Author Archives: Avast Blog

Mr. Robot Review: eps2.1_k3rnel-pan1c.ksd

As the name of the episode suggests, there was a lot of panic in this week’s episode of Mr. Robot. The remaining members of fsociety are panicking after both Gideon and Romero were murdered. Elliot is, as usual, freaking out about Mr. Robot, which causes him to find a new addiction, adderall. Angela receives evidence that could be used to prosecute some of the men who could have prevented her mother’s and Elliot’s father’s deaths – something she wanted all last season, but now that she has it, she is unsure of what she should do. She tells Mr. Price she doesn’t trust him, who can blame her? Ray, Elliot’s new “friend”, seems to also be a bit panicked about the status of whatever business he is running. Even FBI agent, Dominique DiPierro, appears to be a bit panicked when she finds a list with her name on it at Romero’s murder scene.

While there wasn’t much hacking in this episode, there was quite a bit of computer talk throughout the episode.

WereinWarMrRobot.jpg

Image via: USA Network @whoismrrobot

The evolution of the Retefe banking Trojan

Three weeks ago, we published a blog post about the
Retefe banking Trojan
, which began targeting banking customers in the United Kingdom. The Trojan steals login credentials and other personal information. Retefe is usually spread via a phishing email. The email contains a document, which is embedded with malicious JavaScript and user interaction is needed to activate the Trojan.

Another UK bank has now been added to the list of affected banks. The main behavior of the Trojan has largely remained unchanged, with the exception of its malicious components. The infection vector, as well as the installation of the malicious certificate, are the same as we reported in our last blog post.

Once the JavaScript runs it attempts to kill open Web browser processes. It then installs a fake certificate and changes the proxy auto-config URL. All scripts are obfuscated with the Dean Edwards packer. This behavior is similar to the previous version of Retefe.

The JavaScript, however, now contains three powershell scripts, two of which are the same as in the previous version. ConfirmCert clicks “OK” in the window displayed during the installation of the rogue certificate and AddCertFF adds the rogue certificate to FireFox. InstallTP is the new powershell script. It downloads and installs three programs: Task Scheduler wrapper, Tor and Proxifier.

The Task Scheduler Managed Wrapper is downloaded from Codeplex. This adds the option to use the object “New-Object Microsoft.Win32.TaskScheduler.TaskService”, which is later used for establishing persistence.

The Tor client gives the Trojan the possibility to access .onion domains directly.

Proxifier, as stated on their website, “allows network applications that do not support working through proxy servers to operate through a SOCKS or HTTPS proxy and chains.”.

The AutoConfigURL contains a link to a .onion domain and it can be reached now because Tor was, installed.

AutoConfig URL Retefe.png

Mr. Robot Review: unm4sk-pt1.tc and unm4sk-pt2.tc

The two-part premiere of season two of Mr. Robot did not disappoint! The episodes focused more on the current state of the main characters than on hacking and a lot has changed since season one.

Elliot is trying to get his life back on track. He is living with his mom, has developed a routine, which includes attending a Church group, and keeps a journal. Mr. Robot does not like the new Elliot and is itching to get back to work, taunting Elliot. Darlene is leading fsociety in the meantime, but the group’s other main hackers seemed to have disappeared. Angela has joined the dark side and is working as a PR Manager for E Corp. Joanna, Tyrell’s wife, has found a new BDSM buddy to fill her missing husband’s void.

We were also introduced to some new characters and I am looking forward to learning more about them as the season goes on. There is the FBI agent investigating the E Corp hack and Elliot has also made a “new friend”, Ray. Ray wants to do business with Elliot, but Elliot is not interested – but Mr. Robot seems to be…

Mr._Robot_USA_Network_s2e1.jpg

Image via: USA Network @whoismrrobot

What we can learn from the hacks on season one of Mr. Robot

Mr. Robot is coming back to USA Network on Wednesday, July 13th at 9/10 pm Central (tonight!) for its second season and I cannot wait (especially since I missed Monday’s sneak preview)! Season one was full of complex hacks that were, for the most part, accurately portrayed. By speaking to various Avast experts, I learned a lot about the hacks on the show last summer and how they could affect consumers like you and I.

Mr_Robot_season_2.jpg

Image via: USA Network @whoismrrobot

Here’s a recap of what we learned from the hacks in season one of Mr. Robot:

What can businesses learn about cybersecurity from season one of Mr. Robot

Season one of last summer’s hit new TV show, Mr. Robot, was filled with interesting and, for the most part, accurately portrayed hacks. The hacks were carried out by the show’s main character Elliot and hacker group fsociety. Their goal throughout the season was to take down the multi-national conglomerate, E Corp.

Mr.Robot_season_2_premier.jpg

Image via: USA Network @whoismrrobot

Although the hacks on the show were rather complex and to a certain extent elaborate, there are a few things SMBs can learn from them.

Tools deliver false promises to YouTubers and Gamers

If you have a YouTube account and are an aspiring YouTube star you may have wondered if there’s a way to speed up the slow process of raising your channel to the top. If you’re an unlucky gamer looking for a simple way to advance, you may have wished for coins to make more in game purchases and progress. If you search the Internet, you will definitely find websites with good advice on how to promote your content and even tips on how to create good videos and how to improve your gaming abilities.