STE WILLIAMS

Do you really want to be the crazy guest who checks alarm clocks and coat hooks and smoke alarms and USB power plugs and lightbulbs and air fresheners and picture frames and wall outlets for hidden cameras when you check into an Airbnb?

Oh, YES.

On Thursday, Scottish traveler Dougie Hamilton was sitting there, staring at his Airbnb’s alarm clock, wondering whether he wanted to be that tinfoil hat kind of guest. After 10 minutes, he gave in to the weird feeling he was getting from that odd clock, which he says was wired like a phone charger.

As he told the Daily Record, he “felt a bit weird even thinking it” and kept telling himself “not to be daft. But there was just something.”

Oh yeah, there was something. There was, in the device that was pointed right at the open-plan bedroom, a hidden webcam:

I took the charger out of it and saw there was a lithium battery in the back. At this point, I slid the front facing off the clock and could see there actually was a camera.

Hamilton and his girlfriend, who didn’t want to be identified, had just checked into their Airbnb in Toronto. They were there for about 20 minutes, relaxing after a busy day in the city, before Hamilton noticed the clock.

I just happened to be facing this clock and was staring at it for about 10 minutes. There was just something in my head that made me feel a bit uneasy.

Hamilton and his travel companion didn’t know if the rental’s owner had been watching them, but given that the hidden camera was facing into the living area and the open-plan bedroom, he certainly could have seen whatever he wanted.

It just felt really creepy, and we didn’t want to stay.

We’re innocent-minded people, but the clock was facing where our bed was, and we thought it might be for something more sinister like a sex ring.

Hamilton immediately got in touch with Airbnb, which promised him that it would launch an urgent investigation. The service also told him that the host in question has six other properties that he rents out.

Next, Hamilton called Toronto police. A spokeswoman for Toronto police confirmed to the Daily Record that an investigation into the hidden video camera was under way.

Hamilton says that Airbnb passed the couple’s official complaint on to its security team. Then it gave them a choice of three nearby luxury hotels and told them that they’d get a full refund. Airbnb also said that the host’s future reservations would be cancelled.

Undisclosed electronic surveillance is verboten per Airbnb rules. It’s also completely verboten in “private” spaces, such as bedrooms and bathrooms, even if a host discloses it.

And no, you’re not safe from hidden webcams – or from non-hidden webcams that have been hacked, for that matter – if you opt for a hotel room over an Airbnb listing. Hotel owners have also been found guilty of setting up live links to record people having sex.

You can see why Airbnb hosts would want to record guests: they don’t want their places trashed, and they don’t want their stuff stolen. There are ways to avoid getting ripped off on Airbnb from a cyber perspective, but hidden cameras are a whole other kettle of fish.

Even if hosts use a hidden surveillance camera merely to make sure their home and possessions aren’t trashed, with no intention of nefariously capturing nude images or intercepting private information about their guests, the setup of a hidden surveillance camera, the presence of which was allegedly undisclosed, was still an egregious breach of privacy.

Even if the hosts hadn’t planned to sell or post naked images, that doesn’t mean that an intruder couldn’t hack a webcam and do it in their stead.

How to detect a hidden webcam

Derek Starnes, who works in tech and who detected a webcam hidden inside a Florida Airbnb a year ago, told WFTS that he spotted a small black hole on a smoke detector and became curious. Poking around, he found a camera and microphone had been hidden inside. He immediately alerted police.

There are other ways to detect these hidden devices besides curious little holes. That’s good to know, given that some of them can be hiding behind furnishings, decorations or vents.

For a camera to see you, it needs a line of sight, and that means that you can see it. So visually inspect vents for holes or gaps – you could even look for a lens reflection by turning off the lights and scanning the room with a flashlight.

If you’re feeling flush, you could pick up a gizmo for finding cameras (they can get pricey), or if you’re technical you could use Nmap or similar to see what gadgets are using the Wi-Fi.

What to do if you detect an undisclosed camera

1. Take photos of the device for evidence.
2. Take photos of your accommodation so you can prove that you haven’t trashed the place: some hosts have reportedly made such false accusations.
3. Get your clothes on and get out of there.
4. Report it to police. You want to stop that stream before other people get swept up in it.
5. If you’re in an Airbnb rental, report it to Airbnb, along with your evidence, before it happens to another victim.

By the way, we’ve done more than just two hidden-webcam-in-Airbnb stories. It’s a bit of a genre: here’s a third.

Dougie Hamilton, we don’t think you’re weird for wanting to pull apart that alarm clock. We think you’re reading the right kind of stories. If that makes you feel a little paranoid, well, that’s better than being included in someone’s private sex tape collection. Like say, that of Wayne Natt, the Florida Airbnb host who copped a plea deal after admitting to 14 counts of secretly filming his guests. He’s now serving a one-year jail sentence.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/JeDfHKoBF0Y/

Thanks to Peter Mackenzie of Sophos Support for his behind-the-scenes work on this article.

In the year since the “shock and awe” of WannaCry and NotPetya – outbreaks that spread globally in a matter of hours – ransomware has been making a lot less noise.

You’d be forgiven for thinking that it’s had its day, but reports of the demise of ransomware have been greatly exaggerated, as they say.

While cryptomining and cryptojacking have been sucking all the air out of the press room, a snowball that started rolling well before anyone had ever heard of WannaCry has been gathering pace and size.

