CivilSphere Project

 Civilsphere provides free solutions to NGOs, journalists, and people at risk to protect them against targeted attacks. Born at the @stratosphereips laboratory.

[civilsphereproject]

Civilsphere AI VPN: v0.1.0-beta release

Civil society organizations, activists, journalists and human rights defenders rely on digital devices to do their jobs, and are often in the field without the protection of firewalls, IDS, or any other advanced threat protection more commonly available to corporate users. How can these individuals identify if their devices are at risk while working in the field?

Since 2018, our Emergency VPN service has been leveraging VPN technologies to provide users with a security assessment of their devices’ network traffic tailored to identify digital threats. Our new AI VPN aims to take this work even further.

The AI VPN is a free software tool that provides users with an automatic network security assessment of their network traffic. Users can request a new OpenVPN or WireGuard VPN profile via email or Telegram, connect to it for a predefined amount of time (hours to days), and receive a full report after their VPN profile expires. 

The AI VPN aims to enable organizations to deploy their own instance without the need to rely on third-parties with their data.

AI VPN v0.1.0-beta release

This beta release features the following functionality: 

Automatic management of VPN accounts

Support for multiple VPN technologies, including Wireguard, OpenVPN and a NoVPN, a special configuration of OpenVPN without encryption to be used in countries where the use of encryption or VPNs may be illegal or endanger users.

Automatic network traffic captures and analysis per session. 

Support for multiple methods to request a new VPN profile, including Email and Telegram.

Integration with Slips, the Stratosphere Linux IPS, a free software intrusion detection system that uses machine learning to automatically detect threats.

Slips leverages dozens of threat intelligence feeds of known threats, plus has special modules tailored for the AI VPN such as the new Leak Detection module.

Integration with Pi-Hole to provide protection against trackers while using the AI VPN service.

Support for launching the service using Nix Arion for NixOS users.

The beta version release notes are available on GitHub. This version was tested using Docker v20.10.6 and docker-compose v1.28.5.

The AI VPN is the New Emergency VPN Service Engine

Since late November, users of our Emergency VPN service can already experience the new AI VPN technology. Our Emergency VPN was enhanced and is now powered by the AI VPN, giving it more stability, speed, and reliability. We hope our users will enjoy the changes and help us improve even more this new tool. Get started using the Emergency VPN.

Acknowledgements

This project was funded through the NGI0 PET Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.

This project was developed by the Stratosphere Laboratory, Artificial Intelligence Centre, Faculty of Electrical Engineering, Czech Technical University in Prague (2020-2021).

The AI VPN threat detection is provided by the Stratosphere Linux IPS developed at the Stratosphere Laboratory.

We would like to give a special thank you to the individuals who helped us get to this release, specially Sebastian Garcia, Maria Rigaki, Joaquin Bogado and Alya Gomaa.

Resources

Documentation: https://aivpn.readthedocs.io/

Repository: https://github.com/stratosphereips/AIVPN 

[civilsphereproject]

Capturing and Detecting AndroidTester Remote Access Trojan with the Emergency VPN

Mobile remote access trojans, or RATs, are malicious programs that allow attackers to fully control a mobile device. What does this mean in reality? The person controlling the malware will be able to access information on the phone, including SMS, pictures and messaging applications, and also be able to steal or implant files on the phone. RATs are precision tools used to track and gather information about a person. 

In this blog post, we show how the Emergency VPN can help identify RAT infections on Android phones. The images and network traffic included in this blog post are part of the original research by Civilsphere researcher Kamila Babayeva on the Android Mischief Dataset [1].

Android Tester Remote Access Trojan

AndroidTester is a RAT for Android that has been around since approximately 2020, and it is believed to be a variation of another RAT known as SpyNote. Among its functionalities, the RAT can access files, SMS messages, calls, contacts, locations, accounts, applications, and allows access to the shell, microphone, camera, keylogs, settings, and other functionalities. This functionality is shown in Figure 1 and 2. 

Once the phone is infected with the RAT, the attacker has complete access to the phone. As we can see in the screenshots below, the RAT can list all the files and all the installed applications, among other things.

Capturing the Android Tester RAT with the Emergency VPN

The Emergency VPN is a service that provides a free security assessment of a phone’s network traffic to determine if the device is infected, under attack, or compromised. The Emergency VPN works like any other VPN, with the addition that once you connect to the Emergency VPN, our team will capture the network traffic generated by the device in order to analyse it and find potential security threats. The high level workflow of the Emergency VPN is shown in Figure 3.

To capture the behavior of the AndroidTester RAT, we connected a Nokia Phone with Android 10 to our Emergency VPN and then infected the device with AndroidTester v.6.4.6. The Nokia Phone was remotely controlled like a real attacker would do, stealing information, adding and deleting contacts, and locating the device.

During all this time, the Emergency VPN was active and the network connections through the VPN were captured and then analysed by our analysts to identify if there were malicious connections identified or not.

Detecting the AndroidTester RAT with the Emergency VPN

The Emergency VPN captures and stores the network traffic in a PCAP file. This file contains all the network connections the device did using the VPN and it is the primary source for analysis that our researchers use to find malware infections.

In this session, the Emergency VPN was used for 1.2 hours resulting in 80MB of network traffic captured. With this data, we proceed to perform our analysis.

In this investigation, we focused on three things to detect the malware infection:

Unusual data upload: is the device uploading (a lot of) data to unusual services?

Periodic connections: are there network connections that appear not to be human? 

Data leaks: is there any personal information being leaked on the network?

The first thing we usually look at are usual data uploads. Most users are data consumers, generally downloading more data than they send. This quick analysis highlighted one suspicious connection to a server not associated with any well-known service, where the device uploaded 43MB as it can be seen below:

This connection is suspicious because the service is not known, the device uploads 43MB of data, but also, because compared to the other activities in the device this is an outlier. However suspicious, this alone is not enough to classify this connection as malicious and we investigate further.

Now that we have a connection that we consider suspicious, we analyse it to determine if this connection may have been generated by a human or a program. When humans browse the internet or use applications, we rarely do it in a periodic and automated fashion. Computers on the other hand, they do. 

The Stratosphere Linux IPS is a network analysis tool that allows to quickly analyse if a connection is periodic. As shown below, the connection to this server is periodic, does not have an associated DNS name, and the data transfer occurs over a non-standard port (1337).

All of these individual findings show us that this connection appears more and more suspicious. We can examine the content of the connection and, if the traffic is not encrypted, we can see if there is anything else pointing out if this connection is malicious.

Upon examination, we find the attacker command and the device response sending the mobile phone number and name over the network:

With all the information gathered, our researchers will use existing Threat intelligence and their advanced knowledge on traffic analysis to try to associate the traffic with a specific malware family whenever possible to facilitate the risk assessment and remediation steps taken by users.

The Emergency VPN report for this device is available here. A technical in-depth analysis of AndroidTester network traffic is available in the Stratosphere Blog [6].

How to Avoid Getting Infected by RATs

These are our recommendations to stay safe:

Install new apps only from the Google Play Store and trusted developers.

The Google Play Protect is enabled by default, keep it enabled at all times. 

Click only on links sent by people you know and trust. When in doubt, do not click.

Download and open attachments sent only by known and trusted contacts. When in doubt, do not download and do not open.

Keep only the essential applications installed on the phone for maximum safety.

Never leave your phone unattended or unlocked, even in trusted spaces.

Never share your phone PIN or Pattern, even with loved ones.

Remember that you can use the service ShouldIClick to check links before clicking, and see its content without visiting the site directly on your phone. Get started using the Emergency VPN.

References

[1] Execution, Analysis and Detection of Android RATs traffic, Civilsphere, https://www.civilsphereproject.org/research/execution-analysis-and-detection-of-android-rats-traffic. Accessed on 07/15/2021.

[2] A Study of Remote Access Trojans: This repository contains a curated list of papers, articles and other sources related to remote access trojans, GitHub, https://github.com/stratosphereips/a-study-of-remote-access-trojans. Accessed on 07/15/2021.

[3] ANDROID TESTER V6.4.6 (RAT) Cracked + Source, BlackHatRussia Web Archive, https://web.archive.org/web/20210705135241/https://www.blackhatrussia.com/1424-android-tester-v646-rat-cracked-source.html. Accessed on 07/15/2021.

[4] Screenshot from 2020-08-07 11-04-04.png, RAT01_AndroidTester, AndroidMischiefDataset_v2, https://mcfp.felk.cvut.cz/publicDatasets/Android-Mischief-Dataset/AndroidMischiefDataset_v2/RAT01_AndroidTester/RAT01_AndroidTester_screenshots/Screenshot%20from%202020-08-07%2011-04-04.png. Accessed on 07/15/2021.

[5] Screenshot from 2020-08-07 11-10-13.png, RAT01_AndroidTester, AndroidMischiefDataset_v2, https://mcfp.felk.cvut.cz/publicDatasets/Android-Mischief-Dataset/AndroidMischiefDataset_v2/RAT01_AndroidTester/RAT01_AndroidTester_screenshots/Screenshot%20from%202020-08-07%2011-10-13.png. Accessed on 07/15/2021.

[6] Dissecting a RAT. Android Tester Trojan Analysis and Decoding, Stratosphere IPS, https://www.stratosphereips.org/blog/2020/12/14/ngwqj0h060yv40w1afp51fg7wo9ijy-pzlhk. Accessed on 07/15/2021.

[civilsphereproject]

Civilsphere AI VPN: v0.1-alpha pre-release

Civil society organizations, activists, journalists and human rights defenders rely on digital devices to do their jobs, and are often in the field without the protection of firewalls, IDS, or any other advanced threat protection more commonly available to corporate users. How can these individuals identify if their devices are at risk while working in the field?

Since 2018, our Emergency VPN service has been leveraging VPN technologies to provide users with a security assessment of their devices’ network traffic tailored to identify digital threats. Our new AI VPN aims to take this work even further.

The AI VPN is a free software tool that provides users with an automatic network security assessment of their network traffic. Users can request a new VPN profile via email, connect to it for a predefined amount of time (hours to days), and receive a full report after their VPN profile expires. 

The AI VPN aims to enable organizations to deploy their own instance without the need to rely on third-parties with their data.

AI VPN v0.1-alpha pre-release

This project is still in its early development, however we are happy to have an alpha pre-release already available for testing. This first release includes some of the AI VPN core functionality: 

Automatic generation of VPN accounts

Automatic network traffic captures per account

Automatic revocation of VPN accounts

Automatic report generation of the captured traffic per account

Email is currently the supported method for sending VPN requests and obtaining the network traffic analysis reports.

VPN supported technologies currently include OpenVPN

AI VPN currently handles up to 253 simultaneous users.

This version was tested using Docker v20.10.6 and docker-compose v1.28.5.

The AI VPN documentation can be accessed at https://aivpn.readthedocs.io. The application can be downloaded in our GitHub repository https://github.com/stratosphereips/AIVPN.

Acknowledgements

This project was funded through the NGI0 PET Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.

This project was developed by the Stratosphere Laboratory, Artificial Intelligence Centre, Faculty of Electrical Engineering, Czech Technical University in Prague (2020-2021).

[civilsphereproject]

Introducing Our New Project: Civilsphere AI VPN

It’s hard to keep our mobile devices secure. The lack of tools for early detection of attacks in mobile devices makes this even harder. Our civil society organizations, activists, journalists and human rights defenders rely on mobile devices to do their jobs, often without the protection of firewalls, IDS, or any other advanced threat protection available to corporate users. How can these individuals identify if their devices are at risk while working in the field?

We are happy to announce that with the support of the NLNET Foundation and the Czech Technical University in Prague we are working on our new project, the Civilsphere AI VPN, to provide individuals with automatic advanced threat detection on the go.

Meet Our Civilsphere AI VPN

Our Civilsphere AI VPN project will research and implement an automated, easy to install, locally deployed VPN running novel protection software that analyses your network traffic to automatically find attacks, infections, targeted threats, and data leaks. When your device is at risk, the VPN will automatically block your traffic. At the end of each day, you will receive a report with all the meaningful security events discovered. This project is not about VPN technologies, it is about protecting users.

The AI VPN will be fully integrated with the Stratosphere Linux IPS (SLIPS) to provide state-of-the-art machine learning threat detection using models trained on real attacks. SLIPS is a free software tool designed to focus on targeted attacks, detection of command and control channels to provide insights on traffic usually not caught by traditional security tools.

How Does The AI VPN Work?

The AI VPN follows the same workflow as our Emergency VPN. A user requests a new VPN profile and connects to the VPN. The AI VPN monitors the traffic in real time, blocking known threats and malicious connections. A full traffic capture of the user’s network traffic is captured for more advanced automatic analysis. After a given period of time the AI VPN will automatically generate and send a report to the user with all the known threats found in that period of time. The AI VPN is designed to protect and also help NGOs or at-risk individuals to know if they are at risk.

Your AI VPN: Modular And Customizable Design

The AI VPN follows a microservice architecture based on Docker, and is fully modular. We plan to support various types of VPN technologies including OpenVPN and Wireguard. NGOs and individuals will be able to deploy the AI VPN in their own servers reducing the need to trust third parties with their network traffic.

The integration with the Stratosphere Linux IPS also enables anyone to have threat detection on their traffic without the need to have the technical expertise. Users will simply connect to the VPN and receive a threat report from that connection.

Stay Tuned for the First Release

Our first public release of the AI VPN will be released soon! Stay tuned! 

[civilsphereproject]

The Civilsphere Emergency VPN

Technology has been very beneficial to journalists and activists around the world: it gives journalists access to a wealth of data and makes it easy for them to communicate with sources without having to meet in person, while it can help activists amplify their message. 

But technology is also increasingly used against the same people through government surveillance and mobile spyware. The latter often gives adversaries full access to a targeted device, used by many governments and non-state actors. Recent examples include the targeting of dozens of Indian journalists which is believed to use NSO Group's Pegasus spyware and the discovery of FinSpy implants in Myanmar.

For journalists who are concerned about the possibility of their phone being infected and/or their communications being surveilled, the Civilsphere Project has created a free Emergency VPN service. Once you connect to the Emergency VPN, our team will capture the network traffic generated from your device for a few days. We will thoroughly analyse the data received and based on the network connections determine if your phone is infected, or if there are any threats that you should be aware of.

In the report we send you, we will also warn you about insecure apps you may have installed. While the risk of using insecure apps, which may for instance leak your location, isn't the same for all users, for a journalist or activist at high risk it is recommended to reduce their attack surface as much as possible.

Are you a journalist, a human rights defender or do you work at an NGO? Are you worried that your phone could be infected? Please contact us so that we can help!

[civilsphereproject]

Should I Click: a Machine Learning Based Tool to Analyze if a URL is Safe to Click

The great majority of attacks, including targeted attacks, start with a link in an email, chat or sms. Phishing websites have been on the rise for the last decade, and their number is even bigger than websites hosting malware. Nowadays it’s easy to become a victim of such attacks, mostly when under pressure or when it’s hard to verify if the URL we clicked on is the right one. For this reason Should I Click was born. In this blog post we would like to introduce this new service, how it works, and how it can help protect our civil society from digital threats.

What is Should I Click?

“Should I Click” is a free online web service that helps users decide if they should click on a suspicious link or not. This service was born as part of the master thesis of František Střasák. Should I Click uses machine learning systems that were trained with thousands of real websites used for attacks. For every submitted URL, the service will not only tell you if it’s safe to click or not, but Should I Click is also able to tell you why.

How does it work?

Once the user inserts the URL to check, the service will automatically download all possible information from the website, will extract features from the downloaded resources, and will run a series of machine learning algorithms to process these features and give a final verdict.

The data from the website is accessed directly from Civilsphere servers, and also using the service https://urlscan.io/. The service also runs special virtual machines to analyze in real time if the JavaScript code of the webpage is trying to attack your browser or not. After all the data is processed, features are extracted and the machine learning algorithms give a verdict on the URL.

Should I Click Under The Hood

There are many reasons why a user should not click on a link. Currently an ongoing project, in its beta-version Should I Click is trained to detect four types of websites: evil twin websites, scam websites, websites with dangerous behavior, and websites with bad HTTPS practices. Each of these classes of websites are described below.

EVIL TWIN WEBSITES

Evil twin websites are websites designed to look the same as a normal website but are completely controlled by the attacker. These are used as phishing techniques to steal emails, passwords, credit card numbers and other sensitive data. Evil twin websites success is based on users’ visual perception: the user needs to perceive the evil twin website as completely normal. When done properly, Evil twin websites are very hard to detect. 

The only way for users to detect if a website is an evil twin is to check the URL they are accessing every time to make sure it is the correct website they want to visit.

SCAM WEBSITES

As the previous type, Scam websites are also phishing techniques. However scam websites often offer fake products to users with the aim to steal their credentials. In most cases all this happens under time pressure. For instance, “You won a new iPhone7 and you have only  60 seconds to fill this information to get this phone.”).

For experienced users, scam websites are not difficult to detect because they have patterns that are easy to recognize. However, these patterns so evident for a human are a very difficult task for a machine learning algorithm: the patterns the human can identify are difficult to translate into features for algorithms.

WEBSITES WITH DANGEROUS BEHAVIOR

In this category we include a wide range of malicious websites. It can mean they contain harmful JavaScript, cryptojacking attacks, or exploits. All these different attacks are designed to attack the web browser of the user and in the end, infect or abuse the device. The presence of these attacks are difficult to recognize from a user point of view. For machine learning algorithms this proves to be also a difficult task and this complexity translates to results being always not good enough. 

WEBSITES WITH BAD HTTPS PRACTICES

In this category we include all websites that handle users data without proper encryption. Most of these websites are not malicious, however the lack of encryption makes them vulnerable to attacks such as man-in-the-middle or redirection attacks. Furthermore users should be even more suspicious if a website has no HTTPS but there is an input form for sensitive data such as: email, password or credit card number. Additionally, Should I Click also verifies the HTTPS certificate validity, if it’s expired or has an unknown certificate issuer. While this type of certificate issues are shown as warning in today’s browsers, it is important to also include them in our analysis and evaluation. 

Your Feedback Makes Should I Click Better

Should I Click uses your feedback to get better. If you know a website is malicious or benign, and the verdict by Should I Click is wrong, we urge you to use the feedback form to give us feedback. This helps adjust our algorithms and be able to provide better verdicts in the future.

We hope Should I Click will help protect the civil society and reduce the number of successful attacks. We hope Should I Click will help you. The best place to start is here: www.shouldiclick.org.

[civilsphereproject]

36c3 Chaos West: Emergency VPN, Analyzing Mobile Network Traffic to Detect Digital Threats

Our team had the opportunity to present a talk at the Chaos West stage on the 36th Chaos Communication Congress (36c3) in Leipzig. The 36c3 is the biggest hacker conference in Europe and it gathers every year more than 16,000 attendees from all over the world.

Sebastian Garcia, director of Civilsphere and Veronica Valeros, project leader of Civilsphere, presented the Emergency VPN in the Chaos West stay on December 27th. In their talk they emphasized the increased use of surveillance technology such as spyware by governments to surveil and abuse journalists, activists and human rights defenders. However, as Veronica Valeros mentioned in the talk, governments have crossed the line and have used this spyware also to target civilians, including, children.

