STE WILLIAMS

The Port of San Diego has been hit with a ransomware attack affecting several computers and having an impact on processing park permits and record requests, along with other business services. The attack, first reported to port officials on Tuesday, is ongoing, according to a statement from the port.

Some experts have noted the similarities between this attack and the one that hit the city of Atlanta earlier this year. In both cases, essential customer services were affected and the criminals demanded payment in Bitcoin.

While the Port of San Diego has not released the amount of the ransom demanded, Barry Shteiman, vice president of research and innovation at Exabeam, says that the decision on whether or not to pay will likely come down to economics. “If the cost of paying the ransom is less than the downtime caused by unavailable data, or by the backup restoration process, then organizations should pay. By the same token, if the cost of giving up on the encrypted data is higher — both in lost revenue or intellectual property — than remediation would be, the company doesn’t have much choice but to pay up,” he says.

The attack was originally reported to the California Office of Emergency Services and the County of San Diego Office of Emergency Services, and the port is now partnering with the FBI and the Department of Homeland Security on investigating the attack. Officials note that normal port operations, including ship access and public safety, have not been affected by the attack.

For more, read here.

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/ransomware-attack-hits-port-of-san-diego/d/d-id/1332924?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Advanced persistent threat (APT) group Sednit has deployed a rootkit capable of modifying a computer’s Unified Extensible Firmware Interface (UEFI) to install malware that can survive both an OS reinstallation and hard disk replacement.

Security vendor ESET recently discovered the malware — dubbed LoJax — installed on a system as part of a broader Sednit APT campaign and described it this week as the first UEFI rootkit ever discovered in the wild. The discovery shows that UEFI rootkit attacks — long perceived as a theoretical threat — are a reality, says Alexis Dorais-Joncas, security intelligence team lead at ESET.

“Organizations should review the Secure Boot configuration on their hardware and make sure they are configured properly to prevent unauthorized access to the firmware memory,” Dorais-Joncas says. They also need to think about controls for detecting malware at the UEFI/BIOS level, he says.

UEFI is a specification for the interface between a computer’s firmware and its operating system. The interface contains information for booting the operating system and for running pre-boot applications. Anyone able to tamper with the interface can make firmware changes that completely compromise the integrity of the system.

In recent years, chipmakers, hardware vendors, OS makers, and others have introduced measures that make it very hard for anyone to make such changes. One example is Secure Boot, a mechanism that ensures only securely signed firmware and software can be booted up and run on a system.

Secure Boot is supported on nearly every modern computer and, when enabled, can make it very hard for someone to make unauthorized changes at the firmware level. Such controls are the reason why security researchers have considered UEFI rootkits as something that typically government and government-backed entities are likely capable of developing and successfully using.

The discovery of LoJax shows that capabilities around UEFI rootkits are developing. “We certainly should expect rootkits of this type to evolve,” says Ang Cui, CEO of Red Balloon Security. “We shouldn’t be surprised to see more UEFI rootkits in the wild going forward, which could potentially incorporate more advanced capabilities like signature verification bypass.”

Stealthy and Persistent
ESET says it discovered LoJax on a system belonging to an organization that the Sednit group is targeting as part of a broad campaign against government entities in the Balkans and also in Central and Eastern Europe. Sednit, aka APT28, Sofacy, and Fancy Bear, is a notorious Russian threat actor, perhaps best known in recent times for its attack on the Democratic National Committee in 2016. The group’s success in deploying the rootkit should serve as a warning to those it its crosshairs about the group’s growing sophistication.

According to ESET, its analysis shows that the Sednit group used a kernel driver bundled with a legitimate and freely available utility called RWEverything to install the UEFI rootkit. The driver can be used to access a computer’s UEFI/BIOS settings and gather information on almost all low-level settings on it.

Sednit bundled RWEverything’s functionality into two custom tools. One of the tools was for reading the contents of the flash memory where the UEFI is located and saving the image to a file. The second was a patching tool to add the rootkit to the firmware image and write it back to flash memory, thereby installing it on the system, ESET said.

This module can drop and execute malware on disk during the boot process, making the malware hard to remove even with an OS reinstall and a hard disk replacement, ESET said.

“The infection mechanism was to write the entire UEFI firmware memory with unsigned code,” Dorais-Joncas says. However, the same technique — flashing the UEFI firmware — would not work on a modern system with Secure Boot properly enabled, he says.

The only reason it did in this case was because the victim system was likely misconfigured or was running an older Intel chipset. “In this attack, either the firmware did not properly configure the BIOS write protection mechanisms or the victim’s machine had a chipset older than the Platform Controller Hub,” Dorais-Joncas says.

However, it is a mistake to underestimate the threat all the same. Researchers have previously found several vulnerabilities that bypass UEFI protections and gain write access, so there is no guarantee the same thing can’t happen again, he notes.

“We should not assume that Secure Boot will be a magic-bullet solution against UEFI rootkits going forward,” Cui says. If not properly locked down, attackers can take advantage of new features that hardware manufacturers have begun implementing, like UEFI, CPU Management Engine, and One Time Protect, in flash to launch devastating attacks.

UEFI, for instance, is a particularly good place for a rootkit to live because it is easier for it to stay persistent and stealthy, Cui says. “On top of that, it can also change the system and modify the OS before the OS loads, giving it lots of ways to change the rules on modern hardware and OS security.”

Related Content:

• How Hackers Hide Their Malware: Advanced Obfuscation
• PLCs Possessed: Researchers Create ‘Undetectable’ Rootkit
• Russia’s Fancy Bear APT Group Gets More Dangerous
• 8 Active APT Groups To Watch

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/russias-sednit-deploys-first-firmware-level-rootkit-in-the-wild/d/d-id/1332923?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The early phases of the traditional cyber kill chain are merging as criminals seek out faster ways to launch targeted attacks, a new report explains.

As part of the “2018 Critical Watch Report,” researchers at Alert Logic reviewed 254,274 total verified security incidents, 7.2 million events linked to those incidents, and 1.2 billion anomalies between April 1, 2017, and June 30, 2018. They surfaced five key insights, top of which was the realization that the traditional cyber kill chain is transforming for different types of attacks.

Since 2011, they report, the typical kill chain has comprised seven steps: reconnaissance (harvesting credentials, email addresses, etc.), weaponization (bundling exploits with backdoors into deliverable payloads), delivery of weaponized bundles to victims, exploitation to execute code on a target system, installation of malware, command and control, and acting on objectives.

In this model, each phase has a corresponding stage to interrupt and contain the attack. The earlier in the kill chain the threat is addressed, the less potential it has to do damage. Companies can detect attackers as they poke around during recon, deny access to data, stop data going to attackers, counterattack command and control, and contain network segmentation.

The traditional attack method is typical of advanced persistent threat (APT) attacks and was common in cybercrime from the mid- to late 2000s, explains Matt Downing, principal threat researcher at Alert Logic.

“It’s an explicit set of steps where the kill chain really made sense,” he says. “An attacker is interested in you because of what you possess or who you are. They do reconnaissance to figure out your attack surface … this is your typical targeted attack scenario.”

Depending on what they found during the recon phase, attackers would match a victim’s vulnerabilities against the exploits they had, bundle them up, and pass them on.

What researchers found is attackers now have modified this kill chain to consolidate the first five phases into a single action, accelerating the process of identifying vulnerable systems and launching attacks. The phases of recon, weaponization, delivery, exploitation, and installation are compressed as attackers leverage predefined, weaponized packages against targets. This merged kill chain was used in 88% of attack cases, researchers report.

Its use case is evident in cryptojacking, which researchers found to be the driving motivation for many attacks showing the condensed cyber kill chain. Most (88%) WebLogic attacks were cryptojacking attempts, and while this type of cybercrime doesn’t steal data or hold systems hostage, it is a sign that target systems are vulnerable to the placement of other malware.

“In the context of cryptojacking, it makes every single host on the Internet valuable,” Downing says. Attackers armed with cryptominers don’t need to conduct recon. They can simply send off their preweaponized payload, and the contained sequence of events plays out. Ransomware is similar; however, a few factors are boosting the appeal of cryptojacking.

