STE WILLIAMS

Facebook said on Tuesday that it’s found no evidence that attackers accessed third-party apps in the breach it announced last week.

Nevertheless, it’s building a tool to allow developers to manually identify which of their apps’ users may have been affected, so they can log them out.

In that breach, attackers exploited a vulnerability in Facebook’s “View As” feature to steal access tokens, which are the keys that allow you to stay logged into Facebook so you don’t need to re-enter your password every time you use the app.

View As lets people see what their own profile looks like to someone else. The vulnerability allowed the attackers to steal Facebook access tokens that they could then use to take over people’s accounts.

Facebook fixed the vulnerability and reset the access tokens for a total of 90 million accounts: 50 million that had access tokens stolen and another 40 million that were subject to a View As look-up in the last year. Those users were subsequently prompted to log back in to Facebook, as well as back into any apps that use Facebook Login.

In Tuesday’s post, Facebook VP of Product Management Guy Rosen said that people have wondered what, exactly, the attack means for the apps that use Facebook Login. At this point, the company has analyzed logs for all third-party apps installed or logged in during the attack, which was discovered on Tuesday, 25 September. So far, there’s no sign that the attackers got at the apps using Facebook Login.

Facebook says that developers using official Facebook software development kits (SDKs) and those who regularly check the validity of their users’ access tokens are in the clear: they were automatically protected when Facebook reset access tokens. The purpose of the new tool is just to stay on the safe side and protect the non-SDK, non-validity-checking developers, Rosen says:

Out of an abundance of caution, as some developers may not use our SDKs – or regularly check whether Facebook access tokens are valid – we’re building a tool to enable developers to manually identify the users of their apps who may have been affected, so that they can log them out.

It’s security SNAFUs like this that lead Facebook to recommend that developers stick to the official Facebook SDKs, Rosen said. These are its best practices for login security:

• Use the official Facebook SDKs for Android, iOS and JavaScript: they automatically check the validity of access tokens on a daily basis and force a fresh login when reset by Facebook, protecting the security of users’ accounts.
• Use the Graph API to keep information updated regularly and always log users out of apps where error codes show that any Facebook session is invalid.

Is my Facebook account on the Dark Web?

Understandably, in the aftermath of this big breach, minds turn to the auction block: if attackers got access tokens that could have let them take over accounts, does that make it possible that your account is being sold off by criminals on the Dark Web?

When Facebook first learned about the attack, it said that the vulnerability behind it came out of a change the platform made to its video uploading feature in July 2017 that affected View As, incorrectly generating an access token that had the permissions of the Facebook mobile app – not for you, but for whoever you might have looked up.

The vulnerability was there for a year: a year in which the attackers needed to find it and exploit it to get an access token, then pivot from one account to others to steal more tokens.

As of Wednesday, Facebook hadn’t yet figured out if the attackers accessed information in people’s accounts or abused the accounts in other ways. So yes, maybe your account is being sold on the Dark Web.

Maybe it’s there because of this vulnerability, or then again, maybe not. It’s not as if this vulnerability spontaneously created the market for hijacked accounts, be they for Facebook, PayPal, Netflix, Amazon, eBay, Twitter, Uber or Gmail, among scores of others.

The market has been around for quite some time. Back in 2016, PayPal accounts were fetching anywhere from $1 to $80, Gmail or Yahoo accounts would set you back between 70 cents and $1.20, and attention, Walmart shoppers, your accounts were going for $2.50.

So yes, there are no doubt Facebook accounts for sale on the Dark Web right now. But they could have been there for weeks, or months, access-token SNAFU or no access-token SNAFU.

Your accounts are worth cold, hard cash. Account monitoring company LogDog gives a few examples of why:

Any account that can generate fraudsters money, or even help them receive a service for free, has a demand in the cyber underground.

…Uber, for example, are sought after by fraudsters simply because they provide “free taxi rides”. Demand for adult entertainment accounts is high due to interest for self-consumption.

…eBay and Amazon are sought after… to steal money or credits from these accounts… Compromised dating site accounts are also often exploited for romance scams.

And then again, there are creeps who hijack victims’ Facebook and email accounts for the purpose or sextortion. There are hijackers taking over high-profile Instagram accounts and holding them for ransom.

Until Facebook finds evidence that this breach created a bonanza of access to valid accounts that didn’t already exist, there’s no reason to believe that it did. The sun comes up every morning, but nobody’s shaking a fist at it for causing their purloined accounts to show up on the Dark Web.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/haDoy4R9v8A/

A French police officer has been charged with using police intelligence data to power a mobile phone tracking service sold via the dark web.

The law enforcement official is accused of running a service that used police data to track mobile devices based on a phone number. He sold the service as a way for people to track their spouses, and also advertised it as a way for criminal gangs to track their rivals, according to prosecutors.

Operating under the username Haurus, the officer allegedly sold the service via a dark web site called the Black Hand. He also advertised sensitive information that criminals could use to forge documents, say reports.

The officer worked for the French General Directorate for Internal Security, which is an intelligence agency that combats espionage, terrorism and cybercrime, said a report from ZDNet, citing a story in French language newspaper Le Parisien this week.

Law enforcement officials said that they were able to link the documents on the Black Hand with the accused thanks to unique codes embedded on police systems that allowed them to track document history. He was charged on 26 September, and faces up to seven years in prison and a fine of up to €100,000.

Sales of law enforcement assets on the dark web are more common than you might think. In 2015, a hacker targeted law enforcement news site and forum PoliceOne.com, stealing 715,000 member records including usernames, hashed passwords, email addresses and birth dates. Using the name Berkut, they later advertised the information for sale on the dark web site Tochka for $400.

In 2017, former Australian police officer James Goris was charged with selling fake Australian and UK police IDs on AlphaBay after covert investigators transacted with him.

Some cops have been charged with becoming customers, rather than sellers, on dark web marketplaces too. Allen Kennedy, a former officer for the Police Service of Northern Ireland, was caught in a police sting buying a 9mm Russian pistol, 10 rounds of ammunition and a silencer in a sale arranged over the dark web. He was jailed for five years and six months in December 2017.

Police officers have also been found using data from civilian services to help their own investigations in the past. In the US, the New York Times reported that a former Mississippi County, Missouri, sheriff used a service called Securus to track cellphones, including those owned by a judge and other police officers. The system used data that marketers normally use to target cellphone users by location.

Follow @DannyBradbury
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Vh3rkka8kR0/

Over the summer I decided to give my kids an old Apple laptop to share.

We use laptops for school homework from time to time but my kids spend most of their screen time poking and swiping tablets. I wanted to broaden their horizons a little: do a bit of coding; a bit of web searching; get them comfortable with a keyboard; give them something valuable that they had to look after; and get the ball rolling with developing some good computer security habits.

The kids have been at school for a few years and they’re are old enough to have a little independence, but most of what they do is supervised or subject to fairly restrictive boundaries.

The Mac would be no exception, there would be boundaries, so I enlisted its in-built parental controls to see what they could do, and how they could help.

This article walks you through the things I did to secure the laptop, and details the parental controls and options I chose. Later this week we’ll walk you through a similar setup for a Windows machine so stay tuned for that.

A clean slate

Because I was reusing an old laptop I decided to wipe it clean and start again. I reinstalled macOS over the internet on to an encrypted filesystem, went through the setup process until I had a working computer with one user account and installed Sophos Home.

I do this whenever a computer changes hands, even in the same household, but it’s not a prerequisite for setting up parental controls. I’m just letting you know what state my laptop was in when I wrote these steps.

All you need is a working Mac that you’re happy for your kids to spend some time on. What is important is that each of your children starts with their own clean slate: a user account that’s theirs and nobody else’s.

Users

As our starting point I will assume you have a working Mac on which you have Admin rights.

Log on to your Mac and go to System Preferences Users Groups. On the left hand side is a list of users. Under your name it should say Admin.

Before setting up parental controls we need to create an account for each child. To add an account, click on the + button.

When the new user dialog opens choose Managed with Parental Controls from the drop down and fill in the rest of your child’s details. I suggest you enter a placeholder password at this point – you can help your child to change it later.

When you click Create user you’ll see that your child has been added to the list of users on the left, and that Enable parental controls is ticked.

Highlight the child’s name in the left hand menu and click the Open Parental Controls… button.

Parental controls

Different families will require different settings so I’m going to take you through the very restrictive set that I used, as an example, but your mileage may vary.

Whatever your choices, I suggest you apply the principle of least privilege, giving your children the access they need, and no more. If I couldn’t immediately think of a sensible use case for allowing something, I switched it off. It’s easy to change the settings if later if you get something wrong.

As you go through the controls, pay careful attention to the labels because you’ll be using ticks to indicate both positives and negatives – sometimes your tick means allow, at other times it might be disable or restrict.

There are six tabs in the parental controls pane: Apps, Web, Stores, Time, Privacy and Other.

Apps

The Apps tab lets you limit access to the computer’s camera, set restrictions on email and multiplayer games, and create an allow list of apps.

I couldn’t think of a reason my children would need the camera or multiplayer games so I unticked Allow use of camera and Allow joining Game Center multiplayer games.

To restrict who can exchange emails with your child tick Limit Mail to allowed contacts and click the Manage… button.

I ticked Send requests to and entered my email address so that I’ll be notified of any attempts to email sombody who isn’t on the allow list.

Click the + button and add the names and email addresses of the contacts you’ll allow.

Click Done to return to the Apps tab.

Next, tick Limit Applications on this Mac. Click the arrows to list the apps on your computer. Again, I suggest you take the attitude that everything is off limits unless you have a reason for it not to be.

In my screenshot you’ll see that Safari is ticked, giving the child access to the entire web, warts and all. I used the controls in the next tab, Web, to rein that in.

Web

To put some boundaries on my child’s web access I clicked on the Web tab and selected Allow access to only these websites. To add a website to the list click the + button.

If you want to give your kids more freedom then the second option, Try to limit access to adult websites, might be worth a try. Note that Apple is very clear that it’s trying to limit access with this tool. No filter is foolproof so if you choose this option, understand that undesirable sites may get through the filter, and some legitimate sites might not.

If you enable that option you can also use the Customize… button to open a dialog where you can set your own block and allow lists to supplement Apple’s adult website filtering.

Stores

Under the Stores tab you can set up controls for accessing TV shows, books and movies, as well as Apple’s online stores. I ticked options to disable iTunes Store, iTunes U and the iBooks Store.

I also ticked to restrict Music with explicit content, and then ticked Movies to:, TV shows to: and Apps to:, and choose age-appropriate values from their drop downs. Finally, I ticked to restrict Books with explicit sexual content. I couldn’t imagine a situation where that would actually be necessary but the principle of least privilege applies – the child doesn’t need it, so they don’t get it.

Time

The controls under the Time tab allow you to specify how long your child can use the laptop for, and at what times of day. I chose to limit time to one hour per day at times of day when they’re normally awake.

To cap the amount of time to one hour per day, tick Limit weekday use to and Limit weekend use to, and set the sliders to 1 hour a day.

To prevent access over night I ticked School nights and Weekend, and set the times to 20:00 and the finish times to 07:30.

Privacy

The Privacy tab limits access to your kids’ data. Under Allow changes to you’ll see a list of items that can be changed by apps on the computer. For example: ticking Contacts allows apps to create new contacts in the address book and unticking it stops that.

I couldn’t think of a good reason to allow Twitter and Facebook so they’re unticked.

The Manage Privacy… button at the top allows you to see which apps have access to which services on the Mac, and to decide if you’re prepared to allow it. So, if you want Siri and Maps to have access to Location Services, you can set it here.

Either because my Mac was pretty bare, or because of the options I selected when setting up the Mac (such as disabling Siri entirely), there was nothing for me to untick here.

Note that clicking Manage Privacy… kicks you out of the Parental Controls pane and opens up the Privacy tab of the Security Privacy pane. When you’re done just click the back button to return to the Privacy tab under Parental Controls where you started.

Other

The last tab in the row is Other, and it’s where Apple has swept all the things that don’t fit anywhere else under one rug. Note that the first five options are negative and the last, Use Simple Finder, is positive.

I elected to untick Prevent the Dock from being modified, so my child could customise the appearance to their liking (see the passwords section below for more on that), and I elected to Use Simple Finder, because computers are baffling enough when everything is new.

Remote setup

Hidden away where you’ll never, ever find it is an option to enable remote control of a computer’s parental controls. This feature allows you to modify the parental controls on your child’s computer from another Mac on the same network.

To enable it, click on the settings icon (the cog) under the list of children’s names on the left of the Parental Controls pane, and click Allow Remote Setup.

If you log into a different Mac on the same network and go to System Preferences Parental Controls you’ll see the name of your child’s computer. If you click on it you’ll be asked for the username and password of a user with Admin rights on that computer. Once you’ve logged in you’ll be able to select your child’s name and modify their parental controls as if you were sat at their computer.

Security Privacy

Outside of the parental controls there are a few other settings worth paying attention to. In System Preferences open the Security Privacy pane.

Under the General tab tick Require password and then choose the shortest time you think your child can stand from the drop down list. This gets them used to the idea of logging in to the computer again if they leave it for a while, which is a good habit to develop.

I suggest you also turn on the firewall by clicking the Firewall tab selecting Turn On Firewall.

Passwords

Once the machine is set up, it’s time to introduce your children to it. While I was getting my kids’ laptop ready I spent a lot of time thinking about how to get them on the right track with computer security.

I wanted to get them doing some important things right, straight off the bat, so that they become habits – preferably things that I could build on as they got older, but without bewildering them.

I decided to focus on one thing – passwords are supposed to be secret.

There’s more to creating a strong password than that, of course, but it’s an essential building block. We’ll tackle password complexity when they’re older. For now I decided it’s enough for me that they choose passwords they can remember, so that they can practice keeping them secret.

When it came time for them to choose their passwords we made a performance of it: I told them why we don’t share passwords and that passwords need to be secret, from everyone, forever, even me. I had them choose passwords without telling me what they were, and then they typed them into the computer without me watching.

In that moment, frequently through the day, and occasionally through the summer that followed, we made a game of it by asking them “hey, what’s your password?”, at unexpected moments.

Knowing we’re trying to trick them, they take great pride in not giving them up!

At the same time as they chose their passwords I had them choose their own icon and a desktop background. I’m hoping that this basic personalisation will make them want to log in as themselves, and log out if they open the computer and see somebody else’s desktop.

I want to encourage the idea that it’s normal to have your own account on a computer, and that sharing accounts is a bad idea. (I’ve more or less given up with the adults on this one and decided the only chance for progress is raising a generation that just knows that sharing accounts is bad!)

Follow @MarkStockley
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/DRiqQrKDBwM/

Cloud-based email marketing service SendGrid has copped to blabbing customer email addresses, chalking it up to some overenthusiastic indexing without explaining why pages were public-facing in the first place.

In a breach notice sent out on Tuesday 2 October, SendGrid said that “some email addresses processed through the Group Unsubscribe feature of the SendGrid platform over the last nine months may have been exposed through major search engines”.

Oddly, the whole message is about crawling mitigation, and not about why that information was made available to crawlers in the first place.

SendGrid’s breach notice [click to enlarge]

The leak, which SendGrid said it detected on Friday 28 September, was ascribed to a network misconfiguration, rather than any glam hacker action or a specific software vulnerability. The message made no mention of SendGrid fixing the fact it had made the data publicly available in the first place, rather than putting it behind a log-in page, for example.

The cloud marketing firm said:

On December 11, 2017, we introduced new load balancing infrastructure to manage capacity across our platform. The pages that utilized this infrastructure did not include specific instructions within their page headers to inform search engines not to index (or “crawl”) links within the Unsubscribe Groups feature.

As a result, these links contained the email address of the recipient wishing to unsubscribe and the name of the SendGrid customer from whom they had unsubscribed.

The slip-up meant that email addresses could have been harvested through careful probing of Google and the like. The leak was limited to SendGrid customers that used the Unsubscribe Groups feature, and the recipients of emails from that subset of users – seemingly a small group. However, the firm said it was “unable to pinpoint the exact email addresses and SendGrid customer names which may have been made available to search engines during the period from December 11, 2017 to August 17, 2018”.

No other personal or financial data was exposed, according to SendGrid.

The firm added that it had updated its “headers to prevent any future search engine crawling of the Unsubscribe Groups feature”. It said it had been in touch with Google, Bing et al to purge that data and that it was “actively working on multiple projects to ensure we prevent future search engine crawling”.

The Reg asked Sendgrid yesterday why it hadn’t focused on making sure nobody could access the pages without proper credentials, instead of just asking crawlers to please not show the information in their search results. We’ll update when it responds.

Three years ago SendGrid admitted that a much wider set of information – usernames, email addresses, and (salted and iteratively hashed) passwords for SendGrid customer and employee accounts – had been exposed after hackers stole login details to a SendGrid worker’s account. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/10/04/sendgrid_email_leak/

The UK government pointed the finger at Russian military intelligence for a litany of cyber nasties in an alert it issued this morning.

In the bulletin, the UK government’s National Cyber Security Centre (NCSC) declared that a range of attacks blamed on the Kremlin are actually the work of Russian military intelligence, GRU.

This comes in the wake of long-standing concerns that Russia was breaking international norms in cyberspace. The document, speaking for intelligence chiefs in the UK and its closest allies, has publicly blamed the Kremlin for hacking the US Democrat Party during the country’s 2016 presidential election and much more.

GRU (not to be confused with the Despicable Me character) is “engaged in indiscriminate and reckless cyber attacks targeting political institutions, businesses, media and sport”, the alert said.

The National Cyber Security Centre (NCSC) has identified that a number of cyber actors widely known to have been conducting cyber attacks around the world are, in fact, the GRU…

Cyber attacks orchestrated by the GRU have attempted to undermine international sporting institution WADA, disrupt transport systems in Ukraine, destabilise democracies and target businesses.

This campaign by the GRU shows that it is working in secret to undermine international law and international institutions.

The UK and US governments previously blamed the Kremlin for the NotPetya and VPNFilter attacks, based on assessments by their respective intel agencies. The rap sheet was lengthened today when it blamed the country for the BadRabbit ransomware attack of October 2017, the hack on anti-doping agency WADA and the hack and leak of documents against the Democratic National Committee during the US presidential election campaign two years ago.

NCSC assessed with “high confidence that the GRU was almost certainly responsible” for all three attacks. The same level of confidence is attached to a “hack against email accounts belonging to a small (unnamed) UK-based TV station”.

The finger pointing comes amid increased tension between the UK and Russia over the poisoning of Sergei Skripal in Salisbury, also blamed by the Brits on GRU operatives. American prosecutors have accused 12 suspected Russian spies of hacking Democrat and Hillary Clinton campaign officials. The suspects are all allegedly members of Unit 74455, a branch of GRU.

Foreign secretary Jeremy Hunt, whose ministerial responsibilities include GCHQ and NCSC, said: “The GRU’s actions are reckless and indiscriminate: they try to undermine and interfere in elections in other countries; they are even prepared to damage Russian companies and Russian citizens. This pattern of behaviour demonstrates their desire to operate without regard to international law or established norms and to do so with a feeling of impunity and without consequences.”

Russian military hackers are known by numerous pseudonyms including APT28, Fancy Bear and CyberCaliphate – the guise under which it hacked French broadcaster TV5Monde back in April 2015. NCSC’s alert was accompanied by the publication of a technical advisory on Indicators of Compromise for Malware used by APT28.

Fancy Bear, which has also been studied by private security firms, has been active for at least 10 years and has chiefly targeted Western governments and other organisations in apparent furtherance of Russian foreign policy objectives. Its tactics have evolved over the years but there are some common themes (such as targeted phishing attacks) and tools.

Ollie Whitehouse, global chief technical officer at information assurance firm NCC Group, commented: “The techniques used by the GRU are varied, and their tradecraft is evolving. The main goal of the group is ultimately to use credentials gained through successful attacks to access sensitive information for a wide range of current and future applications, from data theft in the guise of emails and documents through to potential disruption.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/10/04/russian_military_intelligence_blamed_for_reckless_cyberattacks/

Organizers are hard at work preparing for another remarkable Black Hat Europe event in London this December. Here’s a sneak peek at two fantastic demos you’ll see there.