The snowball is a trend for stealthier and more sophisticated ransomware attacks – attacks that are individually more lucrative, harder to stop and more devastating for their victims than attacks that rely on email or exploits to spread.

And they do it in a way that’s hard to stop and easy to reproduce.

WannaCry’s reliance on an exploit stolen from the NSA (the USA’s National Security Agency) made its success hard to replicate, and its promiscuous spread attracted the attention of law enforcement everywhere while leaving countless copies of the malware to be analysed by researchers and security companies.

The criminals behind targeted ransomware attacks have no such limits. They rely on tactics that can be repeated successfully, commodity tools that are easily replaced, and ransomware that makes itself hard to analyse by staying in its lane and cleaning up after itself.

And while the footprint of a targeted attack is tiny in comparison to an outbreak or spam campaign, it can extract more money from one victim than all of the WannaCry ransoms put together.

Targeted attacks can lock small businesses out of critical systems or bring entire organisations to a grinding halt, just as a recent SamSam attack against the city of Atlanta showed.

For every Atlanta-style attack that hits the headlines though, many more go unreported. Attackers don’t care if the victims are big organisations or small ones, all that matters is how vulnerable they are.

In fact, the three examples of ransomware we’ve chosen for this article, Dharma, SamSam and BitPaymer can be thought of (allowing for considerable overlap) as ransomware aimed at small, medium and large businesses respectively.

All businesses are targets, not just ones that hit the headlines.

For example, a recent investigation by Sophos revealed that SamSam’s apparent preference for the healthcare and government sectors was an illusion. The majority of the SamSam victims uncovered in the investigation were actually in the private sector but none of them had gone public, whereas some government and healthcare victims had.

The anatomy of a targeted attack

The specifics of targeted attacks evolve over time, vary from hacking group to hacking group, and can be adapted to each individual target. Despite that, they show remarkable similarity in their overall structure.

In a typical targeted attack, a criminal hacker:

1. Gains entry via a weak RDP (Remote Desktop Protocol) password.
2. Escalates their privileges until they’re an administrator.
3. Uses their powerful access rights to overcome security software.
4. Spreads and runs ransomware that encrypts a victim’s files.
5. Leaves a note demanding payment in return for decrypting the files.
6. Waits for the victim to contact them via email or a dark web website.

The similarity between attacks and attackers isn’t the result of coordination, but a convergence around a method that works reliably, netting the criminals using it huge payoffs.

That convergence goes as far as including details like special offers: while the ransoms they demand vary significantly, Dharma, SamSam and BitPaymer attacks all offer their victims the opportunity to decrypt one or two files for free to prove that they can do it – ransomware’s equivalent of a kidnapper’s “proof of life”.

Although the outline of each attack is very similar, scripted even, what makes targeted attacks so fearsome is that the attackers are on hand to adapt and improvise.

In a targeted attack the assailant’s job is to break into the victim’s network and maximise the chances of the ransomware succeeding in its malevolent task, and the adversary most likely to ruin the attacker’s day is security software operating as one of several layers of overlapping protection.

Writing ransomware that isn’t detected by security software is no easy task, so attackers will often look for a way to outflank it by exploiting operating system vulnerabilities that let them elevate their privileges.

If they can make themselves an administrator, an attacker will be permitted to run powerful administration tools, like third party kernel drivers, that can disable processes and force delete files, bypassing the protections put in place to stop the attackers uninstalling security software directly.

Security software still isn’t helpless though. Set up correctly, it can defend itself by blocking the legitimate third party utilities that might be used to undermine it.

Variations on a theme

The coup de grâce in a targeted attack comes when the attacker has manoeuvred themselves into a strong enough position to run their ransomware unencumbered.

Now lets look at some of the ransomware itself.

Dharma

Dharma (also known as Crysis) attacks seem to run to a simple, cookie cutter script with attackers breaking in and then downloading the things they need to execute an attack from the internet as if reading from a todo list: exploits to escalate their privileges, admin or troubleshooting tools to tackle security software, and finally the ransomware itself.

Although simple, the attacks show more variability, and occur at a much greater frequency, than either SamSam or BitPaymer attacks, which may indicate that Dharma is used by multiple groups.

Once the attacker is inside the victim’s network they place the ransomware on one or more of a victim’s servers manually. Consequently, attacks are often limited in scope, affecting just a few servers.

Most Dharma attacks seem to have affected small businesses of up to 150 users, although it’s not known if this is down to deliberate targeting or simply a side-effect of something else.

Ransom demands are made over email, using an address specified in the ransom note, away from prying eyes.

SamSam

SamSam malware first appeared in December 2015 and since then more than $6 million has been deposited into SamSam Bitcoin wallets.

The pattern of attacks and the evolution of the SamSam malware suggests that it’s the work of one person or a small group. Attacks are infrequent (around one a day) compared to other kinds of ransomware, but are devastating.

After breaking in via RDP, the attacker attempts to escalate their privileges to the level of Domain Admin so that they can deploy SamSam malware across an entire network, just like a sysadmin deploying regular software.

The attacker seems to wait until victims are likely to be asleep before unleashing the malware on every infected machine simultaneously, giving the victim little time to react or to prioritise, and potentially crippling their network.

