I deactivated my Facebook account

After many years as a Facebook user yesterday I deactivated my Facebook account. I also deleted my Instagram, but in fact I never used it. The people at Twitter had blocked my Twitter account, so now if you want to talk to me you have to send me an email or call me on the phone 🙂

I know it’s not a big deal, but several friends have been asking me why in the last few hours, so I decided to share this why here, where I can write freely.

I’ve always had a fairly active social life on Facebook, I liked sharing what I was doing and participating in what my friends were sharing. But my passion for social media passed when I realized that social media has become mainly a tool for revenge. Whoever has to say something stupid says it on social media. The real environment in which we live protects and regulates us, no one can say too much bullshit without being reprimanded. Social media, on the other hand, has become the megaphone of morons in too many cases.

Last month I tried deleting the app from my smartphone. It worked well, the usage time was reduced and it didn’t cost me any effort. Finally I could spend more time on the toilet with Nova Lectio.
The notification mechanism is evil, it needs to be managed, especially for young people who grew up with it and are convinced that it’s normal to always be available to others and, even worse, to a program that tries to sell you stuff or, even worse, to sell you to others.

After what happened in Romania, where a civilized state defended itself from a rigged outcome via social media. After seeing how the American government views Europe (and I am happy to be European). After seeing the support that social media gives to characters that I consider embarrassing for the human species. After all this, I thought it was better to take a step back.

I will continue to use LinkedIn because so far “mom Microsoft” is doing a great job and it seems to me that it continues to be a place where one can be at peace.

I’ve never kissed anyone’s ass, and I certainly won’t do it through someone else.

Business breakfast with fraud

Looking at what ends up in the Matrix network I noticed a kit that targets Kraken customers.

As usual, the victim is frightened with an alleged compromise of their account.

The interesting aspect of this kit is that instead of asking the victim to enter their wallet details, the application suggests the victim to schedule a phone meeting. The user is asked to leave their phone number and is even provided with an .ics file with the appointment details, so that the victim remembers not to make other commitments 😀

The user data is sent to a Telegram bot as usual.

Looking for updates received from bots we find several messages waiting to be read by the fraudster. Since the domain where we found the kit does not yet have the kit online, it means that there are other sites with the kit already in operation.

Searching Elastic for domains with “kraken” in their names that are managed by the same DNS server (dnspod.com) brought up several other domains including kraken-centre.com which of course has the kit already online.

Why aren’t criminals’ email accounts closed?

Free time is less and less, nevertheless I try to dedicate at least a couple of hours every week to the analysis of the Matrix evidence. I dedicate some time to the analysis of phishing kits and to the sharing of the email and Telegram token indicators on my public ioc repo: https://github.com/ecarlesi/ioc.git

From this analysis a spontaneous question arises: why do the same accounts continue to be active over time? Does no one notice that they are being used for illicit purposes?

The obvious answer might be that Telegram is based in Dubai, founded by a Russian, maybe preventing or mitigating fraud is not at the forefront of their minds. Maybe. Let’s say the same goes for Yandex, they are Russian. Maybe. What I don’t understand though is why they don’t block Gmail and Yahoo accounts either, just to name two non-Russian companies.

Let’s take the segdairo as gmail dot com account for example. I personally found it in 5 different attacks, the first one dating back to May 13, 2024.

Later I found it in other kits within which I identified other indicators:

  • hxxps://digitalbankingsonoraweb[.]online/verify/SONORA%20CU.zip contains the Telegram token 5453712056:AAE5M0Nnbcm0eanesMhIV62mNU_WgM20A6c
  • hxxps://dlgitaldove88system[.]online/FIRST%20FIFELITY%20BANK.zip contains the Telegram token 7223951606:AAHTkeSZ1UFauExPuwkzK_wfORFsldNFbnA
  • hxxps://digitalconnectfirstnow[.]online/FIRST%20UNITED%20BANK.zip contains the email account hakekelly07 at gmail dot com and the Telegram token 7103172103:AAFibon0scauwaJ6gnsY3vBfQ7e13IST9QY
  • hxxps://online-ctricbonline[.]cfd/cancel/login%20(1).zip contains the Telegram token 6318747656:AAFlcQchhlCb9DNkfpXvCEKXhSr0yINXgQc
  • hxxps://dashboardverfedconnect[.]online/VERMONT%20FCU.zip contains the Telegram token 7482950914:AAEupDhXYLKY_vvZHvwiCdgG_A2y4W5Jgn8

Not understanding why email accounts aren’t blocked even when they are clearly involved in illicit activities, I tried to understand how to report a criminal email account. Searching on the internet I found some instructions from Google that talk about how to report an email received. However, I did not find how to report an email involved in illicit activities without having received any email from it in my Gmail account. I also found directions regarding Google Workspace accounts, which are very convenient, but this is not the case.

