Connect with us

Tech

Hackers exploit websites to give them excellent SEO before deploying malware

Published

on

Hackers exploit websites to give them excellent SEO before deploying malware
Spread the love

….Climbing up Google’s ranks is key to this new technique.

Cyberattackers have turned to search engine optimization (SEO) techniques to deploy malware payloads to as many victims as possible.

According to Sophos, the so-called search engine “deoptimization” method includes both SEO tricks and the abuse of human psychology to push websites that have been compromised up Google’s rankings.

SEO optimization is used by webmasters to legitimately increase their website’s exposure on search engines such as Google or Bing. However, Sophos says that threat actors are now tampering with the content management systems (CMS) of websites to serve financial malware, exploit tools, and ransomware.

In a blog post on Monday, the cybersecurity team said the technique, dubbed “Gootloader,” involves deployment of the infection framework for the Gootkit Remote Access Trojan (RAT) which also delivers a variety of other malware payloads.

The use of SEO as a technique to deploy Gootkit RAT is not a small operation. The researchers estimate that a network of servers — 400, if not more — must be maintained at any given time for success.

ALSO READ:  President Buhari Is Set To Make Power Available To Nigerians

While it isn’t known if a particular exploit is used to compromise these domains in the first place, the researchers say that CMSs running the backend of websites could have been hijacked via malware, stolen credentials, or brute-force attacks.

Once the threat actors have obtained access, a few lines of code are inserted into the body of website content. Checks are performed to ascertain whether the victim is of interest as a target — such as based on their IP and location — and queries originating from Google search are most commonly accepted.

Websites compromised by Gootloader are manipulated to answer specific search queries. Fake message boards are a constant theme in hacked websites observed by Sophos, in which “subtle” modifications are made to “rewrite how the contents of the website are presented to certain visitors.”

ALSO READ:  As Feb 9 Deadline For NIN-SIM Linkage Approaches, Will You Be shutout?

“If the right conditions are met (and there have been no previous visits to the website from the visitor’s IP address), the malicious code running server-side redraws the page to give the visitor the appearance that they have stumbled into a message board or blog comments area in which people are discussing precisely the same topic,” Sophos says.

If the attackers’ criteria aren’t met, the browser will display a seemingly-normal web page — that eventually dissolves into garbage text.

A fake forum post will then be displayed containing an apparent answer to the query, as well as a direct download link. In one example discussed by the team, the website of a legitimate neonatal clinic was compromised to show fake answers to questions relating to real estate.

screenshot-2021-02-26-at-17-36-36.png
Victims who click on the direct download links will receive a .zip archive file, named in relation to the search term, that contains a .js file.

ALSO READ:  Boko Haram Attack Gujba Town, Burn Hospital, School, Others

The .js file executes, runs in memory, and obfuscated code is then decrypted to call other payloads.

According to Sophos, the technique is being used to spread the Gootkit banking Trojan, Kronos, Cobalt Strike, and REvil ransomware, among other malware variants, in South Korea, Germany, France, and the United States.

“At several points, it’s possible for end-users to avoid the infection, if they recognize the signs,” the researchers say. “The problem is that, even trained people can easily be fooled by the chain of social engineering tricks Gootloader’s creators use. Script blockers like NoScript for Firefox could help a cautious web surfer remain safe by preventing the initial replacement of the hacked web page to happen, but not everyone uses those tools.”

Respect: Zdnet.com Source

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Pantami: Forces Against NIN Policy Behind Attacks Against Me

Published

on

By

Pantami: Forces Against NIN Policy Behind Attacks Against Me
Spread the love

Minister of Communications and Digital Economy, Isa Pantami, has alleged forces against the Federal Government’s compulsory policy on National Identification Number (NIN) registration for all Nigerians and those residing in the country are behind recent attacks against him.

Pantami in an exclusive interview with PREMIUM TIMES dismissed all the allegations against him, describing them as ‘untrue’.

He further denied links to extremist views, saying criminals and other ‘entrenched interests’ are behind the attacks on him.

He said: “I have no doubt about this. It has to do with the National Identification Number. Do you know one thing? This policy was started in 2011, it was not successful. Why? It was fought

“…In 2015, it came up, it was not successful. In 2018 there was a time that there were meetings between government and mobile network operators.

“And it was actually announced that by the agreement with government, the deadline was January 2018. It is there online, I will share it with you if you like. By January 2018, it was not implemented because there are forces against it. There are forces!”

ALSO READ:  Buhari Approves New Electricity Tariff; Rich Nigerians To Pay More

Pantami explained NIN registration is not only meant for Nigerians but it could be obtained by anybody in Nigeria.

He said: “Now they have started coming with the news that people are coming from neighbouring countries to register.

“What they fail to understand is that the National Identification Number is not only for Nigerians; anybody in Nigeria can obtain it.

“Section 16 and 17 of the Act mention the registrable people in the country – citizens, legal residents, legal permanent residents, and legal residents for a minimum of two years. So, it is not only for citizens. And it is also important to know that this is not just an indication that they are citizens of Nigeria.

“It is rather an indication that you presented your biometric data, so the government has control over your data.

“And that data of NIMC (National Identity Management Commission), nobody has access to it in any way he likes. Getting access to it illegally is 10 years in prison. It is there in the law. But people will like to discredit it, because they don’t like it.”