A ransom note demands payment of about $50,000 in bitcoins and directs the victims to a dark web site (a Tor hidden service).

Each victim has their own page on the site where they can ask the attacker questions and receive instructions on how to decrypt their files.

To find out more about SamSam, read Sophos’s extensive new research, SamSam: The (almost) six million dollar ransomware.

BitPaymer

The most mysterious and sophisticated malware on our list is BitPaymer. Little is known about this elusive malware, or how it’s deployed (you can read about one of the tricks it uses to hide itself in our article, How BitPaymer ransomware covers its tracks).

What seems certain is that this ‘high end’ ransomware has raised a lot of money for its creators. Six-figure ransom demands as high as $500,000 have been reported and analysis of known BitPaymer Bitcoin addresses shows that it’s raised at least $1 million in the last month alone.

Ransom notes contain email addresses at secure email providers but the method for agreeing payment varies: some simply include a Bitcoin address while others list a dark web URL instead, like SamSam. In some attacks the victims have also been threatened with doxing.

What to do?

Targeted attacks may be relatively sophisticated but the criminals behind them aren’t looking for a challenge, they’re looking for vulnerable organisations. The best way to get yourself off an attacker’s hit list is by getting the basics right: lock down RDP and follow a strict patching protocol for your operating systems and the applications that run on them.

If an attacker does get on your network then make sure they’re met with layers of overlapping defences, a well segmented network, user rights assigned according to need rather than convenience, and be sure that your backups are offline and out of their reach.

We recently published a detailed guide on how to defend yourself against SamSam ransomware, that includes specifics on how to lock down RDP, suggestions on how to organise your user accounts and more. The advice and approach in it are applicable to all the targeted ransomware mentioned in this article.

Follow @NakedSecurity
Follow @MarkStockley

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ya1weyLg6zY/

Fancy driving a Tesla, but can’t convince your local dealer to let you have a go?

If it’s a Model X you’re after, and you don’t mind going to prison for a while if you get caught, you might now be able to fulfil your dream.

Cybersecurity researchers at the Catholic University of Leuven in Belgium just published a report describing how easy it is to clone Tesla Model X car keys.

Tesla’s use of underpowered, way-past-its-sell-by-date keyfob cryptography was to blame.

If you’ve got the popular and convenient “passive entry” setting turned on – where just bringing the key close enough to the car will will unlock it – then breaking into your Tesla car, and very likely driving off in it, may be cryptographically trivial for a car thief.

The flaw described here was responsibly reported to Tesla in mid-2017 and a bug bounty paid out. From June 2018, all Tesla cars have apparently shipped with more secure keyfobs. Also, a recent firmware upgrade for Tesla vehicles allows you to set a start-and-drive-off PIN so that the keyfob alone, whether cloned or stolen, isn’t enough for a crook to make off with your vehicle. And although the researchers explain the cryptographic issues in a way that will help you avoid similar blunders in future, they aren’t handing out any hack-a-Tesla source code for crooks to abuse.

To go joyriding in a Tesla, you will need at least:

• A one-off blast of number-crunching power. (Rented cloud computing time will do fine.)
• About 5500GB of disk space. (Rented cloud storage will do fine.)
• A suitable NFC/RFID hardware device. (Commodity item.)
• A small, portable computer such as a laptop or a Raspberry Pi. (Commodity item.)
• A missing conscience.
  

The cryptographic problem

Until recently, Tesla Model X keyfobs were based on an early-2000s product known as DST (short for Digital Signature Transponder) based on 1990s-era cryptography.

In fact, the DST hardware was analysed by Johns Hopkins University researchers back in 2005; they found it cryptographically inadequate even then, and warned that:

The weakness we have demonstrated in [this] system is ultimately due to the inadequate key length of the underlying DST40 cipher […] The authors hope that future cryptographic RFID system designers will embrace a critical lesson preached by the scientific community: cryptographic hardware systems are generally strongest when they employ industry standard cryptographic algorithms with key lengths sufficient to endure over the life of the devices and assets they protect.

Briefly put: don’t knit your own crypto, and attacks only ever get faster.

You’ve probably inferred from the name DST40 in the quote above that Tesla was using an encryption algorithm with a 40-bit key, and you’re probably aware that 40-bit keys are just half the length of the “absolute legacy minimum” of 80 bits.

(Any symmetric-key cryptographic algorithm still in use from before 2016 really ought to be using 112-bit keys or longer by now; any implementation first fielded in 2016 or later, or expected still to be in use after 2030, ought to have at least 128-bit keys.)

Remember, also, that although 40-bit keys are half the length of 80-bit keys, they are much, much, much less than half as safe against brute force attacks, where you simply try every key until you hit the jackpot.

That’s because you halve the number of different key choices every time you subtract just a single bit from the key – so shortening a key by two bits makes it a quarter as safe, by four bits makes it one sixteenth as safe…

…and, all other things being equal, shortening a key by 40 bits makes it one million million times less secure against brute force attacks. (2⁴⁰ is approximately 10¹², or 1,000,000,000,000.)

How the attack works

The Belgian researchers have a short and punchy explanation of their attack, with a fun and informative 2-minute video.

Read the explanation through before you watch the video – it’s much cooler that way round!

Simply put, here’s why 40-bit crypto simply isn’t enough.

