#FactCheck -AI-Generated Image Falsely Shows Amit Shah and Jay Shah Travelling in Charter Plane Amid Austerity Appeal

Executive Summary:

QakBot, a particular kind of banking trojan virus, is capable of stealing personal data, banking passwords, and session data from a user's computer. Since its first discovery in 2009, Qakbot has had substantial modifications.

C2 Server commands infected devices and receives stolen data, which is essentially the brain behind Qakbot's operations.Qakbot employs PEDLL (Communication Files), a malicious program, to interact with the server in order to accomplish its main goals. Sensitive data, including passwords or personal information, is taken from the victims and sent to the C2 server. Referrer files start the main line of communication between Qakbot and the C2 server, such as phishing papers or malware droppers. WHOIS data includes registration details for this server, which helps to identify its ownership or place of origin.

This report specifically focuses on the C2 server infrastructure located in India, shedding light on its architecture, communication patterns, and threat landscape.

Introduction:

QakBot is also known as Pinkslipbot, QuakBot, and QBot, capable of stealing personal data, banking passwords, and session data from a user's computer. Malware is bad since it spreads very quickly to other networks, affecting them like a worm.,It employs contemporary methods like web injection to eavesdrop on customer online banking interactions. Qakbot is a member of a kind of malware that has robust persistence techniques, which are said to be the most advanced in order to gain access to compromised computers for extended periods of time.
‍

Technical Analysis: 

The following IP addresses have been confirmed as active C2 servers supporting Qbot malware activity:

‍

Sample IP's

• 123.201.40[.]112
• 117.198.151[.]182
• 103.250.38[.]115
• 49.33.237[.]65
• 202.134.178[.]157
• 124.123.42[.]115
• 115.96.64[.]9
• 123.201.44[.]86
• 117.202.161[.]73
• 136.232.254[.]46

These servers have been operational in the past 14 days (report created in the month of Nov) and are being leveraged to perpetuate malicious activities globally.

URL/IP: 123.201.40[.]112

• inetnum: 123.201.32[.]0 - 123.201.47[.]255
• netname: YOUTELE
• descr: YOU Telecom India Pvt Ltd
• country: IN
• admin-c: HA348-AP
• tech-c: NI23-AP
• status: ASSIGNED NON-PORTABLE 
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-16T06:43:19Z
• mnt-irt: IRT-IN-YOU
• source: APNIC
• irt: IRT-IN-YOU
• address: YOU Broadband India Limited
• address: 2nd Floor, Millennium Arcade
• address: Opp. Samarth Park, Adajan-Hazira Road
• address: Surat-395009,Gujarat
• address: India
• e-mail: abuse@youbroadband.co.in
• abuse-mailbox: abuse@youbroadband.co.in 
• admin-c: HA348-AP
• tech-c: NI23-AP
• auth: # Filtered
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-08T10:30:51Z
• source: APNIC
• person: Harindra Akbari
• nic-hdl: HA348-AP
• e-mail: harindra.akbari@youbroadband.co.in
• address: YOU Broadband India Limited
• address: 2nd Floor, Millennium Arcade
• address: Opp. Samarth Park, Adajan-Hazira Road
• address: Surat-395009,Gujarat
• address: India
• phone: +91-261-7113400
• fax-no: +91-261-2789501
• country: IN
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-10T11:01:47Z
• source: APNIC
• person: NOC IQARA
• nic-hdl: NI23-AP
• e-mail: network@youbroadband.co.in
• address: YOU Broadband India Limited
• address: 2nd Floor, Millennium Arcade
• address: Opp. Samarth Park, Adajan-Hazira Road
• address: Surat-395009,Gujarat
• address: India
• phone: +91-261-7113400
• fax-no: +91-261-2789501
• country: IN
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-08T10:18:09Z
• source: APNIC
• route: 123.201.40.0/24
• descr: YOU Broadband & Cable India Ltd.
• origin: AS18207
• mnt-lower: MAINT-IN-YOU
• mnt-routes: MAINT-IN-YOU
• mnt-by: MAINT-IN-YOU
• last-modified: 2012-01-25T11:25:55Z
• source: APNIC

IP 123.201.40[.]112 uses the requested URL-path to make a GET request on the IP-address at port 80. "NOT RESPONDED" is the response status code for the request "C:\PROGRAM FILES GOOGLE CHROME APPLICATION CHROME.EXE" that was started by the process. 

Programs that retrieve their server data using a GET request are considered legitimate. The Google Chrome browser, a fully functional application widely used for web browsing, was used to make the actual request. It asks to get access to the server with IP 123.201.40[.]112 in order to collect its data and other resources. 

Malware uses GET requests to retrieve more commands or to send data back to the command and control servers. In this instance, it may be an attack server making the request to a known IP address with a known port number. Since the server has not replied to the request, the response status "NOT RESPONDED" may indicate that the activity was carried out with malicious intent.

This graph illustrates how the Qakbot virus operates and interacts with its C2 server, located in India and with the IP address 123.201.40[.]112. 

Impact

Qbot is a kind of malware that is typically distributed through hacked websites, malicious email attachments, and phishing operations. It targets private user information, including corporate logins or banking passwords. The deployment of ransomware: Payloads from organizations such as ProLock and Egregor ransomware are delivered by Qbot, a predecessor. Network Vulnerability: Within corporate networks, compromised systems will act as gateways for more lateral movement.

Proposed Recommendations for Mitigation

• Quick Action: To stop any incoming or outgoing traffic, the discovered IP addresses will be added to intrusion detection/prevention systems and firewalls.
• Network monitoring: Examining network log information for any attempts to get in touch with these IPs
• Email security: Give permission for anti-phishing programs.
• Endpoint Protection: To identify and stop Qbot infestations, update antivirus definitions.,Install tools for endpoint detection and response.
• Patch management: To reduce vulnerabilities that Qbot exploits, update all operating systems and software on a regular basis.
• Incident Response: Immediately isolate compromised computers.
• Awareness: Dissemination of this information to block the IP addresses of active C2 servers supporting Qbot malware activity has to be carried out.

Conclusion:

The discovery of these C2 servers reveals the growing danger scenario that Indian networks must contend with. To protect its infrastructure from future abuse, organizations are urged to act quickly and put the aforementioned precautions into place. 

Reference: 

• Threat Intelligence - ANY.RUN
• https://www.virustotal.com/gui
• https://www.virustotal.com/gui/ip-address/123.201.40.112/relations

‍

Introduction

AI-generated fake videos are proliferating on the Internet indeed becoming more common by the day. There is a use of sophisticated AI algorithms that help manipulate or generate multimedia content such as videos, audio, and images. As a result, it has become increasingly difficult to differentiate between genuine, altered, or fake content, and these AI-manipulated videos look realistic. A recent study has shown that 98% of deepfake-generated videos have adult content featuring young girls, women, and children, with India ranking 6th among the nations that suffer from misuse of deepfake technology. This practice has dangerous consequences and could harm an individual's reputation, and criminals could use this technology to create a false narrative about a candidate or a political party during elections.

The working of deepfake videos is based on algorithms that refine the fake content, and the generators are built and trained in such a way as to get the desired output. The process is repeated several times, allowing the generator to improve the content until it seems realistic, making it more flawless. Deepfake videos are created by specific approaches some of them are: -

• Lip syncing: This is the most common technique used in deepfake. Here, the voice recordings of the video, make it appear as to what was originally said by the person appearing in the video.
• Audio deepfake:  For Audio-generated deepfake, a generative adversarial network (GAN) is used to colon a person’s voice, based on the vocal patterns and refine it till the desired output is generated.

• Deepfake has become so serious that the technology could be used by bad actors or by cyber-terrorist squads to set their Geo-political agendas.  Looking at the present situation in the past few the number of cases has just doubled, targeting children, women and popular faces. 

• Greater Risk: in the last few years the cases of deep fake have risen. by the end of the year 2022, the number of cases has risen to 96% against women and children according to a survey.
• Every 60 seconds, a deepfake pornographic video is created, now quicker and more affordable than ever, it takes less than 25 minutes and costs using just one clean face image.  
• The connection to deepfakes is that people can become targets of "revenge porn" without the publisher having sexually explicit photographs or films of the victim. They may be made using any number of random pictures or images collected from the internet to obtain the same result. This means that almost everyone who has taken a selfie or shared a photograph of oneself online faces the possibility of a deepfake being constructed in their image.

Deepfake-related security concerns

As deepfakes proliferate, more people are realising that they can be used not only to create non-consensual porn but also as part of disinformation and fake news campaigns with the potential to sway elections and rekindle frozen or low-intensity conflicts.

Deepfakes have three security implications: at the international level, strategic deepfakes have the potential to destroy precarious peace; at the national level, deepfakes may be used to unduly influence elections, and the political process, or discredit opposition, which is a national security concern, and at the personal level, the scope for using Women suffer disproportionately from exposure to sexually explicit content as compared to males, and they are more frequently threatened. 

Policy Consideration

Looking at the present situation where the cases of deepfake are on the rise against women and children, the policymakers need to be aware that deepfakes are utilized for a variety of valid objectives, including artistic and satirical works, which policymakers should be aware of. Therefore, simply banning deepfakes is not a way consistent with fundamental liberties. One conceivable legislative option is to require a content warning or disclaimer. Deepfake is an advanced technology and misuse of deepfake technology is a crime.

What are the existing rules to combat deepfakes?

It's worth noting that both the IT Act of 2000 and the IT Rules of 2021 require social media intermediaries to remove deep-fake videos or images as soon as feasible. Failure to follow these guidelines can result in up to three years in jail and a Rs 1 lakh fine. Rule 3(1)(b)(vii) requires social media intermediaries to guarantee that its users do not host content that impersonates another person, and Rule 3(2)(b) requires such content to be withdrawn within 24 hours of receiving a complaint. Furthermore, the government has stipulated that any post must be removed within 36 hours of being published online. Recently government has also issued an advisory to social media intermediaries to identify misinformation and deepfakes.

Conclusion

It is important to foster ethical and responsible consumption of technology. This can only be achieved by creating standards for both the creators and users, educating individuals about content limits, and providing information. Internet-based platforms should also devise techniques to deter the uploading of inappropriate information. We can reduce the negative and misleading impacts of deepfakes by collaborating and ensuring technology can be used in a better manner.  

References

• https://timesofindia.indiatimes.com/life-style/parenting/moments/how-social-media-scandals-like-deepfake-impact-minors-and-students-mental-health/articleshow/105168380.cms?from=mdr
• https://www.aa.com.tr/en/science-technology/deepfake-technology-putting-children-at-risk-say-experts/2980880
• https://wiisglobal.org/deepfakes-as-a-security-issue-why-gender-matters/

The concept of web accessibility (i.e., access to the internet) stems from the recognition of internet access as an inalienable right. In 2016, the United Nations Human Rights Commission (UNHRC) General Assembly referred to the access to Internet as an essential human right. The Supreme Court of India also declared such internet access as a fundamental right under the Constitution of India. Various international instruments of which India is a signatory, such as the United Nations Convention on Rights of Persons with Disabilities (UNCRPD) mandate access to information. The heavy reliance on the internet and websites necessitates making the web space inclusive, navigational and accessible to all individuals, including persons with disabilities.

