• Search for:
    8May, 2023
    Hackers Promise AI, Install Malware Instead

    Meta on Wednesday warned that hackers are using the promise of generative artificial intelligence like ChatGPT to trick people into installing malicious code on devices.

    Over the course of the past month, security analysts with the social-media giant have found malicious software posing as ChatGPT or similar AI tools, chief information security officer Guy Rosen said in a briefing.

    “The latest wave of malware campaigns have taken notice of generative AI technology that’s been capturing people’s imagination and everyone’s excitement,” Rosen said.

    Meta, the parent company of Facebook, Instagram and WhatsApp, often shares what it learns with industry peers and others in the cyber defense community.

    Meta has seen “threat actors” hawk internet browser extensions that promise generative AI capabilities but contain malicious software designed to infect devices, according to Rosen.

    In general, it is common for hackers to bait their traps with attention-grabbing developments, tricking people into clicking on booby-trapped web links or downloading programs that steal data.

    “We’ve seen this across other topics that are popular, such as crypto scams fueled by the immense interest in digital currency,” Rosen said.

    “From a bad actor’s perspective, ChatGPT is the new crypto.” Meta has found and blocked more than a thousand web addresses that are touted as promising ChatGPT-like tools but are actually traps set by hackers, according to the tech firm’s security team.

    Meta has yet to see generative AI used as more than bait by hackers, but is bracing for the inevitability that it will be used as a weapon, Rosen said.

    “Generative AI holds great promise and bad actors know it, so we should all be very vigilant to stay safe,” Rosen said.

    At the same time, Meta teams are working on ways to use generative AI to defend against hackers and deceitful online influence campaigns.

    “We have teams that are already thinking through how (generative AI) could be abused, and the defenses we need to put in place to counter that,” Meta head of security policy Nathaniel Gleicher said in the briefing.

    “We’re preparing for that.”

    Resource : https://www.securityweek.com/hackers-promise-ai-install-malware-instead/

    9Jan, 2023
    Hackers Use CAPTCHA Bypass Techniques to Create Five GitHub Accounts Every Minute

    Researchers from Unit 42 analyze Automated Libra, the group of cloud threat actors responsible for PurpleUrchin, the freejacking campaign.

    It is been observed that Automated Libra has been refining its methods to profit from cloud platform resources used for cryptocurrency mining.

    Threat actors abuse free cloud resources by using a new CAPTCHA-solving technique, more aggressive CPU resource utilization for mining, and a mix of “freejacking” and the “Play and Run” method.

    PURPLEURCHIN was initially identified in October 2022 when Sysdig disclosed that the attackers scaled their operations by opening 30 GitHub accounts, 2,000 Heroku accounts, and 900 Buddy accounts.

    Play and Run Tactics

    Reports say PurpleUrchin threat actors used Play and Run strategies, consuming cloud resources while avoiding paying the cloud platform vendor’s bill for such resources.

    Actors from PurpleUrchin carried out these Play and Run activities by setting up and using fake accounts and using fake or perhaps stolen payment cards. These fake accounts had an outstanding balance. $190 USD was one of the greatest outstanding balances discovered.

    “We suspect the unpaid balances in other fake accounts and cloud services used by the actors could have been much larger due to the scale and breadth of the mining operation”, researchers

    The Specifics of Automated Libra 

    The threat actor uses automated campaigns to create new accounts on the platforms and run cryptocurrency miners in containers by abusing continuous integration and deployment (CI/CD) service providers like GitHub, Heroku, Buddy.works, and Togglebox.

    Unit 42 found that the threat actor traded the cryptocurrency they had mined on a variety of trading platforms, including ExchangeMarket, crex24, Luno, and CRATEX, as well as using containerized components for mining.

    Mining with GitHub Workflows

    Researchers say due to its easier account setup process, GitHub was most likely used by the actors. The actors were able to take advantage of a flaw in the GitHub CAPTCHA check.

    Notably, after engaging in a Play and Run strategy where each account would demand computing resources, threat actors finally failed to pay their bills for each of the GitHub accounts.

    PurpleUrchin generated more than 130,000 accounts across numerous virtual private server (VPS) providers and cloud service providers, suggesting that this is a typical operating practice for them (CSPs).

    The threat actors transform CAPTCHA images into their RGB equivalents using ImageMagic’s “convert” tool and then use the “identify” tool to determine each image’s Red channel skewness.

    The “identify” tool’s output value is used to rank the photos in ascending order. The automated tool uses the table to select the image that tops the list, which is usually the right one.

    CAPTCHA and conversion
    CAPTCHA and Conversion
    Ranking images by the skewness value
    Command to extract skewness value and image ranking 

    This system demonstrates Automated Libra’s commitment to enhancing operational effectiveness by raising the number of GitHub accounts they can create each minute.

    Image 13 is a graph showing the number of GitHub accounts created by PurpleUrchin actors. There is a dramatic increase in November 2022, compared to September and October of the same year.
    Number of GitHub accounts created by the PurpleUrchin actor

    “It is important to note that Automated Libra has designed its infrastructure to take full advantage of CD/CI tools,” the researchers concluded.

    “This has become easier to achieve over time as traditional VSPs diversify their service portfolios to include cloud-related services. It’s easier for attackers because they don’t need it to deploy the application.”

    Resource : https://cybersecuritynews.com/hackers-bypass-captcha/