Blog - Cyber Deja Vu

SLAVA GOMZIN on information security and technology

Information security is not a theoretical science but rather the art of combining computer technology with human communication and psychology Tweet

Ether is now worth as much as 82% of all existing Bitcoins

6/21/2017

Is Etherium going to replace Bitcoin?

Got dumps bro?

6/7/2017

One of the best feedbacks and recognitions of my Hacking Point of Sale book came from Facebook messenger:
"Got dumps bro?"
To whom who are not familiar with carders' terminology: "dump" means a file with credit card account numbers, expiration dates, security codes, and/or full content of credit/debit card magnetic tracks stolen from merchants' point of sale systems. So dump is the "product" of any card data breach which can be monetized. Usually, dumps are sold on darknet marketplaces (and paid by bitcoins by the way). Normally, hackers who are behind the breach -- those who actually plan and conduct the attack and steal the card data -- do not use those cards by themselves but sale them in batches ("dumps") to other groups who are in charge of monetization. Those other groups produce fake plastic cards, use them to buy merchandise in brick and mortar stores (or sometimes online), and then sell them on eBay to get cash.

Bitcoin Price Hits New All-Time High at $2,999.91

6/7/2017

Just 9 cents below $3,000... Some people say it's a bubble. I think it's just people trust more and more in digital currency, which slowly but surly enters the payment mainstream.

Study on pacemakers found more than 8,000 known vulnerabilities in code inside the cardiac devices

5/25/2017

I knew there are problems in medical devices security, but I did not know it's so bad.

Researcher Billy Rios and Dr Jonathan Butts from security company Whitescope said their study showed the "serious challenges" pacemaker manufacturers faced in trying to keep devices patched and free from bugs that attackers could exploit.
They found that few of the manufacturers encrypted or otherwise protected data on a device or when it was being transferred to monitoring systems.
Also, none was protected with the most basic login name and password systems or checked that devices they were connecting to were authentic.

Dallas Tops Forbes' List Of The Best Cities For Jobs 2017

5/16/2017

Dallas-Plano-Irving metropolitan area ranks first this year on Forbes' list of the Best Cities For Jobs.

It’s a region that in many ways is the polar opposite of the San Francisco and San Jose metropolitan areas, which have dominated our ranking for the last few years. (They still place second and eighth this year, respectively, among the largest 70 metropolitan areas, though San Jose is down sharply from second place last year.)

Unlike the tech-driven Bay Area, Dallas’ economy has multiple points of strength, including aerospace and defense, insurance, financial services, life sciences, data processing and transportation. Employment in the metro area has expanded 20.3% over the past five years and 4.2% last year, with robust job creation in professional and business services, as well as in a host of lower-paid sectors like retail, wholesale trade and hospitality.

How the massive attack of WannaCry ransomware was stopped

5/16/2017

Here is the detailed description of how the WannaCry attack was "accidentally" stopped.

All this code is doing is attempting to connect to the domain we registered: if the connection is not successful it ransoms the system; if it is successful the malware exits.

The reason that was suggested is that the domain is a “kill switch” in case something goes wrong, but I now believe it to be a badly thought out anti-analysis.

In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to. A side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen).

I believe the malware creators were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox and the malware exits to prevent further analysis. This technique isn’t unprecedented: the Necurs trojan queries five totally random domains, and if they all return the same IP it exits.

However, because WannaCrypt used a single hardcoded domain, my registration of it caused all infections globally to believe they were inside a sandbox and exit... thus we unintentionally prevented the spread and further ransoming of computers infected with this malware. Of course now that we are aware of this, we will continue to host the domain to prevent any further infections from this sample.

One thing that is very important to note is our sinkholing only stops this version of the ransomware, and there is nothing stopping them removing the domain check and trying again, so it’s incredibly important that any unpatched systems are patched as quickly as possible.

Monitoring Ransomware WannaCry's Bitcoin Profits

5/15/2017

The beauty of Bitcoin is not just its ability to anonymously and safely handle darknet market payments like ones demanded by now popular ransomware WannaCry. Another interesting feature of Bitcoin is its ability to provide everyone else with detailed information about the number and amount of those payments as Bitcoin Blockchain is available publicly. WannaCry's Bitcoin addresses are hardcoded, which is kind of stupid but entertaining.

Bitcoin anonymity ends when you need to convert this virtual currency to old good bucks. However, there are still some options available to resolve this issue. First, you can keep the virtual currency and use it on darknet markets. Second, there are special tools called anonimizers which can mix multiple addresses and transactions in order to launder Bitcoins.

Currently, there are about 32 bitcoints on those accounts which equals to ~ $55,000.
Here are the WannaCry Bitcoin accounts:

https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Vulnerability in Frisco, Texas-based True Health Diagnostics software exposed at least two million personal health records

5/10/2017

This design flaw is very primitive but dangerous.

The medical reports that True Health produces contain vast amounts of extremely personal information on patients, including indicators of genetic abnormalities as well as markers of potentially current and future diseases.To demonstrate the flaw, Mursch logged into his account at True Health and right clicked on the PDF file for his latest health report. He showed how the site would readily cough up someone else’s detailed health records and blood tests if he modified a single digit in the link attached to that PDF record and then refreshed the page.

Sabre Corp discloses breach of payment systems

5/4/2017

Just another card data breach.

Today, travel industry giant Sabre Corp. disclosed what could be a significant breach of payment and customer data tied to bookings processed through a reservations system that serves more than 32,000 hotels and other lodging establishments.

The list of top ten web application vulnerabilities has been updated for the first time since 2013

4/28/2017

The release candidate of OWASP Top 10 vulnerabilities of web applications for 2017 has been published on the OWASP website. Injections (like SQL injection or code injection) are still #1 threat for web apps, no changes here since 2013.