Connect with us

E-Business

Kaspersky Warns of a Two-fold Surge in Browser Extensions that Steal Crypto

Published

on

Kindly share this post

A browser extension is a piece of software that users can install to customise the functionality of a web browser. Browser extensions are handy, but they can also pose serious threats to privacy and security.

As an increasing number of people have begun to rely on cryptocurrencies for online transactions, cybercriminals have adapted their tactics accordingly: browser extensions have become an attractive target for hackers looking to exploit unsuspecting crypto users.

At the beginning of 2023 Kaspersky observed a two-fold increase in the number of malicious browser extensions, specifically those designed to perform web injects and steal cryptocurrency. There was also a rise in the number of malicious droppers that install harmful extensions on victims’ machines.

A malicious browser extension interferes in browser functionality and mimics legitimate software. It could be difficult to detect by antivirus software. Malicious extensions can alter what the user sees on his/her browser, as opposed to what is actually sent by the server.

For example, these extensions can add or remove text, labels, text fields, and other website elements. Malicious extensions can track affiliate IDs, engage in phishing activities and steal credentials, as well as steal cryptocurrency.

For instance, a malicious extension can insert an additional field to a form sent by a crypto wallet server. The purpose of these extra fields (accompanied by supporting labels and instructions) is to dupe the user into entering certain confidential information (e.g., login credentials, credit card numbers, CVVs, PINs, tokens, etc.) even if that information was not being requested by the crypto wallet in the original form.

These malicious extensions often mimic legitimate ones, making it difficult for users to differentiate between safe and harmful add-ons. Once installed, these extensions can inject malicious code into users’ browsers, enabling cybercriminals to steal sensitive information such as private keys, seed phrases for crypto wallets, login credentials and two-factor authentication information.

“Browser extensions can be installed both from official browser stores (e.g., in Chrome, Firefox) or direct from a file – this is currently available on Windows machines in the most popular browser – Chrome.

When installed from outside the official stores, the risk of the extension being malicious increases. Users, especially those who engage in cryptocurrency operations on their Windows machines, should be wary of browser extensions that they install,” comments Sergey Lozhkin, Lead Security Researcher at Kaspersky GReAT.


Kindly share this post

Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

E-Business

Africa Among Regions with Highest Number of Industrial Systems Under Attack in Q 1 2023

Published

on

Kindly share this post

Malicious objects of all types were detected and blocked on 34% of Industrial Control System (ICS) computers in the first half of 2023, according to the ICS CERT landscape report by Kaspersky.

In Africa over this period attacks were detected on 40,3% of ICS computers, placing it in first place among the other regions. The top industries under attack were energy (45,9%), engineering & integration (44%) and building automation (40%). All these attacks were blocked after detection.

ICS computers are used in oil & gas, energy, automotive manufacturing, building automation infrastructures and other spheres to perform a range of operational technology (OT) functions – from the workstations of engineers and operators to supervisory control and data acquisition (SCADA) servers and Human Machine Interface (HMI).

Cyberattacks on industrial computers are considered to be extremely dangerous as they may cause material losses and production downtime for the controlled production line and even the facility as a whole. Moreover, industrial enterprises put out of service can seriously undermine a region’s social welfare, ecology and macroeconomics.

An analysis of the most significant and targeted threats detected on ICS computers in selected countries of Africa in the first half of 2023 shows that the threat landscape can vary between countries and between industries due to the differences in the security maturity of different countries/industries and the current focus of threat actors.

In South Africa in the first half of 2023 malware was detected and blocked on 29,1% of ICS computers, in Nigeria on 32,6%, in Kenya on 34,5% of machines.

There are different types of cyberthreats that OT-related computers face – malicious scripts, spy trojans, worms, ransomware, and others. In the first half of 2023 Africa had the highest percentage of ICS computers on which spyware was blocked (9,8%).

The Middle East and Southeast Asia had similarly high percentages (8,3% and 8,1%). The global average stands at 6,1%.

Africa was also the region with the highest percentage of ICS computers (14,8%) on which attacks from denylisted Internet resources were blocked (these are web resources associated with distributing or controlling malware). The global average is 11,3%.

Viruses and worms spread across ICS networks by means of removable media, shared folders, infected files, such as backups, and network attacks on outdated software.

The percentage of ICS computers on which worms were detected was very high in Africa (7% vs. 2,3% global average), making this region the leader by percentage of ICS computers on which threats were detected after removable devices were connected.

“Africa’s industrial landscape is diverse, ranging from large-scale mining operations to small-scale agriculture. This means that ICS cybersecurity solutions need to be adaptable to various sectors and technologies.

In some regions, legacy ICS systems that lack modern security features are still in use. These systems are often more vulnerable to cyberthreats and require significant upgrades. Lastly, some critical infrastructure in Africa is located in remote areas with limited connectivity, which can make it difficult to monitor and secure ICS assets effectively,” comments Evgeny Goncharov, Head of Kaspersky ICS CERT.

“By understanding these risks, organisations can make informed decisions, allocate resources wisely, and efficiently fortify their defenses. In doing so, they not only protect their bottom line but also contribute to a safer and more secure digital ecosystem for all.”


Kindly share this post
Continue Reading

E-Business

PwC Nigeria Tech Talent Bootcamp IDs Leaked- Report

Published

on

Kindly share this post

Participants in PricewaterhouseCoopers (PwC) Nigeria Tech Talent Bootcamp are at risk of identity theft after private data was leaked from a misconfigured Amazon Web Services account, according to the latest Cybernews research team investigation.

PwC Nigeria Tech Talent Bootcamp IDs Leaked- Report

On July 21st, the Cybernews research team conducted a routine check using open-source intelligence (OSINT) methods and revealed a misconfigured Amazon AWS bucket.

According to the Cybernews team, the bucket containing nearly 25,000 sensitive PwC Nigeria files has been attributed to a third-party vendor, Xerde Tech.

The 24,668 exposed files include: copies of passports/government-issued IDs; resumes with phone numbers, home and email addresses, and other private information; and copies of degree/university certificates

PwC was also among the victims of the MOVEit attack earlier this year. The Cl0p ransom gang released data belonging to the company in 11 batches on the dark web and four on the publicly accessible clear web.

“This leak is a significant risk to exposed individuals, as the private information could be used for identity theft, financial fraud, spear-phishing, and scam campaigns. In an environment where the data is easily sold on the dark web, and bad actors specialize in extortion techniques, users should exercise extra caution,” Cybernews researchers said.

Cybernews reached out to PwC Nigeria, and the company resolved the issue, though it had not commented at the time of writing.

Additional Credit: itnewsafrica.com

 

 

 

 


Kindly share this post
Continue Reading

E-Business

How Sophos Excels in MITRE Engenuity ATT&CK® Evaluations with 99% Detection Coverage

Published

on

Kindly share this post

Sophos, a global leader in innovating and delivering cybersecurity as a service, on Thursday announced its strong results in the MITRE Engenuity ATT&CK® Evaluations. Sophos Intercept X with XDR detected 99% of the adversary behaviors in the evaluation, reporting 141 out of 143 adversary attack steps.

Sophos Intercept X with XDR excelled in the independent ATT&CK Evaluations with its comprehensive EDR and XDR capabilities that deliver actionable context on the “what,” “why” and “how” of attacker behaviors.

In addition, Sophos Intercept X with XDR recorded rich analytic data on 98% of the substeps in the ATT&CK Evaluations.

“As active adversaries continue to prey upon the unprepared, good cybersecurity outcomes increasingly depend upon competent technologies in the hands of skilled operators. MITRE’s evaluation is a powerful objective measurement of a technology’s ability to produce the fundamental observations and classifications needed to effectively identify and defend against attackers,” said Joe Levy, president and chief technology officer at Sophos.

“Sophos meticulously architects its solutions for security operators, empowering them with superior protection, detection and response capabilities for known and unknown threats before they become full-blown, destructive attacks, and we believe MITRE’s evaluation results demonstrate the robustness of Sophos’ real-world security capabilities.”

This round of independent ATT&CK Evaluations evaluated the abilities of 30 vendors in detecting and analyzing attack tactics, techniques and procedures (TTPs) of Turla, a known Russia-based threat group. Turla leverages novel TTPs and custom tooling to evade security defenses, and was chosen as the evaluation adversary based on its innovative stealthy maneuvers; targeted sectors, including government, critical infrastructure, education, and more; and breadth of open-source reporting on its tradecraft.

“Turla is one of the most sophisticated threat actors, and their tradecraft is platform diverse, dynamic in stealth, and layered in persistence,” said Amy Robertson, MITRE cyber threat intelligence lead, ATT&CK Evals. “This round provides an emulation that focused on kernel and service-level operations that often run with the same permissions as detection and protection products.

“Our goal is to empower end users and purchasers with unbiased insights into the product capabilities that detect these advanced adversary behaviors, while also collaborating with the participating vendors to evolve their products.”

Sophos Intercept X with XDR combines active adversary mitigations – including industry-first Adaptive Attack Protection that immediately activates heightened defenses when a hands-on-keyboard attack is detected, stopping the attack and providing defenders valuable additional time to respond; anti-ransomware technology; deep learning artificial intelligence; and exploit prevention to prevent and stop attacks.

It is powered by Sophos X-Ops threat intelligence, a cross-operational task force of more than 500 security experts within SophosLabs, Sophos SecOps and SophosAI.

For more information on Sophos’ evaluation results, watch this video and visit https://attackevals.mitre-engenuity.org/enterprise/turla/.


Kindly share this post
Continue Reading

Trending