ALSO READ:  President Buhari Is Set To Make Power Available To Nigerians

The Minister added: “As long as it is implemented by the government, it will go a long way in reducing crime and based on the statistics we have been seeing now, it’s really encouraging.

“As government, our priority is the protection of the lives and property of our citizens. Security is our priority as a government – whether in agric, digital economy, education or in health, in whatever.

“President Muhammadu Buahari is so passionate about security, and he directed me to do that because he knows I try to persevere despite challenges and do what is right in the interest of our citizens and humanity.”

“You know as a government appointee, and at this level, if you say you are going to be intimidated by everything, then you cannot do the work. You cannot do the work.

” I was with the Minister of Foreign Affairs this week, on April 12. I was with the Minister. I was with the ambassadors of the U.K., the U.S., South Korea, and many other countries.

ALSO READ:  Facebook And Instagram Set To Overturn Trump's Indefinite Ban

“Even this issue that we are talking about, based on our findings, preliminary investigation, many people are not happy with what we have been doing – linking National Identification Number with SIM. Because a situation will come that all the people using SIM to commit crime will not be able to do that.

“If they do that, the government will be able to intercept them easily. This is what they don’t want to happen. And this is a mandate given to me by President Muhammadu Buhari. He personally signed the letter that ‘you are mandated to do that’.

“As his appointee, I should either do it or say I cannot. So, since I am willing to serve my country, I must continue to do it to the best of my ability.

“So, in my meeting with them, they even encouraged me to push it and make it very successful.”

Continue Reading

Tech

FG: Issuance Of New Sims To Resume April 19

Published

on

By

FG: Issuance Of New Sims To Resume April 19
Spread the love

The Federal Government says the issuance of new SIM cards will resume on April 19.

Isa Pantami, minister of communications and digital economy, made this known in a statement released by Femi Adeluyi, his technical aide (information technology), on Thursday.

In December 2020, the government suspended the activity as it embarked on an audit of the subscriber registration database.

Pantami announced that the country is set to implement a revised national digital identity policy for SIM card registration, adding that the national identification number (NIN) is mandatory at all levels.

“The policy includes guidelines on new SIM Acquisition and Activation, SIM Replacement, New SIM Activation for Corporates and Internet-of-Things/Machine-to-Machine (IoT/M2M), amongst others,” the statement read.

ALSO READ:  Buhari Approves New Electricity Tariff; Rich Nigerians To Pay More

“The possession of a National Identity number will be a prerequisite for each of these categories.

“For the corporate registration, institutions will be required to appoint a telecoms master (at the minimum of an executive management level) to provide the operational Primary NIN representation. The telecoms master will also be responsible to ensuring that the users provide their NINs to serve as a secondary NIN.

“For IoT/M2M activations, SIM security protocols would be implemented on the SIM profile to ensure that SIMs can only be used for point to point data services specific to the URL they are working with. All other services will be barred.

ALSO READ:  As Feb 9 Deadline For NIN-SIM Linkage Approaches, Will You Be shutout?

“In the event that a data only service is particular to individual use (eg home car tracking, WiFi, MiFi services, etc), the standard NIN registration process will be followed. A telecoms Master will also be required for corporates requiring IoT/M2M activations.

“The full details of the requirements for each class of service will be made available in due course.”

Pantami further directed the Nigerian Comunications Commission (NCC) and the National Identity Management Commission (NIMC) to ensure that the provisions of the policy are strictly followed by all operators and subscribers.

“The revised policy will ensure that operators conform to the required standards for biometric capture,” the statement added.

ALSO READ:  President Buhari Is Set To Make Power Available To Nigerians

“The guidelines in the Policy have been painstakingly developed and while they are thorough, it should be noted that they have been developed that way in national interest since the SIM is essentially a national resource.

“The implementation of the Policy will commence on Monday, 19th of April 2021. The issuance of New SIMs and other suspended activities will resume on the same date, as long as verification is done and the guidelines are fully adhered to.”

Continue Reading

Tech

Minister Of Power Expresses Regret Over Power Outages

Published

on

By

Minister Of Power Expresses Regret Over Power Outages
Spread the love

Engr. Sale Mamman @EngrSMamman

I sincerely regret the recent Power outages across the Nation and the difficulties it has brought with it, and wish to assure my Fellow Nigerians that everyone involved is working assiduously to restore the National grid to its previous historical levels and exceed that.

The problem is caused by the breakdown of some National Integrated Power Plants supplying electricity to the national grid. The plants are namely, Sapele, Afam, Olonrunsogo, Omotosho, Ibom, Egbin, Alaoji and Ihovbor. The Jebba Power Plant was shut down for annual maintenance.

Seven other integrated Power plants, namely Geregu, Sepele, Omotosho, Gbarain, Omuku, Paras and Alaoji are experiencing gas constraints while the Shiroro hydroelectric power plant has water management issues.

ALSO READ:  Donald Trump Jr asks Elon Musk to set up social media network that will not ban his father

https://mobile.twitter.com/EngrSMamman/status/1382640821292392448

Reactions.
Minister Of Power Expresses Regret Over Power Outages

Minister Of Power Expresses Regret Over Power Outages

Minister Of Power Expresses Regret Over Power Outages

Minister Of Power Expresses Regret Over Power Outages

Continue Reading

Trending