Mar 18 2024
Welcome to Gone Phishing, your daily cybersecurity newsletter that wants to see a bloodbath… For the cybercrime industry 😂 #context #Trump #NPCs 🙈🙈🙈
Today’s hottest cybersecurity news stories:
📈 RisePro info stealer spreads via cracked software on GitHub 👾
🧠 Modern CPUs affected by newly discovered GhostRace flaw 👻
🏠 There’s no place like Chrome. Introducing real-time URL protection 🛡️
Cybersecurity researchers have uncovered a series of GitHub repositories housing cracked software, serving as a platform for the distribution of an information stealer known as RisePro. The campaign, dubbed "gitgub," consisted of 17 repositories associated with 11 different accounts.
💾 These repositories, which have since been removed, featured a README.md file promising free cracked software. Notably, the threat actors added four green Unicode circles to the README.md file, mimicking the appearance of status indicators and lending an air of legitimacy. Each repository pointed to a download link hosted on "digitalxnetwork[.]com," containing a RAR archive file.
🗃️ This archive, requiring a password mentioned in the repository's README.md file, contained an installer file that unpacked the next-stage payload—an executable file inflated to 699 MB to thwart analysis tools. The injected RisePro (version 1.6) malware, written in C++, is designed to gather sensitive information from infected hosts and transmit it to two Telegram channels.
🛠️ This method allows threat actors to efficiently extract victims' data. This discovery coincides with Splunk's disclosure of Snake Keylogger's tactics, highlighting the prevalence of stealer malware. Snake Keylogger employs various techniques, including FTP, SMTP, and integration with Telegram, to exfiltrate stolen data in real-time.
🤏 Stealer malware like RisePro and Snake Keylogger have become increasingly common, serving as primary vectors for high-impact data breaches. Reports indicate a surge in the use of stealers, with RedLine, Vidar, and Raccoon being among the most prolific, collectively responsible for millions of compromised passwords.
🐒 As cyber threats evolve, the prominence of information-stealing malware underscores the need for robust cybersecurity measures. Threat actors continually adapt, making stealers more accessible and easier to deploy, emphasising the importance of proactive defence strategies. 🛡️💪
Learn AI in 5 minutes a day. We'll teach you how to save time and earn more with AI. Join 400,000+ free daily readers for trending tools, productivity boosting prompts, the latest news, and more.
A new data leakage threat, GhostRace (CVE-2024-2193), has been uncovered by researchers affecting modern CPUs with speculative execution support. It's a variation of Spectre v1, combining speculative execution and race conditions.
🔒 Common synchronisation methods using conditional branches can be bypassed, creating Speculative Race Conditions (SRCs), allowing attackers to leak data.
🔬 Discovered by IBM Research Europe and VUSec, GhostRace follows SLAM, another side-channel attack revealed in December 2023.
🛡️ Spectre exploits CPU optimizations, letting attackers access privileged data. Though speculative execution boosts performance, errors leave traces attackers can exploit.
👥 GhostRace stands out as it lets unauthenticated attackers extract data via race conditions, accessing speculative code paths.
💻 Mitigation steps include following existing Spectre guidance, with AMD recommending continued measures. Xen hypervisor has introduced hardening patches as a precaution.
🔒 Stay vigilant! Any software relying on conditional branches may be vulnerable. Follow updates from security advisories for protection.
🃏 The Motley Fool: “Fool me once, shame on — shame on you. Fool me — you can't get fooled again.” Good ol’ George Dubya 😂 Let us tell who’s not fooling around though; that’s the Crüe 👀 at Motley Fool. You’d be a fool (alright, enough already! 🙈) not to check out their Share Tips from time to time so your savings can one day emerge from their cocoon as a beautiful butterfly! 🐛 Kidding aside, if you check out their website they’ve actually got a ton of great content with a wide variety of different investment ideas to suit most budgets 🤑 (LINK)
🚵 Wander: Find your happy place. Cue Happy Gilmore flashback 🏌️⛳🌈🕊️ Mmmm Happy Place… 😇 So, we’ve noticed a lot of you guys are interested in travel. As are we! We stumbled upon this cool company that offers a range of breath-taking spots around the United States and, honestly, the website alone is worth a gander. When all you see about the Land of the free and the home of the brave is news of rioting, looting and school shootings, it’s easy to forget how beautiful some parts of it are. The awe-inspiring locations along with the innovative architecture of the hotels sets Wander apart from your run of the mill American getaway 🏞️😍 (LINK)
🌊 Digital Ocean: If you build it they will come. Nope, we’re not talking about a baseball field for ghosts ⚾👻🍿 (Great movie, to be fair 🙈). This is the Digital Ocean who’ve got a really cool platform for building and hosting pretty much anything you can think of. If you check out their website you’ll find yourself catching the buzz even if you can’t code (guilty 😑). But if you can and you’re looking for somewhere to test things out or launch something new or simply enhance what you’ve got, we’d recommend checking out their services fo’ sho 😉 And how can you not love their slogan: Dream it. Build it. Grow it. Right on, brother! 🌿 (LINK)
🔒 Google has unveiled an upgraded version of Safe Browsing, ensuring instant, privacy-focused defence against potentially harmful websites.
🔍 "Chrome's desktop and iOS versions now offer Standard protection, checking sites in real-time against Google's list of known malicious sites," stated Jonathan Li and Jasika Bawa from Google.
⚠️ Users receive warnings if a site poses a risk, with this real-time check expected to block 25% more phishing attempts.
🔄 Previously, Chrome used local lists of unsafe sites, updated every 30-60 mins. Now, real-time checks occur to combat the rapid growth of harmful sites, with 60% of phishing domains lasting less than 10 mins.
📡 With the new system, every website visit undergoes checks against global and local caches, with URLs obfuscated into hashed prefixes for privacy.
🔐 Safe Browsing servers decrypt and match these prefixes, issuing warnings if a match is found.
🌐 Crucially, Google employs an Oblivious HTTP (OHTTP) relay to ensure user privacy, preventing correlation between URL checks and browsing history.
🔒 Your browsing activity remains private, with no single party having access to both your identity and hashed prefixes.
💻 Stay protected while browsing with Google's enhanced Safe Browsing! Thanks for reading, cyber squad. Catch you on the flipside 😉
Every few weeks, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!
🛡️ Tl;dr sec: Join 30,000+ security professionals getting the best tools, blog posts, talks, and resources right in their inbox for free every Thursday 📅
💵 Crypto Pragmatist: Crypto made simple. Actionable alpha in 5 minutes, 3x a week. Join 47,000+ investors and insiders, for 🆓
📈 Bitcoin Breakdown: The best in Bitcoin, carefully curated by an alien from the future 👾
Let us know what you think!
So long and thanks for reading all the phish!