The Emergency VPN is a service that allows users to obtain a free security analysis of the network traffic of the mobile device. This works based on the assumption that spyware or other digital threats will attempt to steal information and send it back to the attackers. Through the use of a VPN “researchers can analyze the data and send back a report with any suspicious or malicious activity that is putting you at risk”, says Sebastian Garcia director of the project.

“Right now we need your help”, indicates Veronica, “we need your help to be able to reach the right people at the right time. Are you at risk? Is people you know at risk? Please reach out to us, we can help. ”

The slides are available for download HERE.

[civilsphereproject]

Use of Facebook UDP Priming Revealed in Unencrypted UDP Connection to port 33000

Early this year we observed suspicious UDP connections to port 33000 in a mobile device. This traffic contained a Facebook URL that included a Facebook Graph token, and it was sent unencrypted over the network. In this blog post we show details of this traffic, what information was disclosed, and our discovery of UDP Priming. We have reported this potential data leak to Facebook, who confirmed this traffic is part of the Facebook normal behavior and that the tokens transmitted in plain text are not security related.

1. Discovery of UDP TRAFFIC to port 33000

We observed this behavior for the first time in the traffic of an iOS mobile device, specifically an Apple iPhone 6, OS Version 12.1.4. In Figure 1 it is possible to observe how this traffic looked like in Wireshark. The internal IP 10.8.0.105 was communicating with different Facebook IPs (31.13.89.19,157.240.30.18). The connections to UDP port 33000 are similar in length, and not periodic. Another thing to consider is that the host is sending traffic but never receiving a response from the server.

2. defining which questions need answering

The goal of our analysis is to understand the traffic and what is happening. The first step was to make a list of questions that we wanted to answer. In our case, were were interested in the following ones:

Who else is generating this traffic? Is this an isolated case?

Is this traffic generated by an official Facebook application, or by a third-party app? If it is, it should be documented.

What is the “primingtoken” of the Facebook Graph API doing?

What is this token used for?

We started our research trying to answer all of these questions.

3. FIRST ATTEMPT TO EXPLAIN WHAT IS HAPPENING

3.1 Is this an isolated case or are other users generating the same traffic?

To answer this questions we did two things:

First, we searched for occurrences in the traffic of some organizations we are monitoring. To our surprise, we observed multiple users generating the same type of connections. Some of these connections can be observed in Figure 2. The observed connections were all from desktop users, increasing the possible users affected by this leak.

Second, we installed Facebook on an Android mobile phone, capture its traffic for three days, and during this time we used the application normally as any normal user would. We then searched in the captured traffic for any connection on port 33000. We didn’t observe any occurrence or connection to high ports on Facebook services.

Conclusion: the observed traffic is not generated by a single user, but for multiple ones. This traffic was generated by both mobile (iOS) and desktop users (Unknown number of OS).

3.2 Is this traffic generated by an official Facebook application, or by a third-party app? If it is, it should be documented.

To answer this question we looked up the documentation associated to Facebook Graph API. The Graph API is at the core of the Facebook ecosystem. According to the facebook documentation [1]:

The Graph API is the primary way for apps to read and write to the Facebook social graph. All of our SDKs and products interact with the Graph API in some way, and our other APIs are extensions of the Graph API, so understanding how the Graph API works is crucial.

User tokens are needed in order to use the API. The documentation [2] states clearly the two main functions of the token:

They typically perform two functions:

1) they allow your app to access a User's information without requiring the User's password, and

2) they allow us to identify your app, the User who is using your app, and the type of data the User has permitted your app to access.

The Graph API documentation is quite good, however, after extensive search we didn’t find any mentions of the primingtoken or anything related to port 33000/UDP. Our tests from 3.1 didn’t help confirming if this behavior was generated by the Facebook App, or the Facebook Messenger. There are hundreds of other apps that may connect to facebook, and at this point this was unfeasible to test.

Problem: we were unable to answer this question at this point as the functionality was not documented. With this we were unable to answer the remaining questions of what does the token do and what is it used for? Solution: let’s report this issue to Facebook, if this is an issue they will fix it, if not, they will explain what this does.

4. REPORT ISSUE TO FACEBOOK

On March 15th we reported the issue to Facebook as “Access Token Disclosure” problems via their bug bounty program. On March 19th, Facebook support contacted us mentioning that these requests/tokens were used for pre-processing and were not security related. In a nutshell, everything was working just as intended. Facebook answer in full can be read below:

Thank you for submitting this. We have looked into this internally and can confirm that this is working as intended. These requests/tokens are used for pre-processing and are not security related. There is no harm for these to be exposed. Thank you for sharing this information with us. Although this issue does not qualify as a part of our bounty program we appreciate your report. We will follow up with you on any security bugs or with any further questions we may have.

This answer gave us enough information to focus our investigation and find the answer. The key elements that helped us move forward where:

This is an official part of Facebook apps.

The tokens are used for pre-processing of requests.

The token is not used (?) for accessing user information.

5. Finding the root cause. Meet UDP priming.

Our research finally led us to a blog post from 2015 [3] on “Optimizing Facebook for iOS start time”. In this blog post they introduce UDP Priming. UDP priming is a technique used to reduce the start time of the application. Every time a user clicks on the Facebook app, the application has to load. There are two cases: if the application is launched for the first time (not running on the background) so a considerable amount of content has to be loaded, this is known as cold start. If the application was already running in the background, a lower amount of content needs to be loaded for the application to run, this is known as warm start. UDP Priming is meant to speed up the cold start on Facebook for iOS applications.

In Facebook own words [3], UDP Priming is about speeding the cold start process: “before we send out the feed request over TCP, we send an encrypted UDP packet to the server, containing the feed request. The purpose of doing this is to give a hint to the server to kick off fetching and caching of data much earlier. When the actual feed request arrives over TCP, the server can then simply construct the response from cached content and send it back. Enabling this technique allowed us to gain several hundred milliseconds more.”

In this case, they mention that the UDP packet is encrypted, but they don’t specify if the token is encrypted, or if all the packet content should be encrypted. In any case, every time the application starts it will generate a request like the one above.

Conclusion

Performing network analysis on mobile phones turned our attention to suspicious connections to Facebook servers. These connections leak Facebook UDP Priming tokens which are used to speed up the loading of Facebook applications. While there is no documentation on this behavior on the Graph API, Facebook confirmed that this is indeed part of the normal behavior of the app. We confirmed that the same optimization technique (code) is present in Android Facebook apps, but we couldn’t confirm that this behavior is actually used in Android apps.

Security impact. Sending the full URL and token in clear text has implications for the security of the users.

First, the transmission of this information discloses to anyone surveilling the user the presence of Facebook applications installed, and can help confirm the operating system behind (if they only use this in iOS devices).

Second, while not confirmed to this date, this user token may disclose personal information about the user. However more research needs to be done to confirm this.

We believe that this negatively affects the privacy of users and the URL should be encrypted. Additionally, this behavior should be documented so users can understand what type of traffic is being sent out from their mobile phones.

References

Graph API, Facebook, https://developers.facebook.com/docs/graph-api

Using the Graph API, Facebook, https://developers.facebook.com/docs/graph-api/using-graph-api/

Optimizing Facebook for iOS start time, Facebook, https://code.fb.com/ios/optimizing-facebook-for-ios-start-time/

[civilsphereproject]

Qué es OONI y Cómo Usarlo

El proyecto OONI (Open Observatory of Network Interference / Observatorio Abierto de Interferencia en la Red) es un proyecto de software libre dedicado a aumentar la transparencia de la censura en internet en todo el mundo. Medir la censura en internet es difícil y desafiante. OONI propone una alternativa basada en la descentralización. Miles de personas en todo el mundo contribuyen a crear un mapa del uso de censura en más de 200 países. En este blog contamos que es y cómo usar OONI.

Por qué es importante medir la censura en Internet?

La censura es una técnica usada para suprimir el acceso a cierta información u obra considerada sensible, perjudicial o inconveniente para gobiernos, instituciones privadas y/o corporaciones.

Muchas veces es difícil tener evidencia de que hay censura: cómo? cuando? dónde? por quién? Estas preguntas son difíciles de contestar sin tener una medida del estado anterior y posterior a una actividad de censura. OONI brinda la tecnología para responder a cada una de estas preguntas. Con cada medición podemos ayudar a determinar en cada una de las redes a las que nos conectamos, en cada país, qué está pasando.

Qué es lo que OONI puede medir?

En este momento OONI permite tomar medidas y recolectar información de los siguientes eventos:

El bloqueo de sitios web: esta prueba examina si ciertos sitios web son accesibles; en caso de que no lo sean, OONI intenta determinar si el acceso a ellos está bloqueado a través de diferentes técnicas y análisis. 

El bloqueo de aplicaciones de mensajería instantánea (WhatsApp, Facebook Messenger y Telegram): OONI tiene un método por cada aplicación de mensajería instantánea para probar si está siendo censurada y su acceso está bloqueado.

El bloqueo de tecnologías para la evasión de censura (Tor): Tor es una de las tecnologías de evasión de censura más populares hoy en dia; OONI provee un método para verificar si el acceso a Tor está siendo censurado o no.

La presencia de sistemas (Presence of systems (middleboxes o cajas intermedias) en las redes capaces de monitoreo o censura del contenido digital: OONI permite también la detección de cajas intermedias de manipulación de tráfico de red.

La velocidad y rendimiento de la red de Internet: OONI también permite medir la velocidad de una red de Internet y el rendimiento de la misma; estas características pueden también ser un indicador de que una red está siendo intervenida.

Riesgos

En algunos países el uso de OONI puede no ser bien visto, y OONI en ciertas pruebas puede acceder a sitios cuestionables que pueden en ciertos países ser ilegales. Antes de probar, lean la guia de riesgos en Español: https://ooni.org/es/about/risks/.

Cómo usar OONI desde tu dispositivo móvil?

Usar OONI desde dispositivos móviles es muy sencillo y solo basta con descargar la aplicación. OONI está disponible para descargar desde el Play Store o F-Droid para dispositivos con Android, y desde el Apple Store para dispositivos con iOS.

Prestar atención al descargar: verificar siempre que el desarrollador de la aplicación sea “The Tor Project” o “Open Observatory of Network Interference”.

Una vez instalada la aplicación se puede comenzar a realizar los pruebas y mediciones de la situación actual en la red de Internet donde el dispositivo móvil esta conectado.

El “dashboard” o “panel” es el que permite hacer las diferentes pruebas mencionadas anteriormente. Al clickear en una prueba el usuario sera presentado con la opción de comenzar la prueba especifica, la cual una vez finalizada mostrara los resultados correspondientes.

En la esquina inferior derecha se puede ver el tiempo que cada prueba va a tomar.

Nótese que por defecto, todos los resultados se publican automáticamente junto con la información de la red y el código del país. Esto es recomendado en la mayoría de los casos, sin embargo, es posible configurar la aplicación para que los resultados no se envíen automáticamente y que cierta información (como el código del país) no se comparta.

Conclusión

La censura en Internet es más común de lo que muchos creemos o tenemos conocimiento. Al momento de escribir este artículo, hay mas de 3000 sitios web bloqueados en Argentina. En Venezuela durante el 2019 el gobierno bloqueó el acceso a Wikipedia, Instagram, y Twitter entre otros.

La falta de evidencia en el área de la censura en Internet hace en muchos casos imposible la investigación y el reclamo hacia las partes responsables. No es suficiente con empezar a monitorear el acceso a Internet cuando grandes eventos suceden. Es vital que el monitoreo empiece cuanto antes, para poder determinar sin lugar a duda, cuando el gobierno o alguna institución publica o privada empieza a tomar medidas de censura.

[civilsphereproject]

Mobile (in)Security Series: application "Moovit" leaks your location, username & email address

SUMMARY

In this blog post we report important issues found on the public transport application “Moovit” for Android and iOS. Our analysis focused only in the network traffic generated by these applications while used by normal users. In summary, the issues found are:

What you type in the destination and origin field is leaked in plain text. Anyone with access to the traffic can know what you type in real time.

Suggestion of partial searches are leaked in plain text. Anyone with access to the traffic can know potential places that you are searching for.

The chosen origin and destination are leaked in plain text. Anyone with access to the traffic can know the potential route you will be taking.

Every character typed generates a new request, leaking not only what you type but how you type it. Anyone with access to the traffic may analyze who you are.

The iOS version of the application leaks your GPS location to the Open Weather Map. Anyone with access to the traffic can know where you are.

The username and email address of the user is leaked in plain text by a response of the Moovit server. Anyone with access to the traffic can know your email address and know this traffic belongs to you.

This affects iOS application version 5.31.0, and Android application versions 5.30.0.403 & 5.31.0.405.

We have reached out Moovit via email to four different addresses and also via Twitter. We haven’t received any response or acknowledgement to this date.

ABOUT THE APPLICATION

“Moovit” is transport application designed to provide users with information on travel routes whether by car, bus, or foot. In their website (www.company.moovit.com/about), the company describes that they have over 400 million users worldwide:

By combining information from public transit operators and authorities with live information from the user community, Moovit offers travelers a real-time picture, including the best route for the journey.

Named Best Local App by Google in 2016, finalist in the Build for Billions category in 2018, and one of Apple’s Best Apps of 2017, Moovit launched in 2012 and now has over 400 million users.

Moovit amasses up to five billion anonymous data points a day to add to the world’s largest repository of transit data. The data gathering is aided by Moovit’s network of more than 550,000 local editors called “Mooviters.” These passionate users help map and maintain local transit information in cities that would otherwise be unserved. Mooviters account for 70 percent of the hundreds of cities Moovit opens every year and make Moovit the Wikipedia of Transit.

According to the information from Google Play Store, the application requests the following permissions:

Identity: find accounts on the device

Contacts: find accounts on the device

Location: approximate location (network-based), precise location (GPS and network-based)

Photos/Media/Files: read the contents of your USB storage, modify or delete the contents of your USB storage

Storage: read the contents of your USB storage, modify or delete the contents of your USB storage

Wi-Fi connection information: view Wi-Fi connections

Other: receive data from Internet, view network connections, pair with Bluetooth devices, full network access, run at startup, draw over other apps, use accounts on the device, control vibration, prevent device from sleeping, read Google service configuration, view network connections, full network access, use accounts on the device, control vibration, prevent device from sleeping.

INFORMATION LEAKED

After opening the application, there is an option to search for a destination. When the user selects a destination, the application proposes several routes that the user can choose from. After selecting a specific route, the application navigates the user to the desired location.

GPS location to the Open Weather Map (iOS)

For iOS users, the information starts leaking the moment the application is opened. The exact GPS location and a unique ID is sent in plain text over HTTP to the Open Weather Map API. Moovit is using Open Weather Map API to provide information about alerts or weather. Note that the request fails, as Open Weather Map has blocked the account due to exceeding requests of the subscription. Also, the GPS location of the general area is also leaked in the response by the server.

Origin and Destination Text Searches

While the user is writing in the destination field, the entire input is leaked together with the suggestions that are being displayed as the user types. The same occurs with the origin location, if the user searches for an address. The GPS location when the ‘current location’ option is selected is not leaked.

Suggestion Based on Partial Searches

As the user types, the application suggests destinations that the user can click on and select. These suggestions are also sent in plain text via HTTP.

Chosen Origin and Destination Points

When the user confirms the starting point and the destination. The application sends a request revealing these two points. For example when the user wants to navigate from “Václavské Náměstí” to the Prague Airport, the request looks as follows:

What The User Types & Typing Behavior

When the user types the application generates requests with the partial searches to retrieve data. Each request sends the text typed by the user in real time. Each letter (or group of letters if the user types fast) is sent in a new request which makes it possible to analyze the behavior and profile of the user. The analysis of typing patterns is known as keystroke dynamics and it is possible to use it to profile who the user is. Because the content is unencrypted, this data is available to anybody with access to this traffic. The following series of screenshots illustrate this point.

Username And Email Address of the User

Moovit has the option to register or login to sync data among different devices, save favourite locations, and other functionalities. We discovered that the username and email address of the user are leaked in plain text, but not by the client, this time by the server.

Lastly, other information about the mobile device is leaked by the mere fact of using HTTP. Information that can be known due the lack of encrypted communications include device type, language settings, application version, and others.

CONCLUSION

Both versions of the Moovit application leak personal data such as location information, unique ID or user’s email (only in iOS). A potential adversary can exploit this information to identify, track and find a targeted victim. The unique IDs also help unequivocally identify user’s data in large amounts of network traffic, making user specific surveillance much easier.

If you are an individual at risk because of the type of work you do, or the people you help, it is important to understand that any tiny piece of data that is leaked may put you at risk. We recommend uninstalling Moovit app and using a different application such as Google Maps which encrypts the content sent to and from the phone.

Stay safe.

[civilsphereproject]

Aplicación "BA Cómo Llego" envía tu ubicación y lo que tipeas en texto plano por la red

RESUMEN

En esta publicación informamos sobre problemas importantes encontrados en la aplicación de transporte público “BA Cómo Llego” desarrollada por el Gobierno de la Ciudad Autónoma de Buenos Aires. En resumen, los problemas encontrados son:

La aplicación envía la ubicación exacta de los usuarios en texto sin cifrar a través de la red. Cualquier persona con acceso al tráfico puede saber dónde el usuario se encuentra.

Todas las búsquedas realizadas por el usuario en la aplicación se envían en texto plano sin cifrar filtrando el contenido de la búsqueda. Cualquier persona con acceso al tráfico puede saber lo que el usuario escribe en tiempo real.

Cada carácter escrito genera una nueva solicitud, filtrando no solo lo que escribe sino también cómo lo escribe. Cualquier persona con acceso al tráfico puede analizar quién eres.

Esto afecta a la versión 5.6.0 de la aplicación para iOS, y a la aplicación actual de Android.

ACERCA DE LA APLICACIÓN

“BA Cómo Llego” es una aplicación desarrollada por el Gobierno de la Ciudad Autónoma de Buenos Aires que cuenta con más de 1.000.000 instalaciones reportadas hasta el momento. Esta aplicación ayuda a las personas a moverse por la ciudad de Buenos Aires mediante la búsqueda de transporte público. La aplicación proporciona direcciones y opciones de transporte que incluyen autobús, metro, tren, automóvil, bicicleta o pie.

La aplicación en Android solicita los siguientes permisos según Google Play Store:

Ubicación (por ubicación de redes WiFi y ubicación precisa mediante tecnología GPS)

Fotos/Medios/Archivos

Almacenamiento

Información sobre Wi-Fi

Otros permisos:

Recibir datos de internet

Ver las conexiones de red

Acceso completo a la red

Prevenir que el dispositivo entre en modo

Prevenir que el dispositivo entre en modo sleep

Leer la configuración del servicio de Google

Los permisos de ubicación también se solicitan explícitamente al instalar la aplicación tanto en Android como en iOS.

INFORMAcIóN filtrada por “BA Cómo LLEGO”

Después de instalar con éxito la aplicación, esta ofrece dos campos de búsqueda: "Desde" y "Hasta", donde el usuario debe escribir origen y destino para encontrar posibles rutas. Cuando el usuario comienza a escribir, la aplicación genera una solicitud HTTP que envía la búsqueda parcial a los servidores. Es importante tener en cuenta que debe escribirse un mínimo de 3 caracteres para que se realice la solicitud HTTP. A medida que el usuario continúa escribiendo, se realizan más solicitudes, casi carácter por carácter. Todos los datos se transfieren en texto plano a través de la red. La primera solicitud se puede observar en detalle en la Figura 1, mientras que la serie de solicitudes realizadas por el usuario mientras escribe la búsqueda completa puede verse en la Figura 2.

Además, la Figura 1 muestra cómo los desarrolladores usan un encabezado HTTP especial para informar que aplicación específica generó la solicitud. En este caso: ar.gob.buenosaires.comollego. En la respuesta, es posible observar los resultados de la búsqueda parcial en formato JSON. Esto se completará con los resultados cuando la dirección escrita coincida con algo en la base de datos.

Como se muestra en la Figura 2, cada solicitud envía el texto escrito por el usuario en tiempo real. Más importante aún, cada letra escrita se envía en una nueva solicitud que permite analizar el comportamiento del usuario y su perfil. El análisis de los patrones de escritura se conoce como dinámica de pulsación de tecla, o keystroke dynamics, y es posible utilizar esta técnica para determinar quién es el usuario. Debido a que el contenido no está encriptado, esta información está disponible para cualquier persona con acceso a este tráfico.

También parece haber un error en la aplicación, ya que está generando solicitudes para "buscar?" y "/ buscar /?", causando mucha más filtración de datos. La figura 3 ilustra este problema. Este error también implica que la aplicación está utilizando más del doble del ancho de banda de datos de su teléfono en comparación con lo que podría usar si este problema no estuviera.

FILTRADO DE LA UBICACIÓN EN LA APLICACIÓN PARA ANDROID

Hay dos tipos de filtrado de la ubicación en la aplicación “BA Cómo Llego”. La primera es sobre las ubicaciones en las que el usuario está interesado. Estas ubicaciones se obtienen al saber qué se escribe en el destino y el origen de los campos de búsqueda. La segunda es mucho más importante y es la aplicación la que filtra la ubicación actual exacta del usuario al enviar las coordenadas del GPS en texto plano en la red. La ubicación exacta se envía incluso cuando el texto escrito en los campos "Para:" y "De:" no es su ubicación actual. La figura 4 muestra este problema. Estas solicitudes se activaron cuando el usuario consultó el mapa interactivo de la aplicación.

En la Figura 4 hay varios aspectos a los que hay que prestar atención:

La aplicación utiliza la API de Google Maps para recuperar datos según la ubicación actual.

El protocolo usado es HTTP 1.0.

Las API de Google generalmente usan HTTPS de forma predeterminada, pero estas solicitudes no usan cifrado.

Si observamos la respuesta de una de estas solicitudes en la Figura 5, podemos ver cómo Google las ha bloqueado y, de hecho, está prohibiendo que la aplicación realice más solicitudes. Esto significa que los propietarios de la aplicación no la están probando y no son conscientes de que Google los está bloqueando. Además, ya no es necesario enviar la ubicación del GPS.

Nota: el filtrado de la ubicación GPS solo se ha observado en la versión de Android de la aplicación “BA Cómo Llego”. Esta filtración no ocurre en la versión de iOS probada en este momento.

CONCLUSIÓn

Si usted es un individuo en riesgo debido al tipo de trabajo que realiza o a las personas a las que ayuda, es importante comprender que cualquier dato pequeño que se filtre puede ponerlo en riesgo. Hoy en día llevamos teléfonos móviles dondequiera que vamos, y es importante entender que estos pueden ponernos en riesgo. Recomendamos desinstalar "BA Cómo Llego" y usar aplicaciones de transporte más convencionales como Google Maps que garanticen un nivel mínimo de seguridad.

SI USTED ES UNA PERSONA QUE PUEDE ESTAR EN RIESGO DE UN ATAQUE DIRIGIDO, CONTÁCTENOS.

[civilsphereproject]

MOBILE (IN)SECURITY SERIES: APPLICATION "BA Cómo Llego" LEAKS YOUR LOCATION & EVERYTHING YOU TYPE

SUMMARY

In this blog post we report important issues found on the public transport application “BA Cómo Llego” developed by Argentinean Government. A summary of the issues found is:

The application sends the exact location of the users in clear text over the network. Anyone with access to the traffic can know where you are.

Every search done in the app by the user is sent in clear text, leaking the content of the search. Anyone with access to the traffic can know what you type in real time.

Every character typed generates a new request, leaking not only what you type but how you type it. Anyone with access to the traffic may analyze who you are.

This affects iOS application version 5.6.0, and current Android application.

ABOUT THE APPLICATION

“BA Cómo Llego” is an application developed by the Government of Buenos Aires City (“Gobierno de la Ciudad Autónoma de Buenos Aires“). With more than 1,000,000 reported installations. This application helps individuals move around Buenos Aires city by finding public transport. It provides directions and transportation options including bus, subway, train, car, bike, or foot.

The application in Android requests the following permissions according to Google Play Store:

Location (network based, and precise location via GPS)

Photos/Media/Files

Storage

Wi-Fi information

Other:

receive data from Internet

view network connections

full network access

prevent device from sleeping

read Google service configuration,

Location permissions are also explicitly requested when installing in both, Android and iOS.

INFORMATION LEAKED

After successfully installing the application, the user is prompt with two key search fields: ‘From’ and ‘To’, where the user should type origin and destination to find possible routes. When the user starts typing, the application generates an HTTP request sending the partial search to the servers. Note that a minimum of 3 characters should be typed for the request to take place. As the user continues typing, more requests are being made, almost character by character. All the data is transferred in clear text over the network. The first request can be observed in detail in Figure 1, while the series of requests made by the user while typing can be seen in Figure 2.

Additionally, Figure 1 shows how the developers dedicated a special HTTP header for reporting the application that generated the request. In this case: ar.gob.buenosaires.comollego. In the answer, it is possible to observe the results of the partial search in JSON format. This will be populated with results when the written address matches something on the database.

As shown in Figure 2, each request sends the text typed by the user in real time. More importantly each letter typed is sent in a new request which makes it possible to analyze the behavior of the user and its profile. The analysis of typing patterns is known as keystroke dynamics and it is possible to use it to profile who the user is. Because the content is unencrypted, this data is available to anybody with access to this traffic.

There also seems to be a bug on the application, as it is generating requests for both “buscar?” and “/buscar/?“, causing the application to be even more noisy with your input text. Figure 3 illustrates this error. This bug also means that the application is using more than double the data bandwidth of your phone compared to what it may use without this bug.

LOCATION LEAKING ON ANDROID APPLICATION

There are two types of location leaking on “BA Cómo Llego”. The first one is about the locations the user is interested in, which is collected by knowing what is typed on the destination and origin of the search fields. The second one is much more important and is the application leaking your exact current location by sending the GPS coordinates in clear text. Your exact location is sent even when the text typed into the “To:” and “From:” fields is not your current location. Figure 4 shows this problem. These requests were triggered when the user consulted the interactive map embedded on the application.

In Figure 4 there are several aspects to pay attention to:

The application is using Google Maps API to retrieve data based on the current location.

The protocol used is HTTP 1.0.

Google APIs generally uses HTTPS by default, but these requests do not use encryption.

If we take a look at the response of one of these requests in Figure 5 we can see how Google has blocked them, and it’s actually forbidding the application of making any more requests. This means that the owners of the application are not testing it and are not aware that Google is blocking them. More over, there is no need now to send the GPS location anymore.

Note: The location leaking has only been observed on the Android version of the “BA Cómo Llego” application. This leak do not happen on the iOS version tested at this moment.

CONCLUSION

If you are an individual at risk because of the type of work you do, or the people you help, it is important to understand that any tiny piece of data that is leaked may put you at risk. We carry mobile phones everywhere we go, and it is important to understand that they may put us at risk. We recommend uninstalling “BA Cómo Llego” and using more mainstream transportation apps such as Google Maps that will ensure a minimum level of security.

IF YOU ARE A PERSON THAT MAY BE AT RISK OF A TARGETED ATTACK, CONTACT US. STAY SAFE!

[civilsphereproject]

Mobile (in)Security Series: location leaked over the network by android application

Summary

In this blog, we report some key issues on the 'Transparent clock & weather' android application after assessing the network traffic generated by it. In our analysis we found:

How a seemingly benign application may leak sensitive information that may put users at risk. We provide details about how the information is leaked.

We examine what an attacker may be able to do if is able to retrieve this information.

 About the application

The 'Transparent clock & weather' application is developed by MACHAPP Software Ltd. According to Google Play Store, the application has 50 million downloads. It has been rated by more than 700,000 users, with a score of 4.4 out of 5.

The latest version of the app, 1.41.01, may request access to:

Calendar

Location

Storage

Other: full network access, prevent phone from sleeping, run at startup, receive data from the internet, control vibration, view network connections, com.google.android.finsky.permission.bind_get install_referrer_service (this gives the developers information on how the users arrived to the app before installing)

Note that after installing it, the application explicitly requests access to the location. It has access to the network by default, but not to the calendar and storage.

information leaked

Upon setting a location for the app to show the time and weather, the application communicates over the network to send the user location. The communication is over HTTP, using GET requests, and none of the transferred data is encrypted. The first request performed by the application is shown in Figure 1. It can be seen from the screenshot, that the location of the user hasn't been set (lat=0, lon=0), and that the user or app uses by default metric units.

The second request performed by the application (see Figure 2) shows that a specific location has already been set by the user. The coordinates 50.075538099999996, 14.437800500000002 are the location of the center of Prague, Czech Republic. This is because the location has been put manually, by typing an address or name of a city. In the request it can be observed that the unit system has not been altered, still metric.

The contacted hostname is tcw.fcawx.net. The domain was first created in 2015-04-01, and it's registered by Gandi SAS, a French company that provides domain name registration as well as other services, including web hosting.

What is most interesting to see from these connections, is the actual behavior. As shown in detail in Figure 3, the user connects to the external server (IP 94.237.26.97) via the standard TCP handshake. Once the connection is established, the user sends an HTTP GET request to the server, sending the information shown above, including coordinates, auth token, and units used. After that, the server acknowledges the transmission, but instead of answering with a typical HTTP response, the connection is closed.

This indicates that these connections are actually not retrieving any data.

We let the application run for some time, and we found that actually, the application is performing connections every roughly 15 seconds (See Figure 4). Which raises the question: why a weather application needs to update itself every 15 seconds in the first place? What is the purpose of these periodic requests if there is no data retrieved? 

In a similar case we analyzed as part of our work in CivilSphere, we observed that sometimes the server is responding with HTTP/XML data. As you can see in Figure 5, the amount of HTTP responses obtained are not proportional with the number of requests sent by the user. Out of 10 requests the user sends, the server responds one or two times with data regarding the weather. 

Mapping your every move?

An attacker with access to this data over a few days or weeks, can guess important information, such as:

Frequently visited places

Location of your work offices

Location of your home

If you visit clients, or institutions, where are they located

If your travel patterns are stable, meaning you have a strict routine, an attacker can predict where you will be approximately at which time.

If several people is using the app, an attacker tracking them can determine if they are meeting together or not.

It is quite possible for an attacker with access to this data to map your movements, and learn vital information that may put you or people close to you, at risk.

Conclusion

If you are a person at risk or that may be target of a cyber attack because of the type of work you do, it is important to understand that your phone is critical to ensure your physical safety. Mobile phones are not as secure as we tend to think. We recommend to keep only the most critical applications installed, and not trusting third party apps. Even a Weather application may put you at risk.

If you are a person that may be at risk of a targeted attack, contact us. Stay safe!

[civilsphereproject]

Report: Malware attacks on Linux servers to run cryptocurrency miners. A real case analysis.

In February 2018, we started investigating a security breach in one of our partner organisations. The analysis lead us to discover a long pattern of attacks against several web servers in the same organisation. The final goal of the attacks: exploiting the computational power of the servers to mine cryptocurrency. 

In this report we will walk you through our analysis from beginning to end: how the analysis started, the type of logs we analysed, finding how the servers were exploited and finally our hunt for similar attacks in other servers of this organisation and attacks by the same actors reported by the community.

The general outline of the report is as follows:

Executive Summary

Discovery and Vulnerability

Forensic Analysis

Infrastructure of the Attack

Timeline of the Attack on Nora

Indicators of Compromise

Response from the Community and Countermeasures

Related Attacks and Educational Environments

Conclusions 

References

Appendix A: Information on malware sample

Appendix B: YARA rules for miner detections

About CivilSphere

CivilSphere is a project born in the Czech Technical University (CTU) in Prague. The project is a spin off of the Stratosphere IPS laboratory, and it's dedicated to provide simple solutions for journalists, activists, and NGOs for detecting attacks in their devices using our network behavioural Intrusion Detection and Prevention System. We believe we can make a difference by putting our knowledge at service of those who need it the most and cannot afford complex and expensive solutions. 

[civilsphereproject]

Do you feel you may be at risk of a targeted attack because of the nature of your work? Get in touch. www.civilsphereproject.org