Hong Kong Security Watch Report (Q4 2022)

HKCERT is pleased to bring to you the "Hong Kong Security Watch Report" for the fourth quarter of 2022.

Major Botnet Families in Hong Kong Network

 

Conficker	207	-7.2%
Nymaim	165	-48.1%
Conficker	120	+421.7%
Tinba	116	-64.8%
Bankpatch	105	+54.4%
VPNFilter	37	-15.9%
Sality	22	-88.5%
Cozi	23	+14.3%

* Individual botnet’s size is calculated from the maximum of the daily counts of unique IP address attempting to connect to the botnet in the reporting period. In other words, the real botnet size should be larger because not all bots are activated on the same day.

Phishing Events Exceed 10,000! Public Must Be More Vigilant on Deception

Recently, the artificial intelligence (AI) ChatBot, ChatGPT, has taken the Internet by storm. It is reported that the tool already has 100 million users. Most users say that compared with the traditional search engines which only rely on input queries to provide websites of highly relevance, ChatGPT allows users to ask questions in the format of a person-to-person dialogue and then output responses. In addition, the generated answers are very accurate with detailed explanations, saving the time to search for information after using search engines.

While its developer, OpenAI, says the current free ChatGPT is still in research preview, its popularity marks a major success in bringing AI and machine learning technology to the masses. Recently, major information technology companies have announced plans to integrate AI into their online services: for example, Microsoft will integrate AI technology more powerful than ChatGPT with Bing search engine and Edge browsers; another search engine giant Google will also incorporate its conversational AI service Bard in its products in the coming weeks. It can be seen that, in the near future, more AI technologies will be integrated into different online services and become more involved in our daily lives.

The wide applicability of AI, on the one hand, has made work or life more time-saving and convenient. For example, some people have used ChatGPT to write programmes and articles faster and less error-prone, and the content of the articles generated is also rich and well-organised; but on the other hand, there have also been criminals who used ChatGPT to create phishing email content and even write malware. Although the system developer has added a security mechanism to prohibit the generation of malicious content, cyber criminals have developed evasion methods and sold them as a Crime-as-a-Service (CaaS). Therefore, the potential security issues cannot be ignored.

At the latest annual information security outlook briefing held in February 2023, HKCERT also predicted that attacks utilising AI and CaaS will be among the five major security risks in 2023. It even listed various possible scenarios of how criminals use AI to attack. On top the above-mentioned examples, AI fraud and poisoning of AI models are also included. In summary, risks involving AI are as follows:

• Data privacy and confidentiality: AI requires vast amounts of data for training, which can include sensitive information such as personal details, financial information and medical records. This may raise privacy concerns, as AI models may be able to access and generate sensitive information.
• Misinformation: AI may insert false or misleading information in order to produce coherent and smooth results. Users rely on such information without verification may be at risk of being convinced the misinformation. In addition, the accuracy of the message will also be affected by the training data it receives. For example, the training data of ChatGPT only goes up to 2021, so when asked about the most recent World Cup champion, it will answer France (2018 champion), not Argentina (2022 champion). Other examples of misinformation include a Google ad promoting its ChatBot Bard, which was found to contain misinformation in an answer to a question about the “James Webb Space Telescope.”

• Bias issues: AI training data may come from the Internet, some of its information may contain biases and discriminatory elements. This can lead to AI models producing biased and discriminatory responses. In addition, criminals can also use biased data to train AI models to generate malicious responses. This method is called Adversarial Perturbation.
• Copyright issues: It is important to consider the rights of third parties, for example, owners of any copyrighted material that may be involved in responses output by ChatGPT. Violation of the rights of others, including unauthorised use of their copyrighted material, may result in legal liability. Therefore, when using ChatGPT, please consider and respect the intellectual property rights of its developers and others, and ensure any use of ChatGPT responses complies with laws and regulations.

Actually, AI is a neutral tool and there is no right or wrong in itself. Just like when ChatGPT is asked if it has security risks, its final response is “However, it is important for users and developers to be aware of these security concerns and take appropriate measures to mitigate them.”  The ultimate responsibility must lie with the users. Finally, when using AI, please maintain a mentality of checking everything and verify facts from various sources.

Local photo printing chain, Fotomax, fell victim to a ransomware attack and malicious encryption of its database in October last year, resulting in the leakage of over 600,000 customer data, including name, gender, date of birth, phone number, email address, contact address and delivery address. The Office of the Privacy Commissioner for Personal Data recently published an investigation report into the incident which found the company to be in breach of the Personal Data (Privacy) Ordinance, thereby issuing an Enforcement Notice to Fotomax, directing it to remedy and prevent recurrence of the contravention.

The incident reflects the importance of maintaining  system security all the time. When learnt of potential threats, appropriate follow-up actions must be taken immediately, and any threats should never be treated lightly. Hence, system administrators should pay attention to the following advice to enhance system security:

1. To keep software, operating system, and anti-virus up-to-date and install security patches regularly, especially for systems exposed to the Internet (e.g., firewalls, VPN servers, etc.).
2. Avoid using end-of-life products.
3. Enable multi-factor authentication to protect network and system accounts.
4. Refer to HKCERT’s Incident Response Guidelines for SMEs to establish and review security incident response plan.
5. Refer to the concept of zero trust and network segmentation to reduce the attack surface and the scope of affected network.
6. Back up all critical data, at least one local backup and one remote backup.
7. Encrypt all sensitive data.

Also, as the incident involves leakage of personal data, HKCERT believes that the data will be or has already been used for phishing attacks and scam incidents. The public is advised to pay extra attention to suspicious emails and calls. HKCERT also reminds enterprises and users:
 

1. To pay attention to the spelling of the URL, carefully check for errors or suspicious elements, and verify the authenticity of the website.
2. Not to assume that websites using the HTTPS protocol must be authentic and credible websites, and phishing websites can also use the HTTPS protocol.
3. Not to open any links or attachments at will and think twice before providing personal information.
4. To confirm the identity of the sender and the content before opening attachments and links in emails or instant messages;
5. To regularly update the login password and enable multi-factor authentication for each account.

In addition, if the public has doubts about the phone number, email address, website URL and IP address, they can use the “Scameter” (https://cyberdefender.hk/en-us/scameter/) by CyberDefender to check whether they are frauds/online pitfalls or not.
 

For more details, please refer to:
https://www.hkcert.org/blog/always-keep-system-security-up-to-date-to-prevent-customer-data-from-becoming-phishing-feeds

According to Israeli cyber security solution provider Check Point’s “Global Threat Impact Index” monthly report published in early November, it was reported that AgentTesla continued to be one of the “Most Wanted Malwares” in the world, affecting over 7% of enterprises. In this regard, HKCERT collected a sample of AgentTesla to analyse its attack vector and operations. Security advice is also offered to help the public to protect against the threat.

Investigate the Malicious Email Attachment

Hackers usually send phishing emails to lure victims to download and execute the malware. In the collected sample, hackers used an email attachment named "PRE SHIPPING NOTICE.zip" to try to guide victims to download and open it.

After downloading and opening the “PRE SHIPPING NOTICE.zip” file, a file named “PRE SHIPPING NOTICE.exe” was extracted.

To check on VirusTotal website, a SHA256 hash value of the file is required. The PowerShell cmdlet Get-FileHash was executed to get the hash value of “PRE SHIPPING NOTICE.exe” which was uploaded to the VirusTotal.

In the VirusTotal search result, 51 cyber security companies can identify the file as malware and AgentTesla.

# Search conducted on 24 November 2022

Analysing “PRE SHIPPING NOTICE.exe”

It is determined the file “PRE SHIPPING NOTICE.exe” is an executable file developed by VB.NET.  Also, it is noted that no software packing technique is applied to the file.

What is Software Packing?

Software packing is a method of compressing or encrypting an executable. Packing an executable will change the file signature in an attempt to avoid signature-based detection.

Once the programming language used was determined, reverse engineering technique was applied to get the code of “PRE SHIPPING NOTICE.exe”. A part of the code of “PRE SHIPPING NOTICE.exe” has shown that AgentTesla is using Windows ntdll.dll to inject the payload.

 
After the payload had been executed, the behaviour detection of AgentTesla on the victim computer showed that it will steal the computer setting, credentials of system and browsers.

Further deep dive into the stolen data using YARA malware research and detection tool found that it included mail profile setting (e.g. thunderbird, incredimail, MS Outlook), remote server credentials (e.g. WinSCP, FileZilla) and the login password stored in browsers (e.g. Firefox, Chrome)

AgentTesla would transfer the stolen data via Telegram API to the hacker’s Telegram account.

Security Advice

Malicious email is one of the spreading channels of AgentTesla. Moreover, different variants of AgentTesla have already appeared on the Internet. Hence, HKCERT recommends users to:

1. Always keep the system, software, and antivirus software up to date
2.  Do not open unknown files, web pages and emails
3. Confirm the legitimacy of sender and the content of the email before opening the attachments and links in the email,
4. Check the file extension to avoid being misled by the file name. Do not open any executable file or Microsoft Office files with macros obtained from unknown source.
   1. Executable file extension: .exe, .vbs, .js, .bat, msi, .ps, psc1, .cmd, .wsf, .jar, .reg, etc.
   2. Microsoft Office files with macros can be contained in all kinds of Office files (e.g. .doc/.docm, .xls/.xlsm, .ppt/.pptm). Users are advised to disable all macros from auto-run in the security settings.
5. Use password management tools to manage the passwords instead of storing them on browsers.
6. Use lower privileged accounts for daily use instead of system administrator accounts.
7. Set up "multi-factor authentication" (MFA) to enhance the account security.

For more details, please refer to:
https://www.hkcert.org/blog/analysing-agenttesla-spyware

-End-

Download Report

< Please click to download Hong Kong Security Watch Report>