Quick refresher: Arsenal is where you want to be if you want to see live tool demonstrations in an open, conversational environment where you can react with presenters in a hands-on experience. To keep things fresh, the presenters change every few hours.  Organizers work hard to ensure presenters remain laser-focused on their subject, and won’t try to upsell you on unrelated products or services. Everything must be open-source and security-related.

This year there’s a killer Arsenal lineup for Black Hat Europe, starting at 10 AM on Wednesday Dec 5,  when Ariel Koren and Ran Dubin will present “SNDBOX: The Artificial Intelligence Malware Research Platform.” (Black Hat Europe runs Dec 3-6)

Koren and Dubin will demonstrate SNDBOX, which they claim is the world’s first AI-driven malware research platform designed to scale up research time and offer researchers never-seen-before malware analysis visibility. They’ll also show you how all levels of your team can leverage SNDBOX platform information for complete malware remediation and new research possibilities while sharing insights and public samples.

On Thursday, Dec 6at 10 AM, Harsh Grover and Sagar Popat will appear for a live presentation on “Astra: Automated Security Testing for REST APIs.” The pair contend that REST (Representational State Transfer) API penetration testing is complex due to continuous changes in existing APIs and the addition of new APIs. Their Arsenal demonstration will show you how security engineers and developers can use the Astra tool to  detect and patch vulnerabilities in the initial phase of the development cycle.

Black Hat Europe returns to The Excel in London December 3-6, 2018. For more information on how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/dont-miss-the-action-packed-arsenal-offerings-at-black-hat-europe/d/d-id/1332940?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In its ongoing exploration of Intel’s Management Engine (ME), security biz Positive Technologies has reaffirmed the shortsightedness of security through obscurity and underscored the value of open source silicon.

The Intel ME, included on most Intel chipsets since 2008, is controversial because it expands the attack surface of Intel-based hardware. If compromised, it becomes side-channel threat to the main processor.

The Electronic Frontier Foundation last year called it a security hazard and asked for a way to disable it, a request that researchers from Positive Technologies subsequently met.

In a blog post on Tuesday, researchers Maxim Goryachy and Mark Ermolov, involved in the discovery of an Intel ME firmware flaw last year, reveal that Chipzilla’s ME contains an undocumented Manufacturing Mode, among its other little known features like High Assurance Platform mode.

“Intel ME Manufacturing Mode is intended for configuration and testing of the end platform during manufacturing, and as such should be disabled (closed) before sale and shipment to users,” explain Goryachy and Ermolov. “However, this mode and its potential risks are not described anywhere in Intel’s public documentation.”

Manufacturing Mode can only be accessed using a utility included in Intel ME System Tools software, which isn’t available to the public. It’s intended to configure important platform settings in one-time programmable memory called Field Programming Fuses (FPF) prior to product shipment and in ME’s internal MFS (Minux File System) on SPI (Serial Peripheral Interface) flash memory, via parameters known as CVARs (Configurable NVARs, Named Variables).

In chipsets prior to Apollo Lake, Goryachy and Ermolov observe, Intel kept access rights for its Management Engine, Gigabit Ethernet, and CPU separate. The SPI controllers in more recent chips, however, have a capability called a Master Grant which overrides the access rights declared in the SPI descriptor.

Intel Management Engine JTAG flaw proof-of-concept published

READ MORE

“What this means is that even if the SPI descriptor forbids host access to an SPI region of ME, it is possible for ME to still provide access,” the researchers explain.

And because it turns out that device makers may not disable Manufacturing Mode, there’s an opportunity for an attacker – with local access – to alter the Intel ME to allow the writing of arbitrary data.

At least one Intel customer failed to turn Manufacturing Mode off: Apple. The researchers analyzed notebooks from several computer makers and found that Apple had left Manufacturing Model open. They reported the vulnerability (CVE-2018-4251) and Apple patched it in June via its macOS High Sierra 10.13.5 update.

As Apple put it in its description of the firmware issue, “A malicious application with root privileges may be able to modify the EFI flash memory region.”

Goryachy and Ermolov have posted Python code on GitHub to allow end-users with the appropriate Intel chips to check whether Manufacturing Mode has been disabled. They have previously described how to disable Intel’s Management Engine entirely.

They contend that Intel’s failure to provide public documentation of its tech leaves users at risk and they speculate that being able to reset the ME without doing the same to the CPU may lead to other security issues.

In an email to The Register, an Intel spokesperson said:

Protecting our customers’ data and ensuring the security of our products is a top priority for Intel. Manufacturing Mode is an essential CSME design feature that enables system manufacturers to configure systems during production. We provide system manufacturers with tools and guidance to properly configure systems before shipping. This includes setting “End of Manufacturing.”

End users who are concerned about the status of their systems can check with their system manufacturer. As always, Intel encourages end users to follow good security practices and keep their system software and firmware up to date.

That goes for you too, Apple. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/10/03/intel_management_engine_hole/

The transaction, valued at $173 million, is intended to bring analytics and threat detection to Palo Alto Networks’ cloud security offering.

Palo Alto Networks today announced its plans to buy cloud security analytics startup RedLock for $173 million in cash.

RedLock was co-founded in 2015 by Gaurav Kumar and Varun Badhwar, both of whom will be joining Palo Alto Network’s team. The company was founded on the premise that it’s up to public cloud users to properly secure content and firewall settings. Its platform brings together security data sets, network traffic, vulnerabilities, and threat intelligence so security teams can manage threats and develop securely on Microsoft Azure, Amazon Web Services, and Google Cloud.

Palo Alto Networks plans to leverage RedLock’s technology to bring security analytics, threat detection, and compliance monitoring into its own cloud security offering for multicloud environments. It’s working on a new cloud security tool, which is expected to be released in early 2019.

This marks Palo Alto Networks’ second cloud security acquisition in 2018. Back in March, the company closed a $300 million purchase of Evident.io, which it bought to help businesses analyze configurations and account settings to ensure cloud deployments were secure.

Read more here.

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/palo-alto-networks-buys-redlock-to-strengthen-cloud-security/d/d-id/1332962?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Alphabet’s Jigsaw has released Intra, a free security app that aims to prevent government censorship.

Jigsaw, a technology incubator operated under Google parent company Alphabet, has released a new security app designed to prevent DNS manipulation attacks by encrypting connections.

The app, dubbed Intra, aims to strengthen mobile browser security by protecting Domain Name System connections, which bring users from the Web addresses they type to their intended destinations. DNS connections are typically unencrypted, enabling attackers to redirect mobile traffic toward malicious websites or away from legitimate information.

DNS manipulation is a popular tactic among cybercriminals who want to distribute malware and governments that try to censor the Internet by blocking certain websites. In nations like Turkey and Iran, governments interfere with DNS connections to control what citizens see online.

In Venezuela, too, a study by the Open Observatory of Network Interference (OONI) shows the government has used DNS manipulation to prevent access to news sites and social media apps. The country became a test site for Intra, which was used among a group of activists. Jigsaw’s idea was to keep the beta release small – but word of the app quickly spread.

Now Jigsaw, a subdivision focused on tackling global security challenges, has rolled out Intra to the public as a free offering on the Google Play store.

Google, along with many companies, has driven the push toward more secure browsing by encrypting HTTPS connections. It acknowledged HTTPS as an Internet-wide security standard by removing the “secure” label from HTTPS websites in May, stating users should expect all websites they visit to have this protection. Non-HTTPS sites are now flagged as “not secure.”

While HTTPS was a big push for Web security, DNS connections are usually unencrypted and leave people vulnerable to malware and political interference. Intra encrypts communications between users and the DNS so they can safely browse wherever they are.

“Intra is dead simple to use,” Jigsaw wrote in a blog post on the news. “Just download the app and turn it on. That’s it. If you want to customize your connection, you can change the DNS provider you use.”

DNS manipulation is such a broad problem, the company says, that Android 9 (Android Pie), the latest version of Android, comes with DNS protection as a default feature. Android 9 uses DNS over TLS encryption protocol, while Intra uses DNS over HTTPS, Wired points out.

