
<amp-img src="/blog-content/june-2022/061422/faceswap.jpg" layout="responsive" width="2000" height="1333" alt="faceswap">
</amp-img>
<img src="/blog-content/june-2022/061422/faceswap.jpg" layout="responsive" width="2000" height="1333" alt="faceswap">
</img>

This article may seem a little late, but the issue of Deepfakes is still very relevant, and there’s a lot of misinformation spread around about what they are, how they work, and what they’re capable of.

In addition to providing an overview of the matter at hand, we’ll discuss the limits of the technology, and what threat it poses, if any.

## What are they?

In short, Deepfakes are pieces of media wherein another person’s face or body is superimposed onto a picture or video. While photoshop isn’t anything new, Deepfake technology puts a bit of a twist on the situation. 

As opposed to more manual methods of photo manipulation that have existed since the start of photography, Deepfakes are far more dynamic and flexible. That’s because of a key distinction in how Deepfake technology works.

## How does it work?

Deepfakes employ machine learning techniques. These of course come with pros and cons. 

Machine learning is very slow, takes an incredible amount of computing power, and doesn’t result in perfect outcomes every time. For example, the youtuber Tom Scott [made a video in 2018](https://youtu.be/OCLaeBAkFAY?t=208) attempting to implement these techniques with his own machine to rather unimpressive results.

The pros; however, are massive. Unlike conventional methods of face swapping, Deepfakes promise to be dynamic and universally applicable. If you train the algorithm well at the start, you can put the desired face onto any target. 

This is of course a very scary idea. 
## The limits of the technology

Deepfakes are still able to be spotted with current technology and a watchful eye, but it’s getting increasingly difficult. Just last year, the [fake Tom Cruise TikTok account](https://www.tiktok.com/@deeptomcruise/video/7082855268043836678) took the world by storm, gaining millions of views. 

That isn’t to say that you can’t tell at all, but it does raise a question - if somebody wanted to lie using this technology, could they?

Well, not everybody.

It’s still the case that this is very hardware intensive, and isn’t likely to result in a good outcome unless you know what it is that you’re doing. Any amateur with a GPU can not crack open some free software and start cranking out videos of Biden declaring war on China. 

That’s not to say that you shouldn't be vigilant and use common sense when analyzing sensational videos of people saying things, just that some of the alarmism of a truly post truth world where it’s impossible to tell what’s real and fake is still a little ways off. 


What are Deepfakes?


<amp-img src="/blog-content/june-2022/061322/security-course.jpg" layout="responsive" width="2000" height="1333" alt="security-course">
</amp-img>
<img src="/blog-content/june-2022/061322/security-course.jpg" layout="responsive" width="2000" height="1333" alt="security-course">
</img>


It is no secret that we at Redact value a person’s online security. Whether it be from our own product (which you can download for free here), or from this very blog, we work to keep not just our own users, but the overall public informed about general information and potential threats to that security. So, when a unique opportunity to enrich our audience’s knowledge presents itself, it is an understatement to say we are eager to share it- and a certain information security company has been generous enough to bring such an opportunity.

Offensive Security (OffSec), the creators of Kali Linux, [recently announced](https://www.offensive-security.com/offsec/offsec-live/) that they would be livestreaming a penetration test course using Kali Linux on the popular streaming platform, Twitch.

The best part about it? It’s entirely free!

## About the Course

Typically, this course has been only available through a paywall and is widely used as a preparation tool for the Offensive Security Certified Professional (OSCP) certification exam and was taught in-person. In the wake of the COVID-19 pandemic, however, the course had to transition to an online format.

As the creators themselves put it, “OffSec Live is our attempt to take what is great about OffSec Academy, and our learnings about successful student learning journeys, and make it available to all students…”

If you are eager to get a thorough review of this course, however, you can still purchase it and get specific, bonus perks during the Twitch livestream, such as being able to talk directly with mentors and instructors via Discord, as well as having access to unique exercises and lab machines.

## Like Online Security? Try Redact!

If you are interested in OffSec’s Kali Linux course, there’s a solid chance you’ll love Redact, too!

Redact provides users, whether they be grizzled online veterans or newcomers to the ominous world of the Internet, with a safe and easy-to-use platform to get rid of pesky old social media posts, direct messages, and even emails!

In addition to that, it’s all free! Every user has access to the same version of Redact with no payment required. So, what are you waiting for? Download Redact for free at [redact.dev/download](https://redact.dev/download) today!






