by Charlie Whooph, CFE
CONCLUSION
U.S. hackers alone bank-rolled $8.8 billion in profits in 2021 using fraudulent malware or scripts.
What’s a PII ? – Personally Identifiable Info
WHAT’s NEW
Some less skilled hacks, but truly creative I must admit, are using similar characters to spoof your intended website. In short, thanks to these hacks: An “α” is not an “𝙖”.
Credible sources dating back to 2001 forewarned of this kind of “spoof” of the website URL.
In this scheme, a user intends to visit Rainstorms.com but searches and finds Rαinstorms.com using spoofed characters like the “α” which is called the “open back unrounded” from the International Phonetic Alphabet (IPO).
In another example involving WhatsApp the hacker used the following nearly invisible spoof or a link:
https://ẉhatsapp.com/free-tickets. Whoa, Nellie! Is that little . under the w, dust? Nope. And it’s not a standard w! The first character looks like the letter “w” but is instead the character “ẉ” – This Latin syllabic character written with a (dot). under the w is otherwise known as the Unicode character U+1E89, clearly not the w Unicode U+0077. So, the hacker can register and own the ẉhatsapp. com domain name legally and use it to spoof you! Frightening.
MALWARE
While I have my own niche, some hacker scripts operate within malicious code or software known as “malware”, which may have been inadvertently downloaded as cargo along with that free movie or song and runs secretly locally on your computer.
The malware package delivery system might have been an attachment: a bank statement, a photo, or a resumé. The code is likely tapped into one of the two most common script languages: Javascript and Python. Although some hacks prefer to script in ‘C’ or PHP.
I’ve even used a Python-written back-end logic called Flask for the server side in one neat little Javascript progressive web server app. The idea of a progressive web app at least in my case was to circumvent the whole nightmarish Apple app-creation approval process. Think web page with local app-like functionality.
Only a few of these malware mosaics are real masterpieces toting spyware capable of soaking up your identity, ransomware mayhem for profit, reduplicating worms, wrecking your computer, and seemingly but not harmless trojans. Quite a repertoire!
Regardless, a well-placed malware package can remain dormant on a phone or desktop computer for months! Then one day it’s activated and capturing your passwords, and PII and wreaking havoc, without even interrupting your sleep!
Bodie’s Doggie Dream Girl and Wolf-Like Studliness
Photo by Richard Brutyo on Unsplash
THE PHISH
Don’t misunderstand, malicious code capable of capturing your PII doesn’t need to be a compiled program package as suggested by the term mal “ware”.
A hacker doesn’t necessarily need to smuggle his coded creation within a free movie, app, or song in order to gain access and grab your personal stuff.
The malicious code can instead be operated remotely, invisibly on a web page from or on the hack’s server – my hack of choice. There’s no code or malware infecting and running on your device, only a server-side script from its web host which happened to have found you.
So, while you travail through endless reams of Facebook posts, you click over to your email, and then to a web page. Now a bank notification text or email. A seamless, efficient routine of hopping about which seems to almost lull you to “sleep”. Social engineers catch you in just such a moment. They entice you to CLICK without thinking. Just once.
DEFINITION of PHISHING! fraudulent practice of sending emails or other messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.
My scripts are simple, though I’m quite certain you’d agree some are rather elegant, were you not so offended by what I do. ☺️
Quite malicious, but exquisitely delivered from a spoofed website looking exactly like your own frequented online CreditCard.com or bank. There’s nothing more intriguing than a seamless electronic payment scheme neatly inserted into some worry-free life’s routine.
One beaut runs an HTML page together with Javascript GET and variable assignment routines to grab what you’ve just typed in a field. JavaScript elements are used to collect user input. Text or string variable elements are designed to match up with your inputs.
input [type=“password”] and name=“card number” and name=“CVC”
Or, with practically NO inputs….
The username/password is autofilled, right? So you’re now looking at YourBank.com.
If you even click on a field and select: username or password, your credentials are autofilled from your Edge browser credentials file or Apple’s version of keychain file used with Safari, and Bam! Gotcha. Yes, there’s little matter of iCloud Keychain encryption and password security which associates username/password with only YourBank.com not YourBαnk.com but there are workarounds.
btw… Are you where you think you are?
