STE WILLIAMS

Image Source: Shutterstock via Stuart Miles

Good news on the security awareness training front: Wombat Security reports that 95% of companies they surveyed now train end users on how to identify and avoid phishing attacks, up from 86% in 2014.

Even more good news: The training also has had an impact. Roughly 54% of security pros said they have been able to quantify reductions in phishing susceptibility based on training activities, according to Wombat’s “2018 State of the Phish” report.

“There’s been an increase in interest over the past year,” says Gretel Egan, brand communications manager for Wombat Security. “A few years ago many scoffed at the idea of security awareness training, but now they realize that it can only benefit their company.”

Yet there’s still some work ahead in getting the word out and doing so effectively. That means understanding where companies go wrong with their security awareness training – and how to correct it.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/6-reasons-security-awareness-programs-go-wrong/d/d-id/1332644?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Remember last year’s Equifax hack? It involved an exploit of a vulnerability in Apache Struts. Yesterday, news came of a new vulnerability in the open source Web framework, one that some people are saying could be worse than the one that put everyone’s credit card information into the hands of criminals.

The new vulnerability, designated CVE-2018-11776, was discovered by Man Yue Mo, a researcher on the Semmle security research team. This vulnerability is in the core functionality of Struts, allowing remote code execution (RCE) when the framework is configured in certain ways.

“The vulnerability doesn’t exist because of configurations, but when the system is configured in a certain way, you can take advantage of vulnerabilities that exist in Struts,” says Glen Pendley, deputy CTO at Tenable.

In the blog post announcing its discovery of the vulnerability, Semmle estimated that at least 65% of Fortune 500 companies use Struts in at least some of their Web applications. Because of its popularity, any core vulnerability is likely to have wide implications for security across the Internet.

“The part of the framework that it touches is potentially far more impactful than earlier vulnerabilities. The endpoints are far more widely used,” Pendley says.

Semmle worked with the Apache Foundation to responsibly disclose the vulnerability, and a set of software updates was issued simultaneously with its disclosure. The Apache Foundation and multiple security professionals recommended immediate updating for any organization using an affected version of Struts.

100% reliable RCE that where vulnerable targets are probably enumerable via Shodan… PATCH THIS. https://t.co/xj6yJjyjtk

— Dino A. Dai Zovi (@dinodaizovi) August 22, 2018

“It’s important that organizations using Struts components upgrade quickly,” says Chris Eng, vice president of research at CA Veracode. Pendley agrees. “Patch your system,” he says. “Get it to a version that’s not vulnerable. I wouldn’t waste time looking for workarounds.”

While the vulnerabilities are real and dangerous, it’s important to note that they require quite specific (though not uncommon) configurations to allow an attacker to exploit the vulnerability. According to the Apache Foundation, the configurations required are:

• The alwaysSelectFullNamespace flag is set to true in the Struts configuration. This is the default setting if an application uses the popular Struts Convention plug-in.
• An application’s Struts configuration file contains an action … tag that does not specify the optional namespace attribute or specifies a wildcard namespace (e.g. “/*”).

Some commenters on Twitter were quick to point out that these requirements limit the vulnerability’s danger.

Re the new Apache Struts vuln CVE-2018-11776 – I’m still looking at it, but early opinion: looks like it will be limited exploitation as it relies on a non-default misconfiguration to be exploitable.

— Kevin Beaumont (@GossiTheDog) August 22, 2018

The problem is knowing, with confidence, whether an organization has an application configured in a vulnerable manner. “Where I think people are going to get in trouble is if the amount of time they take to check the vulnerability of the software,” Pendley says.

To manage the constant threat of new vulnerabilities, Eng advises development teams to “maintain a comprehensive inventory of all the open source elements that are included in their applications.”  

“Only when taking advantage of alerts and notifications of newly discovered vulnerabilities, which are then checked against an accurate, up-to-date inventory, can organizations understand their exposure and how best to mitigate this risk,” he says.

Related Content:

• ‘Strutting’ Past the Equifax Breach: Lessons Learned
• Rise of the ‘Hivenet’: Botnets That Think for Themselves
• 17 Things We Should Have Learned in 2017 But Probably Didn’t
• 7 Takeaways From The Equifax Data Breach

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info. 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/application-security/new-apache-struts-vulnerability-leaves-major-websites-exposed/d/d-id/1332657?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Attackers often use email as a vector for distributing malicious code, but very few threat actors use it as a mechanism for controlling malware on infected systems.

One exception is Turla, a highly sophisticated Russian-speaking cyberespionage group that for the past several years has been using PDF files in emails to control an especially stealthy Microsoft Outlook backdoor.

In a report this week, security vendor ESET described Turla as deploying versions of the backdoor against numerous government and military targets likely since 2009. The most recent victims of the backdoor include Germany’s Federal Foreign Office; a major defense contractor; and the foreign offices of at least two other European countries.

In the attack against the Germany foreign office, Turla dropped the backdoor on several systems and used them to steal data for almost all of 2017. The attacks on the other entities were not previously known until ESET’s investigation uncovered them, the security vendor said.

Timestamps in the malware’s code — likely faked — suggest that Turla developed a basic version of the Outlook backdoor in 2009. The first iteration of the malware could only dump email. Since then, however, the group has added new features to make it an extremely stealthy and resilient tool for stealing data from target networks, ESET said.

In 2013, for instance, Turla introduced a capability that allowed the backdoor to execute commands sent via email in XML format. In 2006, the group added the ability for the malware to respond to commands sent as email attachments in specially crafted PDF documents. The latest version- released in April 2018 -incorporates the ability to execute PowerShell scripts directly in computer memory.

“Email as a network protocol is very rare for a backdoor,” says Matthieu Faou, malware researcher at ESET. Turla is currently the only threat group using a backdoor that’s completely controllable via email.

Most backdoors use HTTP or HTTPS to communicate with their command and control (C2) servers and a few use other protocols such as DNS. Typically, the network traffic associated with these protocols is highly monitored or filtered, especially in big organizations and government entities. Emails are generally only monitored for spam and malicious attachments or links.  

“Also, using emails means that the network traffic blends with the legitimate [traffic] more easily as it goes directly to the enterprise mail server instead of a malicious CC server,” Faou notes. “So [it] is very unlikely that an email, containing a PDF with information exfiltrated from the compromised machine, will be blocked by any security system.”

The Turla group has been installing the Outlook backdoor — basically a Dynamic Link Library (DLL) — on hard drives using other first-stage droppers from its malware arsenal. To maintain persistence on a compromised system, the group uses a technique called COM object hijacking to tamper with the Windows registry, Faou says.

What it Does

The backdoor is designed to monitor all incoming and outgoing emails from the compromised system and to collect message metadata about the sender, recipient, subject, and attachment name (if any). The data is compiled in logs that are then bundled together and sent periodically to Turla operators in specially crafted PDF documents attached to emails.

The Outlook backdoor also checks all incoming email for PDFs that might contain commands from the attackers. The malware is designed to accept commands from any threat actor that is able to encode them in the right format in a PDF document. If the email address to which the malware typically transmits stolen data is blocked, the threat actor can regain control of the backdoor simply by sending a rogue PDF with a new C2 address.

The main difference from other backdoors is that the operator can initiate the communication with the backdoor while the malware is inspecting emails being downloaded automatically to the inbox, Faou says.

No Firewall Issues

A traditional backdoor receives C2 communications from a remote server. If the server is blocked, communication and control is lost as well. “For the Outlook backdoor, the operator can regain control of the compromised machine by sending an email from any email address, removing the single point of failure.” Since the rogue email uses the enterprise Exchange Server, it does not have to deal with any firewalls either, Faou says.

The Turla group has been around for several years, and is called Snake and Uroburos by other security research teams. It is associated with a cybersecurity breach at US Central Command in 2008, and with attacks against numerous governments and military organizations worldwide. Known victims include Finland’s foreign ministry, a Swiss military and the German government.

The manner in which Turla has refined the backdoor shows the group is active and constantly innovating. The improvements also show the group has a very skilled development team Faou says. “Enterprises should not only consider emails as a malware vector but also as a communication layer for malware,” he says.

“It is important to monitor emails for unusual behavior, such as the forwarding of every email to an external email address.”

Related Content:

• Turla Cyberespionage Gang Employs Adobe Flash Installer
• Russian-Speaking Turla Group Uses New Tools to Target Embassies, Consulates
• APT28, Turla Nation-State Groups Deployed Multiple 0Days in Recent Attacks
• 8 Notorious Russian Hackers Arrested in the Past 8 Years

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/turla-threat-group-uses-email-pdf-attachments-to-control-stealthy-backdoor/d/d-id/1332645?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

What appeared to be another cyberattack aimed at the Democratic National Committee (DNC) this week turned out to be a simulated phishing exercise, according to Newsweek.

Lookout Security had alerted the DNC to a phony login page spoofing Votebuilder, a service used by party officials and campaigns, that had been discovered attempting to grab usernames and passwords to the database. DNC officials then reportedly contacted the FBI.

But DNC CISO Bob Lord has now confirmed that the alert spotted by Lookout was actually a phishing test, not a real attack attempt. “We, along with the partners who reported the site, now believe it was built by a third party as part of a simulated phishing test on VoteBuilder,” Lord said in a statement. The test, which mimicked … attributes of actual attacks on the Democratic party’s voter fil­e, was not authorized by the DNC, VoteBuilder nor any of our vendors. The party took the necessary precautions to ensure that sensitive data critical to candidates and state parties across the country was not compromised.”

According to Newsweek, there is at least one report that the Michigan Democratic Party was the organization behind the simulation.

Read more here. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/dnc-incident-was-a-phishing-exercise/d/d-id/1332646?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The adoption of DevOps continues to grow rapidly, and security teams are still trying to keep up. A natural starting point has been to focus on application security and securing the code itself. Although this is definitely an important piece of the puzzle, DevOps today has moved beyond just building application code into binaries into building complete system infrastructure in containers and virtual machines.

With this increased scope of DevOps comes all of the risks of the tens of thousands of known vulnerabilities and misconfiguration issues associated with the operating system, services, and system components included in the build. Just performing security assessments on the source code alone is not sufficient to identify these risks.

With the focus on speed and providing customers a constant stream of new features, DevOps teams typically haven’t prioritized security first. Security is widely believed to be an inhibitor to agility, and using traditional security methods can be a bottleneck to DevOps agility. Security and IT operations teams understand that it’s not sustainable to leave security out of the picture completely, but if security doesn’t work at the speed of DevOps, it will continue to be pushed aside. This is why integrating security into the actual DevOps life cycle is key to managing risk effectively in the world of rapid development.

When looking to implement security at the speed of DevOps, one should understand what DevOps teams mean by the “CI/CD pipeline” and what that looks like. (CI refers to continuous integration, and CD refers to continuous delivery.)

Continuous integration is the concept that developers should be checking-in new code on a frequent basis (this could be several times a day). Code is checked in to a source code repository like GitHub, where an automatic build system, such as Jenkins, compiles the code and checks the new build to ensure the code didn’t break anything.

The new build then continues onto the continuous delivery stage, where it is automatically deployed into testing environments for more involved end-to-end, load, performance, and integration tests. If everything passes, the new build is ready to be deployed to production. 

When deploying the new build, the DevOps team needs to define the right environment to run the applications and then ensure that all components are configured correctly. Tools such as Ansible, Chef, and Puppet are used for this.

Integrating Security into the Process
By understanding the CI/CD pipeline, security teams can see where it makes sense to put security controls in place and how they can match up to the existing DevOps workflow.

As mentioned, checking the source code being committed into the CI is a good first measure. However, many organizations leave it at that when they should go on to address the overall application infrastructure as it moves through the pipeline. It’s not just code going through CI/CD process; operating systems, third-party components, middleware, and databases are being built and deployed along with that code.

The CI/CD process involves a DevOps toolchain, a set of automated tools facilitating the building, testing, environment configuration, and deployment of these systems. By integrating security into this toolchain, organizations can add effective quality gates that fit within the existing process to assess for vulnerabilities, configurations, and compliance with frameworks and/or organizational standards. It’s important have quality gates and assessments at the different stages of building, testing, and deploying because many changes can happen between the code committing and the system deploying. It’s often more costly and frustrating to reject applications at the end of the CI/CD versus having visibility and addressing issues along each stage.

The most effective way to do this is to integrate security tools with CI/CD build tools (e.g., Jenkins, TeamCity, and Bamboo) and CI/CD configuration tools (e.g., Puppet, Chef, Ansible, and Salt) to fully automate these assessments. The assessments can then either stop issues from continuing down the pipeline or at least provide visibility into the risk the business is accepting. To ensure vulnerabilities aren’t slipping through the cracks, having the additional ability to dynamically test systems in a live sandbox would be a great benefit.

Just as important as preventing issues from going into production, organizations will want to monitor and maintain the integrity of their production environments. Several, perhaps hundreds, of production environments were configured specifically to make the DevOps-produced applications work, so once you’ve set it up correctly, you want to monitor for any configuration changes.

DevOps will continue to grow, so organizations must implement security solutions that work at the speed of DevOps. DevOps is the new world of developing, releasing, and updating applications for a growing number of enterprises; therefore, security teams need to let go of the traditional security stack, stop fighting DevOps teams, and instead jump in right beside them.

Related Content:

• 6 Ways DevOps Can Supercharge Security
• Overcoming ‘Security as a Silo’ with Orchestration and Automation
• Gartner Says IT Security Spending to Hit $124B in 2019
• From DevOps to DevSecOps: Structuring Communication for Better Security

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early-bird rate ends August 31. Click for more info. 

David Meltzer is Chief Technology Officer at Tripwire, a leading provider of security, compliance, and IT operations solutions for enterprises, industrial organizations, service providers, and government agencies (www.tripwire.com). He began building commercial security … View Full Bio

Article source: https://www.darkreading.com/application-security/embedding-security-into-the-devops-toolchain/a/d-id/1332571?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

California native Ochenetchouwe Adegor Ederaine Jr., has been arrested and charged for his involvement in a conspiracy to launder funds generated from business email compromise (BEC) fraud schemes, the Department of Justice reported this week.

Ederaine was part of an organization involved with wire fraud and related criminal activity. He laundered the money they generated through bank transactions crafted to conceal the nature, location, source, ownership, and control of the money.

Between March 2016 and November 2017, the DoJ reports, Ederaine used fake passports and other counterfeit identification documents to open about 23 bank accounts at different institutions around the Los Angeles area using six different false identities. Each newly opened account received wire transfers containing proceeds of the group’s illicit activity.

Ederaine faces a maximum sentence of 20 years in prison, three years of supervised release, and a fine of $500,000 or twice the value of funds laundered in the conspiracy.

Read more details here.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/ca-man-arrested-for-conspiracy-to-launder-bec-earnings/d/d-id/1332647?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple