# data[].attributes.body
In February 2018, a widespread fileless attack against financial institutions around the world was reported. The attackers deployed several tools to gain control of the financial networks. To gain administrative privileges, the attackers used Mimikatz for password collection. Then, the attackers placed PowerShell scripts in the registry, and generated Metasploit scripts that were executed using the Windows SC service. In addition, the Windows NETSH tool was used for communication between the victim and the C2. This comprehensive use of tools enabled the attackers to perform a highly sophisticated attack, which remained undetected for some time.

# data[].attributes.body
The hackers were able to obtain more than 380,000 credit cards, allowing them to net more than $17 million. This was done by adding just 22 lines of malicious code tailor-made to the weaknesses of the British Airways site, into the British Airways baggage claim information page.

# data[].attributes.body
To help prevent brute force attacks:

Use a complex password. The difference between an all-lowercase, all-alphabetic, six-digit password and a mixed case, mixed-character, ten-digit password is enormous.

Enable and configure remote access. Ask your IT department if your company uses remote access management.

Never use a dictionary word as a password. If you've read it in a book, it should never be part of your password. If you must use a password instead of an access management tool, consider using a password management system.

# data[].attributes.body
7-Eleven breach - a team of attackers used SQL injection to penetrate corporate systems at several companies, primarily the 7-Eleven retail chain, stealing 130 million credit card numbers.

# data[].attributes.body
If a password is equivalent to using a key to open a door, a brute force attack is using a battering ram. A hacker can try 2.18 trillion password/username combinations in 22 seconds, and if your password is simple, your account could be easily cracked

# data[].attributes.body
Gonzalez and an uncharged conspirator found the targets on a list of Fortune 500 companies and then did reconnaissance to determine the payment-processing systems they used. They then uncovered vulnerabilities in the systems they could exploit.

Using a SQL-injection attack, the hackers broke into the 7-Eleven network in August 2007, stealing an undetermined amount of card data.

# data[].attributes.body
Scenario 1

1. Attacker uses packet sniffer to find insecure connections
2. Attacker intercepts victims' user login information
3. Victims are redirected to a mimic site
4. Attacker intercepts users' credentials on real site

Scenario 2

1. Attacker intercepts and redirects victim to a bank chat mimic
2. Attacker pretends to be the bank when talking to the victim
3. Attacker obtains victim's credentials
4. Attacker impersonates the victim and uses their credentials on real bank chat
5. Attacker gains access to victims' bank account

# data[].attributes.body
Usually, attackers go for identity theft which leads to major damage to your office’s work capabilities and equipment. However, over the past 3-4 years, there has been a recent shift from identity theft to ransomware.
There have been cases where a company brags about the amount of cybersecurity insurance they carry only to be ransomed for that exact amount.

# data[].attributes.body
In February 2021, U.S. government agencies were compromised in a series of nation state attacks as a result of a supply chain attack involving software from SolarWinds. Hackers exploited a vulnerability in the cybersecurity provider’s network monitoring software, allowing them to laterally infiltrate companies that were using that software and gain access to their email communications.
While it hasn’t been confirmed, current and former SolarWinds employees report that the root cause of the supply chain attack was a weak password: an intern had been using the password “solarwinds123”, and that password was publicly accessible via a misconfigured GitHub repository.

# data[].attributes.body
-The damage a MitM attacker can cause reaches far beyond gaining access to your communications.
-The effects of a MitM attack on a small business can be outright disastrous.
-For example, a man in the middle attack often results in a breach of customers’ private data, including credit card details. According to the IBM cost of data breach report 2021, businesses faced an average loss of $18.9 million after a data breach.
-A man in the middle attack can also cause enormous damage to the reputation of a business. According to a study by PWC, 31% of consumers surveyed would switch to another business if a company they used suffered a data breach.

# data[].attributes.body
Living off the land refers to the use of dual-use tools, which are either already installed in the victims’ environment, or are admin, forensic or system tools used maliciously.

Living off the land means surviving on what you can forage, hunt, or grow in nature. LotL cyberattack operators forage on target systems for tools, such as operating system components or installed software, they can use to achieve their goals. LotL attacks are often classified as fileless because they do not leave any artifacts behind.

# data[].attributes.body
Password attacks are one of the most common forms of corporate and personal data breach. A password attack is simply when a hacker trys to steal your password. In 2020, 81% of data breaches were due to compromised credentials.

# data[].attributes.body
Formjacking is a type of cyber attack where hackers inject malicious JavaScript code into a webpage form–most often a payment page form. When a site visitor enters their payment card information and hits submit, that malicious code collects the payment card number–as well as other information like the customer’s name, address, and phone number. The code then sends this information to another location of the attackers’ choosing.

Formjacking is part of a larger group of attacks known as “supply chain attacks” where hackers target a vulnerable provider within the service/supply chain. In the case of formjacking attacks that seek to siphon credit card numbers, the provider is typically a payment processor.

# data[].attributes.body
One of the more prominent formjacking attacks occurred on British Airways in 2018, resulting in a fine of over £20 million pounds (approximately $26 million dollars.) British Airways only discovered the attack when a security researcher alerted them—more than two months after attack initiation.