I finally found a link to the Internet Crime Complaint Center (ic3[.]gov). There is a form to report the event. It is now dinner time, given the length of the form, maybe I will do it after dinner.

Here I found something interesting: the Government explains how to recognize a legitimate Government domain, there is “.gov” and the padlock that indicates the use of https…

I would say not very well since every day there are thousands of new domains that meet these requirements 😀

Phishing against Kraken

At the end of a pretty busy day, I finally found a few minutes to check out the incoming notifications from Matrix. I noticed a kit that targets Kraken customers because their icon reminds me of the ghost from Pacman, and just today I got the vintage Pacman console 🙂

The domain used for the attack is krakeeen[.]top. It was registered three days ago and Matrix keep the monitoring active waiting for the kit. It arrives some hours ago. Thanks attacker 🙂

At the moment the only reports on this matter are those made by Matrix.

As usual, the kit is PHP based.

Every now and then someone tells me that my posts seem like I don’t love it! That’s not true, I really like PHP and often the code is badly written and therefore sucks.

I love PHP and its community!!!!!

As for the stolen credentials, the kit requires that they be sent to the email address hardeyholar47@gmail[.]com.

Of course I added it to the list that I hope you already know 🙂

Attack against Correios

This morning I came across a kit aimed at Brazilian taxpayers. The domain used for the attack is consultarencomeda[.]online

The attack is currently in its initial phase, the domain was registered a few hours ago and the kit was copied to the hosting. Matrix intercepted these two activities, analyzed the archive containing the kit and sent the notification to Urlscan. To date, no one reports this site as malicious.

The default page of the kit mimics a Hostinger landing page in an attempt to block crawlers.

Opening the kit we discover how it works. At the base there is always the attempt to put pressure on the user, here the payment of a fee is demanded.

Without wasting time on how the kit works, as always it is poorly written PHP code, I highlight the channels that are used for payment and sending notifications to the customer.

The transaction takes place through a service provided by the domain codetech-payment-fanpass[.]rancher[.]codefabrik[.]dev

This service has no internet presence, is not advertised nor have I been able to figure out who it is associated with.

Sending notifications is implemented by pushcut[.]io, of course this is a legitimate service and the presence of a key in the kit, I hope it can help the company to identify the abuse.

My thoughts on gun ownership

I have always been opposed to private citizens owning weapons. It seems to me to be a surrender by society, which, unable to guarantee security, subcontracts it to individuals. In Europe, the use of force is the exclusive prerogative of the state. I consider this a great achievement of civilization. Not least because it is based on the principle that personal freedom begins where that of others ends. My freedom cannot be total because it would end up limiting that of others.

Let me explain it for dummies: I can’t play with uranium in my house because the radiation would be harmful to my neighbors.
Do I have the right to keep radioactive material at home? No.
Does this limit my freedom? Yes.
Is this a problem? No, damn it!

At this point, a Trump supporter might argue that if someone is a criminal, they could also use a knife to kill, or a car, or a lot of other things. This reasoning is specious because firearms are designed for the sole purpose of killing, unlike knives and cars.

Another source of malware

One of the features of Matrix is ​​monitoring on some resources that are detected as suspicious. This monitoring is useful to identify threats like this one I am writing about. An hour ago Matrix reported the site file-share-transfer[.]com as “opendir”, this is because there was no content inside.

A few minutes ago however the component that monitors the resources already detected, notified an update. Matrix then ran a scan again and detected an active threat.

The site presents itself as a classic file remote drive that requires you to open a document. By clicking on the button, your local file browser (explorer or finder) opens, showing a well-presented artifact that is not very clear for an inexperienced user, interface.

At first glance, in fact, you might think that the document presented is a local document, while in fact it is a link to a well-disguised remote file.

By proceeding, a link file is downloaded locally that references a malware that is downloaded from Alibaba’s cloud.

This attack is done fairly well, nothing particularly advanced but overall it is very fluid and credible. Performed towards a reality with little expertise it certainly has a good chance of success.

This leads us to understand how it is necessary to improve security at the infrastructure level because an attack like this will hardly be discovered by an average user. In my opinion, a more stringent sandbox on the browser and a more precise analysis would be necessary. My Chrome during this analysis did not highlight anything, the same for Defender. There is still a lot of work to do to make everyone safe.

Script kiddie in action

Today I was analyzing some Matrix collected phishing kits and this struck me.

First of all for the continuous duplication of code, there are ten files with practically the same code with minor changes, he could have made a function… but unfortunately he is an idiot and so I come to the climax of the matter: the copyright on a redirect.

Also done badly because the variable is useless.

Such incompetent people are forced to steal because no one would give them a job in IT 😀

PostNL phishing kit (with video tutorial)

I recently came across this kit that targets PostNL customers.

The kit is currently still online.

Technically it’s not that great, the usual crap written badly in PHP; what I found funny was the “license”.

Пользовательское соглашение:

  • Блокировка на все RU машины (RU header).
  • Продукт поставляется “как есть”, функционал в описании к продукту.
  • Автор не несет ответственности за ваши законные/противозаконные действия, в результате которых был приченен вред какому-либо лицу.
  • Продукт несет в себе исключительно ознакомительный характер и предназначается для изучения и тестирования собственной защиты.
  • Покупатель обязуется не использовать продукт на RU машинах.
  • Покупатель приобретает продукт лично, поддержка оказывается только контакту с которого была оплата.
  • Запрещено выкладывать в публичный доступ файлы продукта и админки, это повлечет блокировку лицензии владельца.

User Agreement:

  • Block on all RU of the machine (RU header).
  • Product is delivered “as is,” the functionality in the product description.
  • Author is not responsible for your lawful/unlawful actions resulting in harm to any person.
  • Product is exclusively exploratory in nature and is intended to study and test its own protection.
  • Buyer undertakes not to use the product on RU machines.
  • Buyer purchases the product in person, which is supported only by the contact from whom the payment was made.
  • It is forbidden to upload product and admin files to public access, this will lead to the blocking of the owner’s license.

The video explaining how to install it is also very useful.

Whois info below

Domain Name: HELPDESK-TEST.ONLINE
Registry Domain ID: D479803092-CNIC
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: https://namecheap.com
Updated Date: 2024-08-20T07:52:01.0Z
Creation Date: 2024-08-20T07:51:58.0Z
Registry Expiry Date: 2025-08-20T23:59:59.0Z
Registrar: Namecheap
Registrar IANA ID: 1068
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: addPeriod https://icann.org/epp#addPeriod
Registrant Organization: Privacy service provided by Withheld for Privacy ehf
Registrant State/Province: Capital Region
Registrant Country: IS
Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
Admin Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
Tech Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
Name Server: DNS1.NAMECHEAPHOSTING.COM
Name Server: DNS2.NAMECHEAPHOSTING.COM
DNSSEC: unsigned
Billing Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
Registrar Abuse Contact Email: abuse@namecheap.com
Registrar Abuse Contact Phone: +1.9854014545
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of WHOIS database: 2024-08-21T10:14:38.0Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

>>> IMPORTANT INFORMATION ABOUT THE DEPLOYMENT OF RDAP: please visit
https://www.centralnicregistry.com/support/rdap <<<

The Whois and RDAP services are provided by CentralNic, and contain
information pertaining to Internet domain names registered by our
our customers. By using this service you are agreeing (1) not to use any
information presented here for any purpose other than determining
ownership of domain names, (2) not to store or reproduce this data in
any way, (3) not to use any high-volume, automated, electronic processes
to obtain data from this service. Abuse of this service is monitored and
actions in contravention of these terms will result in being permanently
blacklisted. All data is (c) CentralNic Ltd (https://www.centralnicregistry.com)

Access to the Whois and RDAP services is rate limited. For more
information, visit https://registrar-console.centralnicregistry.com/pub/whois_guidance.

The domain was registered a few hours ago at Namecheap and in the tutorial we use Namecheap as the hosting platform for the content.