Wednesday, April 14, 2021

TorrentFreak's Latest News

 

Hackers Use Software Cracks and BitTorrent Client to Steal Cryptocurrency
Ernesto Van der Sar, 14 Apr 07:05 PM

DangerIt's no secret that scammers are constantly trying to trick people into downloading malicious content from pirate sites.

These files are generally easy to spot for seasoned pirates and they are often swiftly removed from well-moderated sites. However, for casual downloaders, malware can be a serious problem.

Novices are often directed to dubious portals where these threats are harder to avoid. That can lead to disastrous consequences. This isn't limited to annoying popups either, it can result in financial trouble as well.

Bitdefender Warns Against Malicious Cracks

This week, cybersecurity company Bitdefender reports that hackers are actively using software cracks to empty people's cryptocurrency wallets. The company discovered a series of malicious KMS activators for Office and Windows, as well as Adobe Photoshop cracks. These can completely compromise the victim's computer.

If these malicious cracks are executed, they drop a copy of the legitimate data transfer software "ncat.exe" that can be controlled by the hackers. This tool is used to transfer valuable data from the victim's computer through a TOR proxy.

Torrent Clients Exfiltrate Crypto Wallets

Interestingly, Bitdefender reports that the attackers also use BitTorrent clients to exfiltrate data. Bitdefender's director of threat research, Bogdan Botezatu, informs us that they discovered instances of the Transmission client that shared stolen data via torrents.

"Our monitoring shows that they are using the Transmission client to seed the information they want to exfiltrate. They create torrents with the data to be stolen, then use the client to seed that information through the network," Botezatu informs TorrentFreak.

The torrent clients are not essential but Bitdefender believes that they may be used to obfuscate the malicious traffic.

"While the attackers can directly exfiltrate data by simply zipping the files and sending them across the network, the BitTorrent avenue might help them bypass potential firewalls and blend the traffic into the peer-to-peer noise," Botezatu adds.

Hackers Install Transmission

It is worth noting that this doesn't mean that Transmission users are somehow more vulnerable. The research found that the hackers actively install the client, so it can happen on any system.

With the backdoor, the hackers have full access to the victims' computers. They use this to steal all sorts of valuable data, including Monero cryptocurrency wallets, if those are available.

The cybersecurity company believes that the malware isn't completely relying on automated requests. Instead, it is likely being controlled by a human operator who can change strategy based on individual situations.

Firefox Credentials and More

In addition to stealing cryptocurrency wallets, the security researchers also found that the hackers are going after Firefox browser profile data, which includes browsing history, credentials, and session cookies. This can then be exploited to do more damage.

These are just a few examples of what can be done. Since the attackers have pretty much full access the victims are vulnerable to all sorts of threats. This may vary based on what opportunities the hackers see.

"This list of actions is non-exhaustive, as attackers have complete control of the system and can adapt campaigns based on their current interests," Bitdefender warns.

Who's at Risk?

As we mentioned earlier, these types of malware-ridden cracks mostly affect people who download files from sites that have little or no moderation. This is confirmed by Bitdefender as well.

"These cracks are usually hosted on direct-download websites rather than on torrent portals, as the latter have a community that downvotes and flags malicious uploads," Botezatu says.

At the moment the malware-loaded cracks are most popular in North America and India. More technical details about the files and processes involved can be found in Bitdefender's full writeup.

From: TF, for the latest news on copyright battles, piracy and more.

Philippines Government & ISPs Reach Agreement to Rapidly Block Pirate Sites
Andy Maxwell, 14 Apr 11:25 AM

blockAlongside various initiatives to discourage Internet users from visiting pirate sites, including improved legitimate offerings, governments, rights holders and service providers are pressing ahead with their site blocking plans.

Broadly speaking, site blocking takes place under two regimes – court-ordered injunctions and voluntary arrangements between stakeholders. The former can prove effective but there are considerable costs involved and blocking doesn't always happen as swiftly as rightsholders would like. Voluntary arrangements, on the other hand, are less formal and have the advantage of being less adversarial, not to mention less expensive.

Philippines' Authorities and ISPs Reach Agreement

In common with most regions of the world, the Philippines has a problem with piracy but a new agreement announced this morning hopes to reduce the number of citizens being able to directly access pirate sites for their fix.

A joint announcement by the Intellectual Property Office of the Philippines (IPOPHL), the National Telecommunications Commission (NTC) and the country's internet service providers reveals that a voluntary agreement has been reached to block pirate sites in a streamlined and swift manner.

The proposal was tabled last week by IPOPHL Director General Rowel S. Barba during a focus group discussion attended by around 50 representatives from government agencies and ISPs, including Globe Telecom, Inc., Smart Communications, Inc., PLDT, Inc., Sky Cable Corp., Converge ICT Solutions Inc., and DITO Telecommunity Corp.

How the System Will Work

Via a memorandum of understanding, the parties have agreed to form an alliance that will define coordination protocols that will enable pirate sites to be quickly blocked following an official complaint of infringing activity. The system will work as follows:

In the first instance, rightsholders will present a complaint to IPOPHL which will work to assess the evidence and the need for action.

"The duration of IPOPHL's investigations will depend on the merits of the case and evidence submitted, but we always ensure a speedy and thoroughly validated decision," says IPOPHL's IP Rights Enforcement Office (IEO) Officer-in-Charge Director Ann N. Edillon.

Edillon says that the complaints validation process is a "fine-toothed comb" that aims to ensure that all evidence points to infringing activity before a blocking order is handed down. The requirements for blocking are yet to be published so at this stage the relevant thresholds are unclear.

When IPOPHL is satisfied that blocking is warranted it will hand down an order to the National Telecommunications Commission (NTC), the government body responsible for the supervision and control of all telecoms services, television and radio networks in the country, including ISPs.

Once received and validated by NTC, the blocking order will be distributed among the participating ISPs listed above, which will then go about the practicalities of blocking. At this point, the ISPs believe that blocking can be put in place within two hours but according to the government, further streamlining is not out of the question.

Reducing the Steps Before Blocking

The validation process carried out by NTC after receiving a blocking order from IPOPHL can reportedly take a few days, a delay that rightsholders would like to reduce.

The government says that some of the ISPs are willing to cut out the 'middle man' and take their blocking orders directly from IPOPHL. Others, on the other hand, say that this would require a new law that would formalize IPOPHL's authority to directly block pirate sites, without the involvement of NTC. Another scenario would see IPOPHL hand down a blocking order to NTC, which would immediately forward it to ISPs.

IPOPHL Signs MoU With Anti-Piracy Group AVIA

Earlier this week the IPOPHL announced the signing a memorandum of understanding with the Asia Video Industry Association (AVIA), an anti-piracy group responsible for protecting the interests of video and TV rightsholders in the region.

The MoU envisions cooperation on several fronts including the sharing of information to help prevent and reduce piracy in the Philippines, the development of piracy monitoring and site-blocking processes and their implementation, and assisting local authorities to build their anti-piracy expertise.

"I eagerly look forward to the work with AVIA in the months ahead," said IPOPHL Director General Rowel S. Barba during a virtual signing ceremony.

"Together, may IPOPHL and AVIA successfully stamp out the infringers and enable Filipino film and video producers, artists and contributors to wholly enjoy the rewards they deserve and to continue creating fresh original works for the benefit of society, culture and economy."

AVIA CEO Louis Boswell said that piracy is on the increase in the region and since hosts of pirated content are often outside the country, site blocking is the obvious solution.

"Site blocking is a responsible means of not allowing access to pirated sites. We have experience now in multiple markets all around the region that site blocking, where it is done properly, can be incredibly effective at reducing the levels of piracy in a market," Boswell said.

As part of the agreement, the IPOPHL has agreed to take action against pirates based on information provided by AVIA.

From: TF, for the latest news on copyright battles, piracy and more.

 
 
Powered by Mad Mimi®A GoDaddy® company

No comments: