I got this spam email, and I think it’s a pretty good one!!! Wanted to let you all know why it’s a good spam email and what indicators of spam are in the email!

——————————-

DocHub is a legit website where you can digitally sign and annotate documents. The cool thing (lol) about this spam email is that it comes from the email “no-reply@dochub.com” which is DocHub’s legitimate email. The email says that you bought crypto for $400 using PayPal, and your PayPal will be charged $400 monthly going forward.

——————————-

Spam Email Explanation:

(1) Email Sender:

1. The email is sent from “no-reply@dochub.com”, which is DocHub’s legitimate email and makes it seem like DocHub is letting you know about the charges (how nice of them!!).

(2) Email Subject: Account Notices shared a document with you to view.

1. DocHub allows users to upload documents and share them with people, which is what this scammer is doing… but if DocHub was legitimately sending you an email regarding activity on your account, the subject line wouldn’t be “[Whomever] shared a document with you to view” and it wouldn’t be sent from a “no-reply” email. It would be from “security@dochub.com” or something like that. RED FLAG

(3) Email Body:

1. You’ve been charged $400 USD and are going to be charged that monthly going forward… Spam emails try to create a sense of urgency and get you to act quickly without thinking. RED FLAG

(4) URL from “View Document” in Email Body:

1. Usually in spam emails, the button that you click to “View Document” will take you to a different website than the one you were expecting. Example: You get an email you think is from Microsoft that will take you to “microsoft.com” but the url will take you to “spamwebsite.com”.
2. The URL links to dochub.com which is their actual website. The part that’s interesting about this is that all files users upload to DocHub are actually saved on DocHub’s website. So someone might think that since the document is actually on DocHub’s website it could be real.

(5) Account Notices:

1. Why would a LEGIT email from DocHub include a random Gmail address? MAJOR RED FLAG

(6) Sent By:

1. The email was sent by “Account Notices” (the scammer signed up as First Name: Account – Last Name: Notices)  from a  Gmail address… indicating that the email is not from DocHub. MAJOR RED FLAG
2. DocHub wouldn’t be sending their IP address in official emails (I don’t think)… The IP Address Scan shows as malicious

THANK YOU!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Below shows how an attacker used RMI requests to identify which servers on the network used Java for networking. Whichever servers were found that were not using Java, they attacked with the exploit Heartbleed.

I recieved five Suricata rule alerts from Azure. One was unique, and the other four were the same. Analysis of both alerts below.

Source IP - 192.168.10.151:34656 Destination IP - 192.168.10.144: 445

Port 445 is the Server Message Block, which is network file sharing between computers on the network.

Pattern of Behaviour

Source device is sending RMI (remote method invocation) request from a random source port (34656) to destination device through port 445.

“Alert Rule” references “reference:url, github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/lib/rex/proto/rmi/model.rb;”

Packet encoded in Base64. Python script to convert Base64 to byte sequence.

Ethernet frame analyzer for packet.

Source MAC Address is not registered, and destination MAC address to VMware device.  Unsure if destination and source addresses are flipped in this scenario. Possible that attacker tried to connect to a honeypot, or the captured packet could be the response (destination) to the attacking machine which is using VMware.

Packet capture was incomplete and has continuation data. Packet_info.linktype: 1 indicates ethernet connection. Likely scripts:

nmap --script rmi-dumpregistry -p 445 <host>
nmap --script=rmi-vuln-classloader -p 445 <target>
nmap -sV -sC -p <target>
msfconsole = auxiliary/scanner/misc/java_rmi_server

Tactics:

TA0007 - Discovery: The RMI request can be used to discover/interact with Java objects on a device.

Techniques:

T1046 – Network Service Discovery: The RMI request can be used to discover/interact with Java services on a device.

Procedures:

Network Traffic Obfuscation: Port 445 is a notorious port as it is used for file sharing across a network. The attacker could be using an RMI request in an attempt to bypass the port 445 protection, and then discovering which devices are java enabled on the network.

Recommendations:

Java RMI is not used anymore as both client and server need to be programmed in Java, and is insecure. All Java RMI objects should be replaced with REST or raw socket programming immediately.

Insight 1504:

1.       Source IP – 192.168.10.185:12320

2.       Destination IP – 192.168.10.151:57060

Insight 1505 source:

1.       Source IP – 192.168.10.198:47769

2.       Destination IP – 192.168.10.151:44594

Insight 1552 source:

1.       Source IP – 192.168.10.189:443

2.       Destination IP – 192.168.10.146:42356

Insight 1555 source:

1.       Source IP – 192.168.10.198:47769

2.       Destination IP – 192.168.10.146:42164

Pattern of Behaviour:

The Suricata alert sends a warning when a TLS message is received with content that matches the string “00 02 02 28”. The first two blocks “00 02” indicate the major version (TLS version) and minor version (CipherSuite) which in this case is TLS_RSA_WITH_NULL_SHA, respectively.

TLS 1.0 was published in 1999, and TLS 1.1 in 2006, which were both “officially” deprecated 2021, even though more secure methods have been widely adopted a long time before deprecation.

Hopefully no internal server or device would be using TLS 1.0 or 1.1, therefore we are treating this as malicious. Immediately we would assume this as a TLS downgrade attack.

The other clue we have is that the packets included in the metadata was encoded using base64, as well as packet_info.linktype: 1 which is ethernet. Convert base64 packet to hex in screenshot below.

Source devices below from insight 1504, 1505, 1552, and 1555 respectively.

The source device of insight 1505, and 1555 have the same mac address, as well as the same IP address and source port (192.168.10.198:47769). The system supressed messages from each insight 69, 35, 29, and 11 times, respectively.

Another notable item is the payload_printable field which reads “......(“.

Through a bunch of digging around on the internet, this is found on an openssl website (https://mta.openssl.org/pipermail/openssl-users/2015-March.txt), which fits the Suricata rule perfectly.

Found through more digging that the traffic we’ve seen is related to the Heartbleed vulnerability.

With the repeated and supressed requests we can be certain it’s the Heartbleed exploit, which is easily accessible through Metasploit. Heartbeat was a feature added for keep-alive functionality.

Tactics

-          Exploitation of the heartbeat extension (RFCC6520) causing memory leakage from the server to the client and the client to the server.

Techniques

-          Sending specialized and repeated heartbeat requests.

Procedures

-          Data extraction once encryption keys have been captured.

Recommendation

Identify if any servers are using TLS 1.2 or less, and ensure all servers use TLS 1.3.

How to get a free VPN using an Oracle virtual private server (VPS), Wireguard, and a little technical know-how. I currently pay for NordVPN, but this is an easy way to get a VPN for free, with just a little bit of technical knowledge.

First, signup for a free Oracle account using the below link, and download and install the Wireguard client.

Oracle SignupWireguard Download

After you've put in your account information, and validated your email you must choose your home region. This home region is going to be where your VPN is. You can not change this, so choose carefully. Use the link below to find your closest region.

Oracle Cloud Regions

Once you're in, hit the hamburger menu in the top left, click "Compute" and then "Instances".

Make sure your Compartment is selected in the bottom left, and then hit Create Instance.

Select the Canonical Ubuntu 22.04 Minimal aarch64 image, and you can leave the Shape as-is.

Now save the private and public keys, and hit Create.

You will have to wait a few minutes for the VM to be created. After it is created, you can view the servers information. Note down the IP address, as we will need it later.

Right click on the downloaded ".key" file, hit properties, then the Security tab, and hit advanced. Click Disable inheritance at the bottom and convert to inherited permissions into explicit permissions.

Remove all accounts until your username is the only one left, and then hit apply. Copy that .key file, open up file explorer, and navigate to C:\Users\<your username>\.ssh, and paste the .key file. Right click on the key file and "copy as path"

Now we are going to access the newly created VPS using ssh. We will need two things.

1. The path to your key file. ex: "C:\Users\J\.ssh\ssh-key-2024-05-01.key"
2. The IP address of your VPS. ex: 155.248.218.244

Open Windows terminal and type:

ssh -i pathtoyourkeyfile ubuntu@155.248.218.244

Example:

ssh -i C:\Users\J\.ssh\ssh-key-2024-05-01.key ubuntu@155.248.218.244

Type in yes, and hit enter.

Now we need to update and upgrade the system. Copy the below code one by one. If it asks you which services you need to restart, say none, as we will reboot shortly.

sudo apt update

sudo apt upgrade -y

sudo iptables -I INPUT -j ACCEPT

sudo su

iptables-save > /etc/iptables/rules.v4

exit

sudo reboot now

Wait about 30 seconds, and then press the up arrow key to bring back your ssh command, and then press enter. Run the code below to start the VPN process.

curl -O https://raw.githubusercontent.com/angristan/wireguard-install/master/wireguard-install.sh

chmod +x wireguard-install.sh

sudo ./wireguard-install.sh

Input your Oracle VPS IP address for the first question, and then you can press enter for the remaining questions.

Input a client name, and press enter for the remaining questions.

Paste the below code to view the Wireguard config file.

cat /home/ubuntu/wg0-client-vpn.conf

Highlight from [Interface] all the way to AllowedIPs, and ctrl+c to copy.

Open WireGuard and hit ctrl+n to create a new tunnel. Paste in the information generated from the VPS.

Hit save, and then activate, and then you're connected!

Google your IP address and it should be the same as the VPS IP address.