This Week in Information Security — Week 8, 2017

SUBSCRIBE!

Malware samples recovered from watering hole attacks against the Polish financial regulator’s website contain false flags that fraudulently suggest Russian actors are behind the campaign. BAE Systems Threat Research attributed the attack to the notoriously known Lazarus Group.
 https://baesystemsai.blogspot.ch/2017/02/lazarus-false-flag-malware.html

TeamSpy malware targets high-profile industrial executives, researchers and diplomats using phishing attack. If successful, the malware installs keylogger and hidden TeamViewer application.
 https://heimdalsecurity.com/blog/security-alert-teamspy-turn-teamviewer-into-spying-tool/

The world’s largest spam botnet Necurs, with 5 million infected hosts, has added a DDoS module.
 http://blog.anubisnetworks.com/blog/necurs-proxy-module-with-ddos-features

Montenegro suffered massive cyberattacks against government and media websites.
 http://www.balkaninsight.com/en/article/montenegro-govt-on-alert-over-new-cyber-attacks-02-21-2017

This one about Cloudflare bug is all over the internet, but I found the report from the Google Project Zero engineer interesting.
 https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 https://medium.com/@octal/cloudbleed-how-to-deal-with-it-150e907fd165

Google announces first SHA1 collision attack, demonstrating it with two PDF files.
 https://shattered.io/

Short blog with the self explanatory headline “Why it sucks to be a Security Researcher” written by a Sakurity infosec guy.
 https://medium.com/@homakov/why-it-sucks-to-be-a-security-researcher-8a1d17fbffe8

Crackle is a tool to crack Bluetooth Smart Encryption (BLE). It exploits a flaw in the pairing mechanism that leaves all communications vulnerable to decryption by passive eavesdroppers.
 https://github.com/mikeryan/crackle http://www.darknet.org.uk/2017/02/crackle-crack-bluetooth-smart-encryption-ble/

The Mercure is a tool for generating and managing phishing campaigns. It includes email templates, attachments and landing page management.
 https://github.com/synhack/mercure/

This article was first published at Malgregator