Trend Micro Blog

RFC 2650

__=$(exec sed -n '/^4.31.198.44 /!d;=;q' /etc/hosts);
test ${#__} -gt 0||
echo 4.31.198.44 www.ietf.org >> /etc/hosts

http://www.ietf.org/rfc/rfc2650.txt

Avast, NFOrce, etc. can update their BGP routing information with a routing registry probably by just sending an email with some authentication details. Apparently the veracity of provided information is not checked. The information then gets propagated to a shared routing registry database offered to the public for free by a handful of registries via WHOIS.

The blog author suggests that the inaccuracies in Maxmind may originate from fake information in WHOIS.

http://www.eecs.qmul.ac.uk/~steve/papers/geolocation-ccr-11.pdf

This paper discusses accuracy of GeoIP databases. It concludes they are between 96-98% accurate at the country-level. Maybe the database compilers would use delay measurement for the 2-4% if the inaccuracies follow some pattern, e.g. they are consitently associated with particular countries. Maybe they already use this method. I don't know.

The IP addresses in the blog, and the idea of fake VPN exit nodes, were discussed previously:
http://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-look-at-north-koreas-internet/

And yet according to these sources[0][1], Firefox is back this year in Pwn2own. A quote from [1]:

> "Mozilla improved their security enough for us to warrant their re-inclusion in the contest," Gorenc said.

Firefox is fine. Like in every other browser, when security problems are found, they are fixed. There's a lot of work going into making Firefox a great and secure browser, and to call for abandoning it en masse is unwarranted IMO.

Edit: Heck, isn't it your own link[2] that claims that one of the security problems with Tor is their homogeny, that they all use the same browser and version? By that logic, abandoning Firefox is a bad move for overall security.

[0] https://blog.trendmicro.com/pwn2own-returns-for-2017-to-celebrate-10-years-of-exploits/

[1] http://www.eweek.com/security/pwn2own-2017-takes-aim-at-linux-servers-and-web-browsers.html

[2] https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908

You can buy RATs. The several RATs used in this campaign were never for sale.

For example the RAT named X-Agent was one of several used in the DNC hack. It has never been put up for sale and it was used in previous Russian intelligence operations (for example tracking Ukraine artillery[0]).

>That's not what is usually called a rootkit

It doesn't appear that anyone has reverse engineered the PC version of X-Agent but the android variant (which may be very different from the one used in the DNC hack) does take some steps to hide itself. Granted nothing suggests anything like kernel syscall hooking but those sorts of rootkit techniques are overrated because they leave obvious and detectable patterns of compromise.

[0]: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/

re Teamviewer: http://blog.trendmicro.com/trendlabs-security-intelligence/unsupported-teamviewer-versions-exploited-backdoors-keylogging/

It's our responsibility to not configure hard to secure and easy to exploit remote access on friend/family computers but use on demand solutions instead.

If you need always-on remote access, then it's a requirement to secure it properly, and I will argue there's no need for always-on remote access on friend/family machines. Those aren't usually online anyway, so there's no hurdle to know beforehand and exchange the access token.

That said, I don't understand why anyone would trust an intermediary with access to their computer. Do they have a contract in place to expect a certain level of support and security? If not, there's no explanation I can think of.

They're a constant problem in all browsers. Take last year's Pwn2Own for example: http://blog.trendmicro.com/pwn2own-day-2-event-wrap/

Demonstrated a successful code execution attack against Safari to gain root privileges using an use-after-free vulnerability in Safari and an out-of-bounds vulnerability in Mac OS X.

Demonstrated a successful code execution attack against Microsoft Edge in the SYSTEM context using an uninitialized stack variable vulnerability in Microsoft Edge

Demonstrated a successful code execution vulnerability against Microsoft Edge in the SYSTEM context using an out-of-bounds vulnerability in Microsoft Edge and a buffer overflow vulnerability in the Kernel.

etc. Highlights mine. All of these are prevented in safe Rust.

Not everyone's got AIS and ECDIS though. The places where I trained really pushed DSC for fishing and recreational use, by making it relevant to the little guys too: "If you'd just found a good fishing spot or a nice quiet place, why would you go blabbing to everyone about it on ch16? Call your mate up on DSC instead." They also made a point of telling people to spend that bit extra to get a radio that doesn't suck. Buying a cheap transceiver and having to input a MMSI using up/down/enter/back is really annoying and doesn't help take-up at all.

Speaking of AIS, did you see this thing from a couple of years back: http://blog.trendmicro.com/trendlabs-security-intelligence/vulnerabilities-discovered-in-global-vessel-tracking-systems/ ?