For starters, many view cryptomining as a more benign activity. “There’s a lower ethical bar for some,” points out Christine Meyers, director of product marketing at Alert Logic. “[Attackers] just feel as though this is a victimless attack, whereas ransomware isn’t.”

Operationally, cryptojacking is easy, Downing says. Morally, it’s “a bit ambiguous” but growing among financially motivated cybercriminals who want direct access to digital currencies.

On a broader level, researchers noticed an uptick in automated attacks and “spray and pray” techniques. Web applications remain the primary attack vector across industries, including retail and hospitality (85%), nonprofits (82%), media and entertainment (80%), information technology and services (77%), education (74%), and financial services (71%).

To mitigate risk, researchers advise going back to basics. Vulnerability scanning, especially for low-level vulnerabilities, is essential to learn how an attacker can gain easy access to an environment. “It’s a fundamental hygiene issue,” says Downing, noting that “knowing and patching” is the key to defending against the consolidated cyber kill chain.

Meyers advises regularly assessing security posture – and doing so often. “It’s not a one-and-done thing where you address risk once and it never changes,” she says. “You need to continuously assess it.”

Related Content:

• Cryptomining Malware Continues Rapid Growth: Report
• Fault-Tolerant Method Used for Security Purposes in New Framework
• 6 Dark Web Pricing Trends
• Hacking Back: Simply a Bad Idea

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/the-cyber-kill-chain-gets-a-makeover/d/d-id/1332892?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In perhaps the most comprehensive experiment to study cybersecurity decision-making, MIT’s Sloan School of Management last year paired a group of seasoned security executives with a control group of inexperienced graduate students to test who might fare best in a simulated threat environment.

While the two groups performed differently on various aspects of the simulation, overall there was no significant difference in the success rates of the two groups. The study’s authors note that their conclusion is not to diminish the importance of expertise, but rather that security executives need better tools and training that provide clear visibility into the state of security on the ground. The disconnect, the MIT researchers observe, is in the “significant gaps between business managers’ perceptions, and the actual state of the cybersecurity of their organizations,” exhorting the cybersecurity community to design and adopt enhanced educational and training programs that challenge entrenched mindsets and encourage proactive cybersecurity capability development.

The results are not surprising. Hard-to-define “knowledge gaps” abound between IT leadership, the C-suite, and even boards of directors who are ultimately accountable for the security of data. This is the argument made increasingly by CISOs themselves. In a 2017 survey of 300 CISOs by the cloud-based software company ServiceNow, 81% of respondents say they are highly concerned that breaches at their companies are going unaddressed. Some 78% worry about their ability to detect breaches in the first place. Only 19% of security chiefs say their company is highly effective at preventing security breaches.

The situation is hardly hopeless, but it does require a mindset that begins with an acknowledgement of the fraught way IT and data management has evolved within companies. In the past, IT infrastructure was simply a production tool and source of tactical advantage. Data’s use as a strategic tool came later.

Enter the Data-Driven Enterprise
Data security was always an issue for IT managers, but the squalls were smaller. Today’s emphasis on cloud computing, distributed systems, native mobile apps, and the Internet of Things has created the perfect storm. Customer data, market data, intellectual property, resource consumption data, productivity data, and dozens of other categories are a new form and flow of currency in the data-driven enterprise. However, as data flow has achieved parity with cash flow, the CISO or the CSO has not achieved parity with the CFO.

Consider that companies have had decades to work out the metrics of finance: balance sheet, income statement, and statement of cash flows. These are the standard tools that every CEO has been trained to read. They roll up detailed financial information from every corner of a business into brief, concise reporting that can be quickly consumed and watched over time to aid understanding of the health and progress of a business.

A similar reporting interface can be developed for commercial and business data — and the associated risks. It starts with three guideposts:

1. Establish a common language. Every executive knows what EBITDA is, or the difference between receivables and payables. Data must be characterized into groupings that executives can understand when they approach it from a compliance and risk perspective. Rather than using application names or table or column names, group data at the lowest level into buckets like “high-sensitivity personally identifiable information” or “customer payment information.”

2. Draw a direct line between the user and the data. Financial reporting focuses exactly on who is spending what. Too often companies focus on the relationship between users and application access. This is important, but it doesn’t take into account which applications have access to what data, and therefore ignores the direct relationship between users and data. Who is accessing what? Understanding that direct relationship and even enforcing policy focused on that relationship brings new clarity to data use.

3. Create digital truth. Financials are audited on an annual basis so that executives and regulators know that they can be trusted. Through new technologies like blockchain, data flows can be recorded directly as they happen, making the resulting audit trail immutable and virtually impossible for the record to be manipulated.

It’s time that the business owners and the decision makers who are accountable for the integrity and security of their enterprise data have the tools on hand that correlate with this accountability. Just as financial statements deliver the truth about money, the intelligence on critical flows of data must be structured and organized to deliver concise truth about data.

Related Content:

• Why CISOs Should Make Friends With Their CMOs
• 5 Steps to Success for New CISOs
• The 7 Habits of Highly Effective Security Teams

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dave Sikora is a technology industry veteran with more than 20 years of experience that spans enterprise software, data intelligence, private equity, mobile applications and supply chain solutions. As CEO at ALTR, he is focused on expanding the ways enterprise companies can … View Full Bio

Article source: https://www.darkreading.com/analytics/managing-data-the-way-we-manage-money/a/d-id/1332896?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Chronicle, the independent cybersecurity business under Alphabet, today is releasing a major update to VirusTotal, dubbed VirusTotal Enterprise. The new offering combines VirusTotal’s existing capabilities with new tools, features, and an interface for corporate security pros.

Alphabet, the parent company of Google, Nest, and other ventures, announced Chronicle in January. At the time, Chronicle was the latest program to graduate from X, Alphabet’s tech incubator. It was created to help tech pros detect cyberattacks before they did harm through the combination of a security analytics platform and VirusTotal, which Google bought in 2012.

Chronicle has expressed a focus on enterprise security from the start. This marks VirusTotal’s first major release since Chronicle made its debut earlier this year. Under Alphabet, the platform has grown from increased scalability of data collection, processing, and search. Now, it’s leveraging this expansion to help businesses detect, organize, and address security alerts.

“We’re bringing enterprise expertise in Chronicle to make the product more useful for the cases enterprises are going to be facing,” says Mike Wiacek, Chronicle co-founder and chief security officer.

Security pros can use the tool to search for malware samples with VirusTotal Intelligence, look for future malware samples using VT Hunt with YARA, analyze malware relationships using VT Graph, and automate all of this with VirusTotal’s API. Below, a description of what’s new:

(Image: VT Graph, Chronicle)

Private Graph
Businesses using VirusTotal Enterprise will have access to Private Graph, a feature VirusTotal announced earlier this year to create visualizations of malware relationships while integrating internal corporate information and keeping it all private from other VirusTotal users.

In studying different forms of malware, Wiacek explains, security pros want to know how different forms of malware relate to one another. They can build a giant mesh of which files relate to one another, which relate to different IP addresses, which link to different forms of malware, and how all of their behaviors interrelate. This is all possible with VirusTotal Graph.

“They’re trying to use that knowledge to discover new malware and new features and functionality related to it,” Wiacek says.

But practitioners don’t always want to share enterprise assets (people, departments, machines) publicly, so they requested a way to keep some graphs hidden from the VirusTotal community. Unlike traditional graphs, private graphs aren’t visible to other users on the platform.

Enterprise users on VirusTotal have different concerns than security researchers, Wiacek explains. “An enterprise analyst has different concerns around privacy and data,” he adds. A university researcher looking into an attack might not have the same concerns around keeping the process under wraps as someone trying to protect customers’ information.

With Private Graph, security teams can create investigations restricted to the people collaborating on it. They can add their own data elements, combined with VirusTotal data, to visualize threats and compare internal and external data. For example, if someone’s machine was infected, you can enter it on a graph and compare that threat with others seen in the wild.

