Law enforcement agencies from the US, Canada and Europe, including the UK, have joined forces to target suppliers and buyers of illegal goods on dark web marketplaces and warn buyers of risks

nternational law enforcement agencies made 61 arrests and shut down 50 dark web accounts used for illegal activity in a joint operation, Europol has announced.

As a result of 65 search warrants, police were able to seize nearly 300kg of drugs, 51 firearms and more than €6.2m, including almost €4m in cryptocurrency.

By coordinating efforts and acting simultaneously, Europol said a strong signal has been sent to those active in selling and buying goods on the dark web that they can still be tracked down by police.

While the dark web is accessible only through special software such as the Tor browser and provides a safe environment for personal privacy and freedom, Europol said it is also a “fertile environment” for criminals and individual illegal activities.

“Investigating these illegal activities online has become a priority for law enforcement all over the world. While you may have a higher level of anonymity on the dark web, you still have an identity; dark web applications are not an invisibility cloak or an immunity vaccine against the law,” Europol said.

Europol’s executive director, Catherine De Bolle, said the dark web is not as dark as many users think. “When you buy or sell illegal goods online, you are not hidden from law enforcement and you are putting yourself in danger,” she said.

“This international coordinated approach demonstrates law enforcement’s determination to tackle crime on the dark web and to reduce the number of people who fall victim to criminals selling life endangering products or scamming them for their own gain.”

Europol warned that the risks are higher for anyone who uses the dark web to buy illegal goods anonymously, because anyone carrying out transactions on the dark web exposes their sensitive data to scammers who are only after money and personal details.

In addition, Europol said activity on the dark web exposes users’ devices to some of the most damaging malware around and exposes buyers to potential losses due to the non-delivery of goods as well as harm from lethal drugs, malfunctioning weapons and cyber crime services that work against the buyers.

UC Browser and UC Browser Mini Android apps violate Google Play Store policies by downloading and installing extra app modules thereby exposing its users to MitM attacks.
This updating feature is present in the UC browser application since 2016.
What is the issue – UC Browser and UC Browser Mini Android apps violate Google Play Store policies by downloading and installing extra app modules thereby exposing its users to Man in the Middle (MitM) attacks.

Why it matters – It is to be noted that UC browser has been downloaded by over 500 million users.

The big picture

Doctor Web malware analysts uncovered a feature in UC browser that downloads extra app modules and runs executable codes on users’ devices. The researchers noted UC browser has the ability to download auxiliary software modules, bypassing Google Play servers.

Researchers described that in their analysis, UC Browser downloaded an executable Linux library from a remote server.
Upon downloading, the UC browser saved the Linux library to its directory and launched it for execution.
Worth noting

This updating feature is present in the UC browser application since 2016.
This feature can be exploited by attackers to perform Man in the Middle (MitM) attacks.
MitM attacks help attackers to leverage UC Browser and distribute malicious plug-ins.
“Although the application has not been seen distributing trojans or unwanted software, its ability to load and launch new and unverified modules poses a potential threat. It’s impossible to be sure that cybercriminals will never get ahold of the browser developer’s servers or use the update feature to infect hundreds of millions of Android devices,” researchers said.

How would an attack work?

UC Browser sends a request to the C&C server to download new plug-ins.
In response to the request, the UC browser receives a link to file.
Attackers can get hold of the requests from the UC browser since its communication to the C&C server is carried over an unsecured channel.
Attackers can then replace the commands with ones containing different addresses.
This makes the UC browser download new modules from the malicious server instead of its C&C server.
Doctor Web researchers also created a demo video showing how when a potential victim just wants to view a PDF document using UC Browser but the browser downloads a plug-in module from the C&C server.

What’s the conclusion – Upon detecting the potential dangerous feature in UC Browser and UC Browser Mini, Doctor Web analysts notified the developer of both browsers about the feature. Later, Doctor Web notified the issue to Google. However, both browsers are still capable of downloading new modules.

The hackers had gained access to a variety of data that includes the users’ movements, hometown, search history, email addresses and phone numbers.
The attack occurred due to three flaws in the website.
The massive Facebook cyberattack that occurred last year, has affected more than 110,000 Australians. The attack had affected roughly 29 million individuals worldwide.

The big picture – Internal documents from Freedom of Information Laws reveal that a total of 111,813 Australians were affected in the attack on Facebook in September, 2019. The hackers had gained access to a variety of data that includes the users’ movements, hometown, search history, email addresses and phone numbers.

About 47,912 had only their basic personal information compromised. This includes their names, emails and phone numbers. On their hand, some 62,360 users had their hometown, most recent check-ins, birth dates, education, work history, Facebook search history, names, email addresses, phone numbers, gender, relationship status and religion compromised.

Apart from this data, hackers also gained private Facebook messenger conversations of 1,595 users.

Why it matters – According to the correspondence, Facebook discovered the breach on September 25, 2018, but did not notify the OAIC on time. The firm only informed the agency after four days of the discovery of the incident. The attack occurred due to three flaws in the website. This allowed the attackers to sneak into a user’s Facebook page without entering the password.

Based upon what we’ve learned so far in our investigation, the attackers did not gain access to other personal information such as password information, identity documentation, financial information or payment card information,” the incident update said, the Guardian reported.

A PewDiePie fan has taken his admiration of the popular video game commentator a little too far, creating a ransomware designed to increase the YouTube star’s subscriber count.

Fortunately, anti-malware company Emsisoft last week announced a new a decryption tool that restores machines infected by the unusual malware, named “PewCrypt.”

On its website, Emsisoft describes PewCrypt as a Java-based ransomware that AES and RSA to encrypt files, while adding the extension “.PewCrypt”. The creator’s ransom note asks the victim to subscribe to PewDiePie and warns that the malware creator will not issue a decrypter tool unless and until PewDiePie reaches 100 million subscribers.

“Were that not to happen, people would have no means of decrypting their data,” said Emsisoft researcher Michael Gillespie in an email interview with SC Media.

The ransom note also claims that if T-Series beats PewDiePie in total subscribers, “the private key will be deleted and you [sic] files gone forever [sic]”. T-Series is a record company that produces Bollywood music soundtracks and Indi-pop music, and has regularly been in competition with PewDiePie over who has the number-one YouTube channel.

Ultimately, PewCrypt’s creator went back on his threat and released his own version of a decrypter. But he also open-sourced the malware itself, allowing other actors to potentially adopt and modify PewCrypt to use it in the wild. Using two different variations of the username “JustMe,” the ransomware developer posted his work on both Twitter and GitHub.

According to Gillespie, the decrypter tool “JustMe” provided “was a command-line based decrypter that is not very user friendly. Also, the user would have to trust the person who initially infected them to not further infect them with more malware.”

Instead, victims can now use Emsisoft’s decryption tool, which was created by extracting and converting the private key to make a GUI decryptor, a company spokesperson explained. The spokesperson said that Emsisoft is not aware of a “huge number” of PewCrypt victims, “but there are definitely cases out there.”

In an unrelated development, BleepingComputer reported today that Emsisoft released another decryptor for Hacked Ransomware, aka HKCrypt. Discovered by BleepingComputer creator Lawrence Abrams discovered back in 2017, the ransomware displays a fake Windows Update while encrypting victims’ files with the RC4 algorithm and appending the extension “.hacked” to their names.

Brace yourself guys.

Microsoft is going to release its Windows Defender ATP antivirus software for Mac computers.

Sounds crazy, right? But it’s true.

Microsoft Thursday announced that the company is bringing its anti-malware software to Apple’s macOS operating system as well—and to more platforms soon, like Linux.

As a result, the technology giant renamed its Windows Defender Advanced Threat Protection (ATP) to Microsoft Defender Advanced Threat Protection (ATP) in an attempt to minimize name-confusion and reflect the cross-platform nature of the software suite.

But wait, does your Macbook need antivirus protection? Of course!

For all those wondering if Mac even gets viruses—macOS is generally more secure than Windows, but in recent years cybercriminals have started paying attention to the Mac platform, making it a new target for viruses, Trojans, spyware, adware, ransomware, backdoors, and other nefarious applications.

Moreover, hackers have been successful many times. Remember the dangerous FruitFly malware that infected thousands of Mac computers, the recently discovered cryptocurrency-stealing malware CookieMiner and DarthMiner, and .EXE malware discovered last month?

Microsoft Defender ATP Antivirus for Mac

Microsoft has now come up with a dedicated Defender ATP client for Mac, offering full anti-virus and threat protection with the ability to perform full, quick, and custom scans, giving macOS users “next-generation protection and endpoint detection and response coverage” as its Windows counterpart.

“We’ve been working closely with industry partners to enable Windows Defender Advanced Threat Protection (ATP) customers to protect their non-Windows devices while keeping a centralized “single pane of glass” experience,” Microsoft says in a blog post.

Microsoft also promised to add Endpoint Detection and Response, and Defender ATP’s new Threat and Vulnerability Management (TVM) capabilities in public preview next month.

TVM uses a risk-based approach to help security teams discovery, prioritize, and remediate known vulnerabilities and misconfigurations using a mixture of real-time insights, added context during incident investigations and built-in remediation processes through Microsoft’s Intune and System Center Configuration Manager.

For now, the tech giant has released Microsoft Defender ATP for Mac (compatible with macOS Mojave, macOS High Sierra, or macOS Sierra) in limited preview for businesses that have both Windows and Mac computer systems.

Like MS Office for Mac, Defender for Mac will also use Microsoft AutoUpdate software to get the latest features and fixes on time.

While Microsoft has announced its plans to launch Defender ATP for more platforms in the future, the company has not explicitly named those platforms.

Also, it is not clear if Microsoft is also planning to launch a consumer version of Microsoft Defender for Mac users in the future.

Microsoft’s business customers can sign up here for the limited preview.

In the attempt to make its security software available to more people, Microsoft just last week releasedWindows Defender extensions for Mozilla Firefox and Google Chrome as well.