adm – Page 707 – STE WILLIAMS

Flaws in Mobile Point of Sale Readers Displayed at Black Hat

library
crime | hacking | security

While security is high overall for mPOS tools from companies like Square, PayPal, and iZettle, some devices have vulnerabilities that attackers could exploit to gather data and cash.

Mobile point of sale (MPOS) systems have changed the way business is done for small vendors around the world. These small devices from companies like Square, PayPal, and iZettle allow the smallest businesses to accept credit and debit cards from customers without having to go through the expense and complication of establishing a merchant account with a bank. With millions of these little devices in the market, though, it’s reasonable to ask just how secure transactions can be when they come through a device that costs less (in some cases, far less) than $50.

Leigh-Anne Galloway and Tim Yunusov – Positive Technologies’ security researcher and senior banking security expert, respectively – sought to answer that question in research presented at Black Hat USA and DEF CON. Galloway and Yunosov chose four providers – Square, iZettle, PayPal, and SumUp – and seven separate readers for their research. “We now have quite a few different vendors who are operating in the marketplace. And we’ve also noticed from a personal experience that we’re starting to see these terminals in many different small businesses,” Galloway said in a pre-Black Hat USA interview. “We really wanted to see what the significant differences are between different vendors and different regions.”

There is one key difference between the US and Europe when it comes to reducing fraud: in Europe, EMV chip-enabled cards (created to protect against counterfeiting and card-present fraud) are accepted by roughly 95% of all the MPOS devices in service, while in the US, they’re accepted by roughly 13% of MPOS devices, according to data cited by Galloway and Yunusov. It’s not that EMV cards aren’t present in the US; 96% of credit cards in US circulation support EMV, but less than half of all transactions use the chip, say Yunosov and Galloway.

In testing the devices, the researchers sought to send arbitrary commands to the MPOS device, tamper with the amount of the transaction, and perform remote code execution on the device.

The type of attack changes depending on the aim of the theoretical criminal. Sending arbitrary commands can be part of a social-engineering attack in which the customer is asked to re-try a transaction using a less secure method. Transaction amount tampering amounts to a man-in-the-middle attack in which a $1 transaction at the reader becomes a $50 transaction at the financial institution. And remote code execution can give the attacker access to the memory of the device which then becomes a mobile skimmer for the purpose of stealing credit card account information from customers.

It’s important, Galloway and Yunusov said, to remember that the MPOS devices are part of an overall financial ecosystem, and that different companies protect devices and transactions in different ways. “We did find some really good examples of anti-fraud protection,” Galloway said in the interview. “Some vendors were carrying out very sophisticated anti-fraud detection using forms of correlation to identify bad devices and readers,” she explained. The researchers also found a wide variety of anti-fraud activities taking place during the device and merchant enrollment process, with some vetting potential merchants much more heavily than others.

In the test results, Galloway and Yunusov found that Square and PayPal had the most active anti-fraud and security checks during the transaction process, with iZettle monitoring less actively. They also found that the Miura devices used in some instances by Square and PayPal were susceptible to arbitrary commands and amount tampering via remote code execution.

In general, though, “We were impressed by the level of physical security mechanisms in place generally,” Galloway said. “Most of the readers that we looked at have good internal protection from tampering. It was very good for a product that retails at that price and we were surprised by that, actually.”

The researchers did have suggestions for merchants using MPOS devices. The suggestions included controlling physical access to devices, moving as quickly as possible to EMV transactions, and choosing a vendor with a robust, secure total payment infrastructure.

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/risk/flaws-in-mobile-point-of-sale-readers-displayed-at-black-hat/d/d-id/1332555?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Election Websites, Backend Systems Most at Risk of Cyberattack in Midterms

library
crime | hacking | security

Both adult and kid hackers demonstrated at DEF CON how the hackable voting machine may be the least of our worries in the 2018 elections.

Two 11-year-old budding hackers last week at DEF CON in Las Vegas used SQL injection attack code to break into a replica of the Florida Secretary of State’s website within 15 minutes, altering vote count reports on the site.

Meanwhile, further down the hall in the adult Voting Machine Hacking Village at Caesars Palace, one unidentified hacker spent four hours trying to break into a replica database that housed the real, publicly available state of Ohio voter registration roll. He got as far as the secured server — penetrating two layers of firewalls with a Khali Linux pen testing tool — but in the end was unable to grab the data from the database, which included names and birthdates of registered voters.

