NewsByte by Aishwarya Iyer Recent Information Security News

1. NewsBytes
-Aishwarya Iyer

2.  Graduate from Mumbai University
 Interested in Programming and Information
Security
 Pursuing certification course in core java
followed by advanced java.

3.  Serious TCP/IP Bug allows traffic Hijacking
 Hitler Ransomware
 Australia online census shutdown after
cyber attacks
 Data Breach at Oracle’s MICROS Point-of-Sale
 Miscellaneous

5. //OVERVIEW:
o Vulnerability in TCP implementation in Linux
version 3.6
o Can affect many linux devices, embedded
computers, mobile phones etc..
o Can be done by anyone in the world if attack
machine allows IP spoofing

6. //Vulnerability
o Allows blind off-path attacker to infer
between 2 hosts communicating on TCP
o Leading to connection termination and data
injection
o TCP assembles data in a series of data
packets identified by Sequence numbers
o Side-channel attack
o an attacker with spoofed IP address does not
need a man-in-the-middle (MITM) position

7. //However the good news is…..
Patches have been developed and distributed
for the current linux Kernel.

10. //Technical Analysis
o Main executable is a batch file with other
bundled apps
o Removes all extensions for files under various
folders like %UserProfile%/Desktop etc..
o 3 files are extracted: chrst.exe, erOne.vbs,
firefox32.exe and copied to %temp%

12. //Lastly
It will look for any processes named taskmgr,
cmd etc,, and terminate it

14. //Overview
o Australian census every 5 years
o As they headed to the website, a series of
DOS attacks took place
o “It was an attack from the overseas” – David
Kalisch,ABS

15. //Furtunately but,
o PM-Malcolm Turnbull-”no data has been
compromised”
o ABS- data is secure
o Kalisch-Data is encrypted and in the ABS and
noone else has it

16. //Simple Drawbacks
o Embarrassment to Australian Government
o Labor opposition-”Worst run census in the
history of Australia”
o Mass-discontent

18. //Overview
o Breached 100’s of security systems at Oracle
o Compromised customer support portal
MICROS:
o Top 3 POS vendors globallly
o Oracle-”detected and addressed malicious
code in some legacy systems”
o Size and scope of attack unclear
o 700 security Systems infected

19. //Whois???
o 2 security researchers pointed out
Carbanak Gang:
• Russian
• Known to have stolen 1 billion$ from banks,
retailer firms etc..
//Oracle
o Forced password Reset
o Attackers failed to grasp enormity of access

21. o Pokemon Go! Creator’s twitter Hacked!!
o Microsoft accidently leaks backdoor keys to
bypass UEFI secure boot
o O2 confirms USBs distributed in marketing
campaign contain virus
o Fake Windows Activation is actually a
ransomware Trojan

23. o http://thehackernews.com/2016/08/linux-
tcp-packet-hacking.html
o http://www.bleepingcomputer.com/news/sec
urity/development-version-of-the-hitler-
ransomware-discovered/
o http://www.securityweek.com/australia-
online-census-shutdown-after-cyber-
attacks?utm_source=feedburner&utm_mediu
m=feed&utm_campaign=Feed:+Securityweek
+(SecurityWeek+RSS+Feed)

24. o https://www.facebook.com/ethicalhackingne
wsandtutorials/?notif_t=notify_me_page&noti
f_id=1470887131517196
o https://www.facebook.com/InfoSecInstitute/?
fref=ts
o http://cyberwarzone.com/fake-windows-
activation-actually-ransomware-trojan/
o www.scmagazine.com/o2-confirms-usbs-
distributed-in-marketing-campaign-contain-
virus/article/514719/