Tech,Space,Gaming, and Science Fiction News to wet your whistle
OceanLotus Targets Southeast Asia in New Watering Hole Campaign
A cyber-espionage group believed to be operating out of Vietnam has compromised over 20 websites as part of a watering hole campaign targeting users in Southeast Asia, ESET reports.
As part of the attacks, which are believed to have been active since September 2018, the websites of the Ministry of Defense of Cambodia, the Ministry of Foreign Affairs and International Cooperation of Cambodia, as well as several Vietnamese newspaper or blog websites were compromised.
The actor behind the attacks is believed to be OceanLotus, a group of cyber-spies active since at least 2012 and also known as APT32 and APT-C-00. The new campaign, ESET's security researchers say, appears to be an evolution of a watering hole scheme documented in 2017.
The new campaign shows the use of various techniques to hinder analysis, such as public key cryptography to exchange an AES session key used to encrypt further communications, and the use of WebSocket to hide their malicious communications.
The security researchers have identified 21 distinct websites compromised in the attack, each of them redirecting to a separate domain controlled by the attackers. Most of the websites are related to news media or the Cambodian government. Although the victims were notified in October, most of the websites continue to serve the malicious script injections, ESET says.
The malicious script contains checks to evade detection. It waits for the victim to scroll on the page, and also checks the resolution of the window and whether the Firebug browser extension is enabled. If the checks pass, it decrypts the command and control (C&C) domain using a custom algorithm.
Next, using WebSocket over SSL, the script sends a unique string to the server and receives and executes a second-stage script, which was designed for reconnaissance purposes. The attackers use a slightly modified version of Valve's fingerprintjs2 library, which is available on GitHub.
With all communication going through the WebSocket session opened by the first stage, traffic is difficult to detect and decrypt. The recon script builds a report and sends it to the second stage C&C server.
"The report generated contains detailed information about the victim browser and the website visited: the user-agent, the HTTP Referer, the local and external IP address, the browser plugins the browser's configured language preferences," ESET reports.
To stay under the radar, the attackers registered a first stage and a second stage domain per compromised website, each hosted on a separate server with a distinct IP address. Overall, they registered more than 50 domains and 50 servers for the campaign.
"Despite being actively tracked by many researchers, the OceanLotus group is still very busy attacking targets in Southeast Asia. They also regularly improve their toolset, including their watering hole framework and their Windows and MacOS malware. The recent updates to their watering hole framework show a level of sophistication never before seen for OceanLotus," ESET concludes.
By Liam McCabe This post was done in partnership with Wirecutter . When readers choose to buy Wirecutter's independently chosen editorial picks, it may earn affiliate commissions that support its work. Read the full article here . After six summers of researching, testing, and recommending window air conditioners, we've learned that quiet and affordable ACs make most people the happiest—and we think the LG LW8016ER will fit the bill in most rooms. This 8,000 Btu unit cools as efficiently and effectively as any model with an equal Btu rating, and runs at a lower volume and deeper pitch than others at this price. Little extra features like a fresh-air vent, two-axis fan blades, and a removable drain plug help set it apart, too. The LG LW8016ER is a top choice for an office or den, and some people will find it quiet enough for a bedroom, too. If our main pic
Google has been regularly adding new language support to Gboard , its popular keyboard for iOS and Android. Today, it updated the Android version of its keyboard app with 18 new languages, according to the changelog. You can see the full list of languages the app now supports over at Google Support (over 400!) and download the app from the Google Play store . However, Android Police notes that, when looking at the Google Support list, it could only find 16 new languages or language varieties. These are: Arabic (Gulf) Buryat (Mongolia) Buryat (Russia) Cornish Gondi (Devanagari) Greek (Cyprus) Hakka Hausa (Ghana) Khorasani Turkic (Arabic) Lower Sorbian Mandeali Mundari (Bengali) Portuguese (Macau) Shekhawati Siberian Tatar Talysh (Russia). Additional changes include Japanese support for Android TV
Cuando llevas miles de horas gestionando entornos vSphere, es posible que te encuentres con situaciones o problemas extraños con tus VMs, como es el caso de este post, donde veremos... Leer más » La entrada Forzar el reinicio de una VM que no responde en vSphere aparece primero en Blog de Cenabit . via Latest imported feed items on VMware Blogs https://ift.tt/2OIPfR4 If New feed item from https://blogs.vmware.com/feed , then send me an email at kr