matt_markfort – Matt Markfort's Blog

Career Phishing Scams

For the past few months, I have been focused on getting a job so that when my loans come due, I will have something to pay for them. I’ve also been receiving phishing scams for jobs. You can tell they’re scams because they almost always follow these steps.

First, they email you directly. And the funny part is that they also email a previous email so you’ll see their first attempts. They almost always come from <company>careers.com for their domain.

Next, their domain has been recently been registered, like within the past week. If you run a whois search result on <company>careers.com, it often returns with a registered date within a week of the email. Also, when you go to this domain for a website, you’ll find that it hasn’t been configured for a web site.

Finally, their domain’s MX record is registered with smtp.google.com as their solitary mail exchange record. For example,

$ dig MX firstfincapcareers.com

; <<>> DiG 9.18.28-1~deb12u2-Debian <<>> MX firstfincapcareers.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55310
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;firstfincapcareers.com.                IN      MX

;; ANSWER SECTION:
firstfincapcareers.com. 7207    IN      MX      1 SMTP.GOOGLE.com.

;; Query time: 76 msec
;; SERVER: 192.168.50.1#53(192.168.50.1) (UDP)
;; WHEN: Tue Nov 19 14:42:29 CST 2024
;; MSG SIZE  rcvd: 79

In conclusion, don’t reply to these phishing scams. They’re disingenuous and can leak data.

Concluding Thoughts – Week 15

As I am privately hosting this blog, I’ll at least maintain it for the next semester to permit any referencing of it. After next semester, I will decide whether to maintain this blog for the foreseeable future or whether I’ll try and archive and set the host offline.

For those of you interested in the technicalities of this blog, the following items were used in its construction:

FreeBSD
FreeBSD jail
nginx
- As a reverse proxy at my firewall, and
- As a jail-hosted daemon
WordPress
PHP packages
MySQL/MariaDB
NoIP DyDNS
Certbot HTTPS Certificate and internal SSL certificate fun
VLANs and other networking know-how

I hope you have a Happy Holiday season, and I wish you the best of luck toward your future aspirations.

If you have any job hook-ups, please email me if you think that I’d be a great fit; I am on the market for a job or internship. I am taking my F5 Certified Administrator exam this Monday, December 11th for the 3rd time (as a renewal candidate). You can also connect with me on LinkedIn at: https://www.linkedin.com/in/matthewmarkfort

Nothing About E2E Encryption – Week 13

Nothing, the vendor of Nothing Chat a re-skin of Sunbird app, was discovered to provide a subpar E2E encryption chat app for Android users, in this ArsTechnica.com article: https://arstechnica.com/gadgets/2023/11/nothings-imessage-app-was-a-security-catastrophe-taken-down-in-24-hours/ Nothing has suspended their app, until they can fix their security issues, which were discovered by the broader Internet community.

The following issues were identified with Nothing’s E2E app:

Apple ID and password shared with site,
Sunbird actually logged and stored messages in plain text on both the error reporting software Sentry and in a Firebase store,
Authentication tokens were sent over unencrypted HTTP (TCP-80/HTTP) so this token could be intercepted and used to read your messages, and
“When a message or an attachment is received by a user, they are unencrypted on the server side until the client sends a request acknowledging, and deleting them from the database. This means that an attacker subscribed to the Firebase Realtime DB will always be able to access the messages before or at the moment they are read by the user.”

Conclusion

Per the article, “Içöz recommends that any Sunbird/Nothing Chat users change their Apple password now, revoke Sunbird’s session, and ‘assume your data is already compromised.'” Frankly, I’m amazed the Apple and Play Store don’t start having developers answer a quiz to determine whether their app merits posting into their “Walled Garden,” but perhaps, they already do and this is merely a response by the Internet community that does check each apps claims regarding “security standards” or claims.

For those interested, there are several things they should be ensuring (encryption) secure data “at rest,” “in use” (in memory), and “in motion.”

Security “at rest” is as you’d expect. It ensures that the data stored on the hard drive, when it’s not part of the “hot”/”active” data set is properly encrypted and secured. Security “in use” (or in memory) is ensuring that snooping can’t occur while the user is using it; it’s often associated with sessions. Unfortunately, the Intel Spectre, Intel Meltdown, and “AMD RETbleed” vulnerabilities open this problem because if the processor can be attacked to divulge data in (active) memory, all data on the system is vulnerable. In some cases, Intel or AMD can release microcode for x86 Chipset architectures so check with your motherboard vendor to ensure proper U/EFI (or BIOS) patching; ARM/RISC-V systems haven’t been identified as being vulnerable to these attacks, yet. And finally, security “in motion” is associated with transport data; security on this perspective is often handled through TLS/SSL encryption of the transport layer within the TCP/IP stack.

Maine Hit by MOVEit Supply Chain Attack – Week 12

On November 9th, APNews reports that Maine has informed resident-users that a MOVEit attack caused a breach. In October, 9to5mac.com wrote about a MOVEit 0day that was making in-roads.

Ransomware is now implementing a double-extortion method to get victims to pay its ransoms. Normally, a company or organization might be able to restore from a backup and thereby avoid paying the ransom that was requested for them to restore their services; however, ransomware is now adding the threat of release of information, if that ransom hasn’t been paid.

In 9to5Mac’s 2023 State of Ransomware, the USA is considered the highest target with ransomware. It is 7x more likely to be targeted with ransomware than the next highest countries. Here’s Malwarebytes’ assessment on why CL0P is outpacing Lockbit:

The drive behind the sudden change? CL0P used separate zero-days in GoAnywhere MFT and MOVEit Transfer to gain an edge. This gave them the ability to launch an unprecedented number of attacks within a short time frame and across a massive scale.

The use of zero-day vulnerabilities by ransomware groups like CL0P may trigger a significant shift in ransomware strategies, mirroring the adoption of the “double extortion” tactic in 2019.
Malwarebytes, https://9to5mac.com/2023/08/04/us-number-one-for-ransomware-attacks/

Unfortunately, I don’t foresee any of this easing up. With ransomware crews achieving successes, they’ll probably continue with this activity. In some areas online, I’m starting to hear that the best recommendation (due to these breaches of information) is to freeze your credit, and unthaw it temporarily when shopping. Why is this becoming a common recommendation? With so many breaches, it’s more probable that your information is available. It might also be helpful if the government would implement some protections with teeth to increase the deterrence.

iOS 17 Users Are Vulnerable to Bluetooth Flipper Zero SPAM Flood Attacks – Week 11

TL;DR – The only method to avoid this attack, while on iOS 17, is to disable Bluetooth per https://www.theverge.com/2023/11/3/23944901/apple-iphone-ios-17-flipper-zero-attack-bluetooth The good news is that previous versions of iOS, such as 16, have not been demonstrated to be vulnerable.

The Flipper Zero, touted as a Swiss Army knife for radio attacks, has demonstrated that with a custom firmware on the Flipper Zero, it can attack unsuspecting iOS 17 users.

Van der Ham discovered that the attacker, another passenger on the train, was using a Flipper Zero device with custom firmware to send a combination of Bluetooth low energy (BLE) alerts to nearby iPhone handsets running iOS 17

The Flipper Zero is “a small orange and white plastic gadget with a 1.4-inch display that looks like it could be a child’s toy. The Flipper Zero is a multi-tool for hacking, as it talks to sub-1GHz devices like old garage doors, RFID devices, NFC cards, infrared devices, and of course, Bluetooth devices.”

Although the article is geared toward awareness of iOS users, Android and Windows laptop users can also experience a similar issue; however, Android and Windows users are less likely to require a restart. “On Android, head to Settings → Google → Nearby Share, and turn the toggle on Show notification to the ‘Off‘ position.”

Passkeys – Week 10

In recent news, Amazon is allowing users to adopt passkeys. I wanted to understand a little more about Passkeys, and how Passkeys are supposed to work.

What About Passwords?

Passwords are currently here to stay, and you should still exercise good password hygiene. Good password hygiene/protocol can be summarized as follows:

Create strong passwords
Avoid repeating passwords
Do not share passwords
Avoid leaving passwords in unsafe areas — don’t write them on a memo pad
Use a Password Manager, whenever possible

About Creating Strong Passwords

Strong passwords have entropy, basically the probability of a hacker determining the password. Password policies seek to curb users toward creating better passwords by increasing the symbol selection: letters, digits, and symbols. But that’s part of the battle. To decrease the chance of determining passwords, users should also create passwords over 8 characters, and they should avoid easily guessable ones as well.

How Passkeys Work

In the simplest explanation, it works similarly to public-key infrastructure whereby it uses asymmetric encryption. Asymmetric encryption works by using two keys: a private key and a public key. A real-life demonstration of asymmetric encryption is SSL/TLS used on Web sites connecting over HTTPS. The public key is used to encrypt the message and the private key decrypts the message.