Private graphs can automatically identify and extract threat commonalities from nodes to pinpoint indicators of compromise. Owners of private graphs can share their graphs with other private groups, Wiacek adds.

Ramping Up Malware Search
Chronicle reports VirusTotal Enterprise increases search speed by 100x using new malware n-gram content searches and improves search accuracy by looking for additional parameters: spam emails with a common visual layout, for example, or common icons across files.

“Traditionally, if you’re a commercial customer, you can write custom malware signatures to match files, and match files to see a particular malware strain you’re looking for,” Wiacek explains. “Really, you can enhance and improve speed with which researchers use the VirusTotal corpus to compare malware at scale,” he adds, noting that the new capabilities in VirusTotal Enterprise can accelerate searches from a few hours to seconds.

Malware analysis is also getting an update: Users will have access to more details about uploaded files, included embedded domains, IP addresses, and interest-ranked strings. The search tool lets them look for links across files, behaviors, and relationships, says Wiacek.

Enterprise Management Tools
VirusTotal is adding another layer of security with this release by letting customers use their existing two-factor authentication to access VirusTotal Enterprise accounts. A new API management for corporate groups will keep internal user directories synced with VirusTotal.

Related Content:

• Google to Stop Automatically Logging Users into Chrome
• Inside Microsoft Azure Sphere
• Mirai Authors Escape Jail Time – But Here Are 7 Other Criminal Hackers Who Didn’t
• The Cyber Kill Chain Gets a Makeover

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/alphabets-chronicle-releases-virustotal-enterprise/d/d-id/1332916?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Researchers have discovered a security flaw in the authentication process of the Apple Device Enrollment Program (DEP), an Apple service that helps enterprises enroll iOS, macOS, and tvOS devices in mobile device management systems.

The problem is centered around the authentication required (or not required) for those enrolled devices.

“The vulnerability lets someone send a valid Apple serial number to the server and retrieve the DEP profile,” says James Barclay, senior RD Engineer and lead analyst at Duo Labs, which found the bug.

And that doesn’t necessarily mean that the attacker has seen the devices. “The key space is small enough that the attacker could conceivably generate brute-force numbers and submit them in bulk until they get a valid response,” explains Barclay. While the DEP profile contains information on networks and privileges that could be useful to expand an attack, the news could be much worse for some organizations with specific MDM configurations.

“Many configurations of MDM don’t require further information on the system it’s recording,” says Rich Smith, director of Duo Labs. “If the MDM server doesn’t have authentication requirements, an organization that’s dispensing the certificates for their VPN through the MDM server could see an attacker be enrolled, get the certificate and VPN configuration information, and be an authorized device in the network.”

And at that point, the malicious device is free to roam the network doing its dirty work with little to slow it down, he says.

As of the time of this posting, there is no evidence that this attack has been used in the wild, Smith says.

Duo Labs, which detailed its findings in a blog post published today, followed a 90-day disclosure policy for the vulnerability, notifying Apple approximately 3 months before issuing their report. Duo will not publicly release the code to exploit the vulnerability, Smith says.

Remediating the vulnerability is not something an individual customer can do much about, Smith says. “It’s less a bug and more a flaw; the serial number as the only information used to authenticate a device is the source of the issue.”

“Fixing a flaw may be more complex than fixing a bug,” he notes.

The serial number is not sufficient for authentication, he says. It’s not a “strong enough form of authentication to provide the properties we’d like to see for enrolling in an organization’s fleet,” Smith says.

Meanwhile, Apple may not have to release a patch for the flaw to users. Barclay points out that the issue exists in server-based code within Apple; remediation may happen at any time, with little or no notice to users of the service. Apple has not yet responded publicly about the flaw.

Related Content:

• 10 Tips for More Secure Mobile Devices
• Can Android for Work Redefine Enterprise Mobile Security?
• Half of Small Businesses Believe They’re Not Cybercrime Targets

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/security-flaw-found-in-apple-mobile-device-enrollment-program-/d/d-id/1332920?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple