How to Disable WPAD on Your PC So Your HTTPS Traffic Won’t Be Vulnerable to the Latest SSL Attack

July 26, 2016 – 6:21 PM

You may not know what HTTP is exactly, but you definitely know that every single website you visit starts with it. Without the Hypertext Transfer Protocol, there’d be no easy way to view all the text, media, and data that you’re able to see online. However, all communication between your browser and a website are unencrypted, which means it can be eavesdropped on.

This is where HTTPS comes in, the “S” standing for “Secure.” It’s an encrypted way to communicate between browser and website so that your data stays safe. While it was used mostly in banking, shopping, and other high-security situations, it’s now common for many websites such as Facebook, Google, and even Wikipedia to protect your information with HTTPS. And it’s most important when you’re browsing the internet on free Wi-Fi hotspots, guest networks, and other non-private access points.

But that “security” isn’t so secure anymore, thanks to some security researchers that will be presenting at this years Black Hat security conference in Las Vegas.

You’re in a potentially malicious network (free WiFi, guest network, or maybe your own corporate LAN). You’re a security conscious netizen so you restrict yourself to HTTPS (browsing to HSTS sites and/or using a “Force TLS/SSL” browser extension). All your traffic is protected from the first byte. Or is it?

By forcing your browser/system to use a malicious PAC (Proxy AutoConfiguration) resource, it is possible to leak HTTPS URLs. . . . We will present the concept of “PAC Malware” (a malware which is implemented only as Javascript logic in a PAC resource) that features: a 2-way communication channel between the PAC malware and an external server, contextual phishing via messages, denial-of-service options, and sensitive data extraction from URI’s.


Paperspace: Your full computer in the cloud

July 5, 2016 – 4:41 PM

I’d forgotten that I signed up to test the BETA version of this service about a year ago and I finally got an invite over the weekend and started playing around with it.  VDI is not new but it’s now becoming more affordable for the consumer and they offer some really good price plans in terms of cost/horsepower.  At quick glance, the encryption and privacy looks pretty solid but I did request their official security whitepaper to take a deeper look under the hood.  Check them out if something like this looks interesting to you:

Note: I’m not looking at it right now as a secure desktop replacement, but as a cloud-based secondary desktop for various engagements that require scanning/probing from outside a firewall.  It’s also much cheaper than the alternatives and you seem get more for your money.  I’m locked into a $20/month plan right now.

EduCrypt ransomware teaches you a lesson about computer security

June 30, 2016 – 5:40 AM

Ransomware has been infamously known to be nasty pieces of malware that takes a computer’s files hostage, and then demands a ransom, which can vary in cost. Countless variants have been discovered, which differ in how they are programmed, but all demand money in the end.

However, a new variant recently discovered called ‘EduCrypt’ encrypts a victim’s files, but instead of demanding a ransom, it actually provides the decryption key for free. Along the way, it teaches the victim a lesson about avoiding downloading sketchy items on the internet.

Discovered by Jakob Kroustek of AVG, the malware is based on the Hidden Tear ransomware. Unlike other ransomware variants, which encrypts a large number of file extensions, EduCrypt targets only a limited amount, and does not connect to a Command and Control (C&C) server. The list of files affected are:

.txt, .exe, .doc, .docx, .xls, .index, .pdf, .zip, .rar, .css, .lnk, .xlsx, .ppt, .pptx, .odt, .jpg, .bmp, .png, .csv, .sql, .mdb, .sln, .php, .asp, .aspx, .html, .xml, .psd, .bk, .bat, .mp3, .mp4, .wav, .wma, .avi, .divx, .mkv, .mpeg, .wmv, .mov, .ogg

It will lock up files found in the desktop, Downloads, Documents, Pictures, Music, and Videos folder. Once the ransomware finishes the encrypting process, it will append an extension of “.isis” on every file it touches.

A file called “README.txt” will be made available to the user. Inside the file, it will inform the user that their system is infected with a virus. Generously enough, it also provides a link to the decryptor, which the victim can download for free without paying any ransom. “Don’t download random **** on the Internet,” the Readme file states, hoping to teach the victim a lesson.


Ransomware that’s 100% pure JavaScript, no download required

June 20, 2016 – 4:22 PM

SophosLabs just alerted us to an intriguing new ransomware sample dubbed RAA.

This one is blocked by Sophos as JS/Ransom-DDL, and even though it’s not widespread, it’s an interesting development in the ransomware scene.

Here’s why.

Ransomware, like any sort of malware, can get into your organisation in many different ways: buried inside email attachments, via poisoned websites, through exploit kits, on infected USB devices and occasionally even as part of a self-spreading network worm.

But email attachments seem to work best for the cybercrooks, with fake invoices and made-up court cases amongst the topics used by the criminals to make you think you’d better open the attachment, just in case.


0patch Open Beta is Launched

June 7, 2016 – 7:28 PM

After a long period of internal development and testing, our mighty little patching machine finally got wings and flew out of the nest.

This is BIG for us. We’ve invested a significant part of our last three years into building a technology and a business model that we believe can make a big difference in how vulnerabilities are getting fixed, and consequently make attacks considerably harder and more expensive. It is our sincere hope that the concept of vulnerability micropatching will some day become a “goes without saying” feature in all computers, from large data-processing machines and employee workstations, to car computers, mobile phones and the tiniest Internet-of-Things gadgets.

0patch does not claim to be a silver bullet, and it only aims to solve a very specific problem of patching vulnerabilities, but we believe it’s the most efficient possible way to bridge the security update gap that makes it so unforgivably easy to break into any network today.

We’re very excited about new users testing our technology, as well as security researchers getting a tool for fixing the vulnerabilities they find. However, as with any new technology, we’re expecting that the wheels will sometimes get stuck, and things might crack or break in unexpected ways – that’s the point of testing. So please remember that our technology is in beta, don’t use it in production yet!