adm – Page 649 – STE WILLIAMS

Google actually listens to users, hands back cookies and rethinks Chrome auto sign-in

library
crime | hacking | security

Stung by criticism over its creepy cookie hoarding and automatic sign-in in Chrome, Google has pulled a swift U-turn. Kind of.

That syncing feeling when you realise you may be telling Google more than you thought

Chrome 70, due in October, walks back controversial changes in the browser that had the privacy world all aflutter as Google said it heard and “appreciates” the feedback it got from users.

Doubtless still hiding behind the sofa in Google HQ, Chrome product manager Zach Koch trotted out the earlier excuse that automatically signing a user into Chrome when logging into a Google property was absolutely fine. He went further, showing a blown-up image of the browser to, er, demonstrate how clear the signed-in indicator was.

While still insisting that everything was peachy because this didn’t also auto-enable a Sync slurp of the browser history, Koch proffered a compromise. An option to prevent the sign-in will be tucked away in the Privacy and Security settings, and if turned off, Chrome would behave as it always has.

The Register has contacted Google to check what the default behaviour of this switch is going to be. After all, if it silently defaults to On and the user has to hunt through the UI to turn the thing off, this is little more than a gesture.

Koch also highlighted tweaks to the Chrome UI to make it clearer if Sync is running or not. In our testing, the option “everything” was the default for Sync, requiring a user to opt out of a full slurp rather than opt in.

Finally, Koch assured users that Chrome’s greedy hoarding of Google cookies will stop. Deleting all cookies will mean all cookies are deleted, you lucky, lucky people.

Independent cybersecurity and privacy researcher Dr Lukasz Olejnik reckoned that the changes, introduced silently in Chrome 69, were significant enough to merit a data protection impact assessment (DPIA) under GDPR.

Olejnik went on to say that the tweaks appearing in Chrome 70 further enriched the case. “In effect, Chrome 70 is shipping changes, addressing the issue in a reactive fashion. It is interesting to see Privacy by Design (not) at work.”

For many, it is too little and too late.

Anyway, a big shoutout to the Chrome team for listening and doing damage control. I realize that this is about as good as it’s going to get, so I promise not to complain much about it anymore. I am, however, going to use this as my impetus to start separating from Google.

— Matthew Green (@matthew_d_green) September 26, 2018

The final word goes to Olejnik, who observed: “Would that [have] happened had nobody noticed? What if no privacy/trust-fluent folks had uninstalled Chrome? Who would watch then?”

Who indeed. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/26/google_backtrack_chrome/

Can’t read my… broker face: Premium Credit back online a week after cyber attack

library
crime | hacking | security

UK-based insurance services firm Premium Credit has hauled itself back online following a malware-based attack that struck the business more than a week ago.

Premium Credit underwrites insurance premiums for a network of brokers, business and personal customers and has 400 staffers across the UK and Ireland.

In a statement on its website yesterday that accompanied its return after nine days offline, the UK and Ireland firm played down the episode, adding it had found “no evidence of data loss” following an unspecified “cyber incident”.

External experts continue to investigate. “We have now restored many key systems, and are working around the clock to complete our full restoration,” the statement concluded.

So what happened? The insurance premiums financer told El Reg that it had suffered from an unspecified malware outbreak, adding that it had taken its systems offline as a “precaution“. In a follow-up statement, received via email, Adam Morghem, strategy and marketing director at Premium Credit, provided a fuller rundown of events.

On Sunday 16th September, our virus monitoring alerted us to a cyber incident. We followed our extensive security protocols designed to protect our systems and isolate our partners from harm. We then began the investigation into the incident with external 3rd party experts.

Since then, we have been working around the clock to restore our services for our brokers. Our trading systems are live with our brokers.

Our call centres have been open since Monday 17th to support customers and producers during the outage.

He told us the internal and external probes by infosec specialists had not turned up any evidence of data loss. He said it has told customers that any payment that was delayed due to the outage will not be treated as a deafult so no default charge will be levied.

“We can only apologise for the disruption this has caused our partners and their customers,” said Morghem.

El Reg checked in with Troy Hunt, the security researcher behind the Have I been Pwned breach notification service and normally among the first people to hear about any customer data leak. He said he hadn’t heard anything yet, a good sign, though hardly definitive. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/26/premium_credit_outage/

USB Drives Remain Critical Cyberthreat

library
crime | hacking | security

USB thumb drives may be used less frequently than before, but they are still commonly used as infection vectors for a wide variety of malware.

Small USB sticks can mean big security troubles, according to a new report out today. While USB thumb drives have been overtaken by cloud services as convenient ways to move files from one system to another, they are still commonly used as infection vectors for a wide variety of malware.

“USB threats from malware to miners,” published on Kaspersky Labs’ SecureList, looks specifically at the threats posed by the pocketable devices. According to the report, the Windows LNK malware family is the top threat, with over 22.7 million attempted WinLNK.Agent infections detected. They affected nearly 900,000 users in 2017 and, so far, just over 700,000 users in an estimated 23 million attacks in 2018.

“USB devices may be less effective at spreading infection than in the past, due to growing awareness of their security weakness and declining use as a business tool, but our research shows they remain a significant risk that users should not underestimate,” said Denis Parinov, anti-malware researcher at Kaspersky Lab, said in a prepared statement.

It’s a risk that can actually grow with added security. In an interview at this week’s Ignite 2018, Rob Lefferts, corporate vice president for Microsoft 365, security, and compliance at Microsoft, pointed out that security procedures that add too much “friction” to business processes are the source of shadow IT. “If you make things too difficult, slow things down too much, it drives users to put files on a USB drive or go to their own cloud service. They’re going to get their work done,” he said.

Because USB sticks continue to get the work of carrying malware done, they have been frequent infection vehicles for malware families dating back as far as five years, according to the report. They are not simply vehicles for malicious nostalgia, though; the report notes that the USB payload can include cryptominers (often piggybacking on Trojans known since at least 2014).

USB drives are a global problem, but they’re especially prevalent in developing nations that may see more use of the small devices. The report notes that nations with less-developed communication infrastructures tend to see more local incidents of malware, such as root drive infections, while areas with better networking are more likely to be targeted by cryptominers and other revenue-generating issues.

The report concludes with advice for minimizing the chances of malware infection through a USB drive. That includes being careful with unknown USB devices, investing in encrypted USB drives when they are necessary for business use, and putting a plan in place for checking every USB device (and every file on them) for malware prior to the files being transferred to any production machine.

Related Content:

Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/usb-drives-remain-critical-cyberthreat/d/d-id/1332894?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Mirai Authors Escape Jail Time

library
crime | hacking | security

Courts are getting tougher on the cybercrooks than some might realize.

Image Source: United States Courts

Three individuals who admitted responsibility for creating and operating the highly disruptive Mirai botnet of 2016 have escaped jail time. Instead, they will now assist US law enforcement on cybersecurity matters.

On Sept. 18, a federal judge in Alaska sentenced Paras Jha, 22, of Fanwood, NJ; Josiah White, 21, of Washington, Pa.; and Dalton Norman, 22, of Metairie, La., to five years of probation and 2,500 hours of community service. The three also have to pay $127,000 as restitution for their crime.

Chief US District Judge Timothy Burgess cited the extraordinary cooperation the three individuals had extended to the FBI in several other major and ongoing cybercrime investigations as a reason for his “substantial departure” from sentencing guidelines.

The trio is certainly not the first to get off with what some would consider a light sentence, especially considering how disruptive Mirai was. But for every Jha, White, and Norman are many others who have ended up with substantial jail times. Here are seven criminal hackers who did not fare as well in court.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/mirai-authors-escape-jail-time---but-here-are-7-other-criminal-hackers-who-didnt-/d/d-id/1332873?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

How to thwart rogue staff: Tune in Tuesday this week to our live insider threat webcast

library
crime | hacking | security

Broadcast On 26 September 2018 at 10am PDT, 11am MT, 6pm UK, we’ll have a studio full of experts lined up to talk about insider threats and how even the best organisations can suffer from occasional bouts of “bad employee syndrome”.

It’s clearly a challenge that’s not going to go away as more companies develop mobile workforces and the ability to spot bad practices and actors has become more difficult than ever.

During the hour long broadcast, we’ll be exploring:

What is the new face of the insider threat – how do bad apples manifest themselves in today’s organisations?
What are the costs of doing nothing – how much damage is being done, day on day, and why is nothing being done?
What does a solution look like – how do best practices, tools and roles combine to mitigate the insider threat?
Where to start – what is the best approach to take an organisation from a denial state to a clear view?

The gig is hosted by our own Jon Collins and includes experts from LogRhythm and analysts from Freeform Dynamics. They’re all geared up to answer your questions so come along, come prepared and learn a lot. You can register here.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/25/the_evolution_of_the_insider_threat/

Have I been pwned, Firefox? OK, let’s ask its Have I Been Pwned tool

library
crime | hacking | security

Mozilla on Tuesday debuted a service called Firefox Monitor that it has been testing to help people see whether their email addresses have been compromised.

“We’ll let you know if your email address and/or personal info was involved in a publicly known past data breach,” said Nick Nguyen, Mozilla’s VP of Firefox Product, in a blog post. “Once you know where your email address was compromised you should change your password and any other place where you’ve used that password.”

Firefox Monitor is basically a wrapper for Have I Been Pwned (HIBP), a sprawling database of several billion email addresses (and, separately, passwords) that have shown up in spilled data. Monitor consists of an input form – with Firefox download links – submits hashed email addresses to HIBP and performs a bit of processing on the returned data.

Its main virtue is the hashing, a mathematical mechanism for encoding data. The service creates an SHA-1 hash of the submitted email address and takes the first six characters – [email protected], for example, becomes 567159, from 567159D622FFBB50B11B0EFD307BE358624A26EE – and submits them to HIBP’s hash range query API. HIBP then returns a range of possible matches, if any, to the six character string, without ever handling the full email address.

Mozilla changes Firefox policy from ‘do not track’ to ‘will not track’

Firefox Monitor then iterates through the supplied list, searching for a match of the full email address hash. If found, it tells the user that the email address at issue has been spotted in a data dump, which means the account owner should change the password to avoid being hacked.

HIBP works fine without Firefox Monitor – and has been integrated into other products like 1Password – but other systems involve submitting an email address directly to the site without hashing. This may seem like a quaint concern when looking into whether one’s email address and password have already been exposed online. But it may matter to some.

In an email to The Register, a Mozilla spokesperson explained that Firefox partnered with Troy Hunt, who runs HIBP, to make it easier for internet users to access the service.

“Our first step is to bring the data in HIBP and surface it to users through our website and in-product notifications for Firefox users,” Mozilla’s spokesperson said.

“One difference for now is that sensitive sites will only be sent to you after you’ve verified your email to help keep you safe. There are future plans to integrate it more deeply into the Firefox and future products that are underway.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/25/mozilla_firefox_monitor/

While the UN laughed at Trump, hackers chortled at the UN’s lousy web application security

library
crime | hacking | security

The United Nations has been hit with two damning data leak allegations in as many days.

The global organization has seen researchers uncover a pair of flaws that had left a number of its records, and those of its employees, accessible to hackers online.

Word of the first issue came out yesterday when security researcher Kushagra Pathak found that the UN had left an unsecured set of Trello, Jira and Google Docs projects exposed to the internet.

Pathak, who has specialized in uncovering vulnerable Trello boards and web apps, said the exposed information included account credentials and internal communications and documents used by UN staff to plan projects.

After stumbling onto the vulnerable Trello board, he was able to then get access to the Jira and Google Docs deployments where he harvested other sensitive data. Pathak privately reported the issue to UN, who has since locked down the vulnerable web app instances.

The second exposure was uncovered by researcher Mohamed Baset of Seekurity and resulted in the exposure of “thousands” of résumés submitted by job applicants.

Baset reports that the UN failed to patch vulnerabilities in one of the WordPress CMS systems it uses to handle job applications. This would potentially allow anyone who chose to exploit the local path disclosure the ability to access the thousands of CVs people had submitted when they applied for a job with a UN agency.

The vulnerability was reported to the UN in August, but after getting the full bureaucratic runaround, Baset decided to go public with the flaw this week, and share a proof of concept video:

Youtube Video

It wasn’t all long faces at the UN this week, however.

Members of the org had a moment of levity this morning when US President Donald Trump addressed the General Assembly. The Commander-in-Chief’s boasts of historic accomplishments at the helm of America sparked chuckling and guffawing by foreign diplomats witnessing his speech…

WATCH: Laughter in UN General Assembly as President Trump touts his administration’s progress in past 2 years: “Didn’t expect that reaction, but that’s OK.” pic.twitter.com/V7GViB5g4B

— NBC News (@NBCNews) September 25, 2018

A nice chuckle was had by most. Meanwhile, at last estimate, Trump was custodian to some 4,000 nuclear warheads. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/25/un_trello_jira_wordpress_vulnerability/

NSA dev in the clink for 5.5 years after letting Kaspersky, allegedly Russia slurp US exploits

library
crime | hacking | security

The now-former NSA employee at the heart of the Kaspersky Lab exploit siphoning scandal has been thrown behind bars for five and a half years.

Nghia Hoang Pho, 68, was sent down on Tuesday in the same Baltimore US district court where last year he plead guilty to one felony count of willful retention of national defense information.

Back in 2015, Pho was working for the NSA as a programmer on its highly secretive Tailored Access Operations (TAO) hacking team, when he took top-secret exploit code from America’s surveillance nerve-center home with him to Ellicott City, Maryland, to study.

When Pho loaded the classified security vulnerability exploits up on his home Windows PC, they were scanned by his Kaspersky Lab antivirus software, detected as particularly interesting by the toolset, and subsequently uploaded to the Russian biz’s backend for analysis. From there, the exploit code supposedly fell into the hands of Kremlin agents.

It would later surface that Pho had been taking his highly classified work home with him for roughly five years prior to the incident, and had amassed what US prosecutors called “massive troves” of classified information.

Winner, Winner, prison dinner: Five years in the clink for NSA leaker

Though Kaspersky would deny that it knowingly handed any of the exploit code over the Russian government, the fallout from the brouhaha resulted in the security biz being slapped with a ban on doing business with Uncle Sam’s Homeland Security and the rest of the federal government.

Kaspersky was accused of handing, directly or indirectly, the slurped NSA cyber-weapons to Russian government spies to study and use, but the antivirus maker denied any direct link: the biz claimed it deleted the uploaded files as soon as it realized they were leaked NSA tools.

Pho, meanwhile, took a plea deal, and faced the unenviable position of being made an example US prosecutors set for other intelligence workers who may be tempted to compromise their own classified work by taking it off government premises.

“Pho’s intentional, reckless, and illegal retention of highly classified information over the course of almost five years placed at risk our intelligence community’s capabilities and methods, rendering some of them unusable,” said Assistant US Attorney General John Demers.

“Today’s sentence reaffirms the expectations that the government places on those who have sworn to safeguard our nation’s secrets.”

Well, kind of. Remember David Petraeus, the US general who shared classified military secrets with his mistress? He got probation. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/26/nsa_worker_jailed/

‘Scan4you’ Operator Gets 14-Year Sentence

library
crime | hacking | security

The counter antivirus service, which was shut down in 2016, caused a total loss amount of $20.5 billion, according to the DoJ.

Ruslans Bondars, operator of the “Scan4you” counter antivirus (CAV) service, has been sentenced to 14 years in prison for his role in helping hackers evade antivirus software, the Department of Justice announced this week.

Scan4you was one of the Dark Web’s largest CAV services before it was shut down in 2016. Cyberattackers could use it to determine whether the malicious software they created would be detected by antivirus software. Between 2009 and 2012, the time frame when Scan4you was running, at least 30,000 people used the illicit service to test their malware.

Bondars, a 38-year-old Latvian resident and citizen of the former USSR, was convicted by a federal jury in Virginia on May 16, 2018. After a five-day trial, he was charged with one count of conspiracy to violate the Computer Fraud and Abuse Act, one count of conspiracy to commit wire fraud, and one count of computer intrusion with intent to cause damage and aiding and abetting.

“Ruslans Bondars helped malware developers attack American businesses,” said assistant attorney general Brian Benczkowski. One of these was Target, which was hit with a breach in 2013 that compromised more than 40 million credit cards and nearly 70 million email addresses. Another attacker used Scan4you to create the Citadel Trojan, which infected over 11 million devices.

In issuing its sentence, the court found a total loss amount of $20.5 billion. On top of Bondars’ prison sentence, a judge ordered him to three years of supervised release.

The Cyber Kill Chain Gets A Makeover

library
crime | hacking | security

A new report demonstrates how the cyber kill chain is consolidating as criminals find ways to accelerate the spread of their targeted cyberattacks.

The early phases of the traditional cyber kill chain are merging as criminals seek out faster ways to launch targeted attacks, a new report explains.

As part of the “2018 Critical Watch Report,” researchers at Alert Logic reviewed 254,274 total verified security incidents, 7.2 million events linked to those incidents, and 1.2 billion anomalies between April 1, 2017, and June 30, 2018. They surfaced five key insights, top of which was the realization that the traditional cyber kill chain is transforming for different types of attacks.

Since 2011, they report, the typical kill chain has comprised seven steps: reconnaissance (harvesting credentials, email addresses, etc.), weaponization (bundling exploits with backdoors into deliverable payloads), delivery of weaponized bundles to victims, exploitation to execute code on a target system, installation of malware, command and control, and acting on objectives.

In this model, each phase has a corresponding stage to interrupt and contain the attack. The earlier in the kill chain the threat is addressed, the less potential it has to do damage. Companies can detect attackers as they poke around during recon, deny access to data, stop data going to attackers, counterattack command and control, and contain network segmentation.

The traditional attack method is typical of advanced persistent threat (APT) attacks and was common in cybercrime from the mid- to late 2000s, explains Matt Downing, principal threat researcher at Alert Logic.

“It’s an explicit set of steps where the kill chain really made sense,” he says. “An attacker is interested in you because of what you possess or who you are. They do reconnaissance to figure out your attack surface … this is your typical targeted attack scenario.”

Depending on what they found during the recon phase, attackers would match a victim’s vulnerabilities against the exploits they had, bundle them up, and pass them on.

What researchers found is attackers now have modified this kill chain to consolidate the first five phases into a single action, accelerating the process of identifying vulnerable systems and launching attacks. The phases of recon, weaponization, delivery, exploitation, and installation are compressed as attackers leverage predefined, weaponized packages against targets. This merged kill chain was used in 88% of attack cases, researchers report.

Its use case is evident in cryptojacking, which researchers found to be the driving motivation for many attacks showing the condensed cyber kill chain. Most (88%) WebLogic attacks were cryptojacking attempts, and while this type of cybercrime doesn’t steal data or hold systems hostage, it is a sign that target systems are vulnerable to the placement of other malware.

“In the context of cryptojacking, it makes every single host on the Internet valuable,” Downing says. Attackers armed with cryptominers don’t need to conduct recon. They can simply send off their preweaponized payload, and the contained sequence of events plays out. Ransomware is similar; however, a few factors are boosting the appeal of cryptojacking.

For starters, many view cryptomining as a more benign activity. “There’s a lower ethical bar for some,” points out Christine Meyers, director of product marketing at Alert Logic. “[Attackers] just feel as though this is a victimless attack, whereas ransomware isn’t.”

Operationally, cryptojacking is easy, Downing says. Morally, it’s “a bit ambiguous” but growing among financially motivated cybercriminals who want direct access to digital currencies.

On a broader level, researchers noticed an uptick in automated attacks and “spray and pray” techniques. Web applications remain the primary attack vector across industries, including retail and hospitality (85%), nonprofits (82%), media and entertainment (80%), information technology and services (77%), education (74%), and financial services (71%).

To mitigate risk, researchers advise going back to basics. Vulnerability scanning, especially for low-level vulnerabilities, is essential to learn how an attacker can gain easy access to an environment. “It’s a fundamental hygiene issue,” says Downing, noting that “knowing and patching” is the key to defending against the consolidated cyber kill chain.

Meyers advises regularly assessing security posture – and doing so often. “It’s not a one-and-done thing where you address risk once and it never changes,” she says. “You need to continuously assess it.”

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/the-cyber-kill-chain-gets-a-makeover/d/d-id/1332892?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple