Archive for category: News

With nearly 65% of the global population using the internet in 2023, cyber risks initiated in the browser are growing exponentially

The internet has become an integral part of our daily lives. It provides us with vast amounts of information and resources, but it also poses a significant risk to our privacy. With the increasing use of the internet, the likelihood of online threats has increased. Hackers, cybercriminals, and governments can monitor our online activities, steal sensitive information, and manipulate data. To combat these threats, there is a growing need for secure and privacy-focused browser extensions.

The Importance of Browser Security

Overall, browser security is important to protect personal information, prevent malware infections, protect against malicious websites and browser exploits, and maintain privacy. By using a secure browser and keeping it up to date, individuals and organizations can reduce the risk of cyber attacks and protect themselves online.

1. Protecting personal information: Browsers are often used to access sensitive information such as financial and personal data. If a browser is not secure, this information can be easily stolen by attackers through methods such as phishing scams, malware infections, or network eavesdropping.
2. Preventing malware infections: Browsers can be targeted by attackers who use them to spread malware, such as viruses and Trojans. These infections can compromise the security of the device, steal sensitive information, and spread to other devices on the network.
3. Protecting against malicious websites: Browsers can be tricked into accessing malicious websites that contain malware, phishing scams, or other security threats. These websites can compromise the security of the device and steal sensitive information.
4. Protecting against browser exploits: Browsers can contain vulnerabilities that can be exploited by attackers to gain access to a device. These exploits can be used to steal sensitive information, install malware, or take control of the device.
5. Maintaining privacy: Browsers can be used to track a user’s online activities, including their location, browsing history, and personal information. This information can be used for advertising purposes, but it can also be sold to third parties or used for malicious purposes.

How ConcealBrowse Works

ConcealBrowse uses advanced encryption technologies to protect users’ online activities and sensitive information. The extension encrypts all the data transmitted between the user’s browser and the website, making it difficult for anyone to intercept and read the information.

One of the key features of ConcealBrowse is its ability to hide users’ IP addresses. By hiding the IP address, the extension makes it difficult for websites to track users’ online activities. This helps prevent websites from collecting sensitive information, such as user behavior and personal data.

In addition to IP address hiding, ConcealBrowse also blocks trackers and advertisements. This helps to protect users from online tracking and helps to speed up their browsing experience.

Another important feature of ConcealBrowse is its support for virtual private networks (VPNs). VPNs are used to encrypt all the data transmitted over the internet, making it difficult for anyone to intercept and read the information. By integrating VPN support into the browser extension, ConcealBrowse provides users with an extra layer of security and privacy.

Benefits of ConcealBrowse

1. Enhanced Privacy: ConcealBrowse helps protect users’ online privacy by hiding their IP addresses and blocking trackers and advertisements. This helps prevent websites from collecting sensitive information, such as user behavior and personal data.
2. Improved Security: The extension uses advanced encryption technologies to protect users’ online activities and sensitive information, making it difficult for anyone to intercept and read the information.
3. Fast Browsing Experience: By blocking trackers and advertisements, ConcealBrowse helps speed up users’ browsing experience.
4. Easy to Use: ConcealBrowse is designed to be user-friendly and easy to use, without sacrificing security and privacy.

Conclusion

In conclusion, ConcealBrowse is a secure browser extension that provides users with enhanced privacy and security. With its advanced encryption technologies, IP address hiding, tracker and advertisement blocking, and VPN support, users can browse the internet with confidence, knowing that their online activities and sensitive information are protected.

In the cybersecurity space, ChatGPT has already helped elevate threat actors ability to maliciously deploy attacks on a global scale

At first glance, ChatGPT seems like an ethical machine model with responses programmed to address questionable inputs.  Just this week, when asked how it can be used to write phishing emails and malicious code, the following response as given: 

“I cannot provide information or assistance on how to write phishing emails or malicious code. Engaging in such activities is unethical and illegal, and OpenAI has strict policies against providing information or assistance with malicious or harmful activities.

Phishing emails and malicious code can cause significant harm to individuals and organizations, and their use should be strongly discouraged. Instead, I encourage you to focus on ethical and legal uses of AI and technology that benefit society and promote positive outcomes.”

But, when you look under the hood and begin to understand how to request information, threat actors are finding ways to leverage ChatGPT for malicious intent.   So far, we can confidently talk about ChatGPTs success in creating successful social engineering campaigns and malware.  

Social Engineering 

Recently we discussed how phishing attacks are increasing in number and complexity in a blog post, now we have a new concern.   Beyond phishing kits being made available on the dark web as discussed here, now, threat actors do not even have to access the underground to be able to receive necessary materials to perform a successful social engineering campaign.  While one has to be creative to avoid the canned “I’m sorry, but I cannot provide you with an example of a phishing email. Phishing emails are used to trick individuals into revealing their personal and financial information, and their use is illegal and unethical. It is not appropriate to use such examples for educational purposes” response, researchers around the world are proving the ability to still get creative to get the anticipated results.  What is also increasingly concerning is the language barrier problem that has previously been an advantage for security teams to detect phishing emails due to grammar mistakes and other subtle characteristics that users can detect to question the validity of an email.  

Malware

ChatGPT has been able to write “fairly decent malware” according to many sources in the early days since the release of the AI platform.  In cybersecurity forums around the world, the community has come together to talk through the abilities ChatGPT has to build software that can be used for spam, espionage, ransomware and more.  In one instance, a user in a forum explained that ChatGPT was able to provide code that included encryption, decryption and code signing capabilities.  In another forum, ChatGPT had successfully created crimeware.  The user requested ChatGPT to create a bazaar for buying and trading compromised credentials on the dark web.  

Addressing the Harm 

With an increased availability to creating malicious code and socially engineered content, organizations must be prepared to proactively protect against these new changes to the threat landscape.  Increased quantity and potential sophistication should be a concern of security teams as ChatGPT enables script kiddies around the world.  

Now, more than ever, browser security will be paramount in an organizations cybersecurity strategy.  Browsers can be targeted by attackers who use them to spread malware, such as viruses and Trojans. These infections can compromise the security of the device, steal sensitive information, and spread to other devices on the network.  Protecting users when surfing the web, opening an email, or leveraging an application will provide cybersecurity teams a level of assurance in their proactive protection abilities.  

Learn how ConcealBrowse can be a part of your organization’s strategy to protect against the harm of ChatGPT by requesting a demo today. 

On February 8^th, Proofpoint reported on a new threat actor referred to as TA886, which it discovered targeting organizations in the United States and Germany using custom malware called “Screenshotter.” TA886 utilizes a few different initial attack vectors, all delivered via email. While one technique involved directly attaching malicious Microsoft Publisher files to the email, three other techniques relied on users to click on malicious links that would then be opened in the browser. 

The attackers drastically increased the scale of the attacks once they switched to the browser-based attacks, ramping up from a limited number of emails to a small group of companies with the initial Publisher attack vector, to tens of thousands malicious emails per week with the browser-accessed URL vector.

Once these URLs are loaded, the Screenshotter malware takes screenshots of the victim’s machine and sends them back to the attacker’s server for review. The attackers evaluate the screenshots and decide whether the victim is of value, dropping additional custom payloads that can include a domain profiler script and an info-stealer named “Rhadamanthys” that is loaded into memory. Once these individual tools are loaded, the attackers can steal data and credentials from the machine and map out the victim’s network for possible future lateral movement.

How can modern browser protection solutions prevent this attack?

To prevent these types of attacks, organizations can use advanced browser protection technology like ConcealBrowse’s secure browsing plugin. This plugin blocks phishing and other malicious websites and prevents users from entering login credentials on fake login pages. The technology uses computer vision to detect and block phishing websites, as well as an advanced decision engine that identifies known and suspected malicious URLs so that they can be blocked.

ConcealBrowse’s secure browser extension identifies malicious links wherever they are clicked. This means users of ConcealBrowse are proactively protected from the malicious web sites containing the Screenshotter malware, regardless of whether they receive the link in the email or from another vector.

The discovery of TA886 and their Screenshotter malware highlights the need for organizations to use browser-hardening solutions like ConcealBrowse’s secure browser extension to protect against sophisticated attacks. With ConcealBrowse, organizations can prevent attackers from stealing sensitive information and reduce the risk of data breaches and financial loss.

Written by: Conceal Research Team

Native security is no longer sufficient, requiring organizations to invest in a new approach, a Zero Trust model.

 We talk a lot about the growing sophistication of the threat landscape and attack vectors.  Part of these advancements include the threat actors’ ability to bypass security defenses that have been created from specific signatures and characteristics that traditional phishing attacks possessed.

Dissecting the Success of Phishing Attacks

Phishing campaigns are successful for two key reasons: people and process.  It is a combination of these two components of a phishing campaign that have led to the shortcomings of traditional security tools and measures.

People

The traditional characteristics of a phishing attack, such as grammar errors, misspellings, unfamiliar email addresses, and an unusual request, no longer exist.  Rather, a single lapse in judgment is enough to have users fall victim to a phishing attack anymore.  Traditional security training does not provide a user with the degree of awareness needed to point out a phishing campaign in the twenty-first century.  Spoofed email addresses, brand impersonation, and browser updates all seem legitimate at first and second glance.  Phishing attack cues are evolving.

Process

Today, the legitimacy of the channels for which phishing attacks occur make the bypassing of traditional security defenses a rather easy feat.  Email, web browsers, and social media applications have complicated the required security measures to detect and respond to phishing attacks.  The process of running a phishing campaign is quite novice, making it an easy attack vector for amateur threat actors to leverage.  The technical knowledge necessary to deploy a phishing attack is minimal and with entire phishing kits for sale at a low cost on the dark web, the pure quantity of attacks continues to rise.

Traditional Defenses Are Not Enough

As explored above, the traditional approach to protecting against a phishing attack is unlikely to prove successful.  It’s the combination of convincing users that the correspondence is legitimate and being able to dodge traditional security measures that escalates the severity and success of phishing attacks in 2023.  Rather, organizations need to invest in technical controls for a sophisticated social engineering landscape.

Change in Approach

To protect against phishing attacks in 2023, activity needs to be judged on an instance-by-instance basis, meaning, every email link clicked, every Google Chrome update, every URL visited, needs to pass through its own filters.  The zero-trust model is critical to minimizing the success of social engineering attacks.  With this model, only proven safe activity should be trusted.  In the terms of cybersecurity, this is similar to a whitelist approach.  The issue with a whitelist approach is that employees still need to be able to complete their responsibilities with ease, not bumping against the whitelist that exists.  As a result, a modified approach to filtering needs to be taken, recognized whitelist activity can continue per usual, while additional questioning and isolation is conducted for new traffic.  Beyond the additional security this approach provides, it also establishes a level of confidence and comfortability for the employee that they are being cyber smart without them having to second guess every click on their company network.

Here at Conceal, our browser exists to bring this zero trust approach to life at the edge.  To find out how we can help you change your approach to address phishing and other social engineering attacks on the web, request a demo today.