So, since the Passkey system creates this asymmetric key pair, it alleviates the user of trying to formulate a strong cryptographic key. It is also very difficult for hackers to gain access to it since the private key is stored on the device’s keychain, and the Passkey system creates a new key pair during initial configuration. As it’s kept on the device’s keychain, it might be prone to loss of device or device failure, which is where cloud services can help by using things like Apple’s iCloud and similar for each mobile vendor.

Conclusion

Although I am optimistic of this new method of authentication, I do have apprehension, and I hope that the restoration methods are well-documented. I’m sure passwords and MFA (multi-factor authentication) will remain as a feasible restore procedure for a while.

One issue that is an omnipresent problem is user adoption and user education. Users have a diverse set of backgrounds, and the common user “just wants it to work” and they really don’t care how. Plus, there are users who will be apprehensive of adopting new methods of authentication, and additionally, they’re probably confidently locked (and/or obstinate) into their “tried-and-true method.”

The next hurdle is also adoption by companies deploying them. It takes training, and I’ve seen some really complicated deployments for something as seemingly simple as multi-factor authentication — for whatever reason, possibly poor design by the vendor?

Anyhow, it may be slow or fast adoption. Data breaches of client information may intimidate some to the switch, but not everyone will switch. We shall see how this goes.

DHS (Department of Homeland Security) Confirms Your Privacy Is No Longer Safe – Week 9

In ComputerWorld’s article, https://www.computerworld.com/article/3708251/homeland-security-confirms-your-privacy-is-no-longer-safe.html, they confirm that some Federal departments have not been successful at protections articulated in E-Government Act of 2002 and the Homeland Security Act of 2002.

There are no remediation yet; however, users can go into their Location Services and ensure that apps are only permitted access to Location Services, as appropriate. Ideally, you should work from a positive security model and lock them all down and return their permissions as they come up and are vetted, but that seems very challenging. I’m surprised, at this point, Google and Apple’s Cloud service doesn’t have an applet to modify certain privacy settings more easily.

“Let’s Encrypt” Pros and Cons – Week 8

There are plenty of old blog posts on the Internet regarding its benefits from an administrator point, but I want to speculate about the pros and cons from the perspective of a malicious actor.

Let’s Encrypt through its certbot or ACME client program allows an administrator to spin up a web site and achieve TLS from the Internet. It helps low budget administrators get certificates for their Web sites, which are recognize by a registered 3rd Party certification authority. This permits Web sites, such as my own to have a valid Web site. It also does so in an automated manner, meaning it’s also low touch from an administration stand point — effectively, set it and forget it.

What is ACME (certbot)?

In order to speculate on the pros and cons, let’s review what the ACME/certbot program allows an administrator to do. Once the Web site and its hosting/service software has been configured, the administrator then configures the certbot. The certbot is a utility software on the server that connects to the Let’s Encrypt servers, submits its certificate request, receives the signed certificate, updates the Web server service/daemon configuration, and then restarts or reloads the services.

Pros/Benefits

Low cost

When you configure your certbot, you need at least four things:

an email address,
a valid DNS hostname,
Internet address, and
administrative know-how.

An email addresses can be free, or it can be part of an organization; effectively, it allows Let’s Encrypt (as an organization) to contact the administrator if an issue is detected with the certificates or other communications. Email addresses are so easy to come by, it’s one of the many reasons for the proliferation of SPAM email. It can also be spoofed, and I receive many “malformed” emails so through compatibility reasons, it’s easy to even masquerade. If I were Let’s Encrypt, I’d add a verification step whereby the certificate isn’t registered when the administrator or user doesn’t validate it.

A valid DNS is fairly cheap, and for hosts within DHCP-assigned pools — like many ISPs, you can purchase Dynamic DNS. I did, and I am using it for genuine services. Do you like my blog? Generally, the certbot works by coordinating its signing using the host name in the request, like a callback. So, as long as the DNS host name has a forward resolving address, it’ll work fine with certbot.

The Internet address is a given so long as it’s globally accessible. RFC 1918, and other private IP address spaces, won’t work; however, the host can have a private address, and as long as the firewall permits port forwarding, the certbot should have little issue configuring the site.

Everybody can search the Web using Google, or another Web search service. There is an abundant amount of How-To blogs. Also, there are a lot of YouTube videos that can walk through configuration steps. Additionally, the certbot also comes with manual pages. Once you’ve installed the Web host, and the certbot, you can read the manual via man certbot I will say that understanding networks and having practice is greatly beneficial. Ultimately, the issue of “administrative know-how” boils down to time and practice.

Low “touch” and/or hands free

Once the certbot has been configured, all you need to do is run it on a periodic basis to refresh the certificates. I have a cron task that checks in with Let’s Encrypt on a weekly basis. If the certbot needs to change the certificate because it expired, it does so during check-in. There are also protocols for when a certificate or key becomes compromised; that’s not really hands free, but it’s there.

Provides Valid TLS Certificates

In the link that I provide, certbot does sign valid certificates. Common browsers, such as Mozilla Firefox, Google Chrome, Microsoft Edge, and etc, have Let’s Encrypt as a valid Certificate Authority. The link also talks about the difference between EV, OV, and DV; these are Domain Validation (DV), Organization Validation (OV), and Extended Validation (EV). In certbot’s basic form, it will perform Domain Validation; that is, during configuration, the Let’s Encrypt server will connect back to the host and perform some Web requests. When I was using relayd and httpd (on OpenBSD), I had to ensure that a path requested by certbot would not get an HTTP/302 Redirect while it performed these activities.

Quick Host Name Changes

As part of my dynamic DNS, I could register up to 25 host names. This is a fairly large pool, and when I spun up this WordPress instance, it didn’t take much to update certbot — merely updating the Web VirtualHosts and re-run the certbot.

Cons/Problems

Administrative Complexity

Again, from a malicious/offensive platform, spinning up a host, configuring its services, configuring the certbot, and possibly purchasing DNS and registrar is going to be costly. Some of it can be reduced, namely it could be possible to script these deployments so it can be pipelined; it can be reduced using CMS — like Ansible, but that’s added complexity. Or you could containerize the malicious deployment, which reduces spin up time and can simply be deployed on a container service.

“Paper Trail”

The registrar portion is the most paper trailing part of this — usually involving some form of credit card, and if a SaaS is used, it would also create a paper trail. It is possible to play a shell game, but that’s difficult.

Slow Reaping of Host Names

Since I haven’t attempted to spin down a host name, yet, I can’t comment about how long it takes to reap a host name. If I had to guess, Let’s Encrypt should invalidate and re-issue a new certificate once the Subject Alternative Name field needs updating. It wouldn’t surprise me if too many host name changes on Dynamic DNS causes a red flag to be risen, and I haven’t tested that to see if there are any limits. It may be articulated in a privacy policy, but I’d need to re-read them.

Easy Target to (D)DoS

If the host is done privately, on a private premises, denial-of-service would be very easy to apply on a single host. This is why IaaS is often preferred because the services generally offer some (D)DoS protection. Once the forwarding resolution name has been claimed, it basically helps attackers; it, effectively, paints a bullseye on the perpetrator when hosted privately.

Conclusion

It feels as though using certbot and dynamic or traditional DNS would lead to a higher probability of detection and mitigation by Blue Teams. If I were a Red Team crew hosting some node for collecting reconnaissance, I’d definitely try poisoning Web hosts by implementing some XSS or other persistence method. Most users don’t pay much attention, as long as the Web host has a green light, and this passivity on end-users is often coupled with few methods of reporting the situation. There is no Help Desk and CISO for the Web.

Thousands of Android/TV Ship with Malware – Week 7

It would appear that the supply chain has come under attack again for Android users, https://arstechnica.com/security/2023/10/thousands-of-android-devices-come-with-unkillable-backdoor-preinstalled/ And it’s confirmed by MalwareBytes: https://www.malwarebytes.com/blog/news/2023/01/preinstalled-malware-infested-t95-tv-box-from-amazon

Indicators of Compromise

Root Access

It would appear that in the Android About system settings, a “root switch” has been added to compromised devices. If this is found, then it’s safe to initiate a return or replacement.

Shell Games

If you connect to the device to adb, and you run the shell utility. The compromised systems (via adb shell pm list packages -f) are identifying as “walleye” within the shell, which is an old Google Pixel 2

CoreJava Directories Ought Not Be There

On the Android’s filesystems, compomised hosts have a directory called: /data/system/Corejava. It contains malicious file objects, Looking at the VirusTotal results of the Corejava classes.dex found in my own T95 TV box aligned with it being a Trojan Downloader. The clearest evidence of this were URLs in the code. One of them was a malicious URL associated with other malicious DEX files and APKs:

hxxps://dy.kr.wildpettykiwi.info/dykr/update

Conclusion

The MalwareByes article: https://www.malwarebytes.com/blog/news/2023/01/preinstalled-malware-infested-t95-tv-box-from-amazon offers steps to remediate this on the compromised device. Despite the fact that this may be a dirty deal, it seems common for unsuspecting users on a budget to fall victim to these attacks.