# data[].attributes.body
An example would be : AWS DDoS attack in 2020

What is DDoS attack : Attackers floods a server with internet traffic to prevent users from accessing connected online services

Who was affected : Amazon Web Services, the 800-pound gorilla of everything cloud computing, was hit by a gigantic DDoS attack in February 2020.

How :  A technique called Connectionless Lightweight Directory Access Protocol (CLDAP) reflection, which relies on vulnerable third-party CLDAP servers  (It is used to connect, search, and modify shared internet directories) and amplifies the amount of data sent to the victim’s IP address by 56 to 70 times. The attack lasted for three days and peaked at an astounding 2.3 terabytes per second.

Why it matters : This was the most extreme recent DDoS attack ever. AWS hosting customers potentially losing revenue and suffering brand damage. When IT services in companies are down it can cost them anywhere from $300,000 to over $1,000,000 per hour which can damage their bottom line.

# data[].attributes.body
A SQL injection is a technique that attackers use to gain unauthorized access to a web application database by adding a string of malicious code to a database query. A SQL injection (SQLi) manipulates SQL code to provide access to protected resources, such as sensitive data, or execute malicious SQL statements. When executed correctly, a SQL injection can expose intellectual property, customer data or the administrative credentials of a private business. SQL injection attacks can be used to target any application that uses a SQL database, with websites being the most common prey.

# data[].attributes.body
-Superfish Visual Search software, a piece of adware was discovered to be preinstalled on Lenovo machines in December 2014
-Superfish contained universal self-signed certificate authority susceptible to MiTM to add advertisements even to encrypted content
-Certificate also held identical private keys, allowing eavesdropping through HTTPS transmissions without being flagged by browsers
-Lenovo revealed that their desktops, servers and enterprise laptops did not have Superfish installed, however with BYOD personal Lenovo devices could compromise the security in the company
-Microsoft released a Windows Defender update in Feb 20, 2015 which removed Superfish
-Incident revealed Superfish had been preinstalled in machines of other brands in the form of software bundles prior to the Lenovo security incident

# data[].attributes.attachment_link.readable_text
There is a nasty new fish in town.
Certain consumer-grade Lenovo laptop models shipped out between September and December 2014 came pre-installed with Superfish, a visual search technology that not only exhibits adware behaviors, but also allows cybercriminals to snoop in secure communications via man-in-the-middle (MitM) attacks.

To deal with adware or "advertising-related software" is harrowing enough for many consumers. For them to be actually exposed to the threat of data theft, however, is another story. Unfortunately, this is the case in Superfish adware in Lenovo laptops.

According to Lenovo, desktops, servers, and enterprise laptops never had this adware installed. However, given that the consumerization trend allows employees to bring their own devices in the office. Should one or more of these include affected Lenovo models, company systems may also be open to the consequences of this flaw.

The pre-installed Superfish root certificate allows the software to still function even in SSL-secured (HTTPS) transactions-such as when you log into your online banking account, sign into your favorite social networking site, or log in your email or IM accounts.

The Superfish adware, in effect, replaces all certificates the system receives with its own certificates created on the fly, signed with the installed root certificate. This is exactly how a man-in-the-middle attack is performed.

The problem with this is that attackers can use this knowledge to create their own certificates that the system would consider valid. For example, a phishing site could have what appears to be valid certificate and a typical user would have a very hard time telling the difference. An attacker could also sign a malicious file to make it look like from a reputable developer, and the user would be none the wiser.

Photo source: Rob Graham Twitter account
A Rotten Case of Adware Gone Bad
For many of those who owned one of Lenovo consumer laptop models with Superfish adware, using search engines can be a bit irritating.

When you search something in your browser with Superfish installed, you get visual search results, which Lenovo said in a statement , was placed there "to help customers potentially discover interesting products while shopping."

"Lenovo why are you adding adware...that hijacks search results on any browser? Is it not enough that customers buy a laptop from you?" asked a Lenovo community forum commenter known as "iknorr" on September last year. This is only one in over a hundred comments from customers displeased with the pre-installed Superfish adware.

In response, Lenovo has since stopped preloading the software and disabled server-side transactions on Lenovo products. They have also published instructions on how to uninstall the Superfish applications, which can be found on this link: http://support.lenovo.com/us/en/product_security/superfish_uninstall.

"Longer term, I believe manufacturers should be obliged to offer the option of buying all PCs as a bare-metal option i.e. with no operating system pre-installed. Not only would this reduce cost to the user, it would also increase freedom of choice of Operating System and hand full control back to the owner of the device," says Rik Ferguson, Global VP Security Research at Trend Micro.

[Read: Superfish (and chips) or Super Phish? ]

In the past, we have also noted of how the InstallBrain adware had led to the installation of the MEVADE/ SEFNIT malware.

[Read: Adware Gone Bad: The Adware and MEVADE/SEFNIT Connection ]

# data[].attributes.attachment_link.title
Superfish Adware in Lenovo Consumer Laptops Violates SSL, Affects Companies via BYOD

# data[].attributes.attachment_link.description
There is a nasty new fish in town. Certain consumer-grade Lenovo laptop models shipped out between September and December 2014 came pre-installed with Superfish, a visual search technology that not only exhibits adware behaviors, but also allows cybercriminals to snoop in secure communications via man-in-the-middle (MitM) attacks.