NUEVA LEY DE CIBERSEGURIDAD CONTRA HACKERS DE BANCOS, CAJEROS Y TARJETAS DE CRÉDITO; AHORA ENFRENTARÁN CADENA PERPETUA

CONTENIDO ORIGINAL: https://noticiasseguridad.com/seguridad-informatica/nueva-ley-de-ciberseguridad-contra-hackers-de-bancos-cajeros-y-tarjetas-de-credito-ahora-enfrentaran-cadena-perpetua/

Malas noticias para el cibercrimen. Especialistas en forense digital reportan que los delitos cibernéticos bancarios, como hackear una cuenta en línea o clonar tarjetas de crédito y débito podrían llevar a los responsables a la cárcel por el resto de sus vidas, todo gracias a una nueva propuesta de ley en Filipinas.

El pasado 28 de agosto el presidente Rodrigo Duterte firmó la Ley de la República No. 11449, donde se presentan nuevas y más severas sanciones para las infracciones a la Ley de Regulación de Dispositivos de Acceso de 1998; el proyecto fue revelado este 25 de septiembre por la mañana.

Según se ha mencionado, las penas más altas están reservadas para los delitos relacionados con el llamado fraude de dispositivos de acceso, entre los que destacan el robo y falsificación de tarjetas de pago, posesión o desarrollo de hardware y software para acceder de forma ilícita a información bancaria, acceso ilegítimo a cuentas bancarias o cajeros automáticos y cualquier actividad de hacking contra un banco o usuario, mencionan los expertos en forense digital.

Por otra parte, la pena más alta es de cadena perpetua más una multa millonaria, y está reservada para las actividades de hacking contra un sistema bancario completo, el robo de 50 o más tarjetas de pago y el fraude de dispositivos de acceso contra más de 50 cuentas bancarias o tarjetas de pago, reportan los medios locales.

En la presentación de la nueva ley, el representante del gobierno de Filipinas declaró: “Desde ahora, estas actividades serán consideradas como crímenes atroces con intención de sabotaje económico, por lo que enfrentarán penas más severas”.

Firmas especializadas en forense digital detallan algunas de las nuevas sanciones relacionadas con fraude cibernético bancario en Filipinas:

• Uso fraudulento de tarjetas de crédito: Entre 4 y 6 años de cárcel más una multa del doble del valor del crédito obtenido de manera fraudulenta
• Posesión de un dispositivo de acceso falsificado: Entre 2 y 20 años en prisión, además de una multa equivalente al doble de la cantidad operada por las cuentas afectadas
• Posesión de 10 o más dispositivos de acceso falsificados, sin comprobar acceso a cuentas o créditos: Entre 6 y 12 años de cárcel, además de una multa de al menos 300 mil pesos filipinos o el doble del monto total de las cuentas comprometidas
• Hackeo completo de un sistema bancario, robo de al menos 50 tarjetas de pago o acceso ilegal a al menos 50 cuentas bancarias en línea o tarjetas de pago: Cadena perpetua más multa de hasta 5 millones de pesos filipinos

Especialistas en forense digital del Instituto Internacional de Seguridad Cibernética (IICS) consideran que, a pesar de que este tipo de medidas son reactivas, son un buen comienzo para mitigar las actividades de estos grupos de hackers, que han incrementando sus actividades recientemente, incluso llegando a operar internacionalmente. Hace un par de meses se reportó una campaña de jackpotting en algunos cajeros en Nepal, perpetrada por hackers chinos que recibían órdenes de un grupo de hackers resididos en España; las autoridades nepalíes lograron arrestar a algunos de los miembros de esta operación mientras trataban de retirar dinero de un cajero automático por quinta vez.

Read More

VULNERABILIDAD DÍA CERO EN VBULLETIN EXPLOTADA POR HACKERS; MILES DE SITIOS WEB AFECTADOS

CONTENIDO ORIGINAL: https://noticiasseguridad.com/vulnerabilidades/vulnerabilidad-dia-cero-en-vbulletin-explotada-por-hackers-miles-de-sitios-web-afectados/

Sin importar su uso, cualquier implementación de software puede presentar serios errores de seguridad. Un investigador en análisis de vulnerabilidades que por el momento permanece anónimo ha revelado los detalles acerca de una vulnerabilidad día cero en vBulletin, el software para la creación de foros en Internet más utilizado actualmente.

El problema es que al parecer el encargado de publicar esta información tomó esta decisión de forma unilateral y arbitraria, por lo que la comunidad de la ciberseguridad teme que esto pueda generar una cadena de intentos de explotación de esta falla en múltiples foros de Internet, comprometiendo la información de los usuarios afectados.

Después de analizar el código publicado de forma anónima, los expertos en análisis de vulnerabilidades concluyeron que, de ser explotada, esta vulnerabilidad día cero permitiría a un actor de amenazas ejecutar comandos de shell en el servidor donde se ejecuta la implementación de vBulletin, además no es necesario que el hacker tenga cuenta de usuario en el foro objetivo.

En el mundo de la ciberseguridad, esto se conoce como una vulnerabilidad de ejecución remota de código previa a la autenticación, una severa falla de seguridad que podría afectar por completo cualquier plataforma en línea. Dos firmas especializadas ya han analizado el código y comprobado que realmente funciona.

El experto anónimo decidió publicar los detalles sobre esta falla a través de Full Disclosure, una lista de correo electrónico de acceso público para discutir informar sobre fallas de seguridad, vulnerabilidades, entre otros temas. Cuando una compañía no logra corregir una vulnerabilidad dentro de un lapso de tiempo determinado, es común que los investigadores revelen los detalles sobre la explotación de estas fallas, aunque se deben cumplir algunos requisitos primero.

No obstante, aún no se ha determinado si el investigador reportó la falla de seguridad a vBulletin o si es que los expertos en análisis de vulnerabilidades de la compañía no lograron resolver los inconvenientes de forma adecuada y en el tiempo establecido; al final, el hecho es que el experto anónimo decidió publicar el código.

MH Sub I, LLC, compañía encargada de comercializar este software, no se ha pronunciado al respecto de este incidente. La postura hermética de la compañía hace pensar a los expertos en análisis de vulnerabilidades que esto podría tratarse de una táctica planeada por la compañía, publicando esta vulnerabilidad día cero para generar caos en implementaciones similares, lo que afectaría a millones de usuarios.

A pesar de ser un desarrollo comercial, este es el paquete de software para la creación de foros web más utilizados actualmente, superando a otras implementaciones similares como XenForo, phpMM, Simple Machines Forum, entre otras.

Acorde a especialistas del Instituto Internacional de Seguridad Cibernética (IICS) cerca del 0.1% de todos los sitios web del mundo tienen un foro de vBulletin y, aunque parezca una cifra muy pequeña, esta vulnerabilidad podría afectar a millones de usuarios.

La razón principal para estar preocupados es la misma naturaleza de los foros en línea. Si bien millones de sitios web no cuentan con capacidad de almacenar información de sus usuarios, los foros en línea pueden ser una muy buena fuente de datos, por lo que el alcance de un incidente de estas características no debe tomarse a la ligera.

Read More

WHO WILL CURE THIS HOSPITAL? RANSOMWARE INFECTION ENCRYPTS 1500 DEVICES

ORIGINAL CONTENT: https://www.securitynewspaper.com/2019/09/25/who-will-cure-this-hospital-ransomware-infection-encrypts-1500-devices/

A ransomware attack against a local health system that includes a series of care facilities has affected the 1,500 devices, disrupted service deliveries and forced the use of paper graphics instead of electronic health records, as reported by ethical hacking specialists. Besides, experts consider such incidents keep increasing all over the country.

The incident, which occurred at Campbell County Health Dept. in Wyoming, US, affected Legacy Living & Rehabilitation Center, which has a memory care wing, a general hospital, a medical group of more than 20 clinics, and a surgical center.

“Ransomware attacks increased 100% during this year; this has become the state’s biggest problem,” says Tim Walsh, an expert in ethical hacking in charge of the state’s Department of Technology.

Representatives of the U.S. Department of Homeland Security (DHS) have accumulated multiple reports of ransomware attacks against various organizations, both public and private. “In short, this malware denies access to a system or dataset, demanding that victims pay a ransom,” officials mention. Usually, the ransomware is spread using malicious or fraudulent emails as well as via infected websites.

The county health system detected the problems Friday morning, although operations were ongoing. By Saturday morning, however, multiple systems had already been suspended, forcing local authorities to move some patients to other facilities to ensure all their care.

According to the experts in ethical hacking of the county, until now radiology systems are the most affected, although unfortunately this is not the only faulty service. The total number of patients affected by this incident has not yet been revealed.

According to the experts of the International Institute of Cyber Security (IICS), the local health system already works with local and federal authorities. However, local government representatives note that there is not yet an estimated date for the total restoration of the systems. It has also emphasized that there is no evidence to confirm a theft of health system data.

Read More

SMART HOME HACKED; ATTACKERS EXPOSE A FAMILY TO HIGH TEMPERATURES AND REALLY LOUD MUSIC

ORIGINAL CONTENT_ https://www.securitynewspaper.com/2019/09/25/smart-home-hacked-attackers-expose-a-family-to-high-temperatures-and-really-loud-music/

While they can sometimes help us simplify some everyday tasks, smart home devices can also be used by threat actors for malicious purposes. This is the case of a family in Wisconsin, US, whose members began to be harassed by a group of hackers that compromised the management portal of their Google Nest smart home system, cybersecurity experts report.

After the intrusion, the hackers proceeded to manipulate the Internet of Things (IoT) devices installed in the home of the affected family, starting by raising the temperature to 32 degrees Celsius with their smart thermostat. The owners of the house, Lamont and Samantha Westmoreland, downplayed the event, thinking that the heating system had simply broken.

However, the problems continued. As the couple recounted to cybersecurity experts, after that voices began to be heard from the Westmoreland’s smart speaker, followed by some loud obscene songs. The family tried to disconnect the system and change the password of their Google Nest account, but this didn’t help.

Samantha Westmoreland says this left her very uneasy: “My heart got twisted, I feel scared just to talk about it,” the victim says.

According to cybersecurity experts, to do this the hackers had to access the Westmoreland’s WiFi network to then access the Google Nest system. Google officials noted that hackers most likely found the family’s WiFi passwords due to leaks on other platforms, such as router manufacturers or Internet service providers.

Specialists from the International Institute of Cyber Security (IICS) mention that the hacking of IoT devices is becoming an increasingly common practice, partly due to the growth in the use of these devices, but mainly thanks to the poor information security knowledge among users of this technology. It is very common for users not to change the default passwords on these devices, leaving them too exposed to any intruders. Changing factory passwords on these computers and setting other security measures, such as multi-factor authentication, can be really useful measures to prevent unauthorized access to our networks and smart devices.

Read More

NEW CYBERSECURITY LAW AGAINST BANK, ATMS AND CREDIT CARD HACKERS; THEY WILL NOW FACE LIFE IMPRISONMENT

ORIGINAL CONTENT: https://www.securitynewspaper.com/2019/09/25/new-cybersecurity-law-against-bank-atms-and-credit-card-hackers-they-will-now-face-life-imprisonment/

These are bad news for cybercrime. Digital forensics specialists report that cybercrimes against banking institutions, such as hacking an online account or cloning credit and debit cards could take those responsible to jail for the rest of their lives, all thanks to a new bill in Philippines.

Last August 28th President Rodrigo Duterte signed the Law of the Republic No. 11449, which introduces new and more severe penalties for violations of the Access Device Regulation Act of 1998; the project was revealed this September 25 morning.

As mentioned, the highest penalties are reserved for crimes related to so-called access device fraud, including theft and forgery of payment cards, possession or development of hardware and software to illicitly access banking information, illegitimate access to bank accounts or ATMs and any hacking activity against a bank or user, are mentioned by digital forensics experts.

On the other hand, the highest penalty is life imprisonment plus a really high fine, and is reserved for hacking activities against a full banking system, stealing 50 or more payment cards, and fraud of access devices against more than 50 bank accounts or payment devices, local media report.

In the presentation of the new law, the representative of the government of the Philippines stated, “From now on, these activities will be regarded as heinous crimes with intent of economic sabotage, so they will face more severe penalties.”

Firms specializing in digital forensics detail some of the new sanctions related to cybercrimes against banks in the Philippines:

• Fraudulent use of credit cards: Between 4 and 6 years in prison plus a fine double the value of the credit obtained fraudulently
• Possession of a counterfeit access device: Between 2 and 20 years in prison, plus a fine equivalent to twice the amount operated by the affected accounts
• Possession of 10 or more counterfeit access devices, without checking access to accounts or credits: Between 6 and 12 years in prison, plus a fine of at least 300k Philippine pesos ($5.7K USD) or double the total amount of committed accounts
• Full hacking of a banking system, theft of at least 50 payment cards or illegal access to at least 50 online bank accounts or payment cards: Life sentence plus fine of up to 5 million Philippine pesos ($95.5k USD)

Digital forensics specialists at the International Institute of Cyber Security (IICS) believe that, although these measures are reactive, they are a good start to mitigating the activities of these hacker groups, which have increased their crimes recently, even going on to operate internationally. A couple of months ago a jackpotting campaign was reported at some ATMs in Nepal, perpetrated by Chinese hackers receiving orders from a group of hackers residing in Spain; Nepalese authorities managed to arrest some of the members of this operation while trying to withdraw money from an ATM for the fifth time.

Read More

ZERO-DAY VULNERABILITY IN VBULLETIN EXPLOITED BY HACKERS; THOUSANDS OF WEBSITES AFFECTED

ORIGINAL CONTENT: https://www.securitynewspaper.com/2019/09/25/zero-day-vulnerability-in-vbulletin-exploited-by-hackers-thousands-of-websites-affected/

Regardless of its usage, any software implementation can present serious security errors. A researcher in vulnerability testing that remains anonymous for the time has revealed details about zero-day vulnerability in vBulletin, the most widely used Internet forum creation software nowadays.

The problem is that it appears that the person in charge of publishing this information made this decision unilaterally and arbitrarily, so the cybersecurity community fears that this could lead to a chain of attempts to exploit this flaw in multiple Internet forums, compromising the information of affected users.

After analyzing the published code anonymously, vulnerability testing experts concluded that, if exploited, this zero-day vulnerability would allow a threat actor to execute shell commands on the server where the implementation of vBulletin, in addition it is not necessary for the hacker to have a user account in the target forum.

In the world of cybersecurity, this is known as pre authentication remote code execution vulnerability, a severe security flaw that could completely affect any online platform. Two specialized firms have already analyzed the code and verified that it actually works.

The anonymous expert decided to publish details about this flaw through Full Disclosure, a publicly accessible email list to discuss reporting security flaws, vulnerabilities, among other topics. When a company fails to fix a new vulnerability within a given time frame, it is common for researchers to disclose details about exploiting these flaws, although some requirements must be met first.

However, it has not yet been determined whether the researcher reported the security flaw to vBulletin or whether the company’s vulnerability testing experts failed to correct the issues properly and in the set time; in the end, the fact is that the anonymous expert decided to publish the code.

MH Sub I, LLC, the company in charge of marketing this software, has not commented on this incident. The company’s hermetic stance suggests vulnerability testing experts that this could be a tactic planned by the company, publishing this zero-day vulnerability to create chaos in similar implementations, which would affect millions of users.

Despite being a commercial development, this is the software package for the creation of the most used web forums currently, surpassing other similar implementations such as XenForo, phpMM, Simple Machines Forum, among others.

According to specialists from the International Institute of Cyber Security (IICS) about 0.1% of all websites in the world have a vBulletin forum and, although it seems like a very small figure, this vulnerability could affect millions of users.

The main reason to be concerned is the very nature of online forums. While millions of websites do not have the ability to store information from their users, online forums can be a very good source of data, so the scope of such an incident should not be taken lightly.

Read More

Hackers take control of Asics sports store screens to display porn

Read More