Tag: malware as a service

Programming, Security, Tech

You won’t believe what this snake does…

Consider following on social media!

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

I need to make some money and fast. I could get into the world of IT. Where to start?
Photo by Chinmay Singh, please support by following @pexel.com

There comes a time in one’s life where they may think to themselves and say “The big ole Information Technology world huh, meh, let me give it a shot. What could go wrong?” Foolish child, we’re here to tell you that a lot could go wrong. One’s reasons for choosing a path in Information Technology or IT for short, could range from making a butt load of money, being the next person to create the next big thing, or simply adding a new skill to their already growing list.

Or maybe it’s a combination of all three. It should be the last one primarily because you’re awesome and striving to better a version of yourself every day is on your to-do list, so go you. However, typically, it’s the first reason since we’re all driven by our finances.

If you’re not making money, then you’re not making sense. A narrow and closed-minded way of thinking but hey, people aren’t usually open-minded so, whatever. For one to get into the world of IT, or jailbreak into IT at this point, a process needs to occur aside from simply learning code, linking resources together, and understanding how packets are sent through a network. When in an interview or at some point in a professional setting, one could be asked if they have ever contributed to what is called “Open source”.

Open source, in a nutshell, let’s say you make an application or a small program, once you feel your program or application is complete, it can then be uploaded to a platform like GitHub where others can either add onto or make corrections to your code. This can also be done vice versa. All in all, whoever is asking about contributing to open source wants to gauge your depth in IT. So, say yes, yes you have contributed to open source.

We checked if you have ever contributed to open source, and you didn’t. Printing “Hello World” doesn’t count as a contribution.
Photo by cottonbro studio, please support by following @pexel.com

The Attack

While there is a chance to get your program to an audience for good intentions other than to make money, others have used that same platform for malicious means. Are you interested in knowing what could be on your computer and getting up all in your network’s guts? Look no further than SSH-Snake. For those who may not know what SSH stands for, again, this is an all-inclusive platform, so we’re just being mindful of the audience.

SSH is “Secure Shell Protocol”, it’s a network protocol for operating network services securely over what is mostly an unsecured network. If you have ever worked with the command line, you’re more likely to be aware of SSH. Just know; common people mess with the Graphical User Interface (GUI), nerds, geeks, and hackers mess with the command line interface (CLI). Don’t know why they called “SSH” and not “SSP”, don’t know where the “H” came from but hey, we don’t make the script, we just read them.

I’m not lonely but I could stand to use some company. Fine, you drive a hard bargain, I’ll click your link.
Photo by Andrea Piacquadio, please support by following @pexel.com

Who Can It Be Now

SSH-Snake is known as a “self-modifying worm”. Worms are already a nightmare provided that once they’re in your system, they begin making their way to anything attached to your network. Doesn’t sound like a fun time? Trust us, it’s not. Self-modifying, as the name implies, the malware can infect a device and make alterations to its code. The best way to think of it is; code that adapts to a given situation.

Would you like to know who is using SSH-Snake? Well, we would like to know the same thing. There are instances where researchers find the tool is being used and report it right away but without finding out who. Granted, it just may not be in their scope which we can respect. Do what the job asks of you and nothing more. Ah, that good old work/life balance.

Enjoy the read so far? Why don’t you consider subscribing so you can keep up to date?

Wait, how could a snake get into a computer?
Photo by Moose Photos, please support by following @pexel.com

That Sinking Feeling

Now, how does SSH-Snake work? The malware finds your system’s cornhole (a way in), this could be done by something simple like clicking on a naughty (it’s not always naughty links but most common) link which could trigger downloading of malicious files housing SSH-Snake. Once downloading is complete, like any other worm, code is executed and now it’s free to run rampant and wreak havoc.

S-Snake(SSH-Snake) will begin collecting information from libraries, look for private keys, and shell history files, and begin spreading once the network is mapped. Other problems included are C2C. This is where all the collected information makes its way back to the threat actor’s lair for later use. SSH-Snake and worm virus have most things in common but what separates them overall is Snake’s ability to self-modify.

This port is an exit only.
Photo by Josie Stephens, please support by following @pexel.com

The Prevention

Great, so now you’re wondering, “How do I protect my computer’s cornhole?” A good way to protect your system is by practicing the best security practices. Always be mindful of what you interact with on the internet as some things may not appear to be on the level. Frequently check for updates for your operating system and anti-virus software. Security is becoming more challenging because technology is getting more advanced but the more you learn, the more you can protect. That was a call for you to learn about cybersecurity in case you’re confused.

Your computer’s security starts with you.
Photo by Designecologist, please support by following @pexel.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, sharing this with whomever, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you feel like there is something I may have missed on SSH-Snake? Script a comment below.

Security, Tech

Theft Among JavaScript

Consider following on social media!

