How to Record the Screen on Your Windows PC or Mac.How to Convert YouTube Videos to MP3 Files.How to Save Money on Your Cell Phone Bill.How to Free Up Space on Your iPhone or iPad.How to Block Robotexts and Spam Messages.
I recently wrote about a state-sponsored attack campaign where legitimate versions of software were being replaced with spyware-laden versions with the help of middleboxes and local Internet Service Providers. While the clones of legitimate websites in this case is much less sophisticated, it could still potentially achieve similar results. Tricking a user into installing something on their machine is one of the most desired attack behaviors, as it gives attackers virtually limitless power when installing a Remote Access Trojan (RAT). The infected versions of the cloned software include the fully functional version of that software package, with an extra installer that gives the user an option to install some “optional” software such as AVG anti-virus or a search bar. The cloned websites are also served over HTTPS with valid and trusted SSL Certificates issued by Let’s Encrypt, which further legitimizes the cloned site since users are taught to trust “secure” websites. Even if users take the extra step to verify that the downloaded file matches the known good MD5 hash from the website, that only guarantees that the file was not altered in transit, not that the file was malicious to begin with. While this campaign is barely malicious serving up Potentially Unwanted Applications (PUAs), the potential for abuse is significant. Cloned KeyPass Website serving an adware-laced version of KeyPass
0 kommentar(er)
