Perpetual IT

As we’ve explained before, the opposite (or perhaps we mean the inverse) of Black Friday wouldn’t be White Friday, it would be Red Friday.

The word “black” in the context of the big retail surge that typically follows US Thanksgiving, which is always on a Thursday, refers to ink, from the time when positive and negative account balances were written in black and red ink respectively.

Simply put: it’s all about spending, both in person and these days, of course, online.

So, if you’re going to be going after Black Friday deals online, amidst the retail frenzy of the season, do you need to do anything special? Take precautions that you wouldn’t normally need? Be more careful than usual?

Even more importantly, if you do tread more carefully online during Black Friday season, can you go back to your more casual and carefree online habits afterwards?

Here’s a really handy video that we made just before the words coronavirus, pandemic and lockdown entered our vocabulary, where we explain the issues at stake. (There’s also a full transcript below for those who prefer to read rather than to watch.)

WATCH THE VIDEO

[embedded content]

READ THE TRANSCRIPT

Have you ever had an angry customer bellow the dreaded words, “Just you wait, I’m going to report you to your manager”, or something along those lines?

We’re willing to bet that you have, and word on the street in the UK is that customer complaints, supposedly intensified by coronavirus-related frustrations, are at worryingly high levels right now.

And when someone does say, “I’m going to escalate this”, which is a confrontational, war-like expression at the best of times, it immediately becomes an uncertain, and often unpleasant, waiting game.

Will the blustery behaviour of ranting at you over the phone (or via IM, or on the support forum, or in a webchat session) provide the cathartic release the customer wanted, and bring their frustration to an end?

Or will you wake up tomorrow to a flurry of emails from your manager, or from HR, or from both, telling you about a formal complaint that’s just come in?

Well, over the past 24 hours, we, and many of our colleagues, have been on the receiving end of an email scam that preys on exactly these fears.

(At Naked Security, we receive emails for several different mail aliases along with our own personal addresses, so these bogus “Customer Complaints” have really been pouring in to our mailbox!)

Guilt + Fear = Haste

The goal of these cybercriminals is to make you feel guilty, and to convince you that through inaction on your part, you have caused serious inconvenience not only to the company as a whole, but also to someone more important than you in the organisation:

Technically, this is a targeted attack, known in the jargon as spear-phishing, because it does its best to greet you by name and to pretend to come from a manager in your company.

That makes it much more believable that an impersonal “Dear Colleague” or just a plain old “Hello”.

Yet this sort of targeting is technically trivial to do for anyone who has ever received (or acquired a copy of) an email sent by you at any time in the past.

For example, my emails almost always contain a line of text in the headers that looks like this:

 From: Paul Ducklin <duck@sophos.com>

From that text alone, it’s a fair guess that:

• My email client addresses me as Paul Ducklin.
• My colleagues call me Duck. (And other things, but Duck is one.)
• My employer is an organisation called Sophos.

After all, once you’ve filtered out outlook.com, gmail.com, yahoo.com and other domains associated with well-known webmail services, the email addresses left behind are quite likely to be company-related email identities.

Junior staff at particular risk

As you can see, spear-phishing doesn’t have to be a high-tech cybercrime that only ever targets high-fliers and individuals worth spending lots of time researching, stalking, pretexting and socially engineering for personal details.

Even if all the crooks had was a text string of the form $YOURNAME <$YOU@$BIZNAME.example>, it would be easy for crooks to fit it to a template like this…

 Attention: $YOURNAME Dear $YOU, You're in big trouble. I suggest you bring your coat when you come to the meeting. Yours sincerely, S. O. Meone $BIZNAME Outsourcing Manager

…and turn it into a message you’d be inclined to take seriously, especially if you worked for an outsourced part of the company, and didn’t usually liaise directly with higher-ups in the main company itself.

Worse, of course, is that junior staff under high pressure in commonly outsourced jobs such as first-line support are the most likely to have been threatened with complaints by aggressive callers determined to get their way.

And, let’s be perfectly honest, if you’ve ever worked in support, you’ll rarely ever have “reported yourself to management” when a caller shouted at you and complained, unless the call was so aggressive or threatening that you wanted to ensure it was placed on the record for your own safety.

You just assume that the complaints that they threatened to send won’t materalise, although you also know that sometimes they do.

In other words, receiving an email from a “colleague” whom you don’t know, and who doesn’t know you, but who seems to have been dragged into a customer “dispute” that you weren’t even aware of yet…

…well, it’s pretty much par for the course if you work in front-line support or a busy call centre.

In fact, one of the variants of this scam we received early on took exactly that approach, signing off as someone in the outsourcing team.

We aren’t sure whether the word cpomplaint in the subject line was a simple typo, because it was never repeated, or a deliberate response to some recipients temporarily blocklisting the word complaint in their email filters:

Watch for mistakes

The good news in this case is that the crooks weren’t on top of their game in the first of these emails we received, because the link took us here:

It looks as though they’d mixed up the emails and the web links of two different spear-phishing campaigns, one to do with customer complaints, and the other to do with accounts receivable or finance.

Also, the website was hosted on a Microsoft cloud service, as was obvious from the URL, but had Google Drive branding on the page.

But the criminals soon got their act back together, sending several more emails with a similarly threatening tone but with rather more believable links.

The next few phishing messages ripped off Adobe’s logo, presumably knowing that it’s a good visual match with the PDF file extension, and offered us a copy of the alleged “complaint”:

If you download the file, it turns out not to be a PDF, but it isn’t the usual sort of well-known suspicious substitute that the crooks often use, such as a VBS file (Visual Basic Script) or a JS file (JavaScript) file.

This one is a Microsoft App Bundle.

Like .apk files for Android or .pkg files for macOS, .appxbundle files are Microsoft’s answer to providing a single download for all sorts of platforms and devices.

You need to remember that these files are really just good old .EXE files in disguise, but many Windows users may not be familiar with them yet, especially if they’ve never had reason to download work apps from the Microsoft Store.

There are numerous file formats used by so-called Univeral Windows Platform (UWP) apps. UWP packages are a bit like Apple’s “fat binaries” or Android’s multi-platform APK files, built and provided by vendors so that you don’t need to remember whether you are 32-bit or 64-bit, or if you have an Intel/AMD or ARM processor, every time you install the same program to a new device. File extensions to watch out for include: .msix, .appx, .msixbundle and .appxbundle. If you aren’t familiar with these, think of them as wolf-in-sheep’s-clothing files and avoid them unless they come from a known and trusted source.

Adobe brand hijack

The App Bundle itself, if you allow it to download and run, continues hijacking Adobe’s brand by claiming to be a needed component:

As you can see, the file is reported as a Trusted App, with a vendor name given as Adobe Inc., but that’s as fake as the original email.

If you click on [Trusted App], you’ll see that what purports to be a softare bundle from Adobe was apparently digitally signed by an accounting firm in southern England.

We’re assuming that the crooks acquired a copy of this company’s signing key, or bought it on the dark web, as the after-effect of an cyberintrusion at that company. Many cyberattacks these days include a stage where the crooks steal as many useful-looking files as they can along the way. Often, those stolen files are used by ransomware criminals as extra leverage to blackmail you into paying “hush money”. But selected files from data thefts of this sort have many more uses than just extortion, and have value of their own when sold individually for further cybercriminality.

What happens next?

We won’t describe the technical details of the malware here – for the step-by-step details of how it performs its treachery in multiple stages, see this Twitter thread from @SophosLabs:

Hey everyone. @threatresearch here with a little news about how my day’s been going.

Seems a lot of people are dealing with an outbreak of #BazarBackdoor that starts with an email that sounds like it’s coming from someone who is annoyed you didn’t report a complaint about you. pic.twitter.com/EYrQHBAiXO

— SophosLabs (@SophosLabs) November 4, 2021

Amongst the actions that the malware performed immediately were:

• Telling the crooks your external IP address by consulting a public “find my IP” server. Ironically, the crooks ought to be able to tell your external IP number anyway, because that’s where the callhome data from their malware will originate from. Nevertheless, they make double-sure by finding out how your own computer thinks it connected to the internet.
• Reporting the specifications of your computer. The crooks want to know how much disk space you have available, how much RAM you’ve got, and what motherboard you’re using.

We’re assuming, like most backdoor programs, also known as bots or zombies, that we’ve ever seen, that this malware also includes a “feature” to download and install yet more malware.

In other words, this malware, if you are unfortunate enough to get infected, may look and feel like the end of an attack chain…

…when in fact it merely the begining of the next one.

And as pedestrian as some of the data that this zombie malware steals at the start, such as how much RAM you’ve got, it’s an excellent and simple hint to the criminals of the type of tasks your now-backdoored computer is best suited to.

For example, some cryptocurrency mining processes (and various types of password cracking operation) work best with lots of free disk space, but don’t need a lot of CPU power or RAM; some want as much processing power as they can take; and others run faster the more memory they can use.

Often, zombies also try to estimate your network speed, so that the crooks who control the malware know which parts of their botnet are best suited to leasing ourtfor DDoS (distributed denial of service) attacks, or for sending spam emails containing the next wave of malware.

What to do?

• Stop. Think. Connect. That’s the motto of Cybersecurity Awareness Month, which happens in October, but acts as a reminder of cyberecurity precautions you can take all year round. Never let yourself be pressured or threatened into acting in haste, because that’s exactly what the crooks are hoping you will do. This scam is full of mistakes (spelling, grammar, incorrect web links, unlikely file downloads, digital signatures that simply don’t look right) that you would expect to notice on a good day, but could easily miss if you are acting in haste. But the signs are all there, even if you aren’t technical yourself, that this email simply doesn’t add up, and is fake.
• Always use official channels for communicating with your staff. If you’re a manager, and you really are dealing with an emergency such as a customer complaint, never take IT shortcuts or try to cajole your staff into breaking company rules about official communications. Make it clear that if there is an official complaint, then there will be an official sequence of steps that will be followed. That way, if cybercrimals try to talk your staff into taking unusual steps or downloading unexpected files, even your junior staff will have the knowledge and the self-confidence not to do it.
• Set up a single, easy-to-remember contact point for security reports. Something as simple as a cybersecurity@company.example email address, where any staff member can report anything that doesn’t add up, from a sneaky-sounding phone call to an unlikely email request, is perfect for this. Just make sure that you treat your staff with respect if they report messages that turn out to be false alarms. Get your security team to work on the principle that there is no such thing as a stupid question, only a stupid answer.
• If you didn’t know about App Bundles, add them to your cybersecurity knowledgebase. For example, if you’re routinely blocking .EXE files at your web gateway, consider blocking .appxbundle and friends, too (see above). Also review your email attachment filtering rules, too. Less, when it comes to email, is more.
• Don’t be seduced by on-screen security promises and visual indicators. In the same way that HTTPS and a padlock on a website doesn’t mean that the website is telling the truth, so the remark about the download being a Trusted App doesn’t count for much when it comes to what the app actually does, given that all the digital signature really tells you is that the app was signed by someone’s cryptographic key. (In this case, clicking [Trusted App] to see who signed it does help you spot the scam, because of the obvious mismatch between the signer’s name and the app’s claim to be from Adobe.)

By the way, you can extend the last warning above to all interactions in your digital life.

In particular, when you get a message from a social media friend, via a private group that you belong to, and that you are therefore inclined to trust straight off the bat…

…remember that you don’t actually know that the message came from your friend, merely that it came from your friend’s account.

If in doubt, don’t give it out!

[00’29”] Don’t miss our cybersecurity podcast minisodes!
[01’46”] Bliss is a hill in wine country.
[03’37”] Lessons from a cryptotrading hamster.
[08’46”] Ransomware gang hacked back.
[20’27”] Docusign phishers go after 2FA codes.
[30’23”] Oh! No! Sleep mode considered harmful.

With Paul Ducklin and Doug Aamoth. Intro and outro music by Edith Mudge.

WHERE TO FIND THE PODCAST ONLINE

You can listen to us on Soundcloud, Apple Podcasts, Google Podcasts, Spotify, Stitcher and anywhere that good podcasts are found.

Or just drop the URL of our RSS feed into your favourite podcatcher software.

If you have any questions that you’d like us to answer on the podcast, you can contact us at tips@sophos.com, or simply leave us a comment below.

Two weeks ago was Cybersecurity Awareness Month’s “Fight the Phish” week, a theme that the #Cybermonth organisers chose because this age-old cybercrime is still a huge problem.

Even though lots of us receive many phishing scams that are obvious when we look at them ourselves…

…it’s easy to forget that the “obviousness” of many scam emails comes from the fact that the crooks never intended those scams for us in the first place.

The crooks simply sent them to everyone as a crude way of sending them to someone.

So most scams might be obvious to most people, but some scams are believable to some people, and, once in a while, “some people” might just include you!

When 0.1% is more than enough

For example, we received a phish this morning that specifically targeted one of the main South African banks.

(We won’t say which bank by name, as a way of reminding you that it could have been any brand that was targeted, but you will recognise the bank’s own website background image if you are a customer yourself.)

There’s no possible reason for any crook to associate Sophos Naked Security with that bank, let alone with an account in South Africa.

So, this was obviously a widely-spammed out global phishing campaign, with the cybercriminals using quantity instead of quality to “target” their victims.

Let’s do some power-of-ten approximations to show what we mean.

Assume the population of South Africa is 100 million – it’s short of that, but we are just doing order-of-magnitude estimations here.

Assume there are 10 billion people in the world, so that South Africans make up about 1% of the people on the planet.

And assume that 10% of South Africans bank with this particular bank and use its website for their online transactions.

At a quick guess, we can therefore say that this phish was believable to at most 1-in-1000 (10% of 1%) of everyone on earth.

In other words, it’s easy to extrapolate that 99.9% of all phishing emails will give themselves away immediately.

Therefore you might wonder to yourself, perhaps with just a touch of smugness, “If 99.9% of them are utterly trivial to detect, how hard can the other 0.1% be?”

On the other hand, the crooks knew all along that 999 people in every 1000 who received this email would know at once that it was bogus and delete it without a second thought…

..and yet it was still worth their while to spam it out.

Are you thinking clearly?

The ultimate believability of phishing scams like this one actually depends on many factors.

These factors include: Do you have an account with the company concerned? Have you done a transaction recently? Are you in the middle of some sort of contract negotiations right now? Did you have a late night? Is your train due in two minutes? Are you thinking clearly today?

After all, the crooks aren’t aiming to fool all of us all the time, just a few of us some of the time.

This scam starts, like many phishing scams, with an email:

The email itself comes from cloud-based document and contract-signing service Docusign, and includes a link to a genuine Docusign page. (We have labelled the Docusign screenshot below as FAKE because the content is made up, in the same way we label emails FAKE even if they appear in your trusted email app.)

The Docusign page itself isn’t dangerous because it doesn’t contain any clickable links, and just seeing the curious text in it should make you realise that this is just what it seems, a suspicious and unlikely document about nothing:

It’s not a contract, so there’s nothing to identify the person at the other end, or to reveal what the document is about, so the Docusign link is actually a red herring, though it does add a sense of legitimacy-mixed-with-curiosity into the scam.

“Is this some kind of imposter?”, you are probably wondering, “And what on earth are they talking about given that Docusign only has a page for me to view, not an actual contract to process?”

So you might be inclined to open the attached PDF, which is indeed just a replica of the document in the Docusign window:

Except that the link in the PDF version of the document is live, and if you’re still wondering what’s going on, you might be inclined to click it, given that the PDF probably opened in your chosen PDF viewer (e.g. Preview, Adobe Reader or your browser)…

…so it doesn’t feel like the you-know-it’s-risky option of “clicking links in emails” any more.

You ought to notice that the URL seems unlikely for a major bank, given that it’s a DNS redirector service in the Philippines, and that the site it redirects to is even more unlikely, given that it’s a hacked agricultural company in Bulgaria.

But one thing is certain, namely that the visuals are surprisingly close to the bank’s regular login page:

Perhaps the bank is trying to draw your attention to a transaction that hasn’t gone through yet, given that you’ve not actually “signed” anything yet via Docusign?

Of course, if you do try to login, the crooks will lead you on a merry but visually agreeable online dance, asking for your password:

The next step asks for your phone number, so the crooks get that even if the final step fails, followed by a short animated delay, presumably while one of the crooks (if they’re online, or an automated system if they aren’t) starts trying to login using your credentials, followed by a fradulent request for your 2FA code:

If the crooks get this far, and you do enter your 2FA code, then they almost certainly have enough to get into your account.

If all else fails, or it you’re suspicious of handling the matter online, as we hope you would be, there’s a fallback South African phone number listed in the “invoice” that you can call for help.

It’s not the bank’s real call centre, of course – in fact, it’s a VoIP (internet telephony) connection, so you could end up anywhere in the world.

We didn’t try calling it, but we don’t doubt that if you were to do so, the phone would be answered by someone claiming to be from the very bank against which this scam is being worked.

We’re guessing that a polite and helpful person at the other end would simply explain to you how to connect to the fraudulent site by typing in the URL yourself, and patiently wait with you as you went through the process.

That “helpful” person would probably log into the bank with your credentials in parallel with your call, copying the password and 2FA code as soon as you’d handed them over, and then they’d be helping themselves for real, intead of pretending to “help” you.

What to do?

Here are our tips to avpid getting caught out, even if it’s only those 1-in-1000 emails that you need to worry about:

• Check those URLs. Copying the look-and-feel of a brand’s website is easy, but hacking into that brand’s own servers to run the scam is much harder. If you can’t see the URL clearly, for example because you are on a mobile phone, consider switching to a laptop, where details such as full web addresses are much easier to check out.
• Avoid links in emails or attachments. You might be willing to click a Docusign link, assuming you are expecting one and the URL checks out. That means taking what amount to a well-informed risk. But for services such as banks, webmail and courier companies where you already have an account, bookmark the company’s true website for yourself well in advance. Then you never need to rely on links that could have come from anyone, and probably did.
• Use a password manager. Password managers not only choose random, complex and different passwords for every site, so you can’t use the same password twice by mistake, but also associate each password with a specific URL. This means that when you click through to a fake site, the password manager simply doesn’t know which password to use, so it doesn’t try to log you in at all.
• Never call the crooks back. Just as you should avoid links in emails, you should also avoid phone numbers offered by someone you don’t know. After all, whether the number is genuine or not, the person at the other end is going to greet you as though it is. Find the right number to call by looking it up yourself, ideally without using the internet at all, e.g. from existing printed records or off the back of your credit card.

[04’04”] Apple (you guessed it!) fixes yet another iPhone 0-day.
[08’38”] Apache patches an embarrassing bug and then has to patch the patch.
[20’01”] It’s Fight The Phish week.
[28’42”] Oh! No! The computer that punched a user in the face.

With Paul Ducklin and Doug Aamoth. Intro and outro music by Edith Mudge.

WHERE TO FIND THE PODCAST ONLINE

You can listen to us on Soundcloud, Apple Podcasts, Google Podcasts, Spotify, Stitcher and anywhere that good podcasts are found.

Or just drop the URL of our RSS feed into your favourite podcatcher software.

If you have any questions that you’d like us to answer on the podcast, you can contact us at tips@sophos.com, or simply leave us a comment below.