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

I think I can take a break from hacking to look at some cat videos. That’s not weird.
Photo by Pavel Danilyuk, please support by following @pexel.com

The internet is a wide and, in some cases, unknown territory for many people to be on. Most of us simply surf the internet without a second thought as to how it works and let’s be honest some of us don’t really care to know how it does what it does.

We just want our cat videos and to be able to find that video where Gam Gam accidentally set her hair ablaze trying to blow out a candle. No matter what your reason for surfing online, you have to be aware that while surfing, many things lurk underneath or within.

Depending on who you ask. Small nerd fact, the web pages you view, including this one, have three main components. HTML (Hyper Text Markup Language) is what gives the page its layout that you see, the CSS (Cascading Style Sheets) gives the page its “pretty colors” and some effects, and finally, JS (JavaScript) gives the page the functionality to do certain things.

Within JS comes other languages like Node.js however, with more languages comes more problems. We’re going to be going over what the attack is, who is using it, the effects upon release, and what are some ways you can stay safe on your current webpage.

Fun fact: this may seem harmless, but never under any circumstances leave your computer unattended.
Photo by Flo Dahm, please support by following @pexel.com

The Attack

Now you may be wondering why Node.js is being put under the microscope and not JS, and we have your answer. We’re looking at all of them because each one plays a part in a threat actor’s plan.

It all starts with Node.js and NodeStealer, NodeStealer is a malware that is written in JS language and is executed in Node.js. Told you that we were going to be looking at all of them.

You can think of this as that Russian doll thing that houses another smaller version of the bigger one. Just know, your problems are coming from within.

Yup, there are too many breaches, and only one of me. Yup, I’m going to let this company tank.
Photo by olia danilevich, please support by following @pexel.com

Who Can It Be Now

Are you wondering as to who has been using this nasty little trick? Well, so are we. This malware has been out for some time, and no one has made a name for using it.

This just goes to show there are too many threat actors out in the world to keep track. In most cases, threat actors never get caught because there are too many and attacks from the same one are so infrequent.

With infrequent attacks, comes fewer chances of finding the malicious actors.

Enjoy the read so far? Why don’t you consider subscribing so you can keep up to date?

I’m not worried about no NodeStealer, I have 100% security here buddy.
Photo by Andrea Piacquadio, please support by following @pexel.com

That Sinking Feeling

Are you worried about how something like this could creep its way onto your computer? Don’t worry, Z-Daddy has you on that one. NodeStealer can be distributed by various means.

This could include but is not limited to phishing emails, malvertising, and bundling NodeStealer with software that is legitimate. Once NodeStealer is in, it disguises itself as a harmless document. This would be something like a PDF file which would have an appropriate icon and filename.

This is done with the intent to trick the victim into interacting with it. Once that happens the malware can execute and stay on the machine by establishing a persistence. This means even if you turn off your machine and boot it back up, the malware is still there.

The main objective is to obtain your collection of stored passwords, session information, and other possibly useful information.  A thing to note is that it was designed to go after certain web browsers such as Chrome, Opera, Microsoft Edge, and Brave. Before you think about it, no, this is not the movie “Brave.” Brave’s icon is a lion, not a little girl trying to break free from her father’s shadow.

Update our systems? Why would we do that? These babies work just fine.
Photo by Pixabay, please support by following @pexel.com

The Prevention

You’re interested in protecting yourself from this malware, you say. Good, there are some useful tips, however, keep in mind that there is no such thing as 100% protection. Even hand sanitizer says 99.9%, and that covers both hands.

Some basic security measures like being mindful of who sent you an email with links or attachments that were unwarranted. Keeping your operating system up to date and anti-virus software is a must as patches are released to close vulnerabilities.

On a small scale, this can be easily done, but on a larger scale such as with a company with 1,000 employees, this form of protection is easier said than done. This is due to going through the motions which end up with a lot of complacent workers.

It has been said that having one complacent employee is enough to compromise your whole system, a few more, and that could sink your whole company.

I have one more email to go. Oh, my computer is locked. Ransomware? Yeah, today is my last day at this company.
Photo by Jopwell, please support by following @pexel.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, sharing this with whomever, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you feel like there is something I may have missed on NodeStealer? Script a comment below.

Cloud Talk, Programming, Security, Tech

Jobs Band of Thieves

Consider following on social media!

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

Tim: Hey Briggs, did you read the latest script?
Briggs: You know I did bro.
Tim: Z-Daddy is like my gun, he’s always on point.
Briggs: Bro, stop calling him that and that was mad cringe.
Photo by Pixabay, please support by following @pexel.com

There was a time, a long time ago, when we as humans weren’t divided and we lived together in perfect harmony. In case you were wondering how long ago that time was, I’m referring to the stone age when we were in caves, communicating through grunts and often pointing off into the distance to what may be a potential threat.

But as our civilization grew, so did our divide, and this also happened within the world of technology. There has been a long-standing argument over which PC (Personal Computer) is superior and to what aspect. Many claim that Windows users are the most vulnerable to viruses, malware, and susceptible to other forms of attacks and Apple is the alpha, omega, and like a self-proclaimed independent woman of modern society, they don’t need any virus protection keeping them down.

Mac users, you might want to keep reading because your PC isn’t off the menu.  

Shaw: Mac can get hacked? But Steve Jobs at fruit.
Z-Daddy: Shawn, that has nothing to do with this topic.
Photo by Dima Valkov, please support by following @pexel.com

A Bitten Apple

For many years, Apple has gone under the radar for being targeted for viruses and malware. Viruses have been reported to hit Apple products but not as hard or as often as with Windows and Android.

But there is a new addition to the growing list of viruses aiming to put MacOS higher up on the attacking menu. MacStealer is classed as malware that can collect your passwords, cookies, and other credentials from the web browser. Web browsers like Firefox and Google Chrome are commonly on the menu. MacStealer also has the capability to extract information from the KeyChain database.

KeyChain, in case you’re unfamiliar, is a macOS app that stores your passwords and account information, so in a sense making it easier for you to login into your accounts with less recalling. Always keep in mind that if it makes it easier for you it also makes it easier for the attacker depending on your given level of privilege on your PC.

A small inconvenience can go a long way.

Here at Uptycs, we find viruses and stuff.
Photo by Zhengdong Hu, please support by following @pexel.com

Malware Among Mac

Analyst researchers at a company called Uptycs discovered this malware. Uptycs, which is a cloud-based analytics solution for anomaly detection. You may be asking yourself what all these words mean. These are all fancy words for, “We look for anything that may be suspicious on your network” or “sus”, for those who have played Among Us.

They had found the malware being advertised on a forum site on the dark web. For those who don’t know, the dark web is not what Hollywood makes it out to be, and you may have experienced it to some degree. The dark web is the use of special browsers like Tor Onion and VPNs (Virtual Private Networks) for peer-to-peer connections to access content that otherwise wouldn’t be accessible.

Always keep in mind, just you being there isn’t illegal, however, the activities in which you participate if discovered could have consequences. MacStealer, was not only being sold as Malware-as-a-Service (MaaS) – meaning the author created it and it’s being sold for public use via agreement on pay, but its price tag was $100.

The fact that threat actors keep a budget in mind when it comes to paying for malicious services on the dark web leaves me dumbfounded. Even cyber criminals feel the effects of inflation.

Z-Daddy, please tell I don’t have to switch back to Windows OS.
Photo by Andrea Picacquadio, please support by following @pexel.com

Ideal Co-Worker

So, at this junction, you probably want to know how this malware functions. MacStealer, when distributed, appears as an unassigned DMG (Apple Disk Image file) with a weed icon on the folder.

This is done with the intent to trick the victim into running the file on their computer. After clicking, the victim is prompted with a fake prompt to enter their credentials to “log in”. Once this action is completed, the machine is comprised, and information aggregation can begin.

Once all of the data is collected, it’s stored in a ZIP file and is sent back to controlled servers and stored to be collected later for the hacker. At the same time, MacStealer sends out a notification signifying the task is complete.

Yes, I know, this is more efficient than your co-workers, and no, you can’t make a virus to replace them. I’ve already tried.

Oh my co-workers just got lucky. I was so going to replace them with a virus.
Photo by Andrea Piacquadio, please support by following @pexel.com

Zero Victim Security

This is being told with some good news… finally. No one (that I am aware of) has been hit with this malware yet. Uptycs analyst spotted it and put out an alert in time.

It’s still in the developing stages, so features from the author are looking to be added to it but for now, it’s nothing too sophisticated where you wouldn’t be able to spot it. Still, prevention has to be mentioned because not everyone may be computer savvy.

For some people owning an Apple product is like eating at a fancy restaurant, some people just bought it for the name. I don’t know how many people have put weed icons on their folders but if you find a file or folder with a weed icon and you didn’t put it there, delete it. Only enter your passwords and other log-in information at secure websites.

Never, and if you’re doing it, stop, store your passwords or any information in your web browser. It seems like a good option but it’s the one of few areas threat actors count on for your goodies. If you have too many accounts and passwords to remember, a solution could be using a simple text editor like Microsoft Office Word, saving, and storing your credentials on a flash drive, and unplugging it from the computer for good measure.

Never download files or click on any links sent from unknown sources and double-check with people whom you may know the link was from. There aren’t as many vulnerabilities in MacOS as in Windows, but a moment in evaluating a given situation could see both operating systems with better security.

Any one of these macs could have been comprised, don’t let it be yours.
Photo by fauxels, please support by following @pexel.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you think there is something I may have missed or have another way to prevent this? Script a comment below.