OffSec is Teaching a Kali Linux Penetration Testing Course on Twitch


<amp-img src="/blog-content/june-2022/061222/google-chrome-malware.jpg" layout="responsive" width="2000" height="1333" alt="panic">
</amp-img>
<img src="/blog-content/june-2022/061222/google-chrome-malware.jpg" layout="responsive" width="2000" height="1333" alt="panic">
</img>

A very noticeable rise in a particular brand of Chrome malware has been noticed by security companies. The so-called ‘ChromeLoader malware’ has apparently made a significant return and we all need to be aware.

The ChromeLoader malware, officially called Choziosi Loader, is spread through infected downloads and has been spotted frequently in cracked game ISOs and social media posts with QR codes to pirate content.

The malware isn’t too destructive but it is incredibly annoying.

It hijacks your browser and redirects you to advertising websites. While relatively harmless, the nature of malware means it can be modified at any time to do more damage.

## Invasive Malvertising

The malware is particularly effective at leveraging PowerShell in Windows to inject itself as a Chrome addon.

However, another version has been found working on Mac computers, so nobody is safe right now.

The malware has been spotted inside cracked ISOs, cracks for games and in Twitter posts advertising cracked games. The posts include a QR code that takes you direct to the website to grab the file.

Once activated, the malware will install itself as a Chrome extension and will remove all traces of its installation, including the usual giveaway, the scheduled task within Windows.

This makes it very difficult to find without a malware scanner.

macOS is also being targeted with a version using the DMG disk image format. It will install as either a Chrome or Safari extension and redirect traffic.

## Removing malware from your system

We don’t judge, but if you download cracked or pirate content, you need to be careful on so many levels. This malware is one of many you’re susceptible to, so you need to be aware.

Use a malware scanner regularly and make sure to keep the scanner updated. Malwarebytes for example, has updated itself to track ChromeLoader malware.

We presume other malware scanners have done the same thing, but check, don’t assume.

Check Chrome for any extensions you don’t recognize and remove or disable them. Then perform a full malware scan.


Rise in ChromeLoader Malware Causes Concern


<amp-img src="/blog-content/june-2022/061022/campus.jpg" layout="responsive" width="2000" height="1333" alt="panic">
</amp-img>
<img src="/blog-content/june-2022/061022/campus.jpg" layout="responsive" width="2000" height="1333" alt="panic">
</img>

The [FBI has issued a warning about criminals offering VPN login details for college and university VPN networks](https://www.ic3.gov/Media/News/2022/220526.pdf).

These login details allow access onto educational networks, which could potentially enable bad actors access to student databases or other platforms within that network.

The FBI cautioned:

>If attackers are successful in compromising a victim account, they may attempt to drain the account of stored value, leverage or re-sell credit card numbers and other personally identifiable information, submit fraudulent transactions, exploit for other criminal activity against the account holder, or use for subsequent attacks against affiliated organizations. 

The entire point of a private network is to keep networks and data safe. If that network is compromised, all data and systems within that network can also be compromised.

Once a bad guy has access to that network, it’s no longer private and no longer secure. They have the time and space to operate freely to try to hack systems connected to that network.

## Not the end of the game

That said, having access to a network does not mean hackers will automatically have access to those systems.

If the network has been built correctly, each system will have its own gatekeeper and security. Data within those systems should also be encrypted to help protect the contents.

So, while this is definitely cause for concern, it’s immediately game over.

## How to protect VPN networks

If you find your own VPN network compromised, what can you do about it?

You have a couple of options.

#### 1. Change the login credentials across the entire network

This is a lot of effort for a network the size of a college or university, but it’s also necessary.

A change of username style and length and change of every single password is just the beginning, but should slow down the rate at which hackers can access the network.

#### 2. Audit all user accounts for the network

You would then need to perform a full audit of all active user accounts with current access to the network.

Revoke any accounts you don’t recognize without fail. If you revoke an active account you don’t recognize, you can always reinstate it when you get the call.

It’s much better to have to do this a few times while removing hacked accounts than to leave potentially vulnerable accounts active.

#### 3. Perform a security audit all systems connected to that network

Accessing a VPN network is one thing, being able to then hack the systems connected to it is something else.

As long as those systems have been set up properly with their own logins, two-factor authentication and encryption, it should be a tough ask to hack them.


The FBI Issues a Warning about Criminals Selling College VPN Access


<amp-img src="/blog-content/june-2022/060822/lock-secure-security-safe.jpg" layout="responsive" width="2000" height="1333" alt="lock-secure-security-safe">
</amp-img>
<img src="/blog-content/june-2022/060822/lock-secure-security-safe.jpg" layout="responsive" width="2000" height="1333" alt="lock-secure-security-safe">
</img>

Recently, [the FBI announced that it busted a dark web operation](https://techcrunch.com/2022/06/08/fbi-ssndob-millions-social-security-marketplace/?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cucmVkZGl0LmNvbS8&guce_referrer_sig=AQAAAC_iAoORjWhdGE4BpLaHxfGzHUKGFkDtWXhM7nlG-xYF1SMlKM154Vr_4ilnamhidCOYngCWdRYabe3BbS3-iOL-NZrqvUG1-f8FmJDL7oEo6e5AWKyK2uzAm7tZ-UX-7RRhPmepWznMlnVUZpHgHILJAShm9FtGdywyoScPawfE) called “SSNDOB” that [sold personal information in exchange for Bitcoin.](https://redact.dev/blog/the-dark-side-of-cryptocurrency) While this is excellent news, it’s troubling that apparently the site had been operating for nearly a decade.

That raises the question - how do I keep my SSN safe from people like this?

## Staying Safe
Preventing your SSN from being stolen in the first place just requires a few good habits to implement in your day to day life, online or otherwise. Here’s a list of 5 common sense habits to get into that will keep you safer.

#### 1. Avoid giving out your SSN as much as possible

There are very few instances where it’s absolutely necessary to give your Social Security number to another person. If they accept a different form of ID, you should absolutely opt to provide that instead of a number as vulnerable and important as your SSN.

#### 2. Never carry your card on your person

If you carry your card around with you all the time, it’s likely to suffer weather damage, get lost, or otherwise come to harm. Additionally, if you keep the card in your wallet or purse, and that gets stolen, the criminal responsible has much greater ability to access and abuse your finances. 

#### 3. Shred or burn personal documents after use

Revealing information mailed to you, such as credit card information, tax forms, etc. can allow a bad actor physically close to you to steal your ID with enough accumulated information. This is an incredibly dangerous and scary situation to be in, and you shouldn’t allow it to happen by carelessly throwing important documents into the trash. 

#### 4. Never use your SSN as a password

[We’ve written about how to write a strong password in the past](https://redact.dev/blog/why-is-having-a-strong-password-so-important), and a nine digit number certainly does not pass the test. In addition to it already being a terrible choice, if your password were ever to get stolen, your SSN would go along with it. 

#### 5. Never text or email your SSN to somebody else

[Texts and emails can be intercepted](https://redact.dev/blog/how-secure-is-wifi-really), and if one of them contains a piece of information as vital as your Social Security number, the results would be devastating. It’s best to avoid such channels out of an abundance of caution. 


How to Keep your Social Security Number Safe


<amp-img src="/blog-content/june-2022/060722/panic.jpg" layout="responsive" width="2000" height="1333" alt="panic">
</amp-img>
<img src="/blog-content/june-2022/060722/panic.jpg" layout="responsive" width="2000" height="1333" alt="panic">
</img>

Passwords are not the most secure methods of protecting your data but they are all most services offer have right now, [aside from 2FA](https://redact.dev/blog/what-is-two-factor-authentication). If you are notified of a hack or become aware that your Gmail account may have been compromised, you need to change your password fast.

Gmail is a pretty secure system but there is no such thing as complete security.

Plus, we all have a tendency to share passwords between accounts, especially if we come up with a particularly good one.

If one of the accounts using a shared password is compromised, it’s time to change all of them. Starting with Gmail.

As our email accounts are at the center of things, it’s logical to change that password first and move on to the others later.

Here’s how.

## Reset your Gmail password

The exact steps may differ depending on whether you’re using desktop or phone, but the following always works for us!

1.	Log into Google, not Gmail
2.	Select Security and find Signing into Google
3.	Select Password and enter your current password
4.	Enter a brand new, unique password and select Next
5.	Confirm your new password and select Next
6.	Select the blue Change Password button

Your password will now be changed and any apps you have or any Google products you may use will now require you to log in.

## Reset your Gmail password if it has been lost or changed

If you have forgotten your Gmail password or it has been changed by a hack, all is not lost. You can change it easily using these steps.

1.	Navigate to the Gmail login page
2.	Select Forgot password and enter the last password you remember
3.	Log into the email account you have set as your recovery email address
4.	Locate the email from Google and copy the 6 digit code
5.	Enter the code in the Account Recovery window and select Next
6.	Reset your password following the wizard that appears

As long as you copied the code correctly, you should see the Gmail change password wizard that will walk you through changing the password.

Once done, you should have secured your Gmail account once more.

We would now recommend setting up two-factor authentication to add an extra layer of protection!


How to Quickly Reset your Gmail Password if it becomes Compromised


<amp-img src="/blog-content/june-2022/060322/ransom.jpg" layout="responsive" width="2000" height="1333" alt="ransom">
</amp-img>
<img src="/blog-content/june-2022/060322/ransom.jpg" layout="responsive" width="2000" height="1333" alt="ransom">
</img>

A bizarre (but kinda cool) new ransomware has been identified out in the wild. Rather than locking everything down and demanding cash, this ransomware demands victims perform three good deeds before they get their systems back.

It’s a play on the good Samaritan and, while still criminal, it’s hard to dislike something that is trying to do good. It’s just a shame the method is so questionable.

The malware is written in .NET and targets Windows. There is currently no information on how machines become infected.

## Good samaritan malware

The malware is apparently from the GoodWill ransomware group. It was identified by CloudSEK and has a unique take on malware.

This malware encrypts data and locks down systems like most do, but rather than pay in crypto to unlock, victims need to perform 3 good deeds and publicize them on social media to prove it.

The malware leaves a note on the infected device with instructions.

The first good deed is to provide fresh clothes or blankets to "needy people on the side of the road."

The second good deed is to “take five poor kids from the neighborhood to Dominos, Pizza Hut, or KFC.”

The third deed is to “visit a nearby hospital, find people who can't pay for their treatment, and provide the needed financial assistance.”

The victim must them publicize the deed on social and presumably, an unlock key will be sent by the group to unlock.

There are specific instructions on how to publicize these good deeds. To include video and image evidence and place on specific social networks.

Once complete, the victim must then "write a beautiful article" on social media about "how you transformed yourself into a kind human being by becoming a victim of a ransomware called GoodWill."

## Source of GoodWill

CloudSEK says they have tracked the IP addresses used by the malware to India. 

Some of the code is also written with Hindi comments, so does lead credence to the fact the group may be based there or used local coders.

That doesn’t mean that’s where the group is from, just where they base some of their services.

As we said at the top. We are conflicted about this malware.

On one hand, ‘encouraging’ acts of kindness while asking nothing for themselves is a nice move.

However, doing it through malware and essentially blackmailing people into performing these deeds will not deliver the positive outcome the group probably hopes for.

Sure, some needy people may get a little help, but in return, they make the victim feel blackmailed into it. That’s going to leave quite the bitter taste.


New Ransomware Demands 3 Good Deeds to Unlock Your Data


<amp-img src="/blog-content/june-2022/060222/europe.jpg" layout="responsive" width="2000" height="1333" alt="europe">
</amp-img>
<img src="/blog-content/june-2022/060222/europe.jpg" layout="responsive" width="2000" height="1333" alt="europe">
</img>

The European Union is well known for proposing some crazy laws, but their latest is a doozy. 

The Union proposes that chat apps like WhatsApp and Facebook Messenger will have to scan all chats for child sex abuse material (CSAM). 

Let us first say that anything that tackles this heinous crime is a good thing. It’s a scourge on the world and we are the first to welcome every move to stop this horrendous crime.

However, proposing to invade the privacy of hundreds of millions of law-abiding people to catch a few crazies is a little much.

## Invasion of privacy

The law has only been proposed and is still being worked on, but it hasn’t gone down well so far.

Professor Matthew Green described it as ‘the most sophisticated mass surveillance machinery ever deployed outside China and the USSR. Not an exaggeration.’

The law puts the onus on the platforms themselves to provide the mechanism to scan, assess, and potentially report on the contents of every message you ever send, encrypted or otherwise.

It wouldn’t be wholesale monitoring, though. It would require a ‘Detection order’ from an authority within the EU to request that past chats be scanned for CSAM.

The law in its current draft stipulates that these detection orders would be targeted rather than indiscriminate to minimize invasion of privacy. Yeah right!

Apparently, the wording of the law recommends the use of these detection orders but doesn’t mandate it. This leaves the door open to mass surveillance.

## Unworkable and unfair

The common view so far is that this law would be unworkable. It would require chat platforms to have a system that could store and scan chats on demand, even encrypted ones. Not all chat apps store messages and some that include end-to-end encryption have no way to decrypt them.

That would all have to change if this law was passed.

We know the U.S. has some crazy and some draconian laws, but this is a new extreme. We usually look to our European cousins for their restraint and more balanced approach to lawmaking.

Not in this case.

This law is still a proposal and not yet on the books. The EU still has time to come to its senses, but if it doesn’t, this will have ramifications for everyone.


Our cat diaries

What are Deepfakes? • 2022-06-14

OffSec is Teaching a Kali Linux Penetration Testing Course on Twitch • 2022-06-13

Rise in ChromeLoader Malware Causes Concern • 2022-06-12

The FBI Issues a Warning about Criminals Selling College VPN Access • 2022-06-10

How to Keep your Social Security Number Safe • 2022-06-08

How to Quickly Reset your Gmail Password if it becomes Compromised • 2022-06-07

New Ransomware Demands 3 Good Deeds to Unlock Your Data • 2022-06-03

New EU Law Would Mandate Chat App Scanning for Child Abuse • 2022-06-02