The so-called passive entry feature, where your Tesla automatically opens up for you as you get to it, relies on the car regularly transmitting 40-bit RFID “challenges”, which are just randomly-chosen bit strings sent out to probe for nearby keyfobs.

Your keyfob, if it’s in range, encrypts the challenge into a 24-bit hash value, using the abovementioned DST40 algorithm with a pre-shared 40-bit key, and sends the resulting hash as a response.

The car, which is paired with your fob and therefore has its own copy of the pre-shared key, does the same calculation and verifies the fob’s response.

The theory is that:

• A 24-bit hash is long enough – you only have a 1/2²⁴ chance of getting lucky by blindly guessing the response. (That’s a 1 in 16 million chance – worse than the UK lottery, at 1 in 14 million – and you have to do it twice before you can drive off.)
• A 40-bit pre-shared key is long enough – keeping tables of every possible challenge hashed with every possible key is as good as impossible.
• Guessing at responses is seriously rate-limited – the car only transmits a new challenge string every second or so.

In practice, however, you don’t need a full lookup table of every challenge hashed with every key, and you don’t need to try millions of responses in order to hit the jackpot, either.

You can make what’s called a time/memory tradeoff (TMTO), where you store a table of containing some, but not all, pre-calculated hashes; you then use this partial table as a shortcut to figuring out the key.

The Belgians picked a random challenge value of their own (0x636f736963 is the number to look out for in the video) and pre-calculated the 24-bit hash of that challenge for every possible 40-bit key.

That’s a lot of computation, and a lot of storage, to be sure – but nowhere near an impossible task, at least by 2018 standards.

If we assume that every possible 24-bit hash turns up randomly, and there are 2⁴⁰ different hashes computed (one for each possible 40-bit key), it follows that each hash should show up in the list about 2⁴⁰/2²⁴ times. (2⁴⁰/2²⁴ = 2¹⁶ = 64K = 65536.)

So, the researchers ordered their TMTO list so that it started with all the roughly 65,000 different encryption keys that produced a hash of 0x000000; then they listed the keys that hashed to 0x000001; and then 0x000002; and so on for all 2²⁴ different possible hashes.

Each 40-bit key appears once in the list of 2⁴⁰ different keys for a total of 40×2⁴⁰ bits of storage space – that’s 5,497,558,138,880 bytes at 8 bits per byte, which is where the “about 5500GB” comes from above.

In other words, after paying the one-time cost of preparing the TMTO table, the researchers can now quickly read off the 65,000 possible keys capable of producing any specific hash value for their magic challenge value of 0x636f736963.
.
There’s no longer any need to try 2⁴⁰ different keys to see which one produces a given hash – the TMTO table swiftly chops the brute force search to a mere 2¹⁶ candidate keys.

Tricking the fob

The researchers now need to get close enough to your keyfob to trick it into performing two challenge-response sequences.

Firstly, they ask your fob to reply to a “challenge” of their magic number 0x636f736963 – the value used when building the TMTO table – and capture the 24-bit hash that comes back.

They look up that 24-bit hash in their 5500GB table, which quickly gives them an exhaustive list of 2¹⁶ candidate keys that could have produced that hash.

Then they generate a second, random “challenge”, and pre-calculate the hash that would come back from each of the candidate keys.

Using a battery-powered Raspberry Pi 3+, like the researchers did, calculating the list of possible hashes for all 2⁴⁰ keys would take about two years.

But calculating a list of just 2¹⁶ different hashes is 2²⁴ (16 million) times faster and therefore takes just a few seconds.

Now the attackers know, for the second challenge, what response matches up with which key.

You can see how the attack pans out:

• The first challenge/response, using the TMTO challenge value 0x636f736963, quickly narrows the keyspace down to 65,000 possibilities.
• The second challenge/response, using a randomly chosen challenge, lets the attackers check for the correct key from those 65,000 possibilities.

In the video, the simulated fob attack (watch at about 1’00”) collects the two challenge/response pairs first. Then the Raspberry Pi downloads, via Wi-Fi, the list of candidate keys indexed by the first challenge/response hash that came back (0x0a72c9 in reply to 0x636f736963). Then the Pi does the 2¹⁶ different encryptions to figure out which candidate key matches the second challenge/response pair (0x1858a1 in reply to 0x7465736c61). Downloading the candidate keys via Wi-Fi means the Pi doesn’t have to be plugged into a 6TB USB drive, making the attack much more portable. In the video, downloading the 65,000 candidate keys actually took longer than trying them out – 2.72 seconds compared to just under 1.85 seconds.

Once you’ve worked backwards to the pre-shared key, your rogue Raspberry Pi can now take the place of the real owner’s keyfob to unlock the car and drive off in it.

What to do?

There are several things you can do if you’re a Tesla owner, or a Tesla designer:

• Upgrade to a new, more secure fob. According to Wired, this is an option, but it sounds at the moment as though you’ll have to pay for it yourself.
• Keep your Tesla key in one of those shielding wallets that limits the propagation of NFC/RFID transmissions. We tried some of these products out and they do seem to work as claimed.
• Consider turning off passive keyless entry and turning on the “PIN to drive” feature available in recent Tesla firmware. Be aware, however, that this makes your car harder to start in an emergency.
• Don’t knit your own crypto.
• Remember that attacks only ever get faster, so never skimp on strength.

---

HERE’S ONE WE PREPARED EARLIER

TIME/MEMORY TRADE OFF - A SIMPLIFIED EXAMPLE

Assume a hash function H that takes a 4-bit pre-shared key K plus a 
4-bit challenge C, and returns a 2-bit response R:

H(K,C) = R

A table of every R for every (K,C) combination would let you look 
up the key K directly from a single challenge/response. But you'd 
need a table with 16x16 = 256 entries.

Here's a time/memory tradeoff (TMTO).

Pick a random value for C and compute every R for every K.
You end up with a table of just 16 entries, say like this:

 K    C     R
---- ----   --
0000,1011 → 00
0001,1011 → 00
0010,1011 → 10
0011,1011 → 11
0100,1011 → 10
0101,1011 → 01
0110,1011 → 10
0111,1011 → 01
1000,1011 → 00
1001,1011 → 11
1010,1011 → 10
1011,1011 → 00
1100,1011 → 01
1101,1011 → 01
1110,1011 → 11
1111,1011 → 11

Sort the table on the last column (R) and you get an alternative way
of using the data:

if H(K,1011) = 00 then K ∈ {0000,0001,1000,1011}
if H(K,1011) = 01 then K ∈ {0101,0111,1100,1101}
if H(K,1011) = 10 then K ∈ {0010,0100,0110,1010}
if H(K,1010) = 11 then K ∈ {0011,1001,1110,1111}

Send the keyfob your "magic" C value of 1011, causing it to compute
H(K,1011) for you and respond with the answer, say:

H(K,1011) = 10

From the table above, if H=10 then K must be one of 0010, 0100,
0110 or 1010, so you've cut the keysearch list from 16 entries to 4.

Now pick a second value for C, say 0001, and send it to the keyfob.
Say the fob comes back with: 

H(K,0001) = 11

Try the four candidate keys yourself for C=0001, say like this:

H(0010,0001) = 00
H(0100,0001) = 11
H(0110,0001) = 10
H(1010,0001) = 01

You're done - the only value of K that fits both responses is 0100,
so you have cracked the pre-shared key!

The tradeoffs are as follows:

* To solve the problem with no cryptographic calculations at attack 
time, you need a single eavesdropped challenge/response pair plus 
a precomputed mapping of H → R for all 256 combinations of K and C.

* To solve the problem with no precomputed mapping table, you need 
a single eavesdropped challenge/response pair followed by a runtime
calculation of H → R for all 16 possible values of K.

* The TMTO uses a 16-entry precomputed table, two eavesdropped 
challenge/response pairs and a runtime calculation of H → R for only
4 possible values of K. Your attack computer needs one quarter
of the power that would be needed in the "no mapping table" case,
and your precomputation computer needs one sixteenth of the time and
storage that would be needed in the "no attack time calculation" case.

Generally speaking, the more work you do up front in a TMTO,  the 
less work you need to do every time you mount the attack; and vice 
versa.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/D6H-Zf7zv8o/

Promo New research from Carbon Black shows that a staggering 92 per cent of UK businesses have been breached in the past year and nearly half of companies have reported falling victim to multiple breaches.

Cyberattacks are becoming more frequent and more sophisticated, as nation state actors and crime syndicates continue to leverage fileless attacks, lateral movement, island hopping and counter incident response in an effort to remain undetected.

This issue is compounded by resources and budgeting. Not only is there a major talent deficit in cybersecurity, there is also a major spending delta. It’s estimated that the underground cybercrime community spends upward of $1 trillion annually on developing attacks. By comparison, worldwide businesses are spending about $96 billion to protect themselves. Defenders are being outspent by a ratio of 10 to 1.

According to Carbon Black’s research, businesses are largely unaware about the scale, scope, and sophistication of modern attacks.

So what can businesses do? And how can security teams quickly react to these evolving threats? We will explore these questions in conjunction with Carbon Black’s latest threat report during a LIVE broadcast at 17.00 BST / 12:00 EDT today (Tuesday 11th September).

Join Tom Kellermann, Chief Cybersecurity Officer and Rick McElroy, Security Strategist, who will discuss the latest research and reveal ways your organization can keep attackers at bay.

To tune in, either click here, or just scroll down and hit the play button!

​

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/11/threat_hunting_in_the_modern_attack_landscape/

British Airways faces a £500m lawsuit over its recent mega-breach that exposed payment card details of 380,000 customers.

The airliner last week apologised and offered to compensate customers for any direct financial loss for the attack that took place between 21 August and 5 September via its website and app.

However, an group-action suit* led by SPG Law contends BA has not gone far enough and should be paying travellers for the “compensation for inconvenience, distress and annoyance associated with the data leak”.

The action points to compensation rights in the European General Data Protection Regulation, which came into effect in May.

SPG Law, the Brit limb of US firm Sanders Phillips Grossman, set up a dedicated micro-site to get victims to sign up to the case.

The firm, which cynics might dismiss as an ambulance chaser, is recruiting participants on a “no win, no fee” basis. It has suggested its offer is the best and most straightforward way passengers might be able to secure up to £1,500 compensation.

SPG Law said it would cap its fees at a maximum of 35 per cent including VAT.

If the case goes to court, SPG Law acknowledged the possibility that the airline may win and might even be awarded legal costs.

“In the event that it is necessary to litigate, we will arrange insurance on behalf of all Claimants who sign up with us,” it said. “This will protect you against having to pay BA’s costs in the unlikely event that the claim is lost.”

British Airways is yet to respond to a request for comment from The Register. ®

Bootnote

*A group-action lawsuit is the English law equivalent of a class-action lawsuit. SPG Law is also “campaigning” to mount a group-action lawsuit over the VW emissions scandal on behalf of affected drivers. The firm is acting just days after the breach was disclosed and before the dust has settled and the facts are known.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/11/ba_lawsuit/

It’s more critical than ever for states to protect our democratic system and voting infrastructure from foreign cyber espionage.

In the past, a midterm election season would pass without much fanfare. These have been torpid affairs with low voter turnout and few big-ticket issues, which historically has meant incumbents rather predictably hold their seats.

If midterms made for few headlines then, they’re making up for it now. At the recent Black Hat and DEF CON conferences, election security was a foremost concern.

I was able to visit the DEF CON Voting Village, where actual voting machines were being hacked. But more importantly, there were independent experts and state government voting officials that you could talk to about the voting process.

States such as Colorado are making strides by moving to paper ballots, requiring risk-limiting audits, and providing resources to help cities and counties secure their election systems. There are some small districts in Colorado that are able to use Denver’s election systems instead of trying to secure their own. Alas, there are many states that are not doing any of these things.

The discussions at DEF CON follow troubling revelations of information security around US elections.

Fortune reported that Microsoft uncovered that hackers allegedly associated with Russia’s military “have launched spear-phishing campaigns against at least three candidates running for election in 2018.” Though Microsoft declined to name the candidates or the states they are running in, it seems a safe bet that the pattern of targeting American elections via hacking and disinformation is not restricted to these few, and it’s aimed at both Republicans and Democrats.

That’s why it was welcome to learn that Deputy Attorney General Rod J. Rosenstein recently announced a policy to counter nation-state campaigns designed to undermine US democracy. The government will begin informing “companies, private organizations and individuals that they are being attacked” by threat actors intending to disrupt elections, according to The Washington Post.

What’s at Stake?
That new policy is one sign that our government is taking a harder stance on cyber espionage and nation-state sabotage against our critical infrastructure. Another is a push for stronger and further-reaching penalties against hackers, including requesting their arrest by foreign authorities and seizure of their assets.

It is not only industrial systems and power plants that keep our country functioning, but also the democratic system and the voting infrastructure on which it relies. The harsher countermeasures to deter hacking against critical infrastructure should extend to our election processes. Even if votes aren’t changed, the hacking of voting systems weakens trust in the democratic process.

Manipulation through election hacking is perhaps an even greater threat to society than attacks against physical infrastructure. It’s easier for us to imagine the lights going out following a hack on an electrical grid than the erosion of voting privileges and civil discourse as a result of persistent cyber offensives.

We know voting machines can be hacked. We know cyber operations launched in Russia probed elections systems in at least 21 states and disrupted the 2016 presidential election, and that large-scale disinformation campaigns can influence the outcomes of democratic processes.

As with any complex problem, increasing the security of systems and tools around elections calls for a multilayered approach. The efforts toward transparency are important steps, but there are also practical measures we can begin enacting now:

Step 1: Greater investment in modernizing government tech. Government is always among the most targeted sectors, while also being the most out-of-date with software security. It lags well behind other industries in scanning applications for vulnerabilities. Government agencies still develop applications with older programming languages known to produce more vulnerabilities and are not always fixing the flaws they find. Strict adherence to regulatory practices prevents governments from being agile and gets in the way of a DevSecOps approach to development. States are pushing for greater federal funding for election security, rightfully arguing that it’s a bipartisan issue. These resources can enable states to patch vulnerabilities, bolster cybersecurity staff, and replace outdated voting machines.

Step 2: Creating more secure software from the start. As companies create proprietary software and rely more on open source, there should be less tolerance of releasing software with critical or severe flaws. This is especially relevant to election security because federal, state, and local governments are some of the largest buyers of this software. If every company is a software company, the next evolution is that every company is a secure software company. This is best achieved by building security into the development life cycle early, when flaws are fixed more efficiently and about 30 times cheaper than after the software is released. If software that facilitates electronic voting has fewer flaws, it is less vulnerable to hacking. Software purchasers must scrutinize their supply chain to make sure they have a secure development and system life cycle.

Step 3: Latitude for security researchers. The pace of software development is rapid; developers face mounting pressure to build rich, feature-driven applications on nearly impossible timelines. It is unrealistic to accurately track vulnerabilities relying on the National Vulnerability Database alone. Finding and reporting vulnerabilities is time-consuming and difficult work but worth the time and investment, which is why security researchers should be considered increasingly valuable.

Step 4: Naming a new White House Cybersecurity Coordinator. Information sharing — between the public and private sector, within industry organizations, and between security researchers and vendors or public agencies — is critical. Since former White House cyber coordinator Rob Joyce left his post in April, the position remains vacant. A high-level cyber coordinator can facilitate information sharing on pressing cyber threats and drive cooperation between the State Department, intelligence agencies, the Department of Homeland Security, the Commerce Department, and other agencies.

Countering foreign cyber espionage, at a time when most software is vulnerable and states aren’t well funded to protect elections while attackers are well financed and motivated, may seem insurmountable. It’s difficult work, but we can make real progress with cooperation, shared goals, and transparency.

Related Content:

• 8 Steps Toward Safer Elections
• Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
• The Votes Are In: Election Security Matters

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Chris Wysopal is chief technology officer at CA Veracode. He oversees technology strategy and information security. Prior to co-founding CA Veracode in 2006, Chris was vice president of research and development at security consultancy @stake, which was acquired by Symantec. … View Full Bio

Article source: https://www.darkreading.com/risk/4-practical-measures-to-improve-election-security-now/a/d-id/1332760?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Magecart attackers hit airline with the same “digital skimmers” they used on the entertainment company in June, researchers say.

The British Airways data breach revealed last week, which exposed the personal data of approximately 380,000 customers, was committed by Magecart, the same group responsible for Ticketmaster’s June breach that affected 40,000 customers, according to researchers at RiskIQ.

Researchers suspected Magecart because they noticed that the airline’s reports about the attack indicated that customers’ credit card data and personal information had been stolen directly from payment forms via the website and mobile app. 

Magecart uses “digital skimmers,” which inject scripts to steal payment card information from payment forms, much like a physical credit card skimmer. They used this technology recently in the Ticketmaster compromise.

The attackers set up a highly customized infrastructure for the campaign against British Airways, which indicated to RiskIQ researchers that Magecart may have had extensive access to the British Airways servers, and long before the actual data theft began. “While we can never know how much reach the attackers had on the British Airways servers, the fact that they were able to modify a resource for the site tells us the access was substantial, and the fact they likely had access long before the attack even started is a stark reminder about the vulnerability of web-facing assets.

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/british-airways-breach-linked-to-ticketmaster-breach-attackers/d/d-id/1332783?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft is offering an olive branch to companies taking too long to upgrade from Windows 7, the company revealed last week. It will provide security updates for another three years as it tries to help business customers migrate to Windows 10 – but they’ll have to pay for the privilege.

Microsoft products go through two support phases. The first is mainstream support, which lasts for five years from the product’s release. Then, it provides another five years of extended support, but with caveats.

While the company continues to offer security updates for its products during the extended support phase, non-security updates are only available on a paid basis, and only for enterprise users, not consumers. At the end of the extended support period, the security updates are also supposed to end, which leaves users with increasingly vulnerable systems unless they migrate to a newer version of Windows.

Mainstream support for Windows 7 ended in 2015, and Microsoft had already warned customers that extended support for that version of the operating system would end in January 2020. However, in a blog post, it acknowledged that “everyone is at a different point in the upgrade process”.

To support late upgraders, the company will charge for Extended Security Updates (ESU) for an additional three years. It will charge for these on a per-device basis, ratcheting up the charge each year.

Microsoft eventually phases out support for all of its products. It ended extended support for Windows Vista Service Pack 2 last year, and Windows XP Service Pack 3 in 2014.

However, it is not always easy for users to upgrade to the newer versions before end-of-support deadlines (as we saw with Windows XP). The largest companies are running tens or hundreds of thousands of computers, and must cope with everything from budget to technical integration issues as they prepare to upgrade. In many cases, companies may be running bespoke applications that are not compatible with newer versions of the operating system. Upgrading that software can bring a host of technical, budgetary and compliance issues, and carry knock-on effects throughout the entire organization.

According to web analytics company StatCounter, Windows 10 deployments overtook Windows 7 worldwide only in January this year, following the newer operating system’s launch in July 2015. At the start of this year, 41.86% of worldwide Windows-based internet users were still using Windows 7, according to the company’s figures. Windows 7 still enjoys a strong loyalty among business users, StatCounter executives said at the time.

Windows 7 vulnerabilities have caused global problems in the past. Almost all of the infected computers from last year’s WannaCry ransomware attack were running Windows 7, according to researchers who analyzed infection rates at the time. However, the spread of the malware was down to poor cybersecurity hygiene. Microsoft had released a patch for the issue months before, but many computers had not been updated.

Microsoft’s Windows 7 patches haven’t all been up to par. Earlier this year, researchers discovered that security patches issued to resolve the Meltdown bug introduced a far worse vulnerability in Windows 7.

Microsoft encourages Enterprise customers still on Windows 7 to reach out to their Microsoft account team for details on upgrading.

Follow @DannyBradbury
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/qkhCEyPtn0s/

Is the Keybase secure messaging browser extension safe to use or not?

Respected researcher Wladimir Palant (of AdBlock Plus fame) is so convinced that it isn’t that he has recommended users “uninstall the Keybase browser extension ASAP,” after he discovered what looks like a gap in its claim to offer end-to-end encryption.

As covered previously, Keybase is a desktop messaging app (Windows, Mac and Linux), which can also be used on mobiles (Android and iOS) and, from last year, through browser extensions for Chrome and Firefox.

The extension is a useful way to connect to other Keybase users by advertising its use through profiles on Facebook, Twitter, GitHub, and Reddit.

If Firefox’s daily stats are anything to go by, this method isn’t hugely popular, with fewer than 2,000 daily users – and Palant’s security assessment is unlikely to help its popularity.

Behind the scenes, every message sent via browser chat is passed to the local desktop app, which is the bit that does the encryption. However, according to Palant, messages are unencrypted as they are sent to the app – hardly the “end-to-end encryption” promised on the Keybase website.

Writes Palant:

The Keybase message you enter on Facebook is by no means private. Facebook’s JavaScript code can read it out as you type it in, so much for end-to-end encryption.

In fairness, the extension’s download page on the Keybase website clearly mentions the consequences of a site or browser compromise, although perhaps not in a way the average user will understand or remember.

In Palant’s view, the issue could be avoided by isolating the extension’s user interface in an iframe. When he put this to Keybase, it reportedly told him that “there were technical reasons why iframes didn’t work.”

Should I continue to use Keybase?

As far as the desktop and mobile app is concerned, yes. There is no evidence that they don’t work as advertised.  As for the extensions, it’s a trade-off between convenience and security. Having a Keybase button beside your profile is a good way to advertise the fact that you’re using it. However, if absolute privacy is a must, use the extension to establish contact before moving to the desktop or mobile app.

Most important of all, bear in mind that Keybase is intended not just as another encrypted messaging app – there are plenty of those already – but as a database of proofs that set out to verify the identity of a contact. For anyone who values this, it still remains a feature that sets Keybase apart.

Follow @JohnEDunn
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/HFwFIOKRLRI/

In late August, Microsoft announced a free service that arguably reveals more about the future of the email business and its struggles with security than several years’ worth of earnest press releases.

Called AccountGuard, it’s Microsoft’s answer to the phenomenon of Russian phishing meddling with the US elections and the candidates who stand in them. The idea is simple: a lot of candidates and their helpers get their email provision through Office 365, Outlook.com, or what used to be called Hotmail.com, but these lack the security needed to keep the bad guys out. AccountGuard, ostensibly, will be that extra defence.

At its core, the service is a monitored version of Office 365 email that draws on information from the company’s Microsoft Threat Intelligence Center, or MSTIC.

“Microsoft AccountGuard will provide notification about cyberthreats, including attacks by known nation-state actors, in a unified way across both email systems run by organizations and the personal accounts of these organizations’ leaders and staff who opt in,” according to the launch blurb, which insists it’s “protecting democracy”, penned by corporate vice president of customer security and trust Tom Burt.

Who’s using 2FA? Sweet FA. Less than 10% of Gmail users enable two-factor authentication

READ MORE

At first this sounds a bit like Google’s Advanced Protection Program (APP) launched earlier in 2018, but Microsoft’s service is only for candidates standing in elections, whereas Google’s is open to anyone. AccountGuard is full service, coming with free email and phone support.

APP, basically, mandates that Gmail users log in with hardware authentication keys (see Google’s new Titan key), lock out third-party app access, and puts up with onerous account resets in the event they lose their key.

This provides rules users must follow but is essentially passive. AccountGuard, by contrast, is oriented around telling candidates when Microsoft has detected a phishing campaign that might be targeting them. They can also opt to receive training.

Election-sensitive customers? Anyone?

The differences sound subtle but it’s a huge step up in terms of hand-holding for a service that, let’s not forget, costs nothing. The “free” thing was such a big deal that Microsoft even got its lawyers to send the Federal Election Commission (FEC) a letter (PDF) asking for clarification that AccountGuard wouldn’t breach rules on campaign contributions in kind, which corporations are forbidden from making under US law.

Don’t fear 1337 exploits. Sloppy mobile, phishing defenses a much bigger corp IT security threat

READ MORE

This offered a rare insight into Microsoft’s thinking when it came up with the concept of AccountGuard, including that the lofty marketing pitch about defending democracy from the orcs of chaos might turn out to be good business.

“Microsoft believes its AccountGuard service will help maintain and expand its market share among election-sensitive customers, assist in the company’s product development through the threat intelligence gained from participants in the program, and protect the company’s brand reputation,” wrote the legals.

The letter reveals that Microsoft plans to expand the scope of AccountGuard to include national and state political party committees, campaign tech vendors, think tanks, advocacy non-profits and – in dovetailing perhaps aimed at Google’s APP – journalists.

Intriguingly, the letter went on to mention that “Microsoft may wish to eventually expand its AccountGuard program to include partnering companies, such as Facebook, Twitter, etc., although there are no agreements with such companies at this time,” an ambition that seems to envision AccountGuard as the cornerstone protecting political VIPs’ entire online profile.

The email God that failed

Whatever the deeper thinking at work here, there is a tacit acknowledgment from both companies that web email security is a bird with broken wings. The industry got busy with initiatives such as SPF, DKIM, and DMARC in an attempt to impose sanity on the problem of email validation and authentication, but these haven’t, and probably never will, stop phishing crims from slipping through the cracks.

There are plenty of ideas as to how things could be improved, starting with an authentication overhaul. Google admits almost nobody on Gmail uses its two-step verification security but mucking around with tokens and one-time codes was only ever going to get security so far. What email needs is easier authentication, not more authentication, which is why emerging standards such as WebAuthn look promising.

More advanced account monitoring is the next must-have, which is why Google’s APP and Microsoft’s AccountGuard look significant. The latter is not for everyone yet, but perhaps when bundled in a Office 365 sub, it might be the type of thing no self-respecting email user would be without. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/11/email_security_crisis_what_email_security_crisis/