The whole premise of the phish is around the user’s stream of consciousness, which is socially engineered. So, with the right tools hack does not require the encryption key!
The web page looks authentic, virtually identical to YourBank.com. Well, never mind the autofill and encryption hurdle. The idea is you are convinced and so hurried that you’ll likely resort to just tapping away……. Username. Password. Then your individual keystrokes are recorded by a neat little tool known as a key-logger. And my PII form variables will inevitably be filled by your PII, and your data uploaded in Flask to my server.
Voilà! You’ve been summarily PHISHED!
Or SPEAR phished (targeted).
Or WHALED (biz executive).
Or SMISHED (by text).
Or VISHED (by voice).
PHARMING
Or pharmed. Suppose you’ve learned not to click any links within a text message or email no matter who it’s from. If instead of my sending you an email bearing the clickable link, perhaps I can have you staring at a twin of your actual bank’s website – a fake of course.
You’re THERE at your YourBank.com satisfied that you avoided the risk of being phished via an emailed fraudulent link. In fact, you Google searched and YourBank.com just materialized. Appears to be authentic. But you didn’t actually type in the URL for your YourBank.com in the web address bar (recommended). So in fact, YourBank.com is somehow not your bank; it’s a spoof. (A spoofed website will likely adopt the design of the target website, and it sometimes has a similar URL. ) Well, then in this case you’ve been PHARMED.
In summary, hackers use social engineering tactics to “trick” and “schmooze” their victims into trusting and revealing their PII. This can involve the impersonation of your IT Support or manager or an executive in a position of authority, and manipulating the victim into providing sensitive information.
We’ll come back to that. If you’ll allow me. Let’s introduce you to a few of the basic instruments of the password hack.
Will the Market Uptrend Continue?
Herein is the answer and how YOU can read the “tells”.
HACKING the PASSWORD:
Some hackers are skilled at using Terminal command line commands to navigate their way through your folders, find hidden files, manipulate text, decode, encrypt, decrypt, and monitor to obtain clues for entry. Step into my world for a peek at a few cute little words:
grep, sed, awk, curl, wget, tree, and htop.
And:
sudo, sort, uniq, strings, base64, tr, tar, gzip
And:
bzip2, xxd, mkdir, cp, mv, file, ls, yada yada.
They find hidden files, sort, convert, decode, and decipher….Until they locate a password or a back door.
Yeah, there’s a lot here. Probably deeper than you wanted to go. But let’s decipher a few of these hacker jewels, and give you a flavor.
sudo
The sudo command which is an acronym for superuser do or substitute user do, is a command that runs an elevated prompt without a need to change your identity. Depending on your settings in the /etc/sudoers file, you can issue single commands as root or as another user.
grep
The grep command can search for a string in groups of files. When it finds a pattern that matches in more than one file, it prints the name of the file, followed by a colon, and then the line matching the pattern.
awk
awk is a scripting language, used in the command line for text processing. When using awk, you are able to select data – one or more pieces of individual text – based on a pattern you provide.
strings
The strings command looks for printable strings in a file. A string is any sequence of 4 or more printable characters that end with a new line or a null character.
curl
The cURL command, which stands for client URL, is a command line tool that developers use to transfer data to and from a server. Curl examples include sending a file to a server, submitting a web form, user authentication, saving the server response to disk, and more. Most of the examples given can be done right in the browser using the ReqBin Online Curl Client.
htop
htop command in Linux system is a newer command line utility that allows the user to interactively monitor the system’s vital resources or server’s processes in real-time.
And if the hacker can’t find the target word, phrase, or file, not a problem. There’s always brute force.
Brute-force
When a digital twit resorts to “brute-force” he’s not reaching for the ax. A brute-force password attack sounds crass but consists of fairly simple for-loop code that assembles and tries tens of thousands of combinations of names, common words, and joined letters – ultimately a billion or so text, number, and ASCII symbol guesses. So, bear that in mind when you “think up” a password. “Brute force” speaks to its volume.
And here below is a snippet from the weapon used in the death of some poor soul’s bank balance last week.
For you mathematicians, you’ll appreciate the Product of multiple Sets. It’s code for a Python generator that iterates through multiple sets of words or names, numbers, and symbols, including one set of 12,000 probable words, yielding one giant Cartesian product. A billion sets of words or names, numbers, and symbols, fabulously joined to make a billion or more PASSWORD attempts.
…
generator = product(string.digits + string.ascii_lowercase, repeat=int(l))
p = product_loop(password, generator)
if p is not False:
return p
Trading for Income
Valuable Methods & Triggers from 5 Savvy Traders
…Hello, is this Customer Service?
So, you say, “Well, where’s my bank in all of this?” Hey, hey, hey hey, don’t just rely on your bank! You’ve heard “Caveat Emptor”? Let the BUYER beware. And all renditions and applications of that legal principle.
To take a clip from the Fraud Examiner’s Manual, the chances of being arrested and prosecuted for check fraud are low and the penalties are mild. Law enforcement and prosecutors simply do not have the time or workforce to pursue all such cases. The Whooph is looking deeper into this.
It’s similarly bad with the problem of cyber risk and hackers, but the financial exposure is much worse. Even I cringe at the notion of a compromised password, for heaven’s sake! I mean, just listen…I can almost hear the ravings of some presumptuous husband somewhere saying, “Oh, Honey! What did you do?!” Cyber Security is a frighteningly large, expensive, and growing problem…. Thanks to us. And mark my words, it will come to a head, bearing on business viability.
Not to mention all of the disclaimers available to your bank or credit card company or email host, all suggesting, “Ya know, Ms. Schmuckatelli it’s plain to all of us that you weren’t very careful with whatever you did to help cause this mess and facilitate such easy access to your password!”
So, we might need to get used to the legal concept “let the buyer beware”, because the financial exposure here is unlimited and Hacking is becoming a dang Olympic Event.
When you set your PASSWORD, recall the hacker’s capability and remember the big picture here. This kind of growing financial exposure? – you’re in the beggar’s seat, with almost zero negotiating power. Oh, the $250,000 FDIC insurance. Keep reading.
CREDENTIAL STUFFING
Credential Stuffing is an attack that capitalizes on the high probability that a user has REUSED his or her password across multiple accounts: bank, credit cards, 401k, life insurance, email. Suffice it to say, “You don’t wanna do that.” Especially with your notification email account password – one that all other accounts utilize to notify you of a compromise or breach.
SO, WHY DO I CARE?
Well, seeing my wife, family, friends, and hapless widows devastated by the effects of really skillful hacks, makes me sad. No really. But then it makes me indignant. Almost enough to put on a White Hat and go after these crums – my way! But as for you?
Based on the growth rates of compromised PII, collectively we need clarity on what not to post. Sensitive identifying data (PII) should absolutely not be propagated in social media.
Be intentional, perhaps not too reactive when we consider how to respond to a possibly fake security notification text or email regarding an account. Be thoughtful. Hurried and careless or unconcerned is complacent. Through the “gun sight” of Black Hat hacker capability portrayed herein, you’d qualify as vulnerable.
I’ve written some code in my time, however, I wouldn’t say I’m gifted. But some of you are! You’re gifted or just really good. Give glory to God for that. Some of you would make great Hacks and you’re needed. You could make a difference in this hot war, as White Hats. Ethical Hacks, of course.
So, for now, what can you do to STOP a brute-force attacker in his tracks? He or she – the hacker can conceivably “try” a billion passwords per second. We need to slow ‘em down a bit, don’t ya think?
What You Can Do — How-To Tips
Is your email account hacked?
The following lists definitive signs of a hacked email account:
- You’re not receiving any emails, even emails you send to yourself. So, you can do this test now.
- Your Yahoo Mail is sending spam to your contacts.
- You see logins from unexpected locations on your recent activity page.
- Your account info or mail settings were changed without your knowledge.
So, how am I getting your pii? I may entice you to click a link leading you to a spoof — a site that looks and works exactly like your online bank site.
I lull you to complacency, trick you to login. And here’s the scary part: You clicked on the field, and stopped. You didn’t key in your username.
Well good, right? Wrong! Your browser is set to suggest a username or worse autofill the field. The spoofed malicious site is running a script written using Python or Javascript and has already captured your username suggestion and associated password key for that bank. If you notice any of the above, you might consider changing your notification email account password and your banking password. Pain in the neck, I know, but that’s our new world.
How to Frustrate the Hack!
Best Practice Security Rules:
- Freeze ALL 3 credit agency accounts. Experian, Equifax, and Transunion. Transunion succumbed to a hacker’s “dictionary attack”. The freeze ensures once hackers gain access, lock you out of your account, and steal personal data, they won’t be able to do anything with it such as identity theft.
- Utilize 2FA Two-factor Authentication on all important accounts starting with your bank. Even if hackers get your password, they won’t be able to access your smartphone or email without a 2FA code.
- Utilize Biometric Security – facial recognition on all accounts is preferred. Thus far, a hacker can’t defeat that security mechanism. Fingerprint recognition would be my second choice, but seek the advice of an expert.
- Use Account Lockouts to substantially slow down the hacker in the number of failed attempts allowed before the Login System locks down for a period of time. CAUTION: Unfortunately, you might create a denial of service upon yourself! So, lock-out mechanisms are diminishing in popularity.
- Consider Norton’s LifeLock Security and Identity Theft protection. They used to offer a $1M bond; not certain if they still do.
- Refrain from REUSING the same password across multiple accounts. Prevents a hacker from attempting Credential Stuffing which presumes users REUSE the same password across multiple accounts. Upon guessing your username/password, the next hack will be ONE username ONE password across three thousand financial service companies. Nuff said.
- Refrain from REUSING passwords over time, especially in the case of your notification email account. That email which all other accounts utilize to notify you of a compromise or breach. At least keep that one safe and difficult to guess!
- Birthdates should absolutely not be propagated on social media. Alter or delete whatever personal information you can from your social media. The same would otherwise be published and sold or “pwned” in the dark web”, accessible only via specialized programs like Tor, an acronym derived from “the .onion router” which is a software offering anonymity to users or criminals.
- Be intentional, perhaps not quite so reactive when we consider how to respond to a possibly fake security notification text or email regarding an account. In one sense the hacker expects you to be hurried and profoundly dull to threats and attacks. Don’t give away your power! Be thoughtful. Hurried and careless or unconcerned is complacent. Through the “gun” sight of Black Hat hacker capability portrayed herein, you’d qualify as vulnerable.
- Shred your trash. If you don’t own a shredder, grab a 2-gallon or 5-gallon bucket and pickle any bills, medical records, bank statements, insurance statements, etc. which you don’t have a very good safe for or plan to retain. In a couple of days grab 20 sheets twist and wring them out so the paper and print are unrecoverable. Now, at least you’re protected against the dumpster diver. Don’t laugh. I’ve seen it.
CONCLUSION
As you might imagine it appears the hacker remains paces ahead of security efforts by developers, software and hardware engineers, corporate security, and individual security efforts. So, we should at least adhere to security good practice rules delineated herein. My recommendation is that we all stay abreast of continual developments, progress, and best practice in this hacker war.
Final words:
MAINTAIN YOUR PASSWORDS
Apple: You can manage your passwords in Settings, in Spotlight Search or using Siri. Go to Settings > Passwords, then do any of the following: To add a new password manually, tap Add in the top-right corner. To edit or delete a password, tap Edit in the top-right corner, tap “Select saved passwords”, then tap Edit or Delete.
Thank you all for reading this article. I appreciate every one of you and especially your comments, but also your visits and claps. :o)
I would appreciate your support if you found this blog post helpful or enjoyable. If you’re willing, you can show your appreciation and buy me a coffee ☕️.
Otherwise my advice is free. I trade full time. If you have an interest in Trading for Income please don’t hesitate to ask questions. There are no silly or dumb questions. You’re also welcome to poke around Whooph.com
