Search This Blog

Showing posts with label Encryption. Show all posts

Texas Hit By a Human-Operated Ransomware That Targets against Government Agencies and Enterprises



May 2020 was not a good month for both the Texas Courts and the Texas Department of Transportation (TxDOT) as the month marked the discovery of a new ransomware called Ransom X, being effectively utilized in human-operated and focused on attacks against government agencies and enterprises.

Advanced Intel's Vitali Kremez discovered a 'ransom.exx' which was believed to be the name of the ransomware. As this is human-operated ransomware, as opposed to one distributed by means of phishing or malware, when executed the ransomware opens a console that shows info to the attacker while it is running.

As indicated by Kremez, Ransom.exx works to terminate 289 procedures identified with security software, database servers, MSP softwares, remote access devices, and mail servers.

Ransom X will likewise play out a series of orders all through the encryption process that:
Clear Windows event logs
Delete NTFS journals
Disable System Restore
Disable the Windows Recovery Environment
Delete Windows backup catalogs
Wipe free space from local drives.

The commands executed are listed below:
cipher /w %
s wbadmin.exe delete catalog –quiet 
bcdedit.exe /set {default} recoveryenabled no 
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures 
schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable 
wevtutil.exe cl Application 
wevtutil.exe cl System 
wevtutil.exe cl Setup 
wevtutil.exe cl Security 
wevtutil.exe sl Security 
/e:false fsutil.exe usn deletejournal /D C: 

The ransomware then starts to encrypt the entirety of the information on the computer and affix a custom extension related to the victim to each encrypted record.

As observed below, the custom extension for the Texas Department of Transportation attack was .txd0t.


Furthermore, when completed, the Ransom X console will show the number of encoded files and how long it took to finish it. In every folder that was scanned during the encryption procedure, a ransom note named![extension]_READ_ME!.txt will be made.

This ransom note incorporates the company name, and email address to contact, and guidelines on the most proficient method to pay the ransom.

As observed below, the ransom note is modified for a certain victim that is enduring an attack, which for this situation is the Texas Department of Transportation.


However, in the case of Texas where the attack made its significant hit it is to be noted that at the hour of the attack, it was not comprehended what ransomware focused on the government agencies.

In any case, because of the limited visibility into this ransomware operation, there is no data with respect to the ransom sums or whether they steal information as a major aspect of the attack.

This ransomware has now been broken down, analyzed, and seems secure, which implies that it is highly unlikely to decrypt the files for nothing.

Latest "incorruptible" Privacy Method that makes your VPN Out-of-Date


A unique chip that allows computers to send information using a 1-time 'indestructible' connection.

"Experts have made a unique unhackable safety system that is bound to transform the information secrecy," says the University of St Andrews, King Abdullah University of Sciences and Technology (KAUST) and the Center for Unconventional Processes of Sciences (CUP Sciences). The global organization of experts has built a new optical chip that enables the message to be transmitted from the sender to another receiver using a 1-time untraceable transmission that can accomplish 'absolute privacy' as private information is secured as one of the safest means, thanks to the experts. The experts' designed method utilizes silicon chips that carry compact arrangements that are permanently modified to transfer data in a one-time-key that can't be formed again or hijacked by the hackers.



A technology of the future- 
While the present conventional encryption methods permit messages to be transferred instantly, the information can, however, be hacked by quantum algorithms and computers of the future. But, as per the experts' claim, the latest developed technique for encoding information is solid and utilizes present transmission systems. The newly devised method also occupies limited storage on the present computer systems compared to conventional encoded interactions.

“Due to the arrival of more robust and quantum machines and future computers, all present encodings would be deciphered without taking much time, revealing the confidentiality of our existing and past transmission networks that hold much importance. For example, a hacker can save a piece of encoded information that is available now and he can expect the appropriate systems and technologies that can be availed shortly to decrypt the information. Executing large and cost-effective means of world-class safety is a universal enigma," says Dr. Andrea Fratalocchi, Associate Professor, Electrical Engineering at KAUST and Director of the Research.

He further says: Our research, however, has the caliber to resolve the problems of privacy for every individual across the globe. If by any chance this new technique could be executed across the world universally, the hackers would have a hard time trying to break into someone's personal information and would be seeking jobs elsewhere. For the moment, the groups of experts are currently planning to develop business apps for their trademarked technique and are planning to do a demo very soon.

End of Facebook encrypted messaging?


The United States, United Kingdom and Australia, in an open letter, dated 4 October urged Facebook to create backdoors into its encrypted messaging apps to grant law enforcers faster access to private messages. This would help the government to tackle child abuse, terrorism and organized crimes.

The open letter was signed by UK home secretary Priti Patel, the US Attorney General William Barr, Acting US Homeland Security Secretary Kevin McAleenan and the Australian minister for Home Affairs Peter Dutton on the grounds that cross-platform messaging encryption threatens public safety. It also aligns with UK and US’s agreement of “world-first” data access that will make cross border access to data easier and faster.

Earlier this process took from six months to a year however this agreement will speed up the process by weeks to even days as it will permit law enforcers to demand data directly from the company without asking the country’s government first.

Head of online child safety at the NSPCC Tony Stower said, “The landmark agreement between the US and UK on accessing data will radically reduce the time it takes for police to get hold of the data they need from tech giants to bring offenders to justice.
"It should be a hugely important step forward in tackling online child abuse - if tech giants play their part too."

What is End to End Encryption?

In End to End Encryption, the key to access the message is only with the sender and the recipient, even the platform can’t access the content. And, to access the content the platform needs to add backdoors that they themselves and government can access.

Facebook owned, WhatsApp already has end to end encryption and in March 2019, following the data scandal and Facebook's incompetence to protect its user’s data, Mark Zuckerberg announced plans to incorporate this encryption in messenger and Instagram.

With this open letter the governments of US, UK and Australia are pressuring Facebook to pause its plans of encrypting all messages. To which Facebook stand in opposition saying "people have the right to have a private conversation online." Facebook states that it is "consulting closely with child safety experts, governments and technology companies and devoting new teams and sophisticated technology" to keep people safe.

Privacy or Public Safety 

The letter chiefly focuses on child abuse and exploitation, considering the risk of easy access to offenders and criminals with encryption. In 2018, Facebook reported 16 million child-exploitation tips last year, Deputy Attorney General Jeffrey Rosen said.

FBI Director Christopher Wray said that Facebook’s proposal to encrypt its popular messaging program would turn the platform into a “dream come true for predators and child pornographers.” (Sc Reuters)

The letter supports encryption but with backdoors that grants government “a means for lawful access to the content of communications”

Facebook spokesperson said “We believe people have the right to have a private conversation online, wherever they are in the world. Ahead of our plans to bring more security and privacy to our messaging apps, we are consulting closely with child safety experts, governments and technology companies and devoting new teams and sophisticated technology so we can use all the information available to us to help keep people safe.”

Electronic Frontier Foundation (EFF) called the letter “ an all-out attack on encryption” and the organization cautioned that such measures could pose a risk to journalist and activists and could be used by “authoritarian regimes... to spy on dissidents in the name of combating terrorism or civil unrest.” (Sc Forbes)

The Head of the FSB appealed for the creation of international rules on the Internet


The Head of the FSB of Russia Alexander Bortnikov stated the need to create international rules on the Internet. In particular, to make encrypted messages in mobile applications open to intelligence agencies.

If the international community can come to a consensus on this issue, the terrorists will actually lose the list of opportunities, such as propaganda, recruitment, financing, communication, management, said Bortnikov at an International Conference on Countering Terrorism on 18 April 2019 in St. Petersburg.

He noted that the use of cryptography in services for communication prevents the effective fight against terror. According to him, Russia has developed a concept for the creation of "the system of the deposit of encryption keys generated by mobile applications, which will be open for control” to solve this problem. Bortnikov proposed to the world community to realize this idea together and to provide intelligence agencies with legal access to important encrypted information of the terrorists.

In addition, Bortnikov noted that at the moment there are more than 10 thousand sites of existing international terrorist structures and thousands of accounts in social networks. The information is published in more than 40 languages, but the leading positions are occupied by Arabic, English and Russian languages.

Bortnikov added that the ability to hide data in IP-telephony and foreign e-mail servers leads to an increase in the spread of false reports of terrorist attacks, as well as the sale of weapons and explosives.

According to one of the amendments to the law on Autonomous RUnet (http://www.ehackingnews.com/2019/02/the-kremlin-told-about-hacker-attacks.html), IT-companies were obliged to use Russian cryptography for all traffic in the Russian segment. It is assumed that the Government will determine the issuance and use of codes and encryption.

In addition, in April 2018 Russia tried to block the Telegram messenger for refusing to provide the FSB with the encryption key of the negotiations of suspected terrorists (http://www.ehackingnews.com/2018/04/russian-court-orders-to-block-telegram.html).

The Australian Parliament’s Anti –Encryption Law Opening Doors to Potential Cyber Attacks




The Australian Parliament recently gave a green light to an "anti-encryption" law i.e. the Assistance and Access Bill, broadly recognized by numerous U.S. tech giants, to give the nation's intelligence and law enforcement agencies access to end-to-end encrypted communications.

The bill passed, regardless of vocal opposition from cyber security and technology groups far and wide who cautioned that even secondary passages structured solely for law implementation will without a doubt is exploited by those keen to make way to potential cyber-attacks.

Portrayed as a "secondary passage" or "backdoor" the move is said to, in a general sense debilitate Australia's cyber security and perhaps the other users of these innovations as well.

There is additionally a "far reaching concern" that this law will eventually have a negative impact on the employment status from the Australian technology firms as the global network will never again trust these products.

Lawmakers, who in the present digital economy ought to work to close the "cyber exposure gap", not augment it are rather debilitating Australia's overall cyber security posture, with causing a major impact to the economic outcomes also.

There is no denying the fact that law implementation organizations around the world face reasonable difficulties, however laws that debilitate encryption are the wrong solution.

Therefore, as opposed to following Australia's hazardous point of reference, other nations must work to guarantee open wellbeing while likewise shutting the "cyber exposure gap" and reinforcing cyber security standards for all devices. The dangers related with Australia's activity ought not to be downplayed because cyber security is as much important as national security.

Telegram's 'secret chat' feature stores conversations in plain text



The desktop variant for Telegram for dispatched a new feature called 'secret chats' for the users who wish for complete privacy for their communication. It occurred in this way, that the Telegram secure messaging app was unsuccessful in protecting the chat content locally and thusly offered access to plain text conversations and media that generally was encrypted.

Since Telegram's attention towards administering secure communication is notable the application utilizes encryption to guarantee that an outsider can't peruse the conversations on their way to the 'destination' and by using end-to-end encryption it ensures that just the sender and the receiver can get to the content.



These safety measures are against altering or breaking privacy in transit; the conversations and media files Telegram Desktop stores locally are genuinely simple to access and read since they are not encoded.

Nathaniel Suchy, a reverse engineer and software developer, was, fortunately, able to peruse the application's database and the messages spared there. Suchy said that  “Telegram uses a somewhat difficult to read, but otherwise, not encrypted, SQLite Database to store messages. By analyzing raw data converted to a simpler viewing format, I also found names and phone numbers that could be correlated to one another. Even so, the information is not easy to read, but custom scripts could help make the details stand out in a more intelligible way and automate the extraction.”


The researchers have proven the 'secret chat' feature as it turned out that every one of the messages goes to a similar database, regardless of whether they gain from end-to-end encryption or not. Even Media documents are not far behind as they have a very comparative destiny.

Telegram Desktop features highlights passport protection to counteract unapproved access to the application, yet this security choice does not include encryption. A technically knowledgeable and excessively inquisitive computer user could still be able to access some other users' chats.


Ensuring the information saved locally is conceivable by empowering full disk encryption from the operating system. This is accessible on Windows through BitLocker, on macOS through FileVault; the feature is available on Linux too.





Telegram founder agrees to register in Russia but won't share user data



The Telegram's founder Pavel Durov has agreed to register the company in Russia, after getting pressure from the local authorities.

Few days ago, the Russian communications regulator Roskomnadzor has demanded Telegram to provide information about the messaging app and company details.  The authorities also said this encrypted messaging app is being used by terrorists to plan attacks.

The authorities asked to give access to decrypt messages in order to catch terrorists. Authorities threatened to ban the Telegram, if the company fails to do so.

At first, Durov didn't agree with the demands.  Now, he is agreed to register the company with the Russian government.

"If the Telegram is banned in Russia, it will not happen because we refused to provide details about our company" Durov said in the social network VK.

Roman Jelud, a Professor from dataVoronezh State University, shared his opinion to Regnum that news about "Telegram ban" itself is a PR stunt.  This will only help the Telegram to gain more number of users.  Few days back itself, Roman said that Durov is using this for his PR and eventually Durov is going to agree to provide the required five points of information.

Though Durov says that they are only registering the company in Russia and will not share the users' secret data with the government, it will be hard to know whether it is true or not.

Russia is not only the government that is interested in the Telegram messenger. Last week, Durov stated that US Federal officers want to add a backdoor to the app.

- Christina