“He got to the secure file server but didn’t know how to write the query to pull the data out,” says Alon Nachmany, solution engineer with Cyberbit, which ran the voter registration database simulation. That he got as close to the data as he did was no small feat, however.

“He got very far, but he didn’t have the skill needed to pull the file itself,” Nachmany says.

The setup, using Cyberbit’s training and simulation platform for cyber ranges, was designed to mimic a typical county election system — with a web application server on a DMZ behind a firewall and a secure file server sitting behind its own firewall — but was created more for a red-team training scenario, says Bash Kazi, a Cyberbit partner who built it. “We used a more sophisticated network and attack scenario that somebody would have to much more trained to hack,” he says.

While the election-office simulation challenge proved to be too much of one for most takers at the voting system hacking event, security experts say that these and other web-based systems, such as states’ election-reporting websites and candidate websites, are the most likely (and easy) targets of attackers for the fall midterms.

That’s not to say voting machines are not easy marks: hackers successfully cracked into at least nine different machines in the Village this year, including voting machines, tablets, and e-pollbooks, with buffer overflows, stored passwords, and a lack of encryption, for example. It’s just simpler for a remote hacker such as a nation-state to penetrate a public-facing website to DDoS it, deface it, alter information (such as changing vote count data or polling place information), or access sensitive data stored on its back-end servers than to tamper with a voting machine.

DEF CON and Black Hat founder Jeff Moss says this year’s Village represented an evolution from pure voting machine hacking in 2017 to moving toward election systems and infrastructure. “We’re working from the edges,” Moss says.

“Last year was the big splash. We’re hoping now the that the ‘oohs’ and ‘aahs’ are over, we can now start digging into” other more serious security flaws in election systems, he says. “There’s still work to be done.”

Jake Braun, co-founder and organizer of the DEF CON Voting Village, says including the kids’ portion of DEF CON, R00tz Asylum, in the voting and election hacking events wasn’t meant to be a “gotcha” moment. “The most vulnerable part [of the election system] are these websites,” he says. “The ultimate fake news is changing election results.”

Emmett Brewer, aka @p0wnyb0y, gave himself all of the vote counts, and then tweeted: “I think I won the Florida midterms.” He was first to crack the site, in 10 minutes, followed five minutes later by Audrey, who was able to trip the vote counts on the Florida Division of Elections replica site. Brewer, Audrey, and other kid hackers in R00tz were given a handout on SQL injection and how to use it.

The replica Secretary of State websites and software were set up by Aries Security, whose founder and CEO, Brian Markus, previously converted his Capture the Flag simulator for the US Department of Defense’s cybersecurity training operations.

DEF CON Drama
But DEF CON wouldn’t be DEF CON without a bit of controversy: as the world’s largest hacker conference kicked off last week, the National Association of Secretaries of State (NASS) issued a public statement panning the Voting Village. “Our main concern with the approach taken by DEFCON is that it utilizes a pseudo environment which in no way replicates state election systems, networks or physical security. Providing conference attendees with unlimited physical access to voting machines, most of which are no longer in use, does not replicate accurate physical and cyber protections established by state and local governments before and on Election Day,” NASS said in its statement.

NASS also said allowing hackers to hack “mock” election office networks and voter registration databases isn’t realistic. “It would be extremely difficult to replicate these systems since many states utilize unique networks and custom-built databases with new and updated security protocols,” the association said.

But NASS didn’t dispute potential website weaknesses, however, adding that those sites only provide unofficial and “preliminary” results and have no physical or virtual link to vote-counting systems, so they can’t alter actual vote-count results.

Even so, experts say malicious hackers could wreak chaos and confusion and instill distrust of the election outcomes if they tamper with election-related websites in the run-up to the elections or on Election Day.

Website security analyst Jessica Ortega of SiteLock says website hacking is getting missed amid the wave of voting machine vulnerabilities. “People don’t realize what a weapon it can be,” she says. “It’s almost impossible to impact a legitimate vote count at scale, but you can sow distrust and chaos by defacing a polling place and associated websites, changing the address or phone number of polling places, and the unofficial results that get reported to the media. It’s easy to change a 3 to a 6” in a tally, for example, she says.

Ortega says few local municipalities have DDoS mitigation protections in place. “They don’t even have proper infrastructure for legitimate traffic,” she says, pointing to a recent special election where a county website went down for two hours merely due to high and legitimate traffic, not a DDoS attack.

Paul Gagliardi, former contractor for a US intelligence agency and currently a principal threat researcher at Security ScoreCard, says the entire election ecosystem must be secured, not just voting machines. Funding for state and local IT elections for the most part is relatively low and all about functionality first and security “as an afterthought,” he says. “Hopefully, that changes.”

But DEF CON organizer Braun and others concur that efforts to uncover and address security issues with the election infrastructure overall as well as more intersection between the security community and federal, state, and local officials, didn’t come soon enough for the midterms. “It’s going to be hard to do much for 2018. The goal is before 2020,” Braun says, including more federal funding for election security.

Cyberattacks in Progress
Meantime, Russian nation-state hackers and other potential attackers already have been targeting systems. California Secretary of State Alex Padilla, who headlined a panel at DEF CON, told Dark Reading attempts to attack state election systems “continues” and goes “up and down.”

Padilla said in his opening remarks that while he understood where his colleagues “were coming from” in the NASS statement given the pressures on them to uphold election integrity and security, the first he heard about the statement was when he was contacted about it upon his arrival in Vegas. “We’re trying to strike the right balance of cybersecurity and integrity with confidence in the systems,” he said. “I’m here to listen and learn” from experts at DEF CON, he added.

Also on the panel with Padilla were Jeanette Manfra, US Department of Homeland Security assistant secretary of cybersecurity and communications; Noah Praetz, director of elections in Cook County, Ill.; Neal Kelley, chief of elections and registrar of voters for Orange County, Calif.; and Amber McReynolds, director of elections for the city and county of Denver, Colo.

Orange County’s Kelley reported activity similar to that in 2016. “We’re constantly seeing hits against our firewall: scans. So that level of activity continues like it was in 2016. We haven’t seen that decline,” he told Dark Reading. “Just the same level of standing as we were seeing” in 2016, he said.

Security experts say Russia and other attackers likely have been quietly attacking election systems for some time as part of their campaign to attempt to disrupt the US elections in some way. “I assume most of these things are already in progress,” says Gagliardi. “They don’t happen overnight. I’m confident we’ll see more” activity, he says.

DEF CON plans to publish a final report on all of the Voting Hacking Village findings.

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/election-websites-backend-systems-most-at-risk-of-cyberattack-in-midterms/d/d-id/1332554?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Oracle: Apply Out-of-Band Patch for Database Flaw ASAP

library
crime | hacking | security

Flaw in the Java VM component of Oracle’s Database Server is easily exploitable, security experts warn.

Oracle this week urged organizations to immediately patch a critical vulnerability in multiple versions of Oracle database that gives attackers a way to completely compromise the technology and gain root access to the underlying server.

The flaw [CVE-2018-3110] exists in the Java VM component of Oracle’s Database Server and affects versions 11.2.0.4 and 12.2.0.1 on Windows. It also impacts Oracle Database version 12.1.0.2 on Windows and Oracle Database on Linux and Unix. However, patches for these particular versions of the database were issued with Oracle’s July 2018 monthly patch update.

In an out-of-band security advisory Monday, the enterprise software giant described the vulnerability as an issue that can be remotely exploited only by fully authenticated users who are able to create a session with the database. Even so, it urged customers to take immediate action to address the issue. “Due to the nature of this vulnerability, Oracle strongly recommends that customers take action without delay,” the advisory noted.

The National Vulnerability Database categorized the threat as easily exploitable. “[It] allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM.”

While the flaw exists in the Java VM component, an attacker can exploit the vulnerability to attack other technologies as well. “Successful attacks of this vulnerability can result in takeover of Java VM,” the NVD cautioned.

Todd Schell, product manager of security at Ivanti, says the ease with which an attacker can exploit the flaw makes it imperative for organizations using Oracle’s database to address the issue immediately. “This out-of-band vulnerability and fix should not be overlooked and delayed until Oracle’s next patch update in October,” he warned.

Though an attacker does require valid access credentials to exploit the flaw, even a basic user set of credentials — obtained via methods like phishing – would work, he says.

Oracle, like other major security vendors, typically releases security patches and updates on a fixed, publicly available schedule. While companies like Microsoft follow a monthly schedule, Oracle releases its patch updates in a quarterly cycle— in January, April, July, and October. Because of the complexities involved in applying patches to running databases, even that pace is often too hard to keep up with for many organizations.

“Organizations can take ages,” to apply patches, even if they are as critical as the one announced this week, says John Holt, founder and chief technology officer at Waratek. “Oracle themselves claim that their average customer runs nearly a year beyond in applying critical patches. Other third-party software testing vendors claim that 86% of even the most serious flaws take more than 30 days to fix.”

What makes those numbers especially troubling is the fact that attackers using automated scanners can identify and launch attacks against just announced vulnerabilities within hours of disclosure, Holt says.

With this particular vulnerability though, delay would be inadvisable. Organizations need to realize that vulnerabilities don’t get any easier to exploit, he says. “When someone pushes an exploit script into the wild, any two-penny script kiddie will be able to take hostage one of the most popular and widespread database systems in-use by companies and governments in a single click,” Holt notes.

For most organizations, the principal risk group for this particular vulnerability is internal actors such as rogue employees. External attackers who have compromised lateral systems in an internal corporate network are another major risk group, Holt says.

“A simple static script will be all that is required,” he predicts. “As soon as one is released, then anyone can wield this vulnerability in a single click.”

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/oracle-apply-out-of-band-patch-for-database-flaw-asap/d/d-id/1332556?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Pacemaker controllers still vulnerable 18 months after flaws reported

library
crime | hacking | security

A popular brand of heart pacemaker is still vulnerable to compromise more than a year and a half after the company that makes them was told of weaknesses in its security, researchers have claimed during a Black Hat presentation.

The product in question is the Medtronic CareLink 2090 monitor, used by doctors to control pacemaker settings, and the researchers are Billy Rios of QED Secure Solutions and Jonathan Butts of WhiteScope, both of whom have an impressive track record at finding flaws in unexpected places.

Last year the pair used a show session to highlight flaws that might allow an attacker to gain control of poorly-secured car washes, while Rios has also co-researched weaknesses in diverse devices such as electronic door security and X-ray machines.

This year’s session on pacemaker hacking sounded a lot more dangerous, however. A medical theme the pair underscored by demonstrating a separate attack on Medronic’s MiniMed insulin pump.

As reported by journalists who attended the demo, the vulnerability that makes it possible for an attacker to run malware on the CareLink 2090 is down to poor software design, primarily that software updates aren’t signed or encrypted.

This is far from an unknown issue on IoT devices, but the session wasn’t simply about what is possible so much as how the manufacturer had responded after being told of the weakness.

As of 9 August, the issue had first been reported to Medtronic 570 days ago, with a proof-of-concept 155 days ago, they said.

As the Black Hat session notes observe:

The researchers followed coordinated disclosure policies in an attempt to help mitigate the security concerns. What followed was an 18-month roller coaster of unresponsiveness, technical inefficiencies and misleading reactions.

Medtronic responded to the presentation with this statement:

While the advisory process took longer than all parties desired, this process was necessary to coordinate with WhiteScope, ICS-CERT, and FDA to determine whether this should result in a public disclosure or advisory.

An ICS-CERT advisory for the CareLink 2090 appeared in February, after the issue was reported to them presumably after direct communications with Medtronic did not have the desired effect.

This mentions mitigations such as turning off the device when not in use and connecting to it via VPN, recommendations echoed by Medtronic. The company followed this up last week by publishing a warning regarding the MyCareLink Patient Monitor models 24950 and 24952.

Security by obscurity

None of this does much for the patients, many of whom will remain blissfully unaware that the products used to manage their health conditions might have hidden problems.

This “bliss” often remains even after public disclosures are made by medical companies. As Rios said during the demo:

When someone gets this advisory and they’re reading this language, it’s almost impossible for them to understand what the risks are.

It’s good when problems are brought into the open but sometimes simply being out in the open isn’t always enough on its own.

Follow @JohnEDunn
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/zTyZH2H17_0/

Apple Mac “zero day” hack lets you sneakily click [OK]

library
crime | hacking | security

At the recent DEF CON cybersecurity conference in Las Vegas, macOS security researcher Patrick Wardle did something that the responsible disclosure doctrine says is a bit naughty.

He “dropped 0day” on Apple’s macOS, meaning that he publicly revealed an exploit for which no patch is yet available.

Exploits against unpatched vulnerabilities are known as zero-days for short, or 0days for supershort, because even an on-the-ball system administrator has had zero days to get ahead of the game with updates.

In an ideal world, Wardle would have told Apple quietly first, waited until a fix was out – or a suitable deadline had passed that implied Apple couldn’t be bothered to fix the issue – and only then gone public.

Fortunately, as zero-days hacks go, this one isn’t super-serious – a crook would have to infect your Mac with malware first in order to use Wardle’s approach, and it’s more a tweak to an anti-security trick that Wardle himself found and reported last year than a brand new attack.

The word zero-day originates in the 1980s and 1990s software piracy scene, where crackers competed to be the first to hack a new game so it could be played illegally without paying. The speed of a crack was measured in the number of days after official release until the crack appeared, so that a same-day crack, known as a “zero-day”, was the ultimate achievement.

Wardle told Wired he pretty much found this zero-day “because I wanted to run out and surf and I was being lazy.”

The haste caused Wardle to make a copy-and-paste programming mistake that oughtn’t to have worked at all, yet bypassed Apple’s security checks instead.

This is a stark reminder that hackers and cybercrooks can succeed through dogged determination and a whiff of good luck, simply by trying things no one else had thought of before, or things that everyone else assumed would fail.

The trick he discovered means that a program already running on your Mac can click through on-screen dialogs on your behalf, even when those dialogs are supposed to act as speed bumps to acquire consent for security-related activities.

For example, if you have the Mac firewall turned on and a program tries to accept network connections from the outside, you will to see a warning so you realise what’s happening, and you need to approve it yourself:

The same sort of thing happens if you install software that includes a kernel driver, a low-level component that gets loaded inside macOS and thus has access to the internals of the system itself.

Because apps with kernel drivers have much more power than regular apps – more, in fact, than apps that run with administrator powers – your Mac warns you before a new driver loads for the first time.

You have to click to authorise a new kernel driver, in addition to entering your password to install the app in the first place:

Wardle claims that you can reliably click past these speed bumps using a rogue app, even though Apple aims to make sure that this sort of dialog sticks around until a real user deals with it.

Wardle’s zero-day revealed

Clearly, any security warning that can simply be clicked through, rather than requiring some sort of authentication such as a password, isn’t particularly strict.

But if it’s supposed to be a warning, and it’s supposed to alert you to something an app isn’t supposed to be able to do of its own accord, then that selfsame app oughtn’t to be able to bypass the warning for you.

In 2017, Wardle spent time looking into just how careful Apple was at preventing apps from sneakily clicking past warnings that were supposed to demand user attention, and he found that there were surprisingly many ways for a rogue app to pretend to be a dutiful user.

In fact, Wardle discovered a vulnerability that became CVE-2017-7150, patched in an official Apple update at the end of the year. (That update more notably patched Apple’s infamous “password stored as plaintext hint” bug.)

Apple’s intention, in the CVE-2017-7150 security patch, was to detect what are known as synthetic clicks in order to force user-facing popups to be dealt with by real users, not by mouse-clicking code running in the background.

Anyway, it was while preparing his 2018 DEF CON talk on the very issue of synthetic clicks that Wardle had his surfing urge.

The way Wardle tells it, he was writing code to generate a mouse click that that he assumed Apple would block, but accidentally coded his synthetic click as “generate a mouse down event followed by another mouse down event”.

Clearly, this can’t happen with a physical mouse, where the only thing you can do after pressing the mouse button down is to let it come back up, so his mouse simulation code shouldn’t have made any sense at all.

In theory, the double-mouse-down code should have been an irrelevancy that did nothing.

In practice, Wardle found that his code not only triggered a synthetic mouse click, but also went undetected.

In other words, it looks as though Apple’s anti-synthetic-click protection isn’t perhaps as generic as it ought to be – a bit like a cop who asks to see your driving licence to check its validity, sees it’s from overseas and therefore in an unfamiliar format, and decides simply to take it at face value and wave you through.

Note. Wardle’s DEF CON paper refers to the use of synthetic clicks to extract Apple Keychain passwords without you realising. As far as we can see, his new “zero day” does not revive this particular bug, because the dialog that Keychain pops up now always requires your password. Just clicking through is no longer enough to export passwords and keys from Keychain storage, assuming you have patched your Mac recently.

What to do?

If you’re a Mac user, there’s not a lot you can do until Apple issues an update to its original CVE-2017-7150 update.

This bug isn’t a show-stopper, of course, because it’s not a way to break into a computer, merely a way to skip sneakily past warnings that are routinely clicked through anyway.

Apparently, the next release of macOS, codenamed Mojave, will disallow many of the system features that make synthetic clicks possible in the first place – this might cause hassles for some legitimate but hackerish utility apps, but ought to be a general security improvement overall.

If you’re a programmer, remember that security is a journey, not a destination, and the patch you came up with today might not be effective next month or next year, so never rest on your cybersecurity laurels.

And if you’re a security researcher or a penetration tester, remember that security is a journey, not a destination, and attacks that get blocked today might not stay blocked for ever.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/eUbUbTc4gHI/

CVE? Nope. NVD? Nope. Serious must-patch type flaws skipping mainstream vuln lists – report

library
crime | hacking | security

The first half of 2018 saw a record haul of reported software vulnerabilities yet a high proportion of these won’t appear in any mainstream flaw-tracking lists, researcher Risk Based Security (RBS) has claimed.

According to the company’s estimate, from the beginning of the year until June 30 it recorded a total of 10,644 vulnerabilities, 16.6 per cent of which were given CVSSv2 scores of 9.0 or higher (High to Critical severity), which means they required urgent patching.

However, 3,279 of these don’t appear in official databases such as the Common Vulnerabilities and Exposures (CVE) and the US National Vulnerability Database (NVD), potentially leaving companies in the dark about their existence.

Of this less well-documented group, 44.2 per cent had a severity rating between 9.0 and 10.0.

“While other criteria than just CVSS scores are important to consider when managing and prioritizing vulnerabilities, it is highly problematic if an organisation is not aware of higher severity vulnerabilities that pose a risk to their assets,” said RBS chief research officer, Carsten Eiram.

The underlying reason, RBS claimed, is that as vulnerability reporting has grown, it has also become more decentralised. Today, vulnerabilities are being logged “everywhere and anywhere”.

It’s why companies such as RBS have sprung up to monitor numerous sources to gain a more accurate picture of the total number of flaws, it added.

This isn’t as simple as tracking multiple sources because vulnerability reporting is often confusing and incomplete, including sources in languages other than English. “While some contend that the CVE/NVD solution is good enough, the number of data breaches based on hacking points to a different conclusion,” said RBS’s VP of vulnerability intelligence, Brian Martin.

“In today’s hostile computing environment, with non-stop attacks from around the world, organisations using sub-par vulnerability intelligence are taking on significant risk needlessly.”

Another issue was disclosure – how coordinated software vendors and developers are when informing customers that the software being used by them has a vulnerability.

The good news from the 2018 Mid-Year VulnDB QuickView Report is that 48.5 per cent are now disclosed in a coordinated way, an improvement over 2017.

And yet, 25.5 per cent of the flaw haul between January and June have no known solution, either in the form of a software patch or a mitigation to reduce a flaw’s severity.

It could be argued that the overall gradual rise in the number of vulnerabilities should be interpreted as good news, a reflection of the small army of researchers who make it their job to find them.

While this might be true to some extent, only 13.1 per cent of coordinated disclosures originated from the booming sector of bug bounty programmes, the report’s authors estimated. Meanwhile, almost a third of the total vulnerabilities were known to have a public exploit.

Leaving aside RBS’s sales pitch for their own research, it’s clear that organisations should be looking beyond mainstream vulnerability data sources.

“We continue to see a surprising number of companies still relying on CVE and NVD for vulnerability tracking, despite the US government funded organisations’ continued underrepresentation of identifiable vulnerabilities,” said Martin. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/14/record_software_vulnerabilities/

Three more data-leaking security holes found in Intel chips as designers swap security for speed

library
crime | hacking | security

Intel will today disclose three more vulnerabilities in its processors that can be exploited by malware and malicious virtual machines to potentially steal secret information from computer memory.

These secrets can include passwords, personal and financial records, and encryption keys. They can be potentially lifted from other applications and other customers’ virtual machines, as well as SGX enclaves, and System Management Mode (SMM) memory.

SGX is Intel’s technology that is supposed to protect these secrets from snooping code. SMM is your computer’s hidden janitor that has total control over the hardware, and total access to its data.

Across the board, Intel’s desktop, workstation, and server CPUs are vulnerable. Crucially, they do not work as documented: where their technical manuals say memory is protected, it is not.

It is the clearest example yet that, over time, Chipzilla’s management traded security for speed: their processors execute software at a screaming rate, with memory protection mechanisms a mere afterthought. In the the pursuit of ever increasing performance, defenses to protect people’s data became optional.

Redesigned processors without these speculative execution design blunders are expected to start shipping later this year. Mitigations in the form of microcode updates, operating system patches, and hypervisor fixes, should be arriving, and should be installed if you’re worried about malware or malicious virtual machines slurping data.

These are the three cockups, which Intel has dubbed the L1 Terminal Fault (L1TF) bugs.

CVE-2018-3615: This affects Software Guard Extensions (SGX), and was discovered by various academics who will reveal their findings this week at the Usenix Security Symposium. According to Intel, “Systems with microprocessors utilizing speculative execution and software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via side-channel analysis.” This vulnerability was named Foreshadow by the team who covered it.
CVE-2018-3620: This affects operating systems and SMM. According to Intel, “Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and side-channel analysis.”
CVE-2018-3646: This affects hypervisors and virtual machines. According to Intel, “Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and side-channel analysis.”

The operating system and hypervisor-level flaws – CVE-2018-3620 and CVE-2018-3646 – were discovered by Intel’s engineers after they were tipped off about CVE-2018-3615, the SGX issue, by the university researchers. The impact, according to Chipzilla, is as follows:

Malicious applications may be able to infer the values of data in the operating system memory, or data from other applications.

A malicious guest virtual machine (VM) may be able to infer the values of data in the VMM’s memory, or values of data in the memory of other guest VMs.

Malicious software running outside of SMM may be able to infer values of data in SMM memory.

Malicious software running outside of an Intel SGX enclave or within an enclave may be able to infer data from within another Intel SGX enclave.

Intel has a technical white paper, here, with more information, and an FAQ here.

Finally, it must be said that no malware, to the best of our knowledge, is exploiting the related Meltdown and Spectre flaws, nor the aforementioned speculative-execution vulnerabilities – partly because mitigations are rolling out across the industry, and partly because there are easier ways to hack people.

It is easier to trick someone into entering their online banking password into a bogus website than developing malicious software that tickles the underlying hardware in such a specific way to slowly extract secrets from memory. In a warped way, we should be thankful for that.

Developing… this story will be updated with more information.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/14/intel_l1_terminal_fault_bugs/

Equifax Avoided Fines, but What If …?

library
crime | hacking | security

Let’s imagine the consequences the company would have faced if current laws had been on the books earlier.

Equifax made headlines around the world in 2017 with a massive data breach of more than 143 million records worldwide. It waited 40 days before notifying consumers of the breach, exposing customers to further risk. And that’s not all.

Things went downhill from there, with the CEO, CISO, and CIO retiring or resigning and multiple executives charged with insider trading related to the breach.

All this as the internal processes that led to the breach showed significant failures and a lack of basic awareness of why basic information security practices are in place. Although the company has been working to overhaul its approach to security, critical questions remain.

Why Do They Have My Data?
In the backlash, many customers — especially those in the EU and Canada, where strong privacy laws exist — wondered why a company they had never agreed to do business with was holding all of this personally identifiable information. This naturally leads to a larger question of what role, if any, data brokers should play and how they should be regulated and monitored.

In late June, it was announced that US consumers — the majority of those affected in the breach — would finally see the consequences of Equifax’s (in)action.

The result: nothing.

Nothing?
Well, technically, not “nothing,” but close enough. Reuters details the consent decree approved by regulators in eight states, including New York, Texas, and California. The required action by Equifax was to complete a detailed assessment of cyber threats, increase board oversight, and improve patching processes for known security vulnerabilities. In essence, security 101.

With the exception of “board” oversight — but not oversight in general — these are all common security basics. They are part of the PCI standard that must be adhered to by any company processing credit card information. However, the data broker that maintains a huge piece of the credit rating marker only now has to step “up” to this level of cybersecurity?

Alternatives
Let’s work through a few “what-if” scenarios to explore the potential penalties that Equifax would have to face under various regulations.

1. If the Equifax breach happened under GDPR in the EU (which took effect May 25, 2018), it’s likely that they would be hit with two major fines. The first for failure to adequately notify affected individuals, and the second for a failure to secure the data in the first place.

Failing to notify would cost Equifax up to 2% of its global revenue, and failure to secure would cost up to another 4%. In 2017, Equifax had global revenues of $3.36 billion. That means Equifax would have been fined about $201 million under GDPR for this breach.

2. If the Equifax breach happened under the new California Consumer Privacy Act of 2018 (which comes into effect in 2020), it could face financial penalties. The penalties for data theft under this act range from $100 to $750 per California resident, or actual damages.

We know from the initial data breach report that Equifax had records on 143 million Americans. That’s about 56.9% of the eligible population. If we use that percentage for California, we have about 17.2 million affected California residents. That means that Equifax could have been fined between $1.7 billion and $12.75 billion for this breach.

Both penalties are a far cry from the $0.00 fine it received.

Frustration
The biggest challenge with the Equifax breach is the inability for any affected user to take reasonable actions to prevent any abuse of their information.

All of the recommendations (monitor your credit, carefully check your bank transactions, look out for identity theft, etc.) are all reactive. They will only help highlight something that has already happened. Legislation like GDPR in the EU and the California Consumer Privacy Act are designed to shift the balance of power back to the owner on the information.

Make no mistake: Your information is yours. You only entrust it to others. Part of that trust is that they will do their best to protect it.

That’s the real issue at the heart of the Equifax breach from the consumer point of view. At no point was that information explicitly entrusted to Equifax. The company simply acquired it and started to monetize it.

This is a case where strong individual rights for privacy and control over our data make sense.

Enough?
Thankfully — as reported by the New York Times — Equifax is still under investigation by a number of agencies, including the Federal Trade Commission, Consumer Finance Protection Bureau, and the Securities and Exchange Commission. That means there is still hope that Equifax will face further punishment for a breach that never should have happened.

Hopefully, something will come of it. Cybersecurity as it is currently practiced is a constant and near overwhelming challenge. Companies need to develop and maintain a culture of security. A culture that respects data privacy. With that in place, cybersecurity becomes far easier.

Cybersecurity is everyone’s responsibility. That needs to be acknowledged and practiced before we can move forward.

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early-bird rate ends August 31. Click for more info.

Mark Nunnikhoven explores the impact of technology on individuals, organizations, and communities through the lens of privacy and security. Asking the question “How can we better protect our information?,” Mark studies the world of cybercrime to better understand the risks … View Full Bio

Article source: https://www.darkreading.com/equifax-avoided-fines-but-what-if-/a/d-id/1332487?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

‘Election Protection’ Aims to Secure Candidates Running for Office

library
crime | hacking | security

The kit is designed to prevent credential theft targeting people running for federal, state, and local elected offices.

The Cybersecurity Election Protection Toolkit, released today by Thycotic, aims to protect US election candidates and their employees during campaigns for federal, state, and local office.

Thycotic specializes in privileged access management, and its goal with this tool is to prevent credential theft. Its free kit addresses common means to target elections: getting unsuspecting people to download malware, cracking weak passwords, and stealing confidential information.

What’s inside: a digital edition of Cybersecurity for Dummies, an incident response template to help plan for an attack, and a poster template to hang in campaign offices to educate staffers on how to stay safe online and protect their credentials. The kit also provides access to a free password strength checker and strong password checker, both available online.

Washington Man Sentenced in Ransomware Conspiracy

library
crime | hacking | security

A guilty plea brings 18-month sentence on money laundering charges for former Microsoft employee.

A federal judge has sentenced a Maple Valley, Wash. man to 18 months in prison for his role in a scheme based on Reveton ransomware. Raymond Odigie Uadiale, 41, a former employee of Microsoft, was sentenced following his June 4 guilty plea.

Reveton displayed a splash screen with the logo of a law enforcement organization. The screen included a message alerting the victim that the law enforcement organization had found illegal material on the infected computer and required the payment of a “fine” to regain access to the computer and its data.

The victim was instructed to purchase a GreenDot MoneyPak and enter the account number into a form on the splash screen. Using the information from these cards, Uadiale transformed the MoneyPak funds into cash, kept a portion for himself, and sent a portion back to Reveton’s distributor in the United Kingdom.

Indicted on one count of conspiracy to commit money laundering and one count of substantive money laundering, Uadiale pled guilty to the conspiracy charge while the government dismissed the substantive count. In addition to his prison sentence, Uadiale was sentenced to three years of supervised release.

According to court documents, while a graduate student at Florida International University, Uadiale used Liberty Reserve (a digital currency platform) to transfer approximately $93,640 in Liberty Reserve dollars to his co-conspirator as part of the scheme.

For more, read here.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info.

Article source: https://www.darkreading.com/attacks-breaches/washington-man-sentenced-in-ransomware-conspiracy/d/d-id/1332551?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple