STE WILLIAMS

A former NASA contractor was arrested and charged on Wednesday for allegedly sextorting women.

Richard Gregory Bauer, 28, was detained at his Los Angeles home by special agents from the space agency’s internal watchdog. Bauer is accused of stalking, unauthorized access to protected computers, and aggravated identity theft, according to a 14-count indictment returned by a federal grand jury on August 28 – and obtained by The Register this week.

US prosecutors claim that between February 7, 2015, and June 11, 2018, Bauer – who worked at NASA’s Armstrong Flight Research Center in Edwards, California – harassed seven women over the internet by claiming he had compromising pictures of them naked. He allegedly threatened to spread the images publicly online unless they gave him additional X-rated snapshots.

For six of the women, according to the US government, Bauer did have nude pictures, which he obtained by hacking the victims’ accounts with Facebook, Google, and other online services. The indictment stated Bauer, without attempting to conceal his identity, contacted some of the women through Facebook messages to ask them a series of questions, under the pretense that he needed survey data for his “human societies class.”

Some of the questions were those used by online services to reset passwords, such as the city where the victim’s parents met, the name of her first pet, or the make of her first car.

With the answers provided, the indictment stated, Bauer was able to log into the victims’ online profiles and private photo albums, where in most cases he found explicit images he could use against them. He is then alleged to have contacted the victims under a different identity with messages like this:

So a mutual friend gave me some picture of you, and said you would give me more. I liked what I saw. I assume this is you? i have mannnnnny more. So what do you say about giving me some more? I dont want to put these somewhere…

The charges against Bauer also claimed he convinced some victims to install malware on their computers, under the pretense that he needed help testing some image enhancement software he’d written.

Some of the victims responded by changing their email address or deleting their Facebook account, however the indictment stated Bauer continued to harass them.

A NASA Armstrong Flight Research Center spokesperson declined to provide details about Bauer or his contract work and would not identify the contracting firm that employed him. A call to the NASA Office of Inspector General special agent handling the case was not immediately answered.

A spokesperson for the US Attorney’s Office said Bauer was working as a NASA contractor during the period that most if not all of the alleged offenses occurred. The spokesperson declined to comment on whether Bauer used NASA equipment in furtherance of his alleged scheme, but said a probe was launched after a coworker provided information to NASA’s Office of Inspector General.

The indictment noted that the last victim worked with an undercover law enforcement officer, who monitored Bauer’s alleged threats to expose nude pictures. If convicted on all 14 counts, Bauer could be sent down for as long as 64 years.

Don’t forget to switch on your two-factor or multi-factor authentication on your accounts, folks. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/06/nasa_contractor_charged/

Analysis Not since the days of the US Clipper chip in the early 1990s, have backdoors put there by government decree to bypass encryption been this fashionable with governments.

Clipper – an encryption chipset with a US-government-accessible backdoor backed by the US National Security Agency (NSA) – foundered on the stubborn resistance of one man in his spare room, Phil Zimmermann, and a modest home-brew application, PGP, that even some experts struggled to use. But the NSA, which at the time had asked private firms to use Clipper in their telephone and modem designs, never gave up hope. Now it looks as if it’s back for another go.

The US and UK governments have been dropping hints about backdoors for some time, which optimists took as aspiration rather than policy. Last week, backdoors stepped back into the realm of the possible with the publication of an Australian memo issued on behalf of the Five Eyes Alliance, which includes the UK, US Canada and New Zealand.

“The governments of the Five Eyes encourage information and communications technology service providers to voluntarily establish lawful access solutions to their products and services that they create or operate in our countries,” the report states.

Notice, there’s no mention of the word “backdoor”, which isn’t what anyone in officialdom will ever call the concept of “lawful access”. But the intention is clear: “Should governments continue to encounter impediments to lawful access to information necessary to aid the protection of the citizens of our countries, we may pursue technological, enforcement, legislative or other measures to achieve lawful access solutions.”

Ozzie backdoor

Despite the stranglehold that vulnerability database keeper the National Institute of Standards and Technology (NIST) has on which encryption schemes get approved for use by the US government (and, by extension, everyone else in a US-dominated industry), it’s no secret that encryption has become a problem for police. It’s not necessarily that they can’t break it at all – every system has its design weaknesses and vulnerabilities – but they can’t do it presquickly enough to conduct surveillance on enough targets for that to make a difference.

Spies still super upset they can’t get at your encrypted comms data

READ MORE

Everyone imagines the Feds or NSA sitting in a room with a supercomputer hooked up to a terrorist’s hard drive, but that’s not how backdooring works; it’s about bypassing rather than breaking encryption. What the Five Eyes want is a way to quietly and unobtrusively monitor communications, including perhaps in real time. No need for Clipper’s complicated key escrow (or Ray Ozzie’s strange reprise) – this is just a way for the spooks to borrow encryption keys.

None of your business

If this became industry standard, really dangerous people would simply look elsewhere for their internet service, but it’s a given that big web companies will resist for fear of becoming an extension of the budding J Edgar Hoovers-on-the-wiretap in ways that risk undermining their businesses long term.

The question is what business customers would feel about this on a legal and conceptual level. While big organisations can overlay their own encryption on cloud, that’s not true of all services. That’s the whole point of the cloud – the cloud does the job, not the customer. In principle, these would be subject to the same surveillance.

This won’t wash for long. Organisations find themselves investing good money to keep the bad guys out and their own employees in check, the so-called insider threat. While it’s true that governments today can ask for access to any organisation’s data, there are always limits to how and when this happens. To the sceptics – let’s call them the silent majority – mandated government access of cloud data at service provider level will sound like just another risk piled on top of the ones they already have.

Spotting rogue insiders is already hard work. Spotting rogue government insiders whose actions come bundled with a warrant won’t be popular. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/06/government_the_ultimate_insider/

Analysis Not since the days of the US Clipper chip in the early 1990s, have backdoors put there by government decree to bypass encryption been this fashionable with governments.

Clipper – an encryption chipset with a US-government-accessible backdoor backed by the US National Security Agency (NSA) – foundered on the stubborn resistance of one man in his spare room, Phil Zimmermann, and a modest home-brew application, PGP, that even some experts struggled to use. But the NSA, which at the time had asked private firms to use Clipper in their telephone and modem designs, never gave up hope. Now it looks as if it’s back for another go.

The US and UK governments have been dropping hints about backdoors for some time, which optimists took as aspiration rather than policy. Last week, backdoors stepped back into the realm of the possible with the publication of an Australian memo issued on behalf of the Five Eyes Alliance, which includes the UK, US Canada and New Zealand.

“The governments of the Five Eyes encourage information and communications technology service providers to voluntarily establish lawful access solutions to their products and services that they create or operate in our countries,” the report states.

Notice, there’s no mention of the word “backdoor”, which isn’t what anyone in officialdom will ever call the concept of “lawful access”. But the intention is clear: “Should governments continue to encounter impediments to lawful access to information necessary to aid the protection of the citizens of our countries, we may pursue technological, enforcement, legislative or other measures to achieve lawful access solutions.”

Ozzie backdoor

Despite the stranglehold that vulnerability database keeper the National Institute of Standards and Technology (NIST) has on which encryption schemes get approved for use by the US government (and, by extension, everyone else in a US-dominated industry), it’s no secret that encryption has become a problem for police. It’s not necessarily that they can’t break it at all – every system has its design weaknesses and vulnerabilities – but they can’t do it presquickly enough to conduct surveillance on enough targets for that to make a difference.

Spies still super upset they can’t get at your encrypted comms data

READ MORE

Everyone imagines the Feds or NSA sitting in a room with a supercomputer hooked up to a terrorist’s hard drive, but that’s not how backdooring works; it’s about bypassing rather than breaking encryption. What the Five Eyes want is a way to quietly and unobtrusively monitor communications, including perhaps in real time. No need for Clipper’s complicated key escrow (or Ray Ozzie’s strange reprise) – this is just a way for the spooks to borrow encryption keys.

None of your business

If this became industry standard, really dangerous people would simply look elsewhere for their internet service, but it’s a given that big web companies will resist for fear of becoming an extension of the budding J Edgar Hoovers-on-the-wiretap in ways that risk undermining their businesses long term.

The question is what business customers would feel about this on a legal and conceptual level. While big organisations can overlay their own encryption on cloud, that’s not true of all services. That’s the whole point of the cloud – the cloud does the job, not the customer. In principle, these would be subject to the same surveillance.

This won’t wash for long. Organisations find themselves investing good money to keep the bad guys out and their own employees in check, the so-called insider threat. While it’s true that governments today can ask for access to any organisation’s data, there are always limits to how and when this happens. To the sceptics – let’s call them the silent majority – mandated government access of cloud data at service provider level will sound like just another risk piled on top of the ones they already have.

Spotting rogue insiders is already hard work. Spotting rogue government insiders whose actions come bundled with a warrant won’t be popular. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/06/government_the_ultimate_insider/

Researchers based in Germany have discovered how to spoof certificates they don’t own – even if the certs are protected by the PKI-based domain validation.

Though the group withheld the names of certificate authorities whose certs could be spoofed, Dr Haya Shulman, of the Fraunhofer Institute for Secure Information Technology, told The Register a “weak off-path attacker” can – using nothing more than a laptop – steal credentials, eavesdrop, or distribute malware using the method.

All the while, Dr Shulman told us, the user would think their connections were secure because that’s what their browser would report.

In a paper seen by The Register, to be presented at the ACM’s Conference on Computer and Communications Security (Toronto in October), Dr Shulman’s team wrote:

“The attack exploits DNS Cache Poisoning and tricks the CA into issuing fraudulent certificates for domains the attacker does not legitimately own – namely certificates binding the attacker’s public key to a victim domain.”

The group has asked The Register not to republish the paper because it names affected Certificate Authorities.

We have however, seen a demo of a live attack by Fraunhofer’s team.

“The attack is initiated with a DNS request,” the paper explained. “To succeed in the attack, the attacker has to craft a correct DNS response before the authentic response from the real nameserver arrives.”

By successfully mapping their spoofed DNS record to hosts controlled by the attacker, domain validation checks run by the CA are performed not by the record owner, but against the attacker’s hosts.

The attack depends on getting DNS responses broken into fragments, achieved by sending the nameserver an “ICMP fragment needed” packet. This tricks the server into thinking the victim’s system is configured to only process small packets.

The second trick is on the victim: in processing the first fragment, the victim’s machine has completed the DNS challenge-response fields (as the paper stated, these are “echoed by the nameserver in the first fragment”).

In other words, Fragment A contains the validation the victim expects for a domain, but then the attacker injects Fragment B with spoofed information that the victim accepts.

Network admins will have worked out by now that the attacker needs to do some offline research to get this to work – they have to examine responses from the victim’s nameserver to calculate “the offset where the fragmentation should occur”.

The research team proposed a domain validation protocol they dubbed “DV++” to block the attack. In summary, DV++ uses a distributed model which sends requests to multiple certification agents.

“To pass a DV++ validation, domain owners must prove their ownership to a majority of the agents in a fully automated manner by responding to queries sent by the agents for the resource records in the domain.”

Dr Shulman’s collaborators in the project are Markus Brandt, Tianxiang Dai, Amit Klein and Michael Waidner. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/06/boffins_break_cas_domain_validation/

Researchers based in Germany have discovered how to spoof certificates they don’t own – even if the certs are protected by the PKI-based domain validation.

Though the group withheld the names of certificate authorities whose certs could be spoofed, Dr Haya Shulman, of the Fraunhofer Institute for Secure Information Technology, told The Register a “weak off-path attacker” can – using nothing more than a laptop – steal credentials, eavesdrop, or distribute malware using the method.

All the while, Dr Shulman told us, the user would think their connections were secure because that’s what their browser would report.

In a paper seen by The Register, to be presented at the ACM’s Conference on Computer and Communications Security (Toronto in October), Dr Shulman’s team wrote:

“The attack exploits DNS Cache Poisoning and tricks the CA into issuing fraudulent certificates for domains the attacker does not legitimately own – namely certificates binding the attacker’s public key to a victim domain.”

The group has asked The Register not to republish the paper because it names affected Certificate Authorities.

We have however, seen a demo of a live attack by Fraunhofer’s team.

“The attack is initiated with a DNS request,” the paper explained. “To succeed in the attack, the attacker has to craft a correct DNS response before the authentic response from the real nameserver arrives.”

By successfully mapping their spoofed DNS record to hosts controlled by the attacker, domain validation checks run by the CA are performed not by the record owner, but against the attacker’s hosts.

The attack depends on getting DNS responses broken into fragments, achieved by sending the nameserver an “ICMP fragment needed” packet. This tricks the server into thinking the victim’s system is configured to only process small packets.

The second trick is on the victim: in processing the first fragment, the victim’s machine has completed the DNS challenge-response fields (as the paper stated, these are “echoed by the nameserver in the first fragment”).

In other words, Fragment A contains the validation the victim expects for a domain, but then the attacker injects Fragment B with spoofed information that the victim accepts.

Network admins will have worked out by now that the attacker needs to do some offline research to get this to work – they have to examine responses from the victim’s nameserver to calculate “the offset where the fragmentation should occur”.

The research team proposed a domain validation protocol they dubbed “DV++” to block the attack. In summary, DV++ uses a distributed model which sends requests to multiple certification agents.

“To pass a DV++ validation, domain owners must prove their ownership to a majority of the agents in a fully automated manner by responding to queries sent by the agents for the resource records in the domain.”

Dr Shulman’s collaborators in the project are Markus Brandt, Tianxiang Dai, Amit Klein and Michael Waidner. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/06/boffins_break_cas_domain_validation/

Health-insurance biz Premera Blue Cross has been accused of deliberately knackering one of its computers to cover up details of a cyber-break-in. The organization denies any wrongdoing.

The allegation was leveled last week against Premera, and is the latest twist in a long-running class-action lawsuit filed by the insurer’s customers against the business.

It all relates to the 2014-2015 network intrusion at the US health insurer. The biz realized in January 2015 it had been hacked, eight months after miscreants first broke into its systems in May 2014.

The hackers potentially accessed the personal data of up to 11 million people, as well as information on Premera’s workers, partners, and healthcare providers and other business associates. That information may have included names, dates of birth, bank account details, email and home addresses, phone numbers, and Social Security numbers of people who had either taken out or applied for health insurance. Details of claims and some medical information may also have been available to the intruders.

Premera Blue Cross said in March 2015 that it was unclear whether or not sensitive and personal data had been siphoned off from its systems, a position it still maintains – and one that the plaintiffs’ lawsuit seeks to challenge. In short, they want to prove information was swiped from Premera’s network.

This is why you do security audits

Following the discovery of security vulnerabilities in Premera’s systems by auditors at the US Office of Personnel Management in April 2014, the insurer drafted in experts from FireEye Mandiant in October that year to shore up its network. Mandiant’s eggheads discovered the well-hidden intrusion months later in January 2015 before subsequently identifying 35 infected computers.

The plaintiffs in the lawsuit claim they have only been able to produce forensic images “for 34 of those 35 computers; the 35th computer had been destroyed.”

According to court documents filed in an Oregon district court at the end of August this year, data on the missing computer is critical to understanding what happened during the hack – because it was, apparently, a system with admin access to the network and was infected by malware that acted as a fulcrum of the whole attack.

“The 35th computer, called A23567-D, was a ‘developer’ computer – loaded with robust software and afforded security clearance to Premera’s most sensitive databases,” the filing claimed.

“Mandiant found that A23567-D contained a unique piece of hacker-created malware that Mandiant called PHOTO. Mandiant found PHOTO only on A23567-D. PHOTO malware had the capability to upload and download files, and to exfiltrate data. Hackers accessed PHOTO on A23567-D between May 12, 2014 and February 2015,” the lawsuit states.

“The destroyed computer was perfectly positioned to be the one-and-only staging computer hackers needed to create vast staging files for the purpose of shipping even more data outside of Premera’s network.”

The 35th element

That 35th computer allegedly contained evidence proving that the hackers used customized malware to download sensitive data. This system was apparently marked as an “end-of-life” asset in 2016 by Premera’s IT team and destroyed.

Premera healthcare: US govt security audit gave hacked biz thumbs up

READ MORE

The plaintiffs alleged the machine was deliberated ruined to hide evidence that hackers siphoned off sensitive information, a key plank in their claims for damages: after all, they want the jury in the case to “presume that exfiltration occurred,” as ZDnet noted this week.

It was further claimed the destroyed computer’s hard drive contained archives created by hackers to exfiltrate that data, along with other evidence. The lawsuit paperwork also alleged that Premera Blue Cross wiped vital access logs.

In a statement, Premera Blue Cross denied the allegations, adding that it would contest the action.

Steve Kipp, veep of corporate communications, said: “We are aware of the motion for sanctions that was recently filed by the plaintiffs in the class action arising from the 2015 cyberattack at Premera. It is the type of motion that is not uncommon in complex litigation involving voluminous physical and documentary evidence, and represents just one of many disputes that can arise during the discovery phase of a lawsuit.

“We disagree with the motion and do not believe the facts justify the relief plaintiffs have requested. Our attorneys will be filing a response in due course.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/06/premema_breach_lawsuit/

Vid Beware using your web browser’s autofill feature to log into your broadband router via Wi-Fi and unprotected HTTP. A nearby attacker can attempt to retrieve the username and password.

The problem – found by SureCloud’s Elliott Thompson and detailed here – is the result of a mismatch in browser behavior and router configuration security.

It’s not a particularly scary or an easy-to-leverage vulnerability, and we think most miscreants will find it too much of a faff to exploit. However, it is interesting and quirky, and worth checking out.

How to protect yourself

If you’re using Chrome, make sure you’re running at least version 69.0.3497.81, which was released this week and mitigates the security weakness Thompson privately disclosed to Google in March. This particular build brings the browser in line with Firefox, Edge, Internet Explorer, and Safari, which are all harder to exploit via Thompson’s technique.

In short: if you’re suddenly kicked off your Wi-Fi, and rejoin to a page trying to get you to confirm your router administration username and password, be on alert and don’t autofill the login form. Check to make sure you’re actually on the Wi-Fi network you think you’re on and can trust. Alternatively, don’t save your router login details in your browser’s autofill feature.

The login page could instead be a spoof that’s waiting for you to autofill the boxes so it can snatch the username and password.

UK-based SureCloud dubbed this information-stealing technique Wi-Jacking, explaining: “When credentials are saved within a browser, they are tied to a URL and automatically inserted into the same fields when they are seen again. The accepted home router weakness is simply the use of unencrypted HTTP connections to the management interfaces.”

No walk in the park

In order to swipe someone’s router login details in this manner, they need to be physically nearby and on the target wireless network. They could be a cafe owner using their own Wi-Fi from their own laptop at the counter, for instance. They also need to have joined an open wireless network at some point, with automatic reconnections allowed. Their browser should remember their router configuration login details. The router must also use plaintext HTTP for its configuration webpages. All these conditions are required.

You then flood the victim’s computer with network deauthentication requests over the air to kick them off their own Wi-Fi, and onto an open wireless network you control. You then redirect any of their HTTP connections to a URL that matches their router’s admin page URL, such as 192.168.1.1, and serve a webpage that masquerades as the gateway’s login interface.

If the victim has previously used that URL to manage their router from their browser, and saved their credentials to autofill, a vulnerable browser may drop the username and password into the appropriate fields on the page, ready for your page to automatically obtain and use.

Chrome used to require the victim to interact with the spoofed login page, such as clicking somewhere on the page background, before the autofill kicked in.

Now, from this week, it’s more robust, and works like Firefox, Internet Explorer, Safari, and Edge in that the user has to be tricked into selecting the router’s credentials from a drop-down menu in order to autofill the login form. “At this point the attack is mostly social engineering,” Thompson noted. If you can’t get the details from autofill, then you could try guessing them – admin:password is a good start.

The next stage – whether you managed to get the victim to select their autofilled credentials, or simply guessed them – is to quickly and silently let the victim rejoin their wireless network with the spoofed admin page still open. Then some JavaScript on the malicious webpage can use the login details – autofilled or guessed – to access the gateway’s configuration interface, grab the Wi-Fi access password, change its DNS settings to redirect other clients to dodgy websites, and so on.

According to Thompson:

Once the target device is successfully connected back to their original network, our page is sitting on the router admin interface’s origin with the admin credentials loaded into JavaScript. We then login using an XMLHttpRequest and grab the PSK or make whatever changes we need. In most Wi-Fi routers that we tested, we could extract the WPA2 PSK directly from the web interface in plaintext, negating the entire need to capture a handshake to the network. But if a router hides the key, we could enable WPS with a known key, create a new access point, or anything else we can do from within the router’s interface.

We wouldn’t even need to know the HTML structure of the router’s interface. We could just grab the entire page DOM, send it home and extract anything useful by hand.

“Fundamentally this is just a flaw in the way origins are shared and trusted between networks,” he added.

“In the case of home routers, they are predictable enough to be a viable target. The easiest solution would be for browsers to avoid automatically populating input fields on unsecured HTTP pages. It is understandable that this would lower usability, but it would greatly increase the barrier to credential theft.”

Below is a video showing how to exploit a victim’s setup…

Youtube Video

Essentially, if you’re using Chrome, update it. Then, regardless of your browser, be on alert for attempts to phish your router admin password if you’re suddenly kicked off your Wi-Fi by making you autofill your router’s admin page login boxes. As well as the above advice, consider deleting any open networks your machine has saved, refusing automatic reconnections, and don’t use the router’s default credentials, in order to avoid being Wi-Jacked. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/06/wifi_browser_autofill_chrome/

The Windows APLC security hole that emerged early last week remains unpatched, even though it is being actively exploited by hackers to gain total control over PCs.

As we reported at the end of August, a person behind the now-deleted Twitter account SandboxEscaper publicly revealed the system-level privilege escalation zero-day bug in Windows Advanced Local Procedure Call (ALPC) in all versions from Windows 7 to Windows 10. SandboxEscaper also released example exploit code for the programming blunder – a recipe for miscreants to use to commandeer compromised computers.

Now, ESET’s Matthieu Faou has disclosed on Wednesday that a group of miscreants called PowerPool is actively exploiting the bug to move from hijacked user accounts to full system administrator-level control of already infiltrated Windows boxes.

“As one could have predicted, it took only two days before we first identified the use of this exploit in a malicious campaign from a group we have dubbed PowerPool,” said Faou.

So far, the set of victims is small, we’re told. The gang has been going after targets in Chile, Germany, India, the Philippines, Poland, Russia, the UK, America, and Ukraine, ESET reckoned.

The PowerPool crooks modified and recompiled SandboxEscaper’s proof-of-concept source code, Faou wrote, and used it to replace GoogleUpdate.exe – Google’s software updater – on compromised machines so that the next time it is automatically run, it is overwritten by a second stage and gains system-level privileges via the ALPC hole.

The malicious code then opens a “reconnaissance” backdoor and takes screenshots to send to its command and control server. A second-stage backdoor – which Faou described as “clearly not a state-of-the-art backdoor” – is also opened that can execute arbitrary commands from its masters, kill processes, upload and download files, and list folders’ contents.

The miscreants also deploy PowerShell tools to retrieve usernames and login hashes from the Security Account Manager; a post-exploitation framework dubbed PowerSploit; SMBExec for running SMB connections; Quarks PwDump to retrieve Windows credentials; and FireMaster, an executable that retrieves passwords stored by Outlook and web browsers.

Windows 0-day pops up out of nowhere Twitter

READ MORE

Anti-malware toolmaker Barkly’s Jonathan Crowe explained the steps taken by the original exploit example code: it creates an UpdateTask.job task, something that ordinary users can do, but instead of an ordinary file it’s a hard link to a system file such as PrintConfig.dll, which only system-level users are supposed to be able to modify or replace.

Task Scheduler’s SchRpcSetSecurity is called to change permissions on the UpdateTask.job so anyone can modify it, and this “actually changes permissions of the linked-to PrintConfig.dll file, which thus becomes user-modifiable,” we’re told.

The example exploit used this to replace PrintConfig.dll with a DLL that launched Notepad, and then triggered the Print Spooler service to run PrintConfig.dll “using its own Local System identity.”

The good news is that, in the absence of a patch from Microsoft, there are mitigations to hand, even if your antivirus isn’t watching for attacks.

Crowe noted that Clever IT’s Karsten Nilsen and Google Project Zero researcher James Forshaw both suggest using access controls to defeat the bug. Their cure is to prevent anyone writing to the C:WindowsTasks directory.

Influential UK infosec geezer Kevin Beaumont has also written up how to put in place rules that will detect attempted exploits. 0patch also has a micropatch for the bug. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/06/microsoft_windows_attacked_wild/

Paper describes a technique to protect the Internet from Border Gateway Protocol route hijacking attacks.

A new draft publication from the NIST National Cybersecurity Center of Excellence (NCCoE) takes aim at security concerns about the Border Gateway Protocol (BGP), the default routing protocol to route traffic among Internet domains. The paper, “Protecting the Integrity of Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation,” is open for public comment until Oct. 15.

Draft SP 1800-14 was developed in cooperation with ATT, CenturyLink, Cisco, Comcast, Juniper, Palo Alto Networks, and The George Washington University. It describes Route Origin Validation (ROV), a technique intended to shield BGP routers and the routes they advertise from an attack known as route hijacking, in which the bad guys advertise a malicious route, sending traffic to illegitimate servers, routers, or both.

Rather than describing new technology, the paper describes ” … how networks can protect BGP routes from vulnerability to route hijacks by using available security protocols, products, and tools to perform BGP ROV to reduce route hijacking threats,” according to NIST.

Read here and here for more details.

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/perimeter/nist-releases-draft-on-bgp-security/d/d-id/1332740?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Despite the technology’s promise to transform how business is done, there are significant limitations and potential risks at the intersection of the digital and physical worlds.

There is no lack of buzz around blockchain. Though commonly known in relation to cryptocurrencies, blockchain is moving beyond financial services and will become an integral part of all future commercial transactions.

Despite the technology’s promise to transform business operations, there are significant limitations and potential risks that are often overlooked. Those risks reside at the intersection of the digital and physical worlds. The good news is that there are solutions to address those risks, but adopters of blockchain first need to recognize that they exist.

The Security Value Premise of Blockchain
Fundamentally, blockchain technology enables the recording of events or transactions on a distributed ledger. This ledger is shared and accessible to all participants, not owned by any, and records data securely, immutably, and permanently. Essentially, a blockchain is a constantly growing set of interdependent blocks containing data, with each block recording an event or transaction. The game changer is that those blocks are distributed across a decentralized network, and every member of the network has his or her own copy of the entire blockchain.

If blockchain essentially is a digital record keeper, then blockchain is only valuable if those records can be trusted. Blockchain is trustworthy because of the decentralized nature of the network and the new database structure. The broad distribution of many copies of the blockchain provides an unprecedented level of trust because no single party controls the data and there is no single point of failure or tampering risk. Any authorized amendment to a pre-existing transaction is done by creating a new block — the original block remains intact and becomes part of the permanent history. 

Possible Problems
The value of blockchain is the guarantee of immutable data throughout the entire chain. But the digital world increasingly needs to connect and interact with the physical world. Although the security of the blockchain architecture is well established, its value is severely compromised if you can’t ensure the same level of security for data before it is recorded into, or after it is accessed from, the blockchain. Only when this problem is successfully addressed can you claim to have an end-to-end solution.

In other words, the problem with migrating blockchain outside of financial services and into distributed edge computing applications — especially, the Internet of Things (IoT) and the Industrial Internet of Things (IIoT) — is that data can be corrupted before it’s added to the blockchain. If corrupt data infiltrates the blockchain, the benefits are lost.

In the real world, the ends of the blockchain are the physical assets — i.e., in commercial, industrial, supply chain, IoT, and IIoT applications — for the data and records to get into the blockchain, companies need an interface and physical data storage for the data related to those assets.

Most hardware isn’t secure — whether it’s the storage or the interface, there is frequently a direct trade-off between security and usability. Additionally, the most common memory architectures used today are specifically designed to allow simple access and reprogramming, almost inviting tampering by bad actors. Data manipulated before being added to the blockchain would be unreliable, rendering the entire chain of trustworthy transmission and recording useless.

Trustworthy Data at the Edge: A New Approach to Distributed Hardware
With the rise of edge computing, security breaches at the edge of the network continue to plague businesses. Achieving data security at the hardware level offers users a consistent level of confidence both within and without the blockchain.

A new approach to protecting data at the edge is to securely embed it into the physical things and assets to which it relates. By placing highly secure chips directly on assets, critical assets or process data can be reliably stored, written, read, and exchanged in the distributed physical environment. Highly durable and rugged memory can ensure the data survives extreme environmental conditions regardless of where the asset travels.

Using this approach, data and documents can be stored at the point of use, directly onto physical assets in a distributed environment, and the information can be exchanged with the network using IoT or other communication or networking environments and protocols. Securing the data at the physical level ensures anything recorded in the blockchain is also trustworthy end-to-end.

Real-World Applications of Blockchain at the Edge, in IoT and IIoT
One of the most natural applications of blockchain and secure distributed asset data is the multiparty, multitouch, highly decentralized world of supply chain management. Asset-level secure data combined with a blockchain architecture provide multilevel visibility across the global supply chain, decreased administrative costs, and authentication against counterfeit products. The benefits are clear — increased traceability of products and assets to ensure corporate and regulatory standards are met; improved visibility and compliance when outsourcing manufacturing; verification of origin and pedigree of products in the supply chain, eliminating losses from counterfeiting; and reduced paperwork and administrative costs.

Several industries have already taken the lead on deploying embedded asset intelligence or blockchain technologies — from highly vulnerable products of healthcare, pharma and food companies, to unique use cases of luxury goods companies, high-end manufacturers, and aerospace players. Those companies have been using tags, chips, sensors, and software applications to track, secure, and validate origin of products, trace all the way from manufacturer to end user, and enable anyone in the chain with information and insights along the way.

Blockchain’s distributed ledgers are a potent way to securely capture and share transaction and other business information, driving improvements in existing business processes and new ways of doing business. In the real economy, the blockchain needs to reflect data derived from myriad connections to physical things. That intersection of blockchain and hardware, the interface where data are fed to the blockchain, as well as storing it at the edge, is where the otherwise immutable chain is the weakest. Fortunately, technologies to securely store and embed data into physical things already exist and can be utilized to further fortify the entire chain and help deliver on its enormous promises.

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Related Content:

• 7 Ways Cybercriminals Are Scamming a Fortune from Cryptocurrencies
• Redefining Security with Blockchain
• The Good Bad News about Blockchain Security
• Blockchain All the Rage But Comes With Numerous Risks

 

Drew Peck, Executive Director at Tego
Drew Peck is an Executive Director at Tego. He currently serves in an advisory capacity on several semiconductor company boards, focusing on IP and finance issues. He has been involved in the semiconductor industry for 40 years, first in … View Full Bio

Article source: https://www.darkreading.com/endpoint/the-weakest-security-links-in-the-(block)chain/a/d-id/1332723?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple