Cybercrime/malcode – Lifeboat News: The Blog

Cryptojacking Group TeamTNT Suspected of Using Decoy Miner to Conceal Data Exfiltration

Posted by Saúl Morales Rodriguéz in cryptocurrencies, cybercrime/malcode

Mar 16
2023

The cryptojacking group known as TeamTNT is suspected to be behind a previously undiscovered strain of malware used to mine Monero cryptocurrency on compromised systems.

That’s according to Cado Security, which found the sample after Sysdig detailed a sophisticated attack known as SCARLETEEL aimed at containerized environments to ultimately steal proprietary data and software.

Specifically, the early phase of the attack chain involved the use of a cryptocurrency miner, which the cloud security firm suspected was deployed as a decoy to conceal the detection of data exfiltration.

Read more | >

Researchers From Stanford And DeepMind Come Up With The Idea of Using Large Language Models LLMs as a Proxy Reward Function

Posted by Dan Breeden in cybercrime/malcode, internet, robotics/AI | 1 Comment on Researchers From Stanford And DeepMind Come Up With The Idea of Using Large Language Models LLMs as a Proxy Reward Function

Mar 15
2023

With the development of computing and data, autonomous agents are gaining power. The need for humans to have some say over the policies learned by agents and to check that they align with their goals becomes all the more apparent in light of this.

Currently, users either 1) create reward functions for desired actions or 2) provide extensive labeled data. Both strategies present difficulties and are unlikely to be implemented in practice. Agents are vulnerable to reward hacking, making it challenging to design reward functions that strike a balance between competing goals. Yet, a reward function can be learned from annotated examples. However, enormous amounts of labeled data are needed to capture the subtleties of individual users’ tastes and objectives, which has proven expensive. Furthermore, reward functions must be redesigned, or the dataset should be re-collected for a new user population with different goals.

New research by Stanford University and DeepMind aims to design a system that makes it simpler for users to share their preferences, with an interface that is more natural than writing a reward function and a cost-effective approach to define those preferences using only a few instances. Their work uses large language models (LLMs) that have been trained on massive amounts of text data from the internet and have proven adept at learning in context with no or very few training examples. According to the researchers, LLMs are excellent contextual learners because they have been trained on a large enough dataset to incorporate important commonsense priors about human behavior.

Read more | >

AT&T data breach hits nine million customer accounts

Posted by Genevieve Klien in cybercrime/malcode

Mar 13
2023

A third-party vendor hack exposed millions of AT&T customers’ account information, including names, phone numbers, and email addresses.

Read more | >

Stealthy UEFI malware bypassing Secure Boot enabled by unpatchable Windows flaw

Posted by Genevieve Klien in cybercrime/malcode

Mar 13
2023

Researchers on Wednesday announced a major cybersecurity find—the world’s first-known instance of real-world malware that can hijack a computer’s boot process even when Secure Boot and other advanced protections are enabled and running on fully updated versions of Windows.

Dubbed BlackLotus, the malware is what’s known as a UEFI bootkit. These sophisticated pieces of malware target the UEFI—short for Unified Extensible Firmware Interface —the low-level and complex chain of firmware responsible for booting up virtually every modern computer. As the mechanism that bridges a PC’s device firmware with its operating system, the UEFI is an OS in its own right. It’s located in an SPI-connected flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch. Previously discovered bootkits such as CosmicStrand, MosaicRegressor, and MoonBounce work by targeting the UEFI firmware stored in the flash storage chip. Others, including BlackLotus, target the software stored in the EFI system partition.

Because the UEFI is the first thing to run when a computer is turned on, it influences the OS, security apps, and all other software that follows. These traits make the UEFI the perfect place to launch malware. When successful, UEFI bootkits disable OS security mechanisms and ensure that a computer remains infected with stealthy malware that runs at the kernel mode or user mode, even after the operating system is reinstalled or a hard drive is replaced.

Read more | >

CASPER attack steals data using air-gapped computer’s internal speaker

Posted by Genevieve Klien in cybercrime/malcode, mobile phones

Mar 13
2023

Researchers at the School of Cyber Security at Korea University, Seoul, have presented a new covert channel attack named CASPER can leak data from air-gapped computers to a nearby smartphone at a rate of 20bits/sec.

The CASPER attack leverages the internal speakers inside the target computer as the data transmission channel to transmit high-frequency audio that the human ear cannot hear and convey binary or Morse code to a microphone up to 1.5m away.

The receiving microphone can be in a smartphone recording sound inside the attacker’s pocket or a laptop in the same room.

Read more | >

AT&T data breach compromises roughly nine million accounts, here’s what you need to know

Posted by Genevieve Klien in cybercrime/malcode

Mar 11
2023

It looks like AT&T experienced a data breach, leaving roughly 9 million customers data exposed. The data breach didn’t come directly from the wireless carrier, but occurred with one of its vendors.

The news originates from the AT&T forums, where customers were curious about an email that has apparently been going out to affected customers since last week. The email discusses the breach the wireless carrier experienced, sharing that it occurred with one of its vendor’s systems, which gave access to the wireless carrier’s “Customer Proprietary Network Information” (CPNI) system.

Read more | >

New malware variant has “radio silence” mode to evade detection

Posted by Saúl Morales Rodriguéz in cybercrime/malcode, government

Mar 8
2023

The Sharp Panda cyber-espionage hacking group is targeting high-profile government entities in Vietnam, Thailand, and Indonesia with a new version of the ‘Soul’ malware framework.

The particular malware was previously seen in espionage campaigns targeting critical Southeast Asian organizations, attributed to various Chinese APTs.

Check Point identified a new campaign using the malware that started in late 2022 and continues through 2023, employing spear-phishing attacks for initial compromise.

Read more | >

A new inference attack that could enable access to sensitive user data

Posted by Saúl Morales Rodriguéz in cybercrime/malcode, information science, robotics/AI

Mar 7
2023

As the use of machine learning (ML) algorithms continues to grow, computer scientists worldwide are constantly trying to identify and address ways in which these algorithms could be used maliciously or inappropriately. Due to their advanced data analysis capabilities, in fact, ML approaches have the potential to enable third parties to access private data or carry out cyberattacks quickly and effectively.

Morteza Varasteh, a researcher at the University of Essex in the U.K., has recently identified new type of inference attack that could potentially compromise confidential user data and share it with other parties. This attack, which is detailed in a paper pre-published on arXiv, exploits vertical federated learning (VFL), a distributed ML scenario in which two different parties possess different information about the same individuals (clients).

“This work is based on my previous collaboration with a colleague at Nokia Bell Labs, where we introduced an approach for extracting private user information in a data center, referred to as the passive party (e.g., an insurance company),” Varasteh told Tech Xplore. “The passive party collaborates with another data center, referred to as the active party (e.g., a bank), to build an ML algorithm (e.g., a credit approval algorithm for the bank).”

Read more | >

Get Quote

Posted by Shubham Ghosh Roy in business, cybercrime/malcode, education

Mar 6
2023

Get a real time quote from over 300 cutting edge providers worldwide while maintaining contact with FreedomFire Communications only. Our suppliers offer best-in-class business ethernet/fiber networks, network security solutions and cybersecurity educational programs, digital transformation tools and resources, IoT network ecosystems (sensor technology, network connectivity, data analytics), and more… at the most competitive price available with industry leading customer service and support.

Read more | >