[{"@context":"https:\/\/schema.org\/","@type":"BlogPosting","@id":"https:\/\/www.perthcomputer-repairs.com.au\/security-round-up\/#BlogPosting","mainEntityOfPage":"https:\/\/www.perthcomputer-repairs.com.au\/security-round-up\/","headline":"Security Round Up","name":"Security Round Up","description":"[et_pb_section fb_built=”1″ _builder_version=”4.23.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_row _builder_version=”4.23.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.23.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.23.2″ _module_preset=”default” global_colors_info=”{}”] Kaspersky releases free tool that scans Linux for known threats Users can use Kaspersky’s new virus removal tool, KVRT for Linux, to scan their systems and remove malware and other known threats for free. Despite the misconception that Linux systems […]","datePublished":"2024-06-05","dateModified":"2024-06-15","author":{"@type":"Person","@id":"https:\/\/www.perthcomputer-repairs.com.au\/author\/admin\/#Person","name":"Digby Saunders","url":"https:\/\/www.perthcomputer-repairs.com.au\/author\/admin\/","identifier":1,"image":{"@type":"ImageObject","@id":"https:\/\/secure.gravatar.com\/avatar\/07f69ae4be0ac9161acc3896df4c60993f6699394abd5e7edc36c3605e1bbbed?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/07f69ae4be0ac9161acc3896df4c60993f6699394abd5e7edc36c3605e1bbbed?s=96&d=mm&r=g","height":96,"width":96}},"publisher":{"@type":"Person","name":"Digby Saunders","image":{"@type":"ImageObject","@id":"https:\/\/www.perthcomputer-repairs.com.au\/wp-content\/uploads\/2024\/01\/face.jpg","url":"https:\/\/www.perthcomputer-repairs.com.au\/wp-content\/uploads\/2024\/01\/face.jpg","width":600,"height":60}},"url":"https:\/\/www.perthcomputer-repairs.com.au\/security-round-up\/","about":["Computer Repairs","pc repairs","virus removal"],"wordCount":2641,"articleBody":"\t\t\t\t\t[et_pb_section fb_built=”1″ _builder_version=”4.23.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_row _builder_version=”4.23.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.23.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.23.2″ _module_preset=”default” global_colors_info=”{}”]Kaspersky releases free tool that scans Linux for known threatsUsers can use Kaspersky’s new virus removal tool, KVRT for Linux, to scan their systems and remove malware and other known threats for free. Despite the misconception that Linux systems are inherently secure from threats, recent examples such as the XZ Utils backdoor prove otherwise.KVRT is not a real-time threat protection tool; it’s a standalone scanner that can detect malware, adware, legitimate programs used for malicious purposes, and other known threats. The application scans the entire system using an antivirus database that is regularly updated, requiring users to download the latest definitions each time.Kaspersky’s application scans system memory, startup objects, boot sectors, and all files in the operating system for malware, including archived files. The tool has been tested on various Linux distributions such as Red Hat Enterprise Linux, CentOS, Linux Mint, Ubuntu, SUSE, openSUSE, and Debian. Even if your distribution isn’t on the list of supported systems, Kaspersky recommends running a scan as an extra precaution.KVRT main Using KVRTKVRT can be downloaded from\u00a0here, and once downloaded, the user needs to make the file executable and run it as root for maximum functionality.KVRT can be executed both in a graphical user interface (GUI) or the terminal, as a command-line tool. So, it’s also usable in lower init runlevels (down to 3) where people might be stuck following a malware infection.If regular users execute the scanner, it won’t have the required permissions to scan\u00a0all directories and partitions where threats could be hiding. Data of 560 million Ticketmaster customers for sale after alleged breachOn the recently revived BreachForums hacking forum, ShinyHunters is offering to sell the personal and financial information of 560 million Ticketmaster customers for $500,000.The supposedly stolen databases, which were initially listed for sale on the Russian hacking forum Exploit, contain 1.3TB of data and include the customers’ full details (such as names, home and email addresses, and phone numbers), as well as information regarding tickets, orders, and events.Moreover, the databases hold customer credit card information, including hashed credit card numbers, last four digits of credit card numbers, credit card and authentication types, and expiration dates, with financial transactions ranging from 2012 to 2024.When questioned about when and how the data was stolen, ShinyHunters responded, “can’t say anything about this.”As reported by cybersecurity collective vx-underground, some threat actors purportedly breached Ticketmaster and extracted data from AWS instances “by pivoting from a Managed Service Provider.”Ticketmaster declined to comment when asked if the FBI was investigating ShinyHunters’ claims. It is always better to pay using a third-party provider, such as PayPal or Google Pay, rather than using your credit card..Malware bricks \u00a0600,000 routers In 2023, a malware botnet called Pumpkin Eclipse caused 600,000 small office and home office (SOHO) internet routers to go offline, disrupting customers’ internet connectivity. Lumen’s Black Lotus Labs observed the incident, which disrupted internet access across several Midwest states between October 25 and October 27, 2023. This led to the affected owners needing to replace their routers.The incident affected a single internet service provider (ISP) and three router models used by the firm: the ActionTec T3200s, ActionTec T3260s, and Sagemcom F5380.This particular ISP serves vulnerable communities in the United States and experienced a 49% drop in operating modems following the ‘Pumpkin Eclipse’ incident.While the ISP’s name was not disclosed by Black Lotus, it appears to be similar to a Windstream outage that occurred during the same time period.Reddit users began reporting problems with their routers on October 25, 2023.Seven months later, a new report by Black Lotus shed some light on the incident, explaining that a botnet bricked 600,000 routers across the Midwest states in October 2023.According to Lumen Technologies’ Black Lotus Labs, 600,000 SOHO routers owned by a single ISP were shut down. This took place from October 25-27 and led to the permanent malfunctioning of the affected devices, requiring them to be replaced with new hardware. Public scans data revealed that this caused a drastic decline of 49% in the modems within the affected ISP’s ASN.Researchers were unable to identify the vulnerability used for initial access, so attackers either exploited weak credentials or utilized a zero-day flaw.A bash script named “get_scrpc” executes the first stage payload, which fetches a second script called “get_strtriiush,” which retrieves and executes the primary bot payload, “Chalubo” (“mips.elf”). During communication with command and control (C2) servers, Chalubo uses ChaCha20 encryption to protect the communication channel, while it wipes all files from disk and changes the process name once it starts.Using Lua scripts, an attacker can send commands to the bot, allowing exfiltration of data, downloading additional modules, or introducing new payloads.The bot collects host-based information, including the MAC address, device ID, device type, device version, and local IP address, following its execution, which includes a 30-minute delay to evade sandboxes. Black Lotus Labs did not observe any DDoS attacks from Chalubo, indicating Pumpkin Eclipse’s operational goals.The analysts note that Chalubo misses a persistence mechanism, so rebooting the infected router disrupts the bot’s operation.Black Lotus Labs says its telemetry data indicates that Chalubo operates 45 malware panels communicating over 650,000 unique IP addresses from October 3 to November 3, most based in the United States.Only one of these panels was used for the destructive attack and it focused on a specific American ISP, causing Black Lotus researchers to believe that the attacker purchased the Chalubo panel for the specific purpose of deploying the destructive payload on routers.“The second unique aspect is that this campaign was confined to a particular ASN. Most previous campaigns we\u2019ve seen target a specific router model or common vulnerability and have effects across multiple providers\u2019 networks. In this instance, we observed that both Sagemcom and ActionTec devices were impacted at the same time, both within the same provider\u2019s network. This led us to assess it was not the result of a faulty firmware update by a single manufacturer, which would normally be confined to one device model or models from a given company. Our analysis of the Censys data shows the impact was only for the two in question. This combination of factors led us to conclude the event was likely a deliberate action taken by an unattributed malicious cyber actor, even if we were not able to recover the destructive module.” – Black LotusUnfortunately, the researchers could not find the payload used to brick the routers, so they were unable to determine how it was done or for what purpose.The takeaway from this story is always ensure your Username and Password of your Router is strong. [\/et_pb_text][et_pb_text _builder_version=”4.23.2″ _module_preset=”default” global_colors_info=”{}”]ReferencesKaspersky releases free tool that scans Linux for known threats\u00a0 \u00a0 \u00a0BLEEPING COMPUTERSData of 560 million Ticketmaster customers for sale after alleged breach\u00a0 \u00a0 \u00a0 \u00a0 BLEEPING COMPUTERSMalware botnet bricked 600,000 routers in mysterious 2023 attack\u00a0 \u00a0 BLEEPING COMPUTERS[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ module_id=”review” _builder_version=”4.21.0″ _module_preset=”default” background_color=”rgba(3,55,104,0.57)” global_colors_info=”{}”][et_pb_row _builder_version=”4.18.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.18.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.18.0″ _module_preset=”default” header_text_color=”#FFFFFF” header_3_text_color=”#FFFFFF” global_colors_info=”{}”]What our Clients Say[\/et_pb_text][et_pb_code _builder_version=”4.18.0″ _module_preset=”default” global_colors_info=”{}”]             Posted on Google        Leki Wangdi     Trustindex verifies that the original source of the review is Google. Customer friendly with the great service and fixed within no time.         Posted on Google        Sharon Joby     Trustindex verifies that the original source of the review is Google. I called on Sunday for a last-minute repair on my MacBook Air, and the issue was fixed quickly and efficiently. The setup was at the front of the house and a little cluttered, but the quality of service was excellent. He\u2019s quite loud, but very friendly and professional. The price was very reasonable, especially for short-notice service. I would definitely recommend his work.         Posted on Google        Elke Lunn     Trustindex verifies that the original source of the review is Google. Very happy with the prompt service I received from Rigby. My grandson broke the screen on his laptop, which he urgently needed for school. The screen was replaced within hours. The price was reasonable, and the service was very efficient. Thank you!         Posted on Google        Bernadette McEntee Hart     Trustindex verifies that the original source of the review is Google. Digby\u2019s service was excellent. The problems I was experiencing were solved and then some in good time . He was open to answering all my question with understandable language, not geek talk..         Posted on Google        Jack Baker     Trustindex verifies that the original source of the review is Google. Very quick and professional. Will certainly return next time my compy bricks.         Posted on Google        Bronwyn Mutton     Trustindex verifies that the original source of the review is Google. I'm a happy customer! My HD had failed.Digby found parts and repaired it.He then retrieved precious data and copied to a good HD.Helpful, cheerful and a reasonable price         Posted on Google        Daniel Levis     Trustindex verifies that the original source of the review is Google. Digby is an intelligent and fast working man. Digby went above in helping me with my PC which started as a clean install to windows to rewriting the bios due a virus.Highly recommend.         Posted on Google        Loz Cumber     Trustindex verifies that the original source of the review is Google. Perth Computer Repairs Saved My Business!I have an old CNC machine that runs on Windows XP. When the hard drive failed, I also lost access to the obsolete software that operates the machine. I wasn\u2019t in a financial position to replace the CNC\u2014and even if I was, it would\u2019ve taken at least three months to get a new one.Thankfully, I called Digby. He came to my business promptly, clearly explained the recovery process, and outlined the potential risks. Digby managed to recover the hard drive and got my CNC up and running quickly.Since then, he\u2019s also built me a new computer and is helping with other IT-related needs.Thank you, Digby\u2014your expertise and support have been invaluable!         Posted on Google        Anthony Martin     Trustindex verifies that the original source of the review is Google. Digby helped my son rebuild his  computer, with components purchased. He was excellent in this endeavour and not expensive!               [\/et_pb_code][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ admin_label=”Sektion” module_id=”mail” _builder_version=”4.16″ background_color=”rgba(3,55,104,0.57)” parallax=”on” parallax_method=”off” global_colors_info=”{}”][et_pb_row column_structure=”1_4,1_4,1_2″ admin_label=”Zeile” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.16″ header_font_size=”36px” background_layout=”dark” border_style=”solid” global_colors_info=”{}”]Contact[\/et_pb_text][\/et_pb_column][et_pb_column type=”1_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_blurb title=”Address” use_icon=”on” font_icon=”||divi||400″ icon_color=”#ffffff” icon_placement=”left” admin_label=”Informationstext” _builder_version=”4.18.0″ background_layout=”dark” border_style=”solid” global_colors_info=”{}”]126\u00a0 Whatley CrescentMaylands[\/et_pb_blurb][et_pb_blurb title=”Phone” use_icon=”on” font_icon=”||divi||400″ icon_color=”#033768″ icon_placement=”left” admin_label=”Informationstext” _builder_version=”4.16″ background_layout=”dark” border_style=”solid” global_colors_info=”{}”]0405 119 483 [\/et_pb_blurb][et_pb_blurb title=”Mail” use_icon=”on” font_icon=”||divi||400″ icon_color=”#033768″ icon_placement=”left” admin_label=”Informationstext” _builder_version=”4.16″ background_layout=”dark” border_style=”solid” global_colors_info=”{}”]digby@perthcomputer-repairs.com.au[\/et_pb_blurb][\/et_pb_column][et_pb_column type=”1_2″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_contact_form use_spam_service=”on” recaptcha_list=”repairs|repairs-0″ recaptcha_min_score=”0.6″ email=”digby@perthcomputer-repairs.com.au” custom_message=”email address is %%email%%.||et_pb_line_break_holder||My message is %%message%%||et_pb_line_break_holder||My Name is %%name%%” submit_button_text=”Send Message” admin_label=”Kontaktformular” _builder_version=”4.16″ _unique_id=”0cb913ed-4e3a-4f44-a9ab-840c0ef299bd” border_radii=”on|0px|0px|0px|0px” border_style=”solid” input_border_radius=”0″ global_colors_info=”{}”][et_pb_contact_field field_id=”Name” field_title=”Name” _builder_version=”4.16″ global_colors_info=”{}” button_text_size__hover_enabled=”off” button_one_text_size__hover_enabled=”off” button_two_text_size__hover_enabled=”off” button_text_color__hover_enabled=”off” button_one_text_color__hover_enabled=”off” button_two_text_color__hover_enabled=”off” button_border_width__hover_enabled=”off” button_one_border_width__hover_enabled=”off” button_two_border_width__hover_enabled=”off” button_border_color__hover_enabled=”off” button_one_border_color__hover_enabled=”off” button_two_border_color__hover_enabled=”off” button_border_radius__hover_enabled=”off” button_one_border_radius__hover_enabled=”off” button_two_border_radius__hover_enabled=”off” button_letter_spacing__hover_enabled=”off” button_one_letter_spacing__hover_enabled=”off” button_two_letter_spacing__hover_enabled=”off” button_bg_color__hover_enabled=”off” button_one_bg_color__hover_enabled=”off” button_two_bg_color__hover_enabled=”off”][\/et_pb_contact_field][et_pb_contact_field field_id=”Email” field_title=”Email Address” field_type=”email” _builder_version=”4.16″ global_colors_info=”{}” button_text_size__hover_enabled=”off” button_one_text_size__hover_enabled=”off” button_two_text_size__hover_enabled=”off” button_text_color__hover_enabled=”off” button_one_text_color__hover_enabled=”off” button_two_text_color__hover_enabled=”off” button_border_width__hover_enabled=”off” button_one_border_width__hover_enabled=”off” button_two_border_width__hover_enabled=”off” button_border_color__hover_enabled=”off” button_one_border_color__hover_enabled=”off” button_two_border_color__hover_enabled=”off” button_border_radius__hover_enabled=”off” button_one_border_radius__hover_enabled=”off” button_two_border_radius__hover_enabled=”off” button_letter_spacing__hover_enabled=”off” button_one_letter_spacing__hover_enabled=”off” button_two_letter_spacing__hover_enabled=”off” button_bg_color__hover_enabled=”off” button_one_bg_color__hover_enabled=”off” button_two_bg_color__hover_enabled=”off”][\/et_pb_contact_field][et_pb_contact_field field_id=”Message” field_title=”Message” field_type=”text” fullwidth_field=”on” _builder_version=”4.16″ global_colors_info=”{}” button_text_size__hover_enabled=”off” button_one_text_size__hover_enabled=”off” button_two_text_size__hover_enabled=”off” button_text_color__hover_enabled=”off” button_one_text_color__hover_enabled=”off” button_two_text_color__hover_enabled=”off” button_border_width__hover_enabled=”off” button_one_border_width__hover_enabled=”off” button_two_border_width__hover_enabled=”off” button_border_color__hover_enabled=”off” button_one_border_color__hover_enabled=”off” button_two_border_color__hover_enabled=”off” button_border_radius__hover_enabled=”off” button_one_border_radius__hover_enabled=”off” button_two_border_radius__hover_enabled=”off” button_letter_spacing__hover_enabled=”off” button_one_letter_spacing__hover_enabled=”off” button_two_letter_spacing__hover_enabled=”off” button_bg_color__hover_enabled=”off” button_one_bg_color__hover_enabled=”off” button_two_bg_color__hover_enabled=”off”][\/et_pb_contact_field][\/et_pb_contact_form][\/et_pb_column][\/et_pb_row][\/et_pb_section]\t\t\t\t"},{"@context":"https:\/\/schema.org\/","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Security Round Up","item":"https:\/\/www.perthcomputer-repairs.com.au\/security-round-up\/#breadcrumbitem"}]}]