U.S. hackers alone bank-rolled $8.8 billion in profits in 2021 using fraudulent malware or scripts.
What’s a PII ? — Personally Identifiable Info
WHAT’s NEW
Some less skilled hacks, but truly creative I must admit, are using similar characters to spoof your intended website. In short, thanks to these hacks: An “α” is not an “𝙖”.
Credible sources dating back to 2001 forewarned of this kind of “spoof” of the website URL.
In this scheme a user intends to visit Rainstorms.com but searched and found Rαinstorms.com using spoofed characters like the Russian α.
In another example involving WhatsApp the hacker used the following nearly invisible spoof or a link:
https://whatsapp.com/free-tickets. Whoa, Nellie! Is that that little . under the w, dust? Nope. And it’s not a standard w! The first character looks like the letter “w” but is instead the character “ẉ” – This Latin syllabic character written with a (dot) . under the w is otherwise known as Unicode character U+1E89, clearly not the w Unicode U+0077. So, the hacker can register and own the ẉhatsapp.com domain name legally and use it to spoof YOU! Howa about that?
MALWARE
While I have my own niche, some hacker scripts operate within malicious code or software known as “malware”, which may have been inadvertently downloaded as cargo along with that free movie or song and runs secretly locally on your computer.
The malware package delivery system might have been an attachment: a bank statement, a photo, or resumé. The code is likely tapped in one of the two most common script languages: Javascript and Python. Although some hacks prefer to script in ‘C’ or PHP.
I’ve even used a Python-written back-end logic called Flask for the server-side in one neat little Javascript progressive web server app. The idea of a progressive web app at least in my case was to circumvent the whole nightmarish Apple app-creation approval process. Think web-page with local app-like functionality.
Only a few of these malware mosaics are real masterpieces toting spyware capable of soaking up your identity, ransomware mayhem for profit, reduplicating worms, to wreck your computer, and seemingly but not harmless trojans. Quite a repertoire!
Regardless, a well-placed malware package can remain dormant on a phone or desktop computer for months! Then one day it’s activated and capturing your passwords, PII and wreaking havoc, without even interrupting your sleep!
THE PHISH
Don’t misunderstand, malicious code capable of capturing your PII doesn’t need to be a compiled program package as suggested by the term mal “ware”.
A hacker doesn’t necessarily need to smuggle his coded creation within a free movie, app or song in order to gain access and grab your personal stuff.
The malicious code can instead be operated remotely, invisibly in a web page from or on the hack’s server – my hack of choice. There’s no code or malware infecting and running on your device, only a server-side script from its web host which happened to have found you.
So, while you travail through endless reams of Facebook posts, you click over to your email, and then to a web page. Now a bank notification text or email. A seamless, efficient routine of hopping about which seems to almost lull you to “sleep”. Social engineers catch you in just such a moment. They entice you to CLICK without thinking. Just once.
DEFINITION of PHISHING! the fraudulent practice of sending emails or other messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.
My scripts are simple, though I’m quite certain you’d agree some are rather elegant, were you not so offended by what I do. ☺️
Quite malicious, but exquisitely delivered from a spoofed website looking exactly like your own frequented online CreditCard.com or bank. There’s nothing more intriguing than a seamless electronic payment scheme neatly inserted into some worry-free life’s routine.
One beaut runs an HTML page together with Javascript GET and variable assignment routines to grab what you’ve just typed in a field. JavaScript elements are used to collect user input. Text or string variable elements designed to match-up with your inputs.
input [type=“password”] and name=“cardnumber” and name=“cvc”
Or, with practically NO inputs actually….
Username/password are autofilled, right? So you’re now looking at YourBank.com.
If you even click on a field and select: username or password, your credentials are autofilled from your Edge browser credentials file or Apple’s version of keychain file used with Safari, and Bam! Gotcha. Yes, there’s the little matter of iCloud Keychain encryption and password security which associates username/password with only YourBank.com not YourBαnk.com but there are workarounds.
btw… Are you where you think you are?
The whole premise of the phish is around the user’s stream of consciousness, which is social engineered. So, with the right tools hack does not require the encryption key!
The web page looks so authentic, virtually identical to YourBank.com. Well, never mind the autofill and encryption hurdle. The idea is you are convinced and so hurried that you’ll likely resort to just tapping away……. Username. Password. Then your individual key strokes are recorded by a neat little tool known as a key-logger. And my PII form variables will inevitably be filled by your PII. Your data uploaded in Flask to my server.
Voilà! You’ve been summarily phished!
Or SPEAR phished (targeted).
Or WHALED (biz executive).
Or SMISHED (by text).
Or VISHED (by voice).
PHARMING
Or pharmed. Suppose you’ve learned not to click any links within a text message or email no matter who it’s from. If instead of my sending you an email bearing the clickable link, perhaps I can have you staring at a twin of your actual bank’s website – a fake of course.
You’re THERE at your YourBank.com satisfied that you avoided risk of being phished via an emailed fraudulent link. In fact, you Google searched and YourBank.com just materialized. Appears to be authentic. But you didn’t actually type in the URL for your YourBank.com in the web address bar (recommended). So in fact, YourBank.com is somehow not your bank; it’s a spoof. (A spoofed website will likely adopt the design of the target website, and it sometimes has a similar URL. ) Well, then in this case you’ve been PHARMED.
In summary, hackers use social engineering tactics to “trick” and “schmooze” their victim into trusting and revealing their PII. This can involve impersonation of your IT Support or manager or an executive in a position of authority, and manipulating the victim into providing sensitive information.
We’ll come back to that. If you’ll allow me. Let’s introduce you to a few of the basic instruments of the password hack.
HACKING the PASSWORD:
Some hackers are skilled at using Terminal command line commands to navigate their way through your folders, find hidden files, manipulate text, decode, encrypt, decrypt, and monitor to obtain clues for entry. Step into my world for a peek at a few cute little words:
grep, sed, awk, curl, wget, tree, and htop.
And:
sudo, sort, uniq, strings, base64, tr, tar, gzip
And:
bzip2, xxd, mkdir, cp, mv, file, ls, yada yada.
They find hidden files, sort, convert, decode, decipher….Until they locate a password or a back door.
Yeah, there’s a lot here. Probably deeper than you wanted to go. But let’s decipher a few of these hacker jewels, give you a flavor.
sudo
The sudo command which is an acronym for superuser do or substitute user do, is a command that runs an elevated prompt without a need to change your identity. Depending on your settings in the /etc/sudoers file, you can issue single commands as root or as another user.
grep
The grep command can search for a string in groups of files. When it finds a pattern that matches in more than one file, it prints the name of the file, followed by a colon, then the line matching the pattern.
awk
awk is a scripting language, used in command line for text processing. When using awk , you are able to select data – one or more pieces of individual text – based on a pattern you provide.
strings
The strings command looks for printable strings in a file. A string is any sequence of 4 or more printable characters that end with a new-line or a null character.
curl
The cURL command, which stands for client URL, is a command line tool that developers use to transfer data to and from a server. Curl examples include sending a file to a server, submitting a web form, user authentication, saving the server response to disk, and more. Most of the examples given can be done right in the browser using the ReqBin Online Curl Client.
htop
htop command in Linux system is a newer command line utility that allows the user to interactively monitor the system’s vital resources or server’s processes in real time.
And if the hacker can’t find the target word, phrase or file, not a problem. There’s always Brute-force.
Brute-force
When a digital twit resorts to “brute-force” he’s not reaching for the ax. A brute-force password attack sounds crass but consists of fairly simple for-loop code that assembles and tries tens of 1000’s of combinations of names, common words, joined letters — ultimately a billion or so text, number, and ASCII symbol guesses. So, bear that in mind when you think-up a password. “Brute force” speaks to its volume.
And here below is a snippet from the weapon used in the death of some poor soul’s bank balance last week.
For you mathematicians, you’ll appreciate the Product of multiple Sets. It’s code for a Python generator which iterates through multiple sets of words or names, numbers, and symbols, including one set of 12,000 probable words, yielding one giant cartesian product. A billion sets of words or names, numbers, and symbols, fabulously joined to make a billion or more PASSWORD attempts.
…
generator = product(string.digits + string.ascii_lowercase, repeat=int(l))
p = product_loop(password, generator)
if p is not False:
return p
…
Hello, is this Customer Service?
So, you say, “Well, where’s my bank in all of this?” Hey, hey, hey hey, don’t just rely on your bank! You’ve heard “Caveat Emptor”? Let the BUYER beware. And all renditions and applications of that legal principle.
To take a clip from the Fraud Examiner’s Manual, the chances of being arrested and prosecuted for check fraud are low and the penalties mild. Law enforcement and prosecutors simply do not have the time or workforce to pursue all such cases.
It’s similarly bad with the problem of cyber risk and hackers, but the financial exposure is much worse. Even I cringe at the notion of a compromised password, for heavens sake! I mean, just listen…I can almost hear the ravings of some presumptuous husband somewhere saying, “Oh, Honey! What did you do?!” Cyber Security is a frighteningly large, expensive, and growing problem…. Thanks to us. And mark my words, it will come to a head, bearing on business viability.
Not to mention all of the disclaimers available to your bank or credit card company or email host, all suggesting, “Ya know, Ms. Schmuckatelli it’s plain to all of us that you weren’t very careful with whatever you did to help cause this mess and facilitate such easy access to your password!”
So, we might need to get used to the legal concept “let the buyer beware”, because the financial exposure here is unlimited and Hacking is becoming a dang Olympic Event.
When you set your PASSWORD, recall the hacker’s capability and remember the big picture here. This kind of growing financial exposure? — you’re in the beggar’s seat, with almost zero negotiating power. Oh, the $250,000 FDIC insurance. Keep reading.
CREDENTIAL STUFFING
Credential Stuffing is an attack which capitalizes on the high probability that a user has REUSED his or her password across multiple accounts: bank, credit cards, 401k, life insurance, email. Suffice it to say, “You don’t wanna do that.” Especially with your notification email account password. The one which all other accounts utilize to notify you of a compromise or breach.
SO, WHY DO I CARE?
Well, seeing my wife, family, friends, and hapless widows devastated by the effects of really skillful hacks, it makes me sad. No really. But then it makes me indignant. Almost enough to put on a White Hat and go after these crums – my way! But as for you?
Based on the growth rates of compromised PII, collectively we need clarity on what not to post. Sensitive identifying data (PII) should absolutely not be propagated in social media.
Be intentional, perhaps not too reactive when we consider how to respond to a possibly fake security notification text or email regarding an account. Be thoughtful. Hurried and careless or unconcerned is complacent. Through the “gun” sight of Black Hat hacker capability portrayed herein you’d qualify as vulnerable.
I’ve written some code in my time, however I wouldn’t say I’m gifted. But some of you ARE! You’re gifted or just really good. Give glory to God for that. Some of you would make great Hacks and you’re needed. You could make a difference in this hot war, as White Hats. Ethical Hacks, of course.
So, for now what can you do to STOP a brute force attacker in his tracks. He or she — the hacker can conceivably “try” a billion passwords per second. We need to slow ‘em down a bit, don’t ya think?
What can you do to frustrate the Hack?
- Freeze ALL 3 credit agency accounts. Experian, Equifax, and Transunion. Transunion succumbed to a hacker’s “dictionary attack”. The freeze ensures once hackers gain access, lock you out of your account, and steal personal data, they won’t be able to do anything with it such as identity theft.
- Utilize 2FA Two-factor Authentication on all important accounts starting with your bank. Even if hackers get your password, they won’t be able to access your smartphone or email without a 2FA code.
- Utilize Biometric Security – facial recognition on all accounts is preferred. Thus far, a hacker can’t defeat that security mechanism. Fingerprint recognition would be my second choice, but seek advice of an expert.
- Use Account Lockouts to substantially slow down the hacker in the number of failed attempts allowed before the Login System locks down for a period of time. Unfortunately YOU might create a denial of service yourself! So, lock out mechanisms are diminishing in popularity.
- Consider Norton’s LifeLock Security and Identity Theft protection. They used to offer a $1M bond; not certain if they still do.
- Refrain from REUSING the same password across multiple accounts. Prevents a hacker from attempting Credential Stuffing which presumes users REUSE the same password across multiple accounts. Upon guessing your username/password, the next hack will be ONE username ONE password across a three thousand financial service companies. Nuff said.
- Refrain from REUSING passwords, especially in the case of your notification email account. That email which all other accounts utilize to notify you of a compromise or breach. At least keep that one safe and difficult to guess!
- Birthdates should absolutely not be propagated in social media. Alter or delete whatever personal information you can from your social media. The same would otherwise be published and sold or “pwned” in the dark web”, accessible only via specialized programs like Tor, an acronym derived from “the .onion router” which is software offering anonymity to users or criminals.
- Be intentional, perhaps not quite so reactive when we consider how to respond to a possibly fake security notification text or email regarding an account. In one sense the hacker expects you to be hurried and profoundly dull to threats and attacks. Don’t give away your power! Be thoughtful. Hurried and careless or unconcerned is complacent. Through the “gun” sight of Black Hat hacker capability portrayed herein you’d qualify as vulnerable.
- Shred your trash. If you don’t own a shredder, grab a 2-gallon or 5-gallon bucket and pickle any bills, medical records, bank statements, insurance statements etc. which you don’t have a very good safe for or plan to retain. In a couple of days grab 20 sheets twist and wring it out so the paper and print is unrecoverable. Now, at least you’re protected against the dumpster diver. Don’t laugh. I’ve seen it.
Finally,
MAINTAIN YOUR PASSWORDS
Apple: You can manage your passwords in Settings, in Spotlight Search or using Siri. Go to Settings > Passwords, then do any of the following: To add a new password manually, tap Add in the top-right corner. To edit or delete a password, tap Edit in the top-right corner, tap “Select saved passwords”, then tap Edit or Delete.
———————
Resource: http://stackoverflow.com
Sept 1, 2023
Published by
Charlie
View all posts by Charlie
