Tor Browser now bypasses internet censorship automatically

 

The Tor Project team has announced the release of Tor Browser 11.5, a major release that brings new features to help users fight censorship easier.

The Tor Browser has been created specifically for accessing sites through The Onion Router (Tor) network to offer users anonymity and privacy when accessing information on the internet.

It achieves this by routing traffic through nodes on the network and encrypting it at every step. The connection reaches the destination through an exit node that is used to relay the information back to the user.

Auto block bypassing

The updates in Tor Browser 11.5 focus on circumventing censorship, a process that started a year ago in version 10.5 with improving the Tor connection experience.

In the new version, users no longer have to manually try out bridge configurations to unblock Tor.

Tor Browser version 11.5 comes with a new feature called “Connection Assist”, which assigns automatically the bridge configuration known to work best for the user’s location.

“Connection Assist works by looking up and downloading an up-to-date list of country-specific options to try using your location (with your consent),” explains the release announcement.

“It manages to do so without needing to connect to the Tor Network first by utilizing moat – the same domain-fronting tool that Tor Browser uses to request a bridge from torproject.org.”

Connection Assist in action (Tor)

Since Connection Assist is still in an early stage of development (v1.0), the Tor team welcomes user feedback and reports, which would help them iron out any kinks and improve on the system.

HTTPS on by default

Another important new feature in version 11.5 is making ‘HTTPS-Only Mode’ the default browsing mode, so that the connection is through a secure tunnel.

This ensures that all data exchange between the user and the server hosting the website will be encrypted, to defend against man-in-the-middle (MitM) attacks and to protect users from SSL stripping on malicious exit relays.

The Tor team assures users that SecureDrop will continue to work as intended despite the deprecation and replacement of the HTTPS-Everywhere extension that served as an onion name interpreter.

The only exception to replacing HTTPS-Everywhere with the new HTTPS-Only Mode is Android, which has generally fallen behind.

Tor’s development team admitted this and promised to do more about Android, releasing updates more frequently, fixing the many bugs that have accumulated, and catching up with the Fenix (Firefox for Android) releases.

Better settings

The third significant improvement in Tor Browser 11.5 is a heavily revamped Network Settings menu, now called “Connection Settings”, which should make it easier to find and understand specific settings.

Most notably, bridge configuration and connection options have been redesigned to enable quick and easy review and management.

Using emojis on the saved Bridges, the new interface offers visualization for the configuration for the first time, making it easy to identify the right bridge and select it when needed.

Redesigned network settings (Tor)

You can download the latest Tor Browser from the official download portal as an installable package or a portable binary for your OS architecture.

New RedAlert Ransomware targets Windows, Linux VMware ESXi servers

 

A new ransomware operation called RedAlert, or N13V, encrypts both Windows and Linux VMWare ESXi servers in attacks on corporate networks.

 

 

The new operation was discovered today by MalwareHunterTeam, who tweeted various images of the gang’s data leak site.

The ransomware has been called ‘RedAlert’ based on a string used in the ransom note. However, from a Linux encryptor obtained by BleepingComputer, the threat actors call their operation ‘N13V’ internally, as shown below.

 

RedAlert / N13V ransomware command-line options
Source: BleepingComputer

 

The Linux encryptor is created to target VMware ESXi servers, with command-line options that allow the threat actors to shut down any running virtual machines before encrypting files.

The full list of command-line options can be seen below.

-w	 Run command for stop all running VM`s
-p	 Path to encrypt (by default encrypt only files in directory, not include subdirectories)
-f	 File for encrypt
-r	 Recursive. used only with -p ( search and encryption will include subdirectories )
-t	 Check encryption time(only encryption, without key-gen, memory allocates ...)
-n	 Search without file encryption.(show ffiles and folders with some info)
-x	 Asymmetric cryptography performance tests. DEBUG TESTS
-h	 Show this message

When running the ransomware with the ‘-w‘ argument, the Linux encryptor will shut down all running VMware ESXi virtual machines using the following esxcli command:

esxcli --formatter=csv --format-param=fields=="WorldID,DisplayName" vm process list | tail -n +2 | awk -F $',' '{system("esxcli vm process kill --type=force --world-id=" $1)}'

 

When encrypting files, the ransomware utilizes the NTRUEncrypt public-key encryption algorithm, which support various ‘Parameter Sets’ that offer different levels of security.

An interesting feature of RedAlert/N13V is the ‘-x’ command-line option that performs ‘asymmetric cryptography performance testing’ using these different NTRUEncrypt parameter sets. However, it is unclear if there is a way to force a particular parameter set when encrypting and/or if the ransomware will select a more efficient one.

The only other ransomware operation known to use this encryption algorithm is FiveHands.

 

NTRUEncrypt encryption speed test
Source: BleepingComputer

 

When encrypting files, the ransomware will only target files associated with VMware ESXi virtual machines, including log files, swap files, virtual disks, and memory files, as listed below.

.log
.vmdk
.vmem
.vswp
.vmsn

In the sample analyzed by BleepingComputer, the ransomware would encrypt these file types and append the .crypt658 extension to the file names of encrypted files.

 

Encrypting files in Linux with RedAlert
Source: BleepingComputer

 

In each folder, the ransomware will also create a custom ransom note named HOW_TO_RESTORE, which contains a description of the stolen data and a link to a unique TOR ransom payment site for the victim.

 

Red Alert / N13V ransom note
Source: BleepingComputer

 

The Tor payment site is similar to other ransomware operation sites as it displays the ransom demand and provides a way to negotiate with the threat actors.

However, RedAlert/N13V only accepts the Monero cryptocurrency for payment, which is not commonly sold in USA crypto exchanges because it is a privacy coin.

 

RedAlert / N13V Tor negotiation site
Source: BleepingComputer

 

While only a Linux encryptor has been found, the payment site has hidden elements showing that Windows decryptors also exist.

 

“Board of Shame”

 

Like almost all new enterprise-targeting ransomware operations, RedAlert conducts double-extortion attacks, which is when data is stolen, and then ransomware is deployed to encrypt devices.

This tactic provides two extortion methods, allowing the threat actors to not only demand ransom to receive a decryptor but also demand one to prevent the leaking of stolen data.

When a victim does not pay a ransom demand, the RedAlert gang publishes stolen data on their data leak site that anyone can download.

 

RedAlert / N13V Data Leak Site
Source: BleepingComputer

 

Currently, the RedAlert data leak site only contains the data for one organization, indicating that the operation is very new.

While there has not been a lot of activity with the new N13V/RedAlert ransomware operation, it is one that we will definitely need to keep an eye on due to its advanced functionality and immediate support for both Linux and Windows.

微软Exchange被爆高危后门 可用于窃取凭证等

 

卡巴斯基的安全团队发布了一份令人担忧的报告。报告指出在 Exchange 服务器上发现了一个全新的、难以检测的后门。这种名为 SessionManager 的恶意软件于 2022 年初首次被发现。

Exchange 被全球多个国家的政府、医疗机构、军事组织、非政府组织等广泛使用，因此该后门的破坏力可以说是非常惊人的。

卡巴斯基安全团队表示 SessionManager 恶意软件样本目前并没有被大多数主流在线文件扫描服务标记。此外，在 90% 的目标组织中，SessionManager 感染会持续存在。

SessionManager 背后的威胁参与者在过去 15 个月里一直在使用它。卡巴斯基怀疑一个名为 Gelsemium 的黑客组织对这些攻击负责，因为黑客模式符合该组织的 MO。然而，分析师无法证实 Gelsemium 是罪魁祸首。

该恶意软件使用为微软 Internet Information Services (IIS) Web 服务器软件编写的强大的恶意本机代码模块。安装后，它们将响应特殊的 HTTP 请求以收集敏感信息。攻击者还可以完全控制服务器，部署额外的黑客工具，并将它们用于其他恶意目的。

有趣的是，安装 SessionManager 的过程依赖于利用一组统称为 ProxyLogon (CVE-2021-26855) 的漏洞。去年，微软表示，超过 90% 的 Exchange 服务器已被修补或缓解，但这仍然使许多已经受到攻击的服务器面临风险。