The US Federal Bureau of Investigations said today that the operators of the Cuba ransomware have earned at least $43.9 million from ransom payments following attacks carried out this year. From a report: In a flash alert sent out on Friday, the Bureau said the Cuba gang has "compromised at least 49 entities in five critical infrastructure sectors, including but not limited to the financial, government, healthcare, manufacturing, and information technology sectors." The FBI said it traced attacks with the Cuba ransomware to systems infected with Hancitor, a malware operation that uses phishing emails, Microsoft Exchange vulnerabilities, compromised credentials, or RDP brute-forcing tools to gain access to vulnerable Windows systems. Once systems are added to their botnet, Hancitor operators rent access to these systems to other criminal gangs in a classic Malware-as-a-Service model. While an April 2021 McAfee report on the Cuba ransomware found no connection between the two groups, the FBI report highlights what appears to be a new partnership between MaaS providers and ransomware gangs after other ransomware operations struck similar partnerships throughout 2020.

Microsoft is backtracking on changes it made to Windows 11 that made it more difficult to switch default browsers. From a report: A new test build of Windows 11 now allows users of Chrome, Firefox, and other browsers to set a default browser with a single button, which is a far simpler process. Rafael Rivera, developer of the excellent EarTrumpet Windows app, discovered the new Windows 11 changes earlier this week. Instead of having to change individual file extensions or protocol handlers for HTTP, HTTPS, .HTML, and .HTM, Windows 11 now offers a simple button that lets people switch default browsers in a similar way to Windows 10. Microsoft has confirmed the changes are intentional and are currently being tested. "In the Windows 11 Insider Preview Build 22509 released to the Dev Channel on Wednesday, we streamlined the ability for a Windows Insider to set the 'default browser' to apps that register for HTTP:, HTTPS:, .HTM, and .HTML," explains Aaron Woodman, vice president of Windows marketing, in a statement to The Verge. "Through the Windows Insider Program you will continue to see us try new things based on customer feedback and testing."

Long-time Slashdot reader tinskip shares a report from BleepingComputer: Nickolas Sharp, a former employee of networking device maker Ubiquiti, was arrested and charged today with data theft and attempting to extort his employer while posing as a whistleblower and an anonymous hacker. "As alleged, Nickolas Sharp exploited his access as a trusted insider to steal gigabytes of confidential data from his employer, then, posing as an anonymous hacker, sent the company a nearly $2 million ransom demand," U.S. Attorney Damian Williams said today. "As further alleged, after the FBI searched his home in connection with the theft, Sharp, now posing as an anonymous company whistleblower, planted damaging news stories falsely claiming the theft had been by a hacker enabled by a vulnerability in the company's computer systems."

According to the indictment (PDF), Sharp stole gigabytes of confidential data from Ubiquiti's AWS (on December 10, 2020) and GitHub (on December 21 and 22, 2020) infrastructure using his cloud administrator credentials, cloning hundreds of GitHub repositories over SSH. Throughout this process, the defendant tried hiding his home IP address using Surfshark's VPN services. However, his actual location was exposed after a temporary Internet outage. To hide his malicious activity, Sharp also altered log retention policies and other files that would have exposed his identity during the subsequent incident investigation. "Among other things, SHARP applied one-day lifecycle retention policies to certain logs on AWS which would have the effect of deleting certain evidence of the intruder's activity within one day," the court documents read.

After Ubiquiti disclosed a security incident in January following Sharp's data theft, while working to assess the scope and remediate the security breach effects he also tried extorting the company (posing as an anonymous hacker). His ransom note demanded almost $2 million in exchange for returning the stolen files and the identification of a remaining vulnerability. The company refused to pay the ransom and, instead, found and removed a second backdoor from its systems, changed all employee credentials, and issued the January 11 security breach notification. After his extortion attempts failed, Sharp shared information with the media while pretending to be a whistleblower and accusing the company of downplaying the incident. This caused Ubiquiti's stock price to fall by roughly 20%, from $349 on March 30 to $290 on April 1, amounting to losses of over $4 billion in market capitalization.

An anonymous reader quotes a report from Ars Technica: Blockchain startup MonoX Finance said on Wednesday that a hacker stole $31 million by exploiting a bug in software the service uses to draft smart contracts. The company uses a decentralized finance protocol known as MonoX that lets users trade digital currency tokens without some of the requirements of traditional exchanges. "Project owners can list their tokens without the burden of capital requirements and focus on using funds for building the project instead of providing liquidity," MonoX company representatives say here. "It works by grouping deposited tokens into a virtual pair with vCASH, to offer a single token pool design."

An accounting error built into the company's software let an attacker inflate the price of the MONO token and to then use it to cash out all the other deposited tokens, MonoX Finance revealed in a post. The haul amounted to $31 million worth of tokens on the Ethereum or Polygon blockchains, both of which are supported by the MonoX protocol. Specifically, the hack used the same token as both the tokenIn and tokenOut, which are methods for exchanging the value of one token for another. MonoX updates prices after each swap by calculating new prices for both tokens. When the swap is completed, the price of tokenIn -- that is, the token sent by the user -- decreases and the price of tokenOut -- or the token received by the user -- increases.

By using the same token for both tokenIn and tokenOut, the hacker greatly inflated the price of the MONO token because the updating of the tokenOut overwrote the price update of the tokenIn. The hacker then exchanged the token for $31 million worth of tokens on the Ethereum and Polygon blockchains. There's no practical reason for exchanging a token for the same token, and therefore the software that conducts trades should never have allowed such transactions. Alas, it did, despite MonoX receiving three security audits this year. "These kinds of attacks are common in smart contracts because many developers do not put in the legwork to define security properties for their code" said Dan Guido, an expert in securing smart contracts and CEO of security consultancy Trail of Bits. "They had audits, but if the audits only state that a smart person looked at the code for a given period of time, then the results are of limited value. Smart contracts need testable evidence that they do what you intend, and only what you intend. That means defined security properties and techniques employed to evaluate them."

According to Blockchain researcher Igor Igamberdiev, the drained tokens included $18.2 million in Wrapped Ethereum, $10.5 in MATIC tokens, and $2 million worth of WBTC, along with small amounts of tokens for Wrapped Bitcoin, Chainlink, Unit Protocol, Aavegotchi, and Immutable X.

Microsoft is starting to roll out its new Office UI to all users this week. The visual update was originally announced earlier this year and went into testing over the summer. Now it's starting to roll out to all Office 365 and Office 2021 users. From a report: This new Office UI is designed to match the visual changes in Windows 11, and it includes a more rounded look to the Office ribbon bar, with some subtle tweaks to the buttons throughout Word, Excel, PowerPoint, and Outlook. It's a relatively simple refresh, and Office will now match the dark or light theme that you set inside Windows. The new look can be toggled on or off using the Coming Soon megaphone icon in the top right-hand corner of Word, Excel, PowerPoint, or OneNote.

The prevailing narrative about tech workers assumes that they have more power than ever before. This even has a term -- the Great Resignation. But at the booming, much-revered payments company Stripe, some applicants have found themselves accepting job offers only to learn they have been rescinded without warning. From a report: Protocol spoke with two Stripe candidates who received either verbal or written offers from the company and then had those offers revoked because of "shifting business priorities." (We reviewed their communications with Stripe recruiters, including the offer letter, to confirm the candidates' stories). Protocol also spoke with a former Stripe recruiter who described the company as embracing a "hire and fire" mentality and constantly shifting priorities and reorganizing staff. All three of these sources were granted anonymity for fear of repercussions by their current and potential future employers. Protocol also reviewed multiple online complaints detailing similar rescinded offers; the most prominent of these complaints was posted on Hacker News and received a rousing defense of Stripe from Coinbase CEO Brian Armstrong.

"We want everyone who interacts with Stripe during a recruiting process to be treated professionally and with respect. We value feedback and are always looking for ways to improve our recruiting experience," a Stripe spokesperson wrote to Protocol. Stripe, which has the highest valuation of any private, venture-backed tech company in the U.S., has grown so rapidly over the last few years that many engineers and other tech workers see it as one of the most desirable, successful places to work. The former recruiter interviewed by Protocol said that she chose the job over offers at Google and two other tech companies, in part because of the extremely positive and enthusiastic way the company was sold to her and because of Stripe's reputation in the industry.

Thousands of networking devices belonging to AT&T Internet subscribers in the US have been infected with newly discovered malware that allows the devices to be used in denial-of-service attacks and attacks on internal networks, researchers said on Tuesday. From a report: The device model under attack is the EdgeMarc Enterprise Session Border Controller, an appliance used by small- to medium-sized enterprises to secure and manage phone calls, video conferencing, and similar real-time communications. As the bridge between enterprises and their ISPs, session border controllers have access to ample amounts of bandwidth and can access potentially sensitive information, making them ideal for distributed denial of service attacks and for harvesting data.

Researchers from Qihoo 360 in China said they recently spotted a previously unknown botnet and managed to infiltrate one of its command-and-control servers during a three-hour span before they lost access. "However, during this brief observation, we confirmed that the attacked devices were EdgeMarc Enterprise Session Border Controller, belonging to the telecom company AT&T, and that all 5.7k active victims that we saw during the short time window were all geographically located in the US," Qihoo 360 researchers Alex Turing and Hui Wang wrote. They said they have detected more than 100,000 devices accessing the same TLS certificate used by the infected controllers, an indication that the pool of affected devices may be much bigger. "We are not sure how many devices corresponding to these IPs could be infected, but we can speculate that as they belong to the same class of devices the possible impact is real," they added.

Over 300,000 Android smartphone users have downloaded what turned out to be banking trojans after falling victim to malware that has bypassed detection by the Google Play app store. ZDNet reports: Detailed by cybersecurity researchers at ThreatFabric, the four different forms of malware are delivered to victims via malicious versions of commonly downloaded applications, including document scanners, QR code readers, fitness monitors and cryptocurrency apps. The apps often come with the functions that are advertised in order to avoid users getting suspicious. In each case, the malicious intent of the app is hidden and the process of delivering the malware only begins once the app has been installed, enabling them to bypass Play Store detections.

The most prolific of the four malware families is Anatsa, which has been installed by over 200,000 Android users -- researchers describe it as an "advanced" banking trojan that can steal usernames and passwords, and uses accessibility logging to capture everything shown on the user's screen, while a keylogger allows attackers to record all information entered into the phone. [...] The second most prolific of the malware families detailed by researchers at ThreatFabric is Alien, an Android banking trojan that can also steal two-factor authentication capabilities and which has been active for over a year. The malware has received 95,000 installations via malicious apps in the Play Store. [...] The other two forms of malware that have been dropped using similar methods in recent months are Hydra and Ermac, which have a combined total of at least 15,000 downloads. ThreatFabric has linked Hydra and Ermac to Brunhilda, a cyber-criminal group known to target Android devices with banking malware. Both Hydra and Ermac provide attackers with access to the device required to steal banking information. ThreatFabric has reported all of the malicious apps to Google and they've either already been removed or are under review.

An anonymous reader quotes a report from Motherboard: When a scammer wants to set up an account on Amazon, Discord, or a spread of other online services, sometimes a thing that stands in their way is SMS verification. The site will require them to enter a phone number to receive a text message which they'll then need to input back into the site. Sites often do this to prevent people from making fraudulent accounts in bulk. But fraudsters can turn to large scale, automated services to lease them phone numbers for less than a cent. One of those is 5SIM, a website that members of the video game cheating community mention as a way to fulfill the request for SMS verification.

Various YouTube videos uploaded by the company explain how people can use its service explicitly for getting through the SMS verification stage of various sites. The videos include instructions specifically on PayPal, Instagram, Facebook, Telegram, and dating site Plenty of Fish. Instagram told Motherboard it is concerned by sites that suggest people can use services to bypass Instagram's measures to then abuse the platform. Instagram said it uses SMS verification to prevent the creation of fake accounts and to make account recovery possible. "We have many measures in place to protect against scripted account creation and block millions of fake accounts at registration every day," an Instagram spokesperson said.

Some online services don't allow users to perform SMS verification with VoIP numbers, presumably in an effort to mitigate against fraud. 5SIM's numbers, however, are just like ordinary phone numbers, the site claims. When people buy 5SIM's services, they must only use it for receiving texts related to an online account. "Different SMS will [be] rejected," the website adds. 5SIM also offers an API to automate parts of the service. 5SIM's rules say that customers are "Forbidden to use the service for any illegal purposes as well as not to take actions that harm the service and (or) third parties." The website also includes a denylist of words that its service may block. In an email to Motherboard, 5SIM said: "5sim service is prohibited to use for illegal purposes. In cases, where fraudulent operations with registered accounts are detected, restrictions may be imposed on the 5sim account until the circumstances are clarified. 5sim is used by those who want to get a discount or bonus, webmasters, SMM specialists, owners of business for advertising and increasing business loyalty."

An anonymous reader quotes a report from the Record: A recently discovered FBI training document shows that US law enforcement can gain limited access to the content of encrypted messages from secure messaging services like iMessage, Line, and WhatsApp, but not to messages sent via Signal, Telegram, Threema, Viber, WeChat, or Wickr. The document, obtained earlier this month following a FOIA request filed by Property of the People, a US nonprofit dedicated to government transparency, appears to contain training advice for what kind of data agents can obtain from the operators of encrypted messaging services and the legal processes they have to go through.

Dated to January 7, 2021, the document doesn't include any new information but does a good job at providing an up-to-date summary of what type of information the FBI can currently obtain from each of the listed services. [...] While the document confirms that the FBI can't gain access to encrypted messages sent through some services, the other type of information they can glean from providers might still help authorities in other aspects of their investigations. The content of the document, which may be hard to read due to some font rendering issues, is also available in the table [embedded in the article]. Of note, the table above does not include details about Keybase, a recent end-to-end encrypted (E2EE) service that has been gaining in popularity. The service was acquired by video conferencing software maker Zoom in May 2020.

Finland is working to stop a flood of text messages of an unknown origin that are spreading malware. From a report: The messages with malicious links to malware called FluBot number in the millions, according to Aino-Maria Vayrynen, information security specialist at the National Cyber Security Centre. Telia Co AB, the country's second-biggest telecommunications operator, has intercepted some hundreds of thousands of messages. "The malware attack is extremely exceptional and very worrying," Teemu Makela, chief information security officer at Elisa Oyj, the largest telecoms operator, said by phone. "Considerable numbers of text messages are flying around."

Iranians couldn't buy gas. Israelis found their intimate dating details posted online. The Iran-Israel shadow war is now hitting ordinary citizens. From a report: Millions of ordinary people in Iran and Israel recently found themselves caught in the crossfire of a cyberwar between their countries. In Tehran, a dentist drove around for hours in search of gasoline, waiting in long lines at four gas stations only to come away empty. In Tel Aviv, a well-known broadcaster panicked as the intimate details of his sex life, and those of hundreds of thousands of others stolen from an L.G.B.T.Q. dating site, were uploaded on social media. For years, Israel and Iran have engaged in a covert war, by land, sea, air and computer, but the targets have usually been military or government related. Now, the cyberwar has widened to target civilians on a large scale. In recent weeks, a cyberattack on Iran's nationwide fuel distribution system paralyzed the country's 4,300 gas stations, which took 12 days to have service fully restored.

That attack was attributed to Israel by two U.S. defense officials, who spoke on the condition of anonymity to discuss confidential intelligence assessments. It was followed days later by cyberattacks in Israel against a major medical facility and a popular L.G.B.T.Q. dating site, attacks Israeli officials have attributed to Iran. The escalation comes as American authorities have warned of Iranian attempts to hack the computer networks of hospitals and other critical infrastructure in the United States. As hopes fade for a diplomatic resurrection of the Iranian nuclear agreement, such attacks are only likely to proliferate. Hacks have been seeping into civilian arenas for months. Iran's national railroad was attacked in July, but that relatively unsophisticated hack may not have been Israeli. And Iran is accused of making a failed attack on Israel's water system last year. The latest attacks are thought to be the first to do widespread harm to large numbers of civilians. Nondefense computer networks are generally less secure than those tied to state security assets.

Microsoft Edge recently gained a feature that allows people to pay for online purchases in installments. It's known as buy now, pay later (BNPL), and it's currently in testing on Microsoft Edge Dev and Canary. The option drew criticism from fans and users of the browser that expressed frustration in the comments section of the post announcing the feature. From a report: The center of most complaints is the belief that Microsoft Edge is becoming bloated with shopping features rather than delivering a pure browsing experience. BNPL is optional, but its detractors are against the concept of Edge having shopping features built in. "It's impressive how quickly you can throw away years of hard work and good will with a ridiculous feature like this," said vyrotek. "The Edge teams need to pause and think how they possibly thought this was a good idea. Even the Bing features are getting too aggressive." Cameron_Bush states asks for Microsoft to reconsider the addition. "This sounds like an awful idea that will only be seen as a shameless cashgrab are/or bloat by media outlets. I beg you reconsider pushing this to live. The negative press this feature is going to receive isn't worth it."

We're on alert overload. Stray comments and offhand requests once shouted across the office now blink and buzz at us from Microsoft Teams and Slack. Our communication has grown fragmented, spread across myriad apps we have to learn, conform to, remember to check. From a report: Meanwhile, personal texts and social-media mentions have bled into the workday after all this time at home, adding another layer of distraction to our time on the clock. Why put your phone on silent if the boss isn't hovering over you? Our culture has evolved to accommodate rapid communication, says Gloria Mark, a professor of informatics at the University of California, Irvine, and it can be mentally taxing. Many of us struggle to conjure up that brilliant thought that hit right before the notification burst in. "Your memory is just overflowing with information," she says.

It doesn't make for great circumstances for getting work done, but there are ways individuals, managers and organizations can contend with the onslaught. Dr. Mark's research finds people switch screens an average of 566 times a day. Half the time we're interrupted; the other half we pull ourselves away. Breaks -- even mindless ones like scrolling Facebook -- can be positive, replenishing our cognitive resources, Dr. Mark says. But when something external diverts our focus, it takes us an average of 25 minutes and 26 seconds to get back to our original task, she has found. (Folks often switch to different projects in between.) And it stresses us out. Research using heart monitors shows that the interval between people's heart beats becomes more regular when they're interrupted, a sign they're in fight-or-flight mode. The onus is on teams and organizations to create new norms, Dr. Mark says. If individuals just up and turn off their notifications they'll likely be penalized for missing information. Instead, managers should create quiet hours where people aren't expected to respond. "It's a matter of relearning how to work," she says.

The government has introduced new legislation to protect smart devices in people's homes from being hacked. From a report: Recent research from consumer watchdog Which? suggested homes filled with smart devices could be exposed to more than 12,000 attacks in a single week. Default passwords for internet-connected devices will be banned, and firms which do not comply will face huge fines. One expert said that it was an important "first step". Cyber-criminals are increasingly targeting products from phones and smart TVs, to home speakers and internet-connected dishwashers. Hackers who can access one vulnerable device can then go on to access entire home networks and steal personal data.

In 2017, for example, hackers stole data from a US casino via an internet-connected fish tank. There have also been reports of people accessing home webcams and speaking to family members. And poor security on a home wi-fi router could have been behind the uploading of illegal child abuse images from a home network that led to police accusing an innocent couple of the crime. While there are strict rules about protecting people from physical harm -- such as overheating, sharp components or electric shocks -- there are no such rules for cyber-breaches.

A security researcher has publicly disclosed an exploit for a new Windows zero-day local privilege elevation vulnerability that gives admin privileges in Windows 10, Windows 11, and Windows Server. BleepingComputer reports: As part of the November 2021 Patch Tuesday, Microsoft fixed a 'Windows Installer Elevation of Privilege Vulnerability' vulnerability tracked as CVE-2021-41379. This vulnerability was discovered by security researcher Abdelhamid Naceri, who found a bypass to the patch and a more powerful new zero-day privilege elevation vulnerability after examining Microsoft's fix. Yesterday, Naceri published a working proof-of-concept exploit for the new zero-day on GitHub, explaining that it works on all supported versions of Windows.

"This variant was discovered during the analysis of CVE-2021-41379 patch. the bug was not fixed correctly, however, instead of dropping the bypass," explains Naceri in his writeup. "I have chosen to actually drop this variant as it is more powerful than the original one." Furthermore, Naceri explained that while it is possible to configure group policies to prevent 'Standard' users from performing MSI installer operations, his zero-day bypasses this policy and will work anyway. BleepingComputer tested Naceri's 'InstallerFileTakeOver' exploit, and it only took a few seconds to gain SYSTEM privileges from a test account with 'Standard' privileges, as demonstrated in [this video]. When BleepingComputer asked Naceri why he publicly disclosed the zero-day vulnerability, we were told he did it out of frustration over Microsoft's decreasing payouts in their bug bounty program. A Microsoft spokesperson said in a statement: "We are aware of the disclosure and will do what is necessary to keep our customers safe and protected. An attacker using the methods described must already have access and the ability to run code on a target victim's machine."

Naceri recommends users wait for Microsoft to release a security patch, as attempting to patch the binary will likely break the installer.

According to data collected by Microsoft's network of honeypot servers, most brute-force attackers primarily attempt to guess short passwords, with very few attacks targeting credentials that are either long or contain complex characters. From a report: "I analysed the credentials entered from over -- million brute force attacks against SSH. This is around 30 days of data in Microsoft's sensor network," said Ross Bevington, a security researcher at Microsoft. "77% of attempts used a password between 1 and 7 characters. A password over 10 characters was only seen in 6% of cases," said Bevington, who works as Head of Deception at Microsoft, a position in which he's tasked with creating legitimate-looking honeypot systems in order to study attacker trends.

The owner of Facebook and Instagram is delaying plans to encrypt users' messages until 2023 amid warnings from child safety campaigners that its proposals would shield abusers from detection. From a report: Mark Zuckerberg's social media empire has been under pressure to abandon its encryption plans, which the UK home secretary, Priti Patel, has described as "simply not acceptable." The National Society for the Prevention of Cruelty to Children (NSPCC) has said private messaging is the "frontline of child sexual abuse online" because it prevents law enforcement, and tech platforms, from seeing messages by ensuring that only the sender and recipient can view their content -- a process known as end-to-end encryption. The head of safety at Facebook and Instagram's parent company, Meta, announced that the encryption process would take place in 2023. The company had previously said the change would happen in 2022 at the earliest.

"We're taking our time to get this right and we don't plan to finish the global rollout of end-to-end encryption by default across all our messaging services until sometime in 2023," Antigone Davis wrote in the Sunday Telegraph. "As a company that connects billions of people around the world and has built industry-leading technology, we're determined to protect people's private communications and keep people safe online." Meta already uses end-to-end encryption on its WhatsApp messaging service and had been planning to extend that to its Messenger and Instagram apps in 2022. It has already encrypted voice and video calls on Messenger. Announcing the privacy drive in 2019, Zuckerberg, said: "People expect their private communications to be secure and to only be seen by the people they've sent them to -- not hackers, criminals, over-reaching governments or even the people operating the services they're using."

Web hosting company GoDaddy said on Monday email addresses of up to 1.2 million active and inactive Managed WordPress customers had been exposed in an unauthorized third-party access. From a report: The company said the incident was discovered on Sept. 6 and the third-party accessed the system using a compromised password.

Cryptographers are upset that "crypto" sometimes now refers to cryptocurrency, reports the Guardian: This lexical shift has weighed heavily on cryptographers, who, over the past few years, have repeated the rallying cry "Crypto means cryptography" on social media. T-shirts and hoodies trumpet the phrase and variations on it; there's a website dedicated solely to clarifying the issue. "'Crypto' for decades has been used as shorthand and as a prefix for things related to cryptography," said Amie Stepanovich, executive director of Silicon Flatirons Center at the University of Colorado Law School and creator of the pro-cryptography T-shirts, which have become a hit at conferences. "In fact, in the term cryptocurrency, the prefix crypto refers back to cryptography...."

[T]here remains an internecine feud among the tech savvy about the word. As Parker Higgins of the Freedom of the Press Foundation, who has spent years involved in cryptography activism, pointed out, the cryptography crowd is by nature deeply invested in precision — after all, designing and cracking codes is an endeavor in which, if you get things "a little wrong, it can blow the whole thing up...."

"Strong cryptography is a cornerstone of the way that people talk about privacy and security, and it has been under attack for decades" by governments, law enforcement, and "all sorts of bad actors", Higgins said. For its defenders, confusion over terminology creates yet another challenge.

Stepanovich acknowledged the challenge of opposing the trend, but said the weight of history is on her side. "The study of crypto has been around for ever," she said. "The most famous code is known as the Caesar cipher, referring to Julius Caesar. This is not new." Cryptocurrency, on the other hand, is a relatively recent development, and she is not ready to concede to "a concept that may or may not survive government regulation".