Various laws mandate web accessibility:

• Right of Persons with Disability Act, 2016: The Right of Persons with Disability Act 2016 Is the primary document for the protection of the rights of persons with disabilities to ensure their full participation. The Act provides several direct and indirect provisions (such as Section 2(y) “Reasonable Accommodation”, Section 40 on “Accessibility”, and Section 42 on “Access to Information and Communication Technology”) to ensure that technology products and services are accessible to a person with disabilities. 
• Rights of Persons with Disabilities Rules 2017: The 2017 rules under Rule 15 (2) task the respective Ministries and Departments to ensure compliance with accessibility standards.
• Guidelines for Indian Government Websites (GIGW): The GIGW provide a framework for websites to be designed in accordance with Web Content Accessibility Guidelines (WCAG) 2.0 standards. The GIGW enables websites to obtain certification by the Standardisation Testing and Quality Certification Directorate, after audit. 

Various other policies include;

• National Policy on Universal Electronic Accessibility, 2013: The National Policy ("Policy") on Electronic Accessibility recognizes the need to eliminate discrimination on the basis of disabilities and to facilitate equal access to Electronics & ICTs. The National Policy also recognizes the diversity of differently-abled persons and provides for their specific needs. The Policy covers accessibility requirements in the area of Electronics & ICT by different stakeholders. It recognizes the need to ensure that accessibility standards, guidelines and universal design concepts are adopted and adhered to.
• Web Content Accessibility Guidelines (WCAG): The WCAG defines how to make web content more accessible to persons with disabilities. While adhering to these guidelines is optional, various versions of the WCAG have been issued. It operates on four principles; perceivable, operable, understandable and robust. It provides a path to ensuring compliance and demonstrating reasonable accommodation for persons with disabilities.

However, despite the laws, web accessibility remains a challenge. A vast majority of Indian websites, especially e-commerce entities and several government websites remain inaccessible to persons with disabilities and most often do not conform with international accessibility standards. A report by the Centre of Internet and Society states that out of the 7800 websites of the Government of India, 5815 had accessibility barriers and 1985 websites failed to open. The report also notes that more than half of the websites had no navigation markup and only 52 websites had the option to change colours. The Ministry of Electronics and Information Technology (MeITy), during the 258^th Session of the Rajya Sabha on 9 December 2022 noted that 95 websites of the Central Government have been made accessible to persons with disabilities during the COVID-19 pandemic, however, only 45 websites of the Central Government have been certified as compliant under the Guidelines for Indian Government Websites (GIGW). As of that date, certification of the remaining governmental websites remains incomplete due to the pandemic. Meity also stated that the Department of Empowerment of Persons with Disabilities in 2017 sanctioned a project to be implemented by ERNET India for making 917 websites of State and Union territories. Under the project, a total of 647 websites have been made accessible as of that date.

Conclusion 

While India has established a robust legal framework and policies emphasizing the importance of web accessibility as a fundamental right, the existing gap between legislation and effective implementation poses a significant challenge. The reported accessibility barriers on numerous government and e-commerce websites indicate a pressing need for heightened efforts in enforcing and enhancing accessibility standards. 

In addressing these challenges, continued collaboration between government agencies, private entities and advocacy groups can play a crucial role. Ongoing monitoring, regular audits and public awareness campaigns may contribute to improving accessibility for persons with disabilities to ensure an inclusive environment and compliance with fundamental laws.

References:

1. https://www.legalserviceindia.com/legal/article-2967-right-to-internet-and-fundamental-rights.html 
2. https://www.indiacode.nic.in/bitstream/123456789/15939/1/the_rights_of_persons_with_disabilities_act%2C_2016.pdf 
3. https://www.meity.gov.in/writereaddata/files/National%20Policy%20on%20Universal%20Electronics%281%29_0.pdf 
4. https://www.meity.gov.in/writereaddata/files/National%20Policy%20on%20Universal%20Electronics%281%29_0.pdf 
5. https://www.w3.org/TR/WCAG21/#:~:text=Web%20Content%20Accessibility%20Guidelines%20(WCAG)%202.1%20defines%20how%20to%20make,%2C%20learning%2C%20and%20neurological%20disabilities. 
6. https://www.boia.org/blog/india-digital-accessibility-laws-an-overview
7. https://cis-india.org/accessibility/accessibility-of-govt-websites.pdf/view 
8. https://sansad.in/rs/questions/questions-and-answers