Intra is Jigsaw’s way of bringing protection to the billions of people who use older Android phones and may not be able to afford an upgrade. It works on Android 4.0 and later.

Jigsaw anticipates DNS manipulation is likely to continue. In the Freedom House’s “Freedom on the Net” report, nearly half of 65 countries surveyed reported a decline in overall freedom, which experts take as a sign that governments will increasingly try to restrict open Internet access.

Related Content:

• When Facebook Gets Hacked, Everyone Gets Hacked
• CISOs: How to Answer the 5 Questions Boards Will Ask You
• ‘Short, Brutal Lives’: Life Expectancy for Malicious Domains
• 7 Most Prevalent Phishing Subject Lines

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/mobile/an-intro-to-intra-the-android-app-for-dns-encryption/d/d-id/1332965?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

But Recipe Unlimited denies it was the victim of a ransomware attack, as some have reported.

Recipe Unlimited, a publicly traded company that operates nearly 1,400 restaurants under 19 different brands in Canada, has experienced what appears to be a significant security incident impacting several of its brands.

The company — formerly Cara Operations — on Monday noted that a malware outbreak caused a partial network outage at nine of its franchises. Among those impacted were Swiss Chalet, Harvey’s, East Side Mario’s, and Kelseys. A “small number” of restaurants have been closed for a “temporary period of time” because of service issues related to the malware, the company said in a statement.

In a report Wednesday, CBC News described Recipe as the victim of a ransomware attack that forced several locations across Canada to temporarily close down this week. CBC posted a copy of a ransom note that it said had been obtained from a worker at one of the affected restaurants, who described all systems at that location as having crashed.

In the ransom note, the hackers claimed to have used the “strongest military algorithms” to encrypt critical company files and were demanding an unspecified amount of money in Bitcoin, CBC said.

“The final price depends on how fast you write to us,” the purported ransom note said. “Every day of delay will cost you additional +0.5 BTC.”

Dark Reading was unable to independently verify CBC’s report that ransomware was the cause for the network disruptions at Recipe. The company did not immediately respond to an inquiry seeking a status update and information on how many restaurants might have been impacted, how many locations were forced to temporarily close down, and whether, in fact, ransomware was the cause.

Recipe’s statement merely noted that the company discovered the malware outbreak Sept. 28 and took immediate steps to mitigate damage. A number of systems have been taken offline, and Internet access has been suspended to all of the affected locations.

The measures have caused service delays at some locations, leaving them unable to accept payment card transactions. However, those locations are continuing to process card transactions manually, Recipe said. “A smaller number of affected restaurants have decided to close for a temporary period of time to avoid inconvenience to guests due to service issues,” it added.

CBS quoted a Recipe spokeswoman as denying the incident was ransomware-related. The ransom note that the worker purportedly provided to CBS was also just a generic statement associated with malware named Ryuk that surfaced earlier this year, the spokeswoman reportedly said.

If Recipe, in fact, was the victim of a ransomware attack, it certainly wouldn’t be surprising. Security vendor RiskIQ recently estimated that 90 organizations fall victim to ransomware every hour. Just one example is the Port of San Diego, which last week experienced major network disruptions related to a ransomware attack. Over the course of this year, numerous others have been similarly hit, including Boeing, the City of Atlanta, the Colorado Department of Transportation, and the Erie County Medical Center.

RiskIQ estimates the average cost to businesses from such attacks at around $15,220. But some victims end up paying many magnitudes more. Erie County Medical Center, for instance, estimated it spent $10 million on recovering from its ransomware attack; the City of Atlanta pegged its costs at $5 million on emergency IT services alone, and Colorado’s DoT spent more than $1.5 million.

Related Content:

• New Ransomware Attacks Endpoint Defenses
• Cryptocurrency Scams Replacing Ransomware as Attackers’ Fave
• Ransomware Actors Cut Loose on Health Care Organizations
• What To Watch For With Ransomware: 2017 Edition

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/malware-outbreak-causes-disruptions-closures-at-canadian-restaurant-chain/d/d-id/1332966?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple