Big ransomware attack conclusively linked to malvertising?

We DON'T NEED PROOF, but interesting...

Yes,  we  do need good, tested, reliable backups.

UK Uni Ransomware Attacks Linked to Malvertising Campaign

Phil Muncaster UK / EMEA News Reporter , Infosecurity Magazine

The ransomware that caused widespread disruption at two UK universities last week is now thought to have been spread via a much larger malvertising campaign, according to Proofpoint.
Kafeine, a researcher at the security vendor, explained that the C&C IP address for the ransomware in question is commonly associated with the Mole family and payloads linked to the Astrum exploit kit, a known favorite of the banking trojan group AdGholas.
“At that stage, we were almost convinced the events were tied to AdGholas / Astrum EK activity. We confirmed this, however, via an HTTPS connection common to the compromised host avia-book[.]com,” the blog post continued.
This host was apparently being used in a large scale malvertising campaign targeting the UK, Australia, Canada, Italy, Monaco, Liechtenstein, Luxembourg, Switzerland, Japan, Taiwan and the United States.
All compromised hosts are said to have contacted the Astrum C&C IP address.
“It appears that between June 14 and 15, Astrum was dropping Mole ransomware in the United Kingdom and likely in the US. Mole is a member of the CryptFile2/CryptoMix ransomware family. We do not know the payloads in other countries, but, based on past activity, we are confident they were banking Trojans. Unlike ransomware, bankers are generally less noisy and often remain unnoticed by victims,” Kafeine concluded.

more...
https://www.infosecurity-magazine.com/news/uk-uni-ransomware-attacks-linked/?utm_source=dlvr.it&utm_medium=twitter

Interesting wired article on power grid hacking as Cyberwar

How An Entire Nation Became Russia's Test Lab for Cyberwar

The clocks read zero when the lights went out.

It was a Saturday night last December, and Oleksii Yasinsky was sitting on the couch with his wife and teenage son in the living room of their Kiev apartment. The 40-year-old Ukrainian cybersecurity researcher and his family were an hour into Oliver Stone’s film Snowden when their building abruptly lost power.

“The hackers don’t want us to finish the movie,” Yasinsky’s wife joked. She was referring to an event that had occurred a year earlier, a cyberattack that had cut electricity to nearly a quarter-million Ukrainians two days before Christmas in 2015. Yasinsky, a chief forensic analyst at a Kiev digital security firm, didn’t laugh. He looked over at a portable clock on his desk: The time was 00:00. Precisely midnight.

Link here:
https://www.wired.com/story/russian-hackers-attack-ukraine/

NATO publishes a book about Russian Cyber defense in the Ukraine

Cyber War in Perspective: Russian Aggression against Ukraine

The conflict in Ukraine appears to have all the ingredients for cyber war. Moscow and Kyiv are playing for the highest geopolitical stakes, and both countries possess a high level of expertise in information technology and computer hacking. However, there are still many sceptics of cyber war, and more questions than answers. Malicious code has served criminals and spies very well, but can cyber attacks offer soldiers more than a tactical edge on the battlefield? Can they have a strategic effect? And what norms should be established in international relations to govern nation-state hacking in peacetime and in war?

Link here:
https://ccdcoe.org/multimedia/cyber-war-perspective-russian-aggression-against-ukraine.html

Reuters: U.S. banks, corporations establish principles for cyber risk ratings firms

More than two dozen U.S. companies, including several big banks, have teamed up to establish shared principles that would allow them to better understand their cyber security ratings and to challenge them if necessary, the U.S. Chamber of Commerce said on Tuesday. Large corporations often use the ratings, the cyber equivalent of a FICO credit score, to assess how prepared the companies they work with are to withstand cyber attacks. Insurers also look at the ratings when they make underwriting decisions on cyber liability.
The group includes big banks like JPMorgan Chase & Co (JPM.N), Goldman Sachs Group Inc (GS.N) and Morgan Stanley (MS.N), as well as non-financial companies like coffee retailer Starbucks Corp (SBUX.O), health insurer Aetna Inc (AET.N) and home improvement chain Home Depot Inc (HD.N). They are organizing the effort through the Chamber of Commerce, a broad trade group for corporate America.
The move comes in response to the emergence of such startups as BitSight Technologies, RiskRecon and SecurityScorecard that collect and analyze large swaths of data to rate companies on cyber security.



Remember kids - use those ad blockers!
http://www.reuters.com/article/us-banks-cyber-idUSKBN19B1ZL

Paper on why Bancor Is Flawed

http://hackingdistributed.com/2017/06/19/bancor-is-flawed/

Questions for the class:
1. WTF is Bancor?  Is it a cryptocurrency? (Likely)
2. Why on earth did they collect  144M crowdsourcing?
3. Will we hear more of them?
4. Will this be like Ethereum?  Which is $371. OMFG
5. Is there anything I can do about it?

Extra Credit:  Apparently (some (idiotic)) people are shortening "cryptocurrency" to "crypto".  PLEASE do something bad to them, like ask for their AOL or Prodigy email address, or ask which ransomware attacks they've been hit with.

Litecoin is $50 BTW

Vulnerabilities Equity Process

EPIC.org has an interesting post on their blog that I hadn't seen before on the Vulnerabilities Equities Process

It's particularly timely with the recent "Wannacry" ransomware that appeared to use government leaked code that may not have been reported to the Microsoft

Question from the VEP - Is it the job of the intelligence community to find and report bugs?  Are the bug hunters at the IC that much better at programming than Microsoft?  Maybe the IC should share their bug hunting techniques?  How about people not buying buggy software?

Google Chrome "feature" allows recording audio and video without indicator

Slashdot writes about it here - Google Chrome Bug Lets Sites Record Audio and Video Without a Visual Indicator

"Ran Bar-Zik, a web developer at AOL, has discovered and reported a bug in Google Chrome that allows websites to record audio and video without showing a visual indicator," reports BleepingComputer. "The bug is not as bad as it sounds, as the malicious website still needs to get the user's permission to access audio and video components, but there are various ways in which this issue could be weaponized to record audio or video without the user's knowledge. The bug's central element is a 'red circle and dot' icon that Chrome usually shows when recording audio or video streams." Bar-Zik discovered that if the JavaScript code that does the actual audio and video recording is launched inside a small popup, the icon is not shown anymore. This opens the door for various types of scenarios, where an attacker that has tricked a user into granting him permission to record audio and video records user data but when the user doesn't expect this (no visual indicator). For example, an attacker could disguise audio/video recording code inside popup ads. If the user doesn't close the popup, the popup continues to stream audio and video from the victim's house. Google declined to consider this a security bug.

Google bug site at first treats it as a feature not a bug,

Comment 1 by dominickn@chromium.org, Apr 10

Components: UI>Browser>Permissions>Indicators Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Team-Security-UX OS-Chrome OS-Linux OS-Mac OS-Windows Type-Bug Status: Available

Thanks for the report. This isn't really a security vulnerability - for example,

WebRTC on a mobile device shows no indicator at all in the browser.  

The dot is a best-first effort that only works on desktop when we have chrome UI space available. That being said, we are looking at ways to improve this situation. I'll put this in our general permissions indicator pool.

 but  I expect they'll come around quickly