Connect with us

Cars

First-ever malware strain spotted abusing new DoH (DNS over HTTPS) protocol

Published

on

Ten malware families linked to Necurs botnet found on US servers
It is unusual for such malware to be found on infrastructure hosted in the US.

Security researchers from Netlab, a network threat hunting unit of Chinese cyber-security giant Qihoo 360, have discovered the first ever malware strain seen abusing the DNS over HTTPS (DoH) protocol.

The malware, named Godlua, was detailed in a report published on Monday by the company’s researchers.

According to the Netlab team, Godlua is a malware strain written in Lua, which acts like a backdoor on infected systems. It’s written to work on Linux servers, attackers are using a Confluence exploit (CVE-2019-3396) to infect outdated systems, and early samples uploaded on VirusTotal have mislabeled it as a cryptocurrency miner.

But Netlab researchers say the malware actually works as a DDoS bot and they’ve already seen it being used in attacks, with one aimed against liuxiaobei.com, the homepage of a Liu Xiaobei fan site.

DoH helps malware avoid passive DNS monitoring

Researchers say they’ve spotted two Godlua versions so far, with a somewhat similar architecture. Both versions used DNS over HTTPS requests to retrieve the TXT (text record) of a domain name, where the URL of a subsequent command and control (C&C) server was being stored, and to which the Godlua malware was supposed to connect for further instructions.

This technique of retrieving the URL addresses of second/third stage C&C server from DNS text records isn’t new. The newness here is the usage of a DoH request instead of a classical DNS request.

As the protocol’s name clearly states, DNS over HTTPS works by sending DNS requests via an encrypted HTTPS connection, rather than using a classic plaintext UDP request.

The DoH (DNS) request is encrypted and invisible to third-party observers, including cyber-security software that relies on passive DNS monitoring to block requests to known malicious domains.

Looming problem for cyber-security community

The discovery that Godlua uses DoH to hide DNS traffic sent shockwaves through the cyber-security community this week, with many reacting on both Twitter [1, 2] and Reddit.

Many have expressed fears that other malware strains will now also adopt this feature, rendering a large chunk of cyber-security products that rely on passive DNS monitoring useless.

Their fear is justified; however, the cyber-security community has always found workarounds to any tricks malware employs, and it’s expected they’ll find one to deal with any strains that use DoH, as well.

More info on the DoH protocol can be found in the Internet Engineering Task Force’s (IETF) document RFC 8484.

Major browsers like Firefox and Chrome already support DoH. Last month, Google announced DoH support for its public DNS service, which the company provides for free to users in countries where governments are filtering and blocking internet traffic based on passive DNS monitoring.

Related malware and cybercrime coverage:



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Cars

The Feature That You Likely Didn’t Know Your iPhone Camera Had

Published

on

If you’ve ever wanted to take photos while recording video without having to resort to screen captures of video stills, Apple has something for that in almost all of the new phones it’s released since September 2019. QuickTake is a built-in and easy-to-use feature that lets you record video and snap pictures using the same device, with no need to switch between camera modes or download any additional camera apps.

There’s a small catch, however. While the process is very simple when you know how to turn it on, it may affect the overall quality of your photos. In essence, if your photo settings are adjusted for higher-quality images, those settings won’t carry over to video. And since QuickTake uses video camera sensors rather than the regular ones, there’s not much you can do to change that. Newer iPhone models do support up to 4K video, which could yield better results.

Regardless, whatever your reasons for wanting to take photos while simultaneously recording video with your iPhone may be, it’s a very simple process.

How to use QuickTake

Making use of your iPhone’s QuickTake feature doesn’t require any special setup or settings changes — it’s already part of the default Camera app so long as you’re using iOS 13 or newer.

  1. Open the Camera app and leave it on the default Photo mode. You should see “Photo” highlighted in yellow, just above the Shutter Button.
  2. When you’re ready to record, press and hold the Shutter Button to begin recording video. Recording will stop if you release the Shutter Button.
  3. Slide your finger from the Shutter Button over to the Lock icon in the bottom-right corner of the screen (where the button for swapping between front- and rear-facing cameras normally is).
  4. The Lock icon will change to a small Shutter Button, and the video recording button will change to the regular recording icon. At this point, your iPhone will continue to record video if you remove your finger from the screen.
  5. While your video is recording, tap the small Shutter Button in the bottom-right corner of the screen to take photos.
  6. Tap the recording button (it will look like a Stop button while recording) to stop taking video.

The QuickTake video you’ve recorded and all of the photos you snapped will appear in your Photos app. Due to videos being added to the Photos app once recording stops (rather than when it starts), the new video will appear after your QuickTake photos.

Continue Reading

Cars

The Science Behind The Deadly Lake

Published

on

A buildup of carbon dioxide gas is not uncommon for crater lakes, with many of them occasionally releasing bubbles of it over time. Volcanic activity taking place below the Earth’s surface (and below the lake itself) will cause gasses to seep up through the lakebed and into the water. Something that generally isn’t a concern as deeper, colder water is able to absorb substantial amounts of carbon dioxide, but if the concentration gets too dense it can create bubbles that float up to and burst on the surface of the water.

This in itself is common, and the volume of carbon dioxide usually released in this manner will dissipate into the air quickly. However, it’s theorized that Lake Nyos had been amassing an uncharacteristically large amount of gas due to a combination of factors like location, local climate, overall depth, and water pressure. Once that buildup had been disturbed, it all came rocketing out.

Whether it was due to a rock slide, strong winds, or an unexpected temperature change throwing off the delicate balance is still unknown. But whatever the catalyst was, it caused the lower layer of deep, carbon-infused water to start to rise. Which then began to warm up, reducing its ability to contain the gas. The resulting perpetual cycle of rising waters and gasses creates the type of explosion you might see after opening a carbonated beverage after it’s been shaken vigorously.

Continue Reading

Cars

The Super Nintendo’s Secret Weapon

Published

on

The Super Nintendo featured seven different video rendering modes, each offering a different level of display detail, shown in one to four background layers. Most of the Super Nintendo’s games utilized Mode 1, which could display 16-color sprites and backgrounds on two layers plus a 4-color sprite on a third layer. This little trick was the key to the parallax scrolling effect you’d see in games like “Super Mario World,” where background elements would scroll at different rates from foreground elements.

Mode 7, however, was the only one of these display modes that permitted advanced visual effects. In a nutshell, Mode 7 allows the Super Nintendo to take a 2D image and apply 3D rendering effects to it, such as scrolling, curving, stretching, and more. By switching to Mode 7, games could transform one of their background layers into an independently moving image, which could be used for gameplay modifications and simple spectacle. Plus, with a bit of creative warping, a 2D image could be changed into a pseudo-3D view, having 2D sprites move around in a flat 3D space. It’s kind of like rolling a ball on a treadmill.

Continue Reading

Trending