scammers**

In the last week or so alone, a major milk supplier has been made the subject of these fake messages. Everyone from soft drink manufacturers to energy drink and producers of chocolate have all been placed in the fake wrap headlights over the last few years. Sometimes they make a concerted effort to target certain sections of society like students, which is particularly mean considering they may well be in need of funds at short notice.

**Do people fall for this?**

They do. Here’s a woman from last year who was left facing overdraft fees to fix the mess left behind.

If people struggle with payment methods, fraudsters may fall back on suggesting potential victims buy gift cards as “payment” for the car wrap installer. Of course, the only person benefiting from these gift cards will be the person running this ridiculous operation.

**Tearing down the fakes**

YouTuber Pleasant Green recently played a game of cat and mouse with a fake wrap scammer, and it’s worth a watch to see how things play out. You’ll note that the fraudster uses a lot of the tricks mentioned above.

The FTC has several pages related to this type of fraud. You can also file a complaint if necessary. The single most important thing to note about this attack is the bogus cheque angle. As the FTC states:

> “If you get a message urging you to deposit a check and wire money back, it’s a scam. Every time. No matter the story. And if this were a legitimate car wrap opportunity, wouldn’t the company directly pay the car-wrapping vendor, instead of asking you to do it?”

Very good advice. Should you receive one of these messages, do yourself a favour and don’t get yourself wrapped up in promises of money for nothing.

$600 a week to wrap your car? It’s a scam

OpenSSF recently introduced a dynamic analysis tool for all OSS packages when uploaded to open source repositories.
The post A scanning tool for open-sourced software packages? Yes, please! appeared first on Malwarebytes Labs.

The Open Source Security Foundation (OpenSSF), a collective of industry leaders aimed at improving the security of open-source software (OSS), recently announced the release of a prototype tool that scans for malicious packages in open source repositories. This tool, conveniently called Package Analysis, analyzed and identified at least 200 malicious packages uploaded to PyPI (The Python Package Index) and npm after a month of analysis.

Many have embraced open source for the fun and exciting ways of using it. Organizations of all sizes and industries rely on them for their day-to-day tasks, including critical ones. But because OSS requires people and businesses—sometimes, governments—to trust software developers unquestioningly, open source is susceptible to several risks, including exploitation.

Caleb Brown, who is part of Google’s Open Source Security Team and OpenSSF’s Securing Critical Projects Working Group, recognizes the considerable role open source plays in the software world and how “it’s far too easy for bad actors to circulate malicious packages that attack the systems and users running that software.”

“Unlike mobile app stores that can scan for and reject malicious contributions, package repositories have limited resources to review the thousands of daily updates and must maintain an open model where anyone can freely contribute,” Brown said.

Several open source projects have been the subject of malware incidents. One was found to contain a cryptominer, and some have been hijacked to include malware. And in the most recent incident, some open source developers decided to take a stand against Russia’s invasion of Ukraine. To everyone’s dismay, the protestware also contained a wiper feature designed to destroy all files on systems geolocated in Russia or Belarus.

**The Package Analysis project**

Package Analysis doesn’t only answer essential “what” questions about a package—”what files does it access, what addresses does it connect to, and what commands does it run?”—but also looks at its behavior over time. This is to alert people when a usually safe package starts to act suspiciously.

“Unlike mobile app stores that can scan for and reject malicious contributions, package repositories have limited resources to review the thousands of daily updates and must maintain an open model where anyone can freely contribute,” Brown said. “As a result, malicious packages like ua-parser-js, and node-ipc are regularly uploaded to popular repositories despite their best efforts, with sometimes devastating consequences for users.”

Package Analysis performs dynamic analysis of all packages uploaded to known OSS repositories and records results in a table in BigQuery, Google’s cloud warehouse. The scanning tool alerts OSS users of malicious changes to packages they use before they download them. Overall, this secures the software supply chain.

It’s no surprise to see Google supporting the project, describing it as “a welcome step toward helping secure the open source packages we all depend on.”

OpenSSF invites anyone interested to get involved in the project. Here is a wishlist of future goals for the project:

*   Detecting differences in package behavior over time
*   Automating the processing of the Package Analysis results
*   Storing the packages themselves as they are processed for long-term analysis
*   Improving the reliability of the pipeline

**If you secure open source, you secure a supply chain**

Google has been aiming to secure open source to protect its developers and users for a while now.

In 2021, the company invested in a project to evaluate Rust, a favorite programming language among programmers, as a supporting language for further developing the Linux kernel. As we all know, Android is built on the Linux kernel. The project’s goal was not to replace the entire Linux code but to improve parts of it using code written in Rust.

The company believes that Rust would “help us reduce the number of potential bugs and security vulnerabilities in privileged code while playing nicely with the core kernel and preserving its performance characteristics.”

Google also proposed an end-to-end framework to maintain the integrity of the supply chain. Dubbed Supply chain Levels for Software Artifacts (SLSA, pronounced “Salsa”), it is designed to protect the source and build integrities of open source. It also aims to provide users with information on whether a package meets a certain standard based on source, build, provenance, and security aspects.

This way, users are empowered to make informed choices on the security posture of software they heavily rely on.

A scanning tool for open-sourced software packages? Yes, please!

The most important and interesting stories in security from the last seven days.
The post A week in security (May 2 – 8) appeared first on Malwarebytes Labs.

*   Partner Success Story
*   Marek Drummond
    
    Managing Director at Optimus Systems
    
    "Thanks to the Malwarebytes MSP program, we have this high-quality product in our stack. It’s a great addition, and I have confidence that customers’ systems are protected."
    
*   See full story