You might think to yourself,

‘Hey! The only place I worry about hackers breaking into is my bank, and they protect their passwords so I won’t worry.’

Here is the problem with that.

Good hosts, encrypt the password you give them with something called a ‘hash’. Password hashing works by using a one-way mathematical function (a hash function) to convert a readable password into a unique, fixed-length string of characters (a "hash") that's nearly impossible to reverse. Let’s say our friend John Jones has this password:MyDogHasFleas

So ‘plain-text’ it looks like this:

                      MyDogHasFleas

The hash program produces a password that looks like this:

                      1524157875019052

So the user password list might look like this:

USERNAME                        PASSWORD

JohnJones@Gmail.com 15241578750190521

Now, 65% of people re-use the same password on all the sites they visit. So let’s say John Jones logs into Fred’s BBQ Website, and he uses the same password he always does and Fred’s BBQ Website hashes the password, and Fred, thinks he’s safe.

Now, the hacker will do something called a brute-force attack. Where his computer tries a password of aaaaaaa, then aaaaaab, then aaaaaac… you get the idea, working through all the letters and numbers until he gets logged in. For a short password of say, 8 characters, he can crack it in less than an hour.

Now he won’t try this on a bank web site, because they’ll catch the multiple attempts and stop him.

He’ll do it on Fred’s BBQ Website, because when he gets in, he knows 65% of people re-use the same password on all the sites they visit, so then he goes to John's bank and logs into John Jone's account using the password he just figured out.

Then he empties the bank account.

This faked email using a one-time address I made,  came to me in an attempt to steal my login id and password. 

IP Address 34.13.253.167 belongs to Google, indicating the the person who obtained this address is sending the emails by relaying off Google email servers.

The fake delivery failure message has a hyperlink going to :

cabinet.trk.net.ua

Cabinet.trk.net.ua is registered to:

registrar:        co.webcraft
organization:     WebCraft Ltd
organization-loc: ТОВ "ВЕБКРАФТ”
url:              http://webcraft.ua
city:             Kyiv
country:          UA
abuse-email:      

@webcraft.ua abuse-phone: +380.443625825 abuse-postal: Ukraine, 02206, Kyiv, PO BOX 67 abuse-postal-loc: Україна, 02206, Київ, а/с 67 source: EUNIC

in Ukraine. It creates a fake login screen:

It then uses:

https://api.ipify.org to try to get your IP address

https://api.telegram.org to send data to Telegram with retry mechanism

https://submit-form.com to record and send the data typed in

https://dev-fghhtfthh.pantheonsite.io  to send to the hackers own php script

Ultimately harvesting your email address, and your login id/password.

This is obviously something the hacker downloaded and modified for their own use. They then used a fake Gmail login to use a Google server to send this email.

WHY THIS IS SINISTER

What makes this scam effective, is the way this script is written. It background loads the @domain site so that it appears behind the faked login screen.

Imagine that the compromised account is stuartwise@gmail.com so it back-loads the gmail.com page and then dims the page and places the fake login failure on top of it, making it appear legitimate. 

It harvests people’s email address and their password. Although it only seems to compromise the email account, it is worse than that. 65% of people reuse passwords across sites. This means that if one account gets breached, everything else becomes vulnerable.

Imagine if the hacker finds your bank. Uses the same email address and password to login to your bank!

Ha ha! I guess it is true there is no honor among thieves! In the past 12 months—the period the research covers—criminals on the forums have lost more than $2.5 million to other scammers, the analysis says.

Serves them right...

-Stu

https://www.wired.com/story/cybercrime-hackers-scams-forums/

Scammers Are Scamming Other Scammers Out of Millions of Dollars

Nobody is immune to being scammed online—not even the people running the scams. Cybercriminals using hacking forums to buy software exploits and stolen login details keep falling for cons and are getting ripped off thousands of dollars at a time, a new analysis has revealed. And what’s more, when the criminals complain that they are being scammed, they’re also leaving a trail of breadcrumbs of their own personal information that could reveal their real-world identities to police and investigators.

Hackers and cybercriminals often gather on specific forums and marketplaces to do business with each other. They can advertise upcoming work they need help with, sell databases of people’s stolen passwords and credit card information, or tout new security vulnerabilities that can be used to break into people’s devices or systems. However, these deals often don’t go to plan.

The new research, published today by cybersecurity firm Sophos, examines these failed transactions and the complaints people have made about them. “Scammers scamming scammers on criminal forums and marketplaces is much bigger than we originally thought it was,” says Matt Wixey, a researcher with Sophos X-Ops who studied the marketplaces.

Wixey examined three of the most prominent cybercrime forums: the Russian-language forums Exploit and XSS, plus the English-language BreachForums, which replaced RaidForums when it was seized by US law enforcement in April. While the sites operate in slightly different ways, they all have “arbitration” rooms where people who think they’ve been scammed or wronged by other criminals can complain. For instance, if someone purchases malware and it doesn’t work, they may moan to the site’s administrators.

The complaints sometimes lead to people getting their money back, but more often act as a warning for other users, Wixey says. In the past 12 months—the period the research covers—criminals on the forums have lost more than $2.5 million to other scammers, the analysis says. Some people complain about losing as little as $2, while the median scams on each of the sites ranges from $200 to $600, according to the research, which is being presented at the BlackHat Europe security conference.

The scams come in multiple forms. Some are simple, others are more sophisticated. Frequently, there are “rip-and-run” scams, Wixey says, where the buyer doesn’t pay for what they’ve received or the seller gets the money but doesn’t send across what they sold. (These are often known as “rippers.”) Other types of scams involve faked data or security exploits that don’t work: One person on BreachForums claimed a seller tried to send them Facebook data that was already public.

In one extreme incident on the Exploit forum, an account posted a lengthy complaint that they had provided someone with a Windows kernel exploit and hadn’t been paid the $130,000 they had agreed for it. The buyer said they would pay once they had tested the software but never stumped up the cash. “At each stage, he gave different excuses for delaying the payment,” a translated version of the complaint says.

The important things to get out of this:

1. Make sure you access RDP login only after passing a VPN credential challenge.

 

2. Make sure to block those SPAM emails from your user community so they don't get sucked in to handing over credentials, or inadvertently running keylogger programs on their workstation.
 

3. Although they compromised one big player VPN server appliance there are thousands of others that aren't.
 

-Stu

The top three most popular intrusion methods include unsecured RDP endpoints, email phishing, and the exploitation of corporate VPN appliances.

RDP — number one on the list

 At the top of this list, we have the Remote Desktop Protocol (RDP). Reports from Coveware, Emsisoft, and Recorded Future clearly put RDP as the most popular intrusion vector and the source of most ransomware incidents in 2020.

"Today, RDP is regarded as the single biggest attack vector for ransomware," cyber-security firm Emsisoft said last month, as part of a guide on securing RDP endpoints against ransomware gangs.

Statistics from Coveware, a company that provides ransomware incident response and ransom negotiation services, also sustain this assessment; with the company firmly ranking RDP as the most popular entry point for the ransomware incidents it investigated this year.

Further, data from threat intelligence company Recorded Future, also puts RDP firmly at the top.

"Remote Desktop Protocol (RDP) is currently by a wide margin, the most common attack vector used by threat actors to gain access to Windows computers and install ransomware and other malware," Recorded Future threat intel analyst Allan Liska wrote in a report published last week about the danger of ransomware to the US election infrastructure.

Some might think that RDP is today's top intrusion vector for ransomware gangs because of the current work-from-home setups that many companies have adopted; however, this is wrong and innacurate.

RDP has been the top intrusion vector for ransomware gangs since last year when ransomware gangs have stopped targeting home consumers and moved en-masse towards targeting companies instead.

RDP is today's top technology for connecting to remote systems and there are millions of computers with RDP ports exposed online, which makes RDP a huge attack vector to all sorts of cyber-criminals, not just ransomware gangs.

Today, we have cybercrime groups specialized in scanning the internet for RDP endpoints, and then carrying out brute-force attacks against these systems, in attempts to guess their respective credentials.

Systems that use weak username and password combos are compromised and then put up for sale on so-called "RDP shops," from where they're bought by various cybercrime groups.

RDP shops have been around for years, and they are not something new.

However, as ransomware groups migrated from targeting home consumers to enterprises last year, ransomware gangs found a readily available pool of vulnerable RDP systems on these shops -- a match made in heaven.

Today, ransomware gangs are the biggest clients of RDP shops, and some shop operators have even shut down their shops to work with ransomware gangs exclusively, or have become customers of Ransomware-as-a-Service (RaaS) portals to monetize their collection of hacked RDP systems themselves.

VPN appliances — the new RDPs

But 2020 has also seen the rise of another major ransomware intrusion vector, namely the use of VPN and other similar network appliances to enter corporate networks.

Since the summer of 2019, multiple severe vulnerabilities have been disclosed in VPN appliances from today's top companies, including Pulse Secure, Palo Alto Networks, Fortinet, Citrix, Secureworks, and F5.

Once proof-of-concept exploit code became public for any of these vulnerabilities, hacker groups began exploiting the bugs to gain access to corporate networks. What hackers did with this access varied, depending on each group's specialization.

Some groups engaged in nation-level cyber-espionage, some groups engaged in financial crime and IP theft, while other groups took the "RDP shops" approach and re-sold access to other gangs.

While some sparse ransomware incidents using this vector were reported last year, it was in 2020 when we've seen an increasing number of ransomware groups use hacked VPN appliances as the entry point into corporate networks.

Over the course of 2020, VPNs quickly rose as the hot new attack vector among ransomware gangs, with Citrix network gateways and Pulse Secure VPN servers being their favorite targets, according to a report published last week by SenseCy.

Per SenseCy, gangs like REvil (Sodinokibi), Ragnarok, DoppelPaymer, Maze, CLOP, and Nefilim have been seen using Citrix systems vulnerable to bug CVE-2019-19781 as an entry point for their attacks.Similarly, SenseCy says ransomware groups like REvil and Black Kingdom have leveraged Pulse Secure VPNs that have not been patched for bug CVE-2019-11510 to attack their targets.

Per Recorded Future, the latest entry on this list is the NetWalker gang, which appears to have started targeting Pulse Secure systems to deployt their payloads on corporate or government networks where these systems might be installed.

With a small cottage industry developing around hacked RDPs and VPNs on the cybercrime underground, and with tens of cyber-security firms and experts constantly reminding everyone about patching and securing these systems, companies have no more excuses about getting hacked via these vectors.

It's one thing to have an employee fall victim to a cleverly disguise spear-phishing email, and it's another thing not patching your VPN or networking equipment for more than a year, or using admin/admin as your RDP credentials.

Interesting news.

• PEW showing the vast majority of people DON'T use Twitter.
• Nielsen Media Research data showing although Fox News is the top rated news, 99% of people don't watch it.
• CNN has worse numbers..CNN was in last place in total viewers
• More people donated to charities than to political parties.

-Stu

from https://www.axios.com/political-polarization-twitter-cable-news-ac9699c6-260d-4141-b511-5c7193566ea1.html

Most people you meet in everyday life — at work, in the neighborhood — are decent and normal. Even nice. But hit Twitter or watch the news, and you'd think we were all nuts and nasty. 

Why it matters: The rising power and prominence of the nation's loudest, meanest voices obscures what most of us personally experience: Most people are sane and generous — and too busy to tweet. 

Reality check: It turns out, you're right. We dug into the data and found that, in fact, most Americans are friendly, donate time or money, and would help you shovel your snow. They are busy, normal and mostly silent.

• These aren't the people with big Twitter followings or cable-news contracts — and they don't try to pick fights at school board meetings.
• So the people who get the clicks and the coverage distort our true reality. 

Three stats we find reassuring:

1.  75% of people in the U.S. never tweet.
2. On an average weeknight in January, just 1% of U.S. adults watched primetime Fox News (2.2 million). 0.5% tuned into MSNBC (1.15 million).
3. Nearly three times more Americans (56%) donated to charities during the pandemic than typically give money to politicians and parties (21%).