• chevron_right

      Hugging Face, the GitHub of AI, hosted code that backdoored user devices

      news.movim.eu / ArsTechnica · Friday, 1 March - 18:02

    Photograph depicts a security scanner extracting virus from a string of binary code. Hand with the word "exploit"

    Enlarge (credit: Getty Images)

    Code uploaded to AI developer platform Hugging Face covertly installed backdoors and other types of malware on end-user machines, researchers from security firm JFrog said Thursday in a report that’s a likely harbinger of what’s to come.

    In all, JFrog researchers said, they found roughly 100 submissions that performed hidden and unwanted actions when they were downloaded and loaded onto an end-user device. Most of the flagged machine learning models—all of which went undetected by Hugging Face—appeared to be benign proofs of concept uploaded by researchers or curious users. JFrog researchers said in an email that 10 of them were “truly malicious” in that they performed actions that actually compromised the users’ security when loaded.

    Full control of user devices

    One model drew particular concern because it opened a reverse shell that gave a remote device on the Internet full control of the end user’s device. When JFrog researchers loaded the model into a lab machine, the submission indeed loaded a reverse shell but took no further action.

    Read 17 remaining paragraphs | Comments

    • chevron_right

      Pirate Sites With Malicious Ads Face Restrictions Under New Initiative

      news.movim.eu / TorrentFreak · Thursday, 29 February - 19:10 · 4 minutes

    malware-s1 There was a time when visiting a pirate site was much like visiting any other. Keen to attract eyeballs wherever they might be, many of the world’s biggest brands exchanged cold hard cash for an appearance on prominent pirate portals.

    Over time and as the thorny issue of funding illicit platforms gained traction, companies including Ford, Toyota, Nissan, Mazda and Volvo came under increasing pressure. The same held true for other household names, such as tech giant Samsung , along with Nokia, Canon, Carlsberg, even Coca Cola.

    These companies weren’t deliberately placing ads on pirate sites, but their ads kept turning up on them nonetheless.

    Goodbye Quality Brands

    As brand protection became increasingly important during the previous decade, companies such as White Bullet provided intelligence on which sites to avoid, with similar lists deployed to facilitate the work of the UK’s Infringing Website List , among others. In the United States, the formation of the Trustworthy Accountability Group (TAG) in 2015 saw advertisers and advertising agencies come together to clean up the system and prevent ad revenue from reaching pirate sites.

    TAG enjoys considerable support; Amazon, Disney, Google, Meta, NBC, Sky, and Spotify, among others, sit on TAG’s Leadership Council. Most were around in 2019 when TAG launched Project Brand Integrity , an initiative to prevent valuable brands’ advertising ending up next to potato-quality copies of Hollywood movies and other unauthorized content.

    Half a Decade Later, TAG Upgrades

    While TAG says that v1.0 has performed well, on Wednesday it announced Project Brand Integrity 2.0. More easily scalable than its predecessor, PBI 2.0 still aims to defund pirate sites and protect advertisers from undesirable associations. If all goes to plan, it will be quicker to react and more responsive to domain hopping too.

    “Project Brand Integrity 1.0 was incredibly effective but hard to scale, as it involved a time-consuming manual process of notifying advertisers when their ads were found on pirate sites,” says Mike Zaneis, CEO of TAG.

    “Although most advertisers took action when alerted to such misplacements, the money often had already changed hands, and the criminals quickly moved their efforts to new domains.”

    Excluded From Ads, Pirates Welcomed to Exclusion List

    Also receiving an upgrade is TAG’s database of pirate sites, which is shared within the industry to help advertisers avoid undesirable platforms. This ‘exclusion list’ is maintained and developed through intelligence sharing at TAG’s AdSec Threat Exchange , where members collaborate with participating companies, utilize open source resources, and share information on pirate domains.

    The resulting list aims to limit pirate sites’ access to advertisers, thereby reducing their ability to generate revenue from advertising.

    “Through PBI 2.0, TAG will leverage new partnerships with the industry’s major ad tech intermediaries to cut off funding from pirate websites through a comprehensive pre-bid exclusion list, thus preventing pirate sites from monetizing stolen intellectual property (IP),” TAG says.

    “By incorporating real-time intelligence on new pirate domains from TAG’s Ad Sec Threat Exchange and TAG member companies, PBI 2.0 will protect brands while preventing ad dollars from reaching those illegitimate sites.”

    Malvertising Everywhere

    In an interview with EMA last December, Michael Lyden, TAG’s Vice President of Threat Intelligence, spoke of the constant battle against malvertising, a portmanteau of ‘malware’ and ‘advertising.’ Scam ads, auto-redirections, cloaking, and drive-by downloads all received a mention. Not exclusively in connection with pirate sites, though, the problem is much broader than that.

    Given the nature of this pervasive adversary, TAG’s v2.0 exclusion list will also combine data originally collected by anti-malware vendors, with the intelligence providing an enhanced view of pirate sites that combine free downloads with malicious or deceptive ads. Once that information is placed in the hands of advertisers, it’s hoped that having two reasons not to fund pirate sites will be better than having just one.

    Proactively Eliminating Malvertising

    What kind of effect the project will have at the consumer end is unclear. One of the great ironies of the pirate site/malware debate is that by driving trusted advertisers away, anti-piracy groups not only removed revenue but also opened up the market for less inhibited advertising agencies to do more business with pirate sites.

    Lower ad rates made available to pirate sites with fewer opportunities elsewhere, can lead to an elevated chance of risky ads, on web-based portals in particular. Since TAG’s system will only make things worse and the rest of the internet isn’t getting any better, some sites may need to be tackled more directly.

    The good news is that plenty of solutions for disappearing bad ads, malvertising, endless trackers, and other stuff some sites just can’t get enough of, are readily available for free. Since they don’t discriminate, they’re just as happy removing all hot girls in your area to the 80 advertising partners imposed on visitors by too many mainstream sites.

    For those really averse to abusive advertising, moving away from ISP-provided DNS to Quad9’s threat-blocking alternative is a good start.

    For the more adventurous, a self-hosted DNS server like Pi-Hole, loaded with various hand-picked blocking lists, is something that few people think they need. At least until they see how even seemingly regular ads, not to mention things like smart TVs, can really abuse their trust.

    Finally, uBlock Origin on top is an essential for every browser, and if all goes to plan, malvertising will be a thing of the past. Then, working from a nice clean sheet, unblocking the sites worthy of support seems the way to go, while enjoying the internet all over again.

    From: TF , for the latest news on copyright battles, piracy and more.

    • chevron_right

      Russian-based LockBit ransomware hackers attempt a comeback

      news.movim.eu / TheGuardian · Monday, 26 February - 16:34

    Gang has set up a new site on the dark web and declares an intention to vote for Donald Trump

    The LockBit ransomware gang is attempting a comeback days after its operations were severely disrupted by a coordinated international crackdown.

    The Russian-based group has set up a new site on the dark web to advertise a small number of alleged victims and leak stolen data, as well as releasing a rambling statement explaining how it had been hobbled by the UK’s National Crime Agency, the FBI, Europol and other police agencies in operation last week.

    Continue reading...
    • chevron_right

      Prolific cybercrime gang disrupted by joint UK, US and EU operation

      news.movim.eu / TheGuardian · Monday, 19 February - 23:57

    LockBit’s website under control of security agencies from both sides of Atlantic, according to post

    Lockbit, a notorious cybercrime gang that holds its victims’ data to ransom, has been disrupted in a rare international law enforcement operation by Britain’s National Crime Agency, the FBI, Europol and a coalition of international police agencies, according to a post on the gang’s extortion website.

    “This site is now under the control of the National Crime Agency of the UK, working in close cooperation with the FBI and the international law enforcement taskforce, ‘Operation Cronos’,” the post said on Monday.

    Continue reading...
    • chevron_right

      Un malware Android prolifère à grands coups d’escroqueries amoureuses

      news.movim.eu / JournalDuGeek · Monday, 5 February - 07:00

    Android

    Une nouvelle campagne d'espionnage orchestrée par le groupe Patchwork a été découverte par les chercheurs en sécurité d’ESET Research. Elle exploite des applications malveillantes sur Google Play et d'autres plateformes, infectées par le malware VajraSpy RAT.
    • chevron_right

      IPTV Anti-Piracy Threats May Increase Male Motivation to Pirate By 30%

      news.movim.eu / TorrentFreak · Saturday, 3 February - 17:17 · 6 minutes

    Ripper If it was possible to recall and then count every anti-piracy campaign targeted at the UK public since the dawn of the VCR, the answer would be of interest to us, because we have absolutely no idea.

    But maybe volume isn’t particularly important. Perhaps a better question would be this: Has an anti-piracy campaign targeting the public in the last 40+ years ever actually worked?

    Those who guessed “yes” are absolutely right, well done. Those who guessed “no” are absolutely right too. There are no losers in this game because it’s all about framing.

    No Anti-Piracy Campaign Has Ever Failed

    Since anti-piracy campaigns cost money, it is incredibly rare for anyone to admit that their campaign didn’t work. It’s much more likely that an apparently unsuccessful campaign finds itself celebrated as the campaign that prevented things from getting even more out of hand than they already were. You see, while it’s always been about framing, it’s always been about timing too.

    When lobbying the government to contribute to campaigns with funding from the public purse, that’s the perfect time to mention the threats; to specific industries, employment, the economy in general, public order, crime waves, terrorism, whatever fits the mood of the day. When the campaign is done, pick out the positives, tell everyone that the money was well spent, thank the government, and then say nothing . Just wait.

    In time, probably just a few months, a couple of gentle mentions of how piracy keeps evolving is a great way not to confront sources of funding with embarrassing news of failure. The campaign itself was a success, it was everything else that changed.

    What never really changes is the underlying sense of threat. The threat of a looming catastrophe that, to date, has never actually happened. Not because a catastrophe was never likely, but because everyone pulled together to avoid one. In much the same way as everyone needs to work as a team to avoid whatever threats are coming up next.

    Threats to the Public

    For the past several months, an anti-piracy campaign has been running in the UK. On one hand, the BeStreamWise campaign aims to sensitize consumers of illicit IPTV services to various threats; the threat of being scammed, for example, or even defrauded. When dealing with criminals, anything is possible.

    The threat of identity theft shouldn’t be ruled out either but the really important thing is to allow the public to a) soak up the threat b) feel the building anxiety and sense of impending doom and c) ditch illegal services before something terrible happens. When everyone is out of danger, d) click here to subscribe to one of our legal and safe subscription services.

    The Threat of Being Caught & Sent to Prison

    On the campaign website, BeStreamWise wisely steers clear of the potential legal repercussions of using pirate services. In anti-piracy, however, the presence of legal threats is an opportunity rarely missed.

    The apparently separate but coordinated media campaign being conducted through the UK tabloids, which really stepped up a gear in November and has barely stopped since, has been running in parallel to the BeStreamWise campaign.

    Despite appearing to have similar goals, the BeStreamWise campaign only gets a handful of mentions in at least dozens of articles. Instead, the Federation Against Copyright Theft often responds to questions raised in the articles, which all carry exactly the same message, as the sample below shows.

    United threat to safety threats

    In much the same way that millions of people in the UK were convinced that if they play the lottery “It Could Be You!”, it seems that the goal here is to make the odds of prosecution seem just as convincing.

    After seeing over 50 of these articles published since late November in a broad range of national and local online news outlets, we used various tools to analyze their text and AI to identify the most prominent keywords. Across all articles, keyword similarity was rated at 82%, which is extraordinary when there’s no common news event underpinning any of the articles.

    A couple of exceptions aside, sentiment was rated negative, as expected, with the most popular keywords across all articles shown below. The situation as portrayed seems……..a little threatening perhaps?

    Nobody should be offended when broadcasters and other rightsholders defend their products from piracy. When IPTV providers, resellers and everyone else in the supply chain get arrested and, horror of horrors, find themselves being privately prosecuted, that is literally the worst thing that can possibly happen.

    People who consume pirated content have their own balancing act to consider. It’s not difficult to imagine that someone, somewhere, has decided that scare tactics amplified through the media – no, more than that, completely reliant on the media – is a great way tip the balance in the right direction.

    Bottom Line: Do Scared People Pirate Less?

    It’s difficult to say whether fear has ever played a part in reducing piracy, but one thing is certain: nobody ever scared anyone into being a loyal customer; the effect is temporary at best, counterproductive and completely ineffective at worst.

    A new study reveals that men (also a focus of BeStreamWise in respect of live sports) are not only primed to immediately reject negative outside messaging, but their response significantly exacerbates the same problem threat messaging aims to reduce.

    The study, Psychological Reactance to Anti-Piracy Messages Explained by Gender and Attitudes , was published last month. According to its authors, it “uses evolutionary psychology as a theoretical framework to examine whether messages based on real-world anti-piracy campaigns cause reactance and whether this effect is explained by gender and pre-existing attitudes.”

    Threats Could Make Matters Worse

    In summary, the researchers exposed adult participants to the messaging contained in three previous, real-life anti-piracy campaigns.

    The first, Get It Right (From a Genuine Site) , carried prosocial messaging, while Crimestoppers (CrimeStoppers-uk.org) and Graduated Response (French Three-Strikes scheme) provided the threatening messaging. A control group received no anti-piracy messaging at all.

    “The results indicate that the prosocial message has no significant effect, neither causing reactance nor influencing a decrease in piracy for either gender or attitude group,” the researchers write.

    “The threatening messages, in particular Crimestoppers which emphasizes the risk of computer viruses, had a polarizing effect on the group with favorable attitudes towards piracy. Men with favorable attitudes towards piracy reported an increase, and women with favorable attitudes towards piracy reported a decrease in piracy intentions.”

    “The results support our evolutionary theoretical proposition that reactance to messages is adaptive, with men being more sensitive to threats to freedom by external forces than women.”

    The chart above shows that females with favorable attitudes towards piracy responded positively to threats. However, men with the same favorable attitudes towards piracy responded to all types of anti-piracy messaging with a significant increase in their motivation to pirate.

    Most pronounced is the 30%+ increase in the ‘Crimestoppers Group’ which may have implications* for the current BeStreamWise campaign. If nothing else, they share almost identical messaging.

    Crimestoppers (Threatening Message 2)

    The communication was delivered by crime reduction charity Crimestoppers (crimestoppers-uk.org) and funded by film industry trade body BASE (British Association of Screen Entertainment). The campaign focused on the individual’s risk of computer viruses, identity fraud, money/data theft and hacking, using precise numbers of cases reported to legitimize their claims.

    After four decades of anti-piracy campaigns that have failed to scare pirates into compliance, and 15 years of ISP blocking measures that have mostly failed to render pirate services non-functional, a solution to the problem seems more elusive than evere.

    Since no anti-piracy companies believe their market is on the brink of collapse, confidence must be high that the same strategies that have always fueled the market will long continue to do so. That might be the clearest signal yet that something needs to change.

    Whitman, K., Murad, Z. & Cox, J. Psychological Reactance to Anti-Piracy Messages explained by Gender and Attitudes. J Bus Ethics (2024). https://doi.org/10.1007/s10551-023-05597-5

    Summary available here

    *BASE is a member of the BeStreamWise campaign.

    From: TF , for the latest news on copyright battles, piracy and more.

    • chevron_right

      « Il a trahi son pays » : l’auteur de la pire fuite de la CIA condamné à 40 ans de prison

      news.movim.eu / Numerama · Friday, 2 February - 09:56

    central agency

    « La plus grande violation de données de l'histoire de la CIA ». Le département de la justice américaine a réagi à la condamnation de Joshua Schulte, un ancien employé de l'agence, à 40 ans de prison. Il a été à l'origine de la fuite baptisée Vault 7, qui a exposé l'arsenal numérique de la CIA.

    • chevron_right

      Chinese malware removed from SOHO routers after FBI issues covert commands

      news.movim.eu / ArsTechnica · Wednesday, 31 January - 23:34 · 1 minute

    A wireless router with an Ethernet cable hooked into it.

    Enlarge / A Wi-Fi router. (credit: Getty Images | deepblue4you )

    The US Justice Department said Wednesday that the FBI surreptitiously sent commands to hundreds of infected small office and home office routers to remove malware China state-sponsored hackers were using to wage attacks on critical infrastructure.

    The routers—mainly Cisco and Netgear devices that had reached their end of life—were infected with what’s known as KV Botnet malware, Justice Department officials said . Chinese hackers from a group tracked as Volt Typhoon used the malware to wrangle the routers into a network they could control. Traffic passing between the hackers and the compromised devices was encrypted using a VPN module KV Botnet installed. From there, the campaign operators connected to the networks of US critical infrastructure organizations to establish posts that could be used in future cyberattacks. The arrangement caused traffic to appear as originating from US IP addresses with trustworthy reputations rather than suspicious regions in China.

    Seizing infected devices

    Before the takedown could be conducted legally, FBI agents had to receive authority—technically for what’s called a seizure of infected routers or "target devices"—from a federal judge. An initial affidavit seeking authority was filed in US federal court in Houston in December. Subsequent requests have been filed since then.

    Read 11 remaining paragraphs | Comments

    • chevron_right

      Ars Technica used in malware campaign with never-before-seen obfuscation

      news.movim.eu / ArsTechnica · Tuesday, 30 January - 21:24 · 1 minute

    Ars Technica used in malware campaign with never-before-seen obfuscation

    Enlarge (credit: Getty Images)

    Ars Technica was recently used to serve second-stage malware in a campaign that used a never-before-seen attack chain to cleverly cover its tracks, researchers from security firm Mandiant reported Tuesday.

    A benign image of a pizza was uploaded to a third-party website and was then linked with a URL pasted into the “about” page of a registered Ars user. Buried in that URL was a string of characters that appeared to be random—but were actually a payload. The campaign also targeted the video-sharing site Vimeo, where a benign video was uploaded and a malicious string was included in the video description. The string was generated using a technique known as Base 64 encoding. Base 64 converts text into a printable ASCII string format to represent binary data. Devices already infected with the first-stage malware used in the campaign automatically retrieved these strings and installed the second stage.

    Not typically seen

    “This is a different and novel way we’re seeing abuse that can be pretty hard to detect,” Mandiant researcher Yash Gupta said in an interview. “This is something in malware we have not typically seen. It’s pretty interesting for us and something we wanted to call out.”

    Read 10 remaining paragraphs | Comments