STE WILLIAMS

Would a bill banning bots do more harm than good?

There’s a bill currently in the works in the California state legislature (SB-1001 Bots) that would require bots to disclose that they’re bots. Specifically, the bot needs to own up to its purpose if it is being used to “mislead the other person about its artificial identity for the purpose of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election.”

According to the bill as it stands now, it would be okay to use a bot for these purposes as long as it discloses that it is a bot; otherwise, the bot’s use is “unlawful,” says the bill, though the consequences aren’t exactly clear.

Bots are automated accounts on online services (frequently on social media like Twitter and Facebook) that can be used to drum up support for a specific point of view in order to sway public opinion.

The idea here is that if convincingly-human-seeming bots flood social media with messages for support for a specific political opinion, their overwhelming presence will start to bring real voters to their side. This tactic was purportedly used in social media campaigns for both Brexit and for the 2016 election in the United States, and it’s understandable that this bill was introduced to try and prevent this kind of interference from occurring in another election.

But bots on social media have other uses. They’re used by artists and hackers alike to generate everything from poems to memes to self-care reminders to randomly-generated nonsense. Requiring every single one of these bots to disclose their bot-ness would be oppressive to free speech and creativity, said the EFF in its appeal to Senator Hertzberg of California, who introduced the bill.

As of the time of this writing, the text of the bill has been amended several times and had one major revision. The previous version of the bill came down hard both on bots and services the bots used, with at least one previous revision requiring that the service provider investigate suspected bots within 72 hours of notice of a bot’s potential presence, as well as providing possible reports to the Attorney General about any action taken against bots. Notably, these requirements were removed in further revisions, and right now the bill only requires that a bot disclose itself in a “clear, conspicuous, and reasonably designed” fashion… and that’s about it.

While the initial version of the bill may have had more teeth, it was decried by organizations like the EFF as likely to cause a lot of unintended harm. The current version of the bill is narrower in scope, but it’s not really clear if, even in its current form, it would make any kind of helpful impact to stem the tide of bots astroturfing election chatter online.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/aJatS637n_Q/

  • 26/07/2018
  • adm

Twitter boots 143K bad apps, throttles developer access to API

Devs now have to register and will be limited to 10 apps. Those apps have been put on an activity diet: no more endless gorging on spam/privacy invasion/bot-pestering.

We’re sick and tired of our APIs being used to spam, invade privacy and manipulate conversations, Twitter said on Tuesday, announcing that it bumped over 143K bad apps off the platform between April and June.

Yoel Roth of API policy and Rob Johnson, senior director product management, said in a post that in its ongoing efforts to make Twitter healthier and stop malicious apps faster, it’s going to limit the access the apps have to its platform in the first place.

To that end, devs, welcome to a few new hoops you’ll have to jump through to develop Twitter apps – specifically, to develop all of your new, default allotment of 10 apps.

To wit:

No ticket? No laundry. As of Tuesday, all new requests for access to both standard and premium APIs have to go through registration. Twitter introduced a new developer account application process in November that includes use case reviews, policy compliance checks and new protections to prevent the registration of spammy and low-quality apps. So welcome to that: no more free and easy access to the API, nor to the not-free and more firehosey API, for that matter.

Yes, it’s a bit more work, but Twitter thinks it will limit the number of bad actors:

While this change adds a few steps and some additional time to the process of getting started with access to our APIs, we’re committed to supporting all developers who want to build high-quality, policy-compliant experiences using our developer platform and APIs, while reducing the impact of bad actors on our service.

The change means that to get at Twitter’s APIs, you’re going to have to apply for a developer account using the new developer portal at developer.twitter.com. After you’re approved, you can create new apps or manage existing apps on the developer portal, though you can also still manage existing apps on apps.twitter.com.

Same change is coming for existing apps. Twitter will give developers of existing apps at least a 90-day heads-up before it requires them to complete a developer account application in order to maintain their apps.

All developers are going to have to provide detailed information about how they use or intend to use Twitter’s APIs so that the platform can better ensure compliance with its policies. If an app doesn’t comply, it will be rejected. Also, developers that request additional products or features down the line could be looking at additional, more radical policy reviews. That will apply if, say, developers want their apps to post more frequently or at higher volumes than new rate limits allow.

One developer account = 10 apps. The new default number of apps that can be registered by a single developer account is now 10. Need more? You can request permission by using the API Policy support form. Developers who already have more than 10 apps registered can continue to use them – as long as those apps behave and comply with policy.

No more hyperactivity. Twitter’s imposing new rate limits for POST endpoints. That should cut down on spam posts, Twitter says, though the rates will apply to any app that tweets, retweets, likes, follows, or direct messages.

These are the new default limits …

  • Tweets and retweets (combined): 300 per 3 hours
  • Likes: 1000 per 24 hours
  • Follows: 1000 per 24 hours
  • Direct messages: 15,000 per 24 hours

…that will go into effect on 10 September. This is a big drop from the existing rate of POST activity allowed from a single app by default, Twitter says, but at least apps that are playing nicely now can keep on doing what they’re doing: Policy-compliant developers can maintain existing rates of POST activity, plus they can request elevated rate limits if need be.

Twitter’s now reviewing policy of potentially affected apps and plans to let eligible developers know how to request elevated access so their apps won’t be affected when the new rate limits go into effect in September. Check that your email’s up to date so that Twitter can contact you if necessary.

It would have been nice to give a longer chunk of time before introducing a big change like that, Johnson and Roth said. Twitter greased the rails because “protecting our platform and people using Twitter from abuse and manipulation is our highest priority.”

One would imagine that another highest priority is not getting sued by the European Union, fed up as it is with what it says is the feeble, not-fast-enough removals of hate speech, extremist content and propaganda, to name just a few products of the bad-app situation, by Twitter and its social media brethren.

Another highest priority well might be heeding a declaration passed down from Unilever last month when CMO Keith Weed announced that the company’s had it up to here with fake followers and bots.

Earlier this month, Twitter shuttered accounts linked to election hacking. That move followed Twitter’s removal of tens of millions of suspicious, probably fake accounts from users’ followers lists.

Will any of these moves against fake/bot accounts help?

There are skeptics. One such, Geoff Golberg, says he started looking into Twitter’s spam detection tools when somebody bought his Twitter account 10K fake/bot followers. One thing he says he found was a “family of Twitter accounts” he said were falsely representing North Carolina and various North Carolina municipalities to “amplify Trump/right-leaning content in a coordinated fashion.”

In a post on Medium, Golberg said Twitter didn’t take his complaints seriously.

He pointed to this thread …

… from voting system researcher Mike Farb, who describes how Twitter accounts can automatically be created, re-named and re-purposed, while hijacked accounts can be “sanitized” by deleting old tweets and changing their handles, screen names and imagery.

The recent Twitter Purge is a step in the right direction, Golberg says, but it’s just “the tip of the iceberg,” given how tangled the fake-account ecosystem is.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/U3vb0lya6sg/

  • 26/07/2018
  • adm

Sen. Ron Wyden: Adobe Flash is doomed, why is Uncle Sam still using it?

It’s bug-ridden, eternally insecure, and on death row – yet Adobe Flash persists on too many US government webpages.

Now Senator Ron Wyden (D-OR) wants to hear the sound of this deity-forsaken plugin torn from .gov websites, dragged behind a shed, and a single final gunshot.

Regular Reg readers will remember that even Adobe has seen written the writing on the wall, and last year set 2020 as the end-of-support date for its beleaguered exploit magnet.

virus_1_648

Patch or ditch Adobe Flash: Exploit on sale, booby-trapped Office docs spotted in the wild

READ MORE

In a letter [PDF] to NIST under-secretary Walter Copan, NSA director, US Cyber Command commander Paul Nakasone, and secretary of Homeland Security Kirstjen Neilsen, Wyden today asked the agencies to learn from Microsoft Windows XP: it’s expensive to ask vendors continue fixing up out-of-support software. In other words, stop relying on it, get rid of it, and replace Flash files with HTML5.

He has the NSA, DHS and NIST in his sights because those three government organizations carry “the majority of cybersecurity guidance” to the rest of Uncle Sam’s agencies. Wyden wants government officials to stop creating new Flash content within 60 days, and also asks that:

  • Agencies remove Flash content from their websites by August 2019;
  • To aid in that effort, the DHS’s “routine cyber-hygiene scans” should identify, and list for agencies, all Flash content found; and
  • Agencies should pilot removing Flash from staff computers, starting in March 2019, ahead of expunging it by August 1, 2019.

Wyden noted that US-CERT “has warned about the risks of using Flash since 2010” – making it a latecomer: the earliest Flash fsckup we can find in El Reg‘s archives seems to be this directory traversal horror from 2007.

When the plugin falls out of support, Wyden wrote, “cybersecurity risks will only be compounded.”

We couldn’t agree more. Stop using Adobe Flash. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/26/ron_wyden_adobe_flash/

  • 26/07/2018
  • adm

The ABCs of Hacking a Voting Machine

A hacker who successfully infiltrated a voting machine at last year’s DEF CON will demonstrate at Black Hat USA how he did it, as well as what he later found stored on other decommissioned WinVote machines.

It took computer scientist Carsten Schuermann just minutes last year to hack into one of the 30 pieces of voting equipment sitting in a cramped room in Caesar’s Palace that housed DEF CON’s maiden Voting Machine Village. He fired up his laptop, quickly spotted a WinVote voting machine on the Wi-Fi network using Wireshark, and then typed in a command that launched a Metasploit exploit.

“And, poof, that was it,” Schuermann says. He was able to access the Windows XP-based voting machine using the Remote Desktop Protocol (RDP), exposing real election and voting data that was still stored in it. The voting machine’s inherent weaknesses made it an easy mark: It ran XP (Service Pack 0), Wi-Fi and RDP were enabled by default, it employed the outdated WEP security protocol, and the majority of WinVote machines he had studied all used the same password: “abcde.” 

“The only changes I did was turn off the machines remotely, and we added new files to the directories,” he says. His exploit used an old buffer overrun flaw in XP, which apparently had not been patched on the voting machine.

Schuermann had been studying security weaknesses in the WinVote machine back at his home office at the IT University of Copenhagen in Denmark. He now has eight decommissioned WinVote machines that were used in previous elections – four from Virginia – that he’s been dissecting and looking for clues of compromise and hacking attempts. He’ll be back in Vegas in August at Black Hat USA, demonstrating just how he hacked the machine at DEF CON, as well as sharing some research findings from the WinVote machines he’s been studying. 

[See Schuermann’s Black Hat USA talk on August 9, Lessons from Virginia – A Comparative Forensic Analysis of WinVote Voting Machines]

“I’m going to bring a machine and show how easy it is to hack … exploiting the same vulnerability” used in last year’s DEF CON contest, he says. Schuermann, an academic expert in election security who has been studying election security for a decade, used a root shell script to control the machine, and says he can change data on the voting machines. The notoriously insecure WinVote machines – which don’t include a paper-trail feature – were replaced in Virginia prior to the 2016 election, but some localities, including some in Pennsylvania, still use them.

“Since these machines all have the same access point they connect to, once you know how to get into that wireless network … and use the ‘abcde’ password, then you have networking access to the machine and can deploy the exploit. Then you’re in,” he says. “The scary thing is you could make this automatic: You could drive by polling stations and make changes on all of the totals in the voting machines.”

Schuermann has been conducting forensic investigations on the disks in the WinVote machines using the so-called Autopsy tool. “I was trying to understand if everything was OK with the machine or was it hacked,” he says.

But because the machine’s XP platform doesn’t provide system logging, there’s no way to track whether someone connected remotely to the machine. “There’s no trail of who accessed it,” Schuermann says. So the only way to spot a potential hack is the data on the disks.

So far, Schuermann has found traces of MP3 files on the disks of one of the WinVote machines, including a Chinese music file, he says. It appears the machine was used to record songs from CDs and play MP3s.

“But there’s no evidence real hacking happened” on the machines so far, he says, and no signs of election-meddling in vote counts. 

Even so, Schuermann says hacking one of the machines would have been fairly simple. “If anyone really knows what they are doing, they could hack those machines in a minute. And once you’ve hacked one, you know [how] to hack [others],” he says.

The biggest risk overall, he says, is citizens losing trust in an election and the voting systems if hackers are able to break into them and alter or change results. “Now, with the Russia investigation and election interference, people are becoming more aware that this is not only possible but also likely someday. That’s the scary part,” he says. 

His message for the US midterm elections: “How important [a] paper [trail] is,” he says.  

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/iot/the-abcs-of-hacking-a-voting-machine/d/d-id/1332386?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 26/07/2018
  • adm

Hey you smart, well-paid devs. Stop clicking on those phishing links and bringing in malware muck on your shoes

Software developers have been lionized in recent years for their influence over the information economy. At the Node Summit in San Francisco, California, on Wednesday, Guy Podjarny, CEO and cofounder of security biz Snyk, reminded an audience full of devs that they’ve become a popular vector for malware distribution.

Programmers, he said “have become far more powerful today than ever before” in terms of their access to information and their reach.

At the same time, he said, they’re often overconfident about their susceptibility to attack. He pointed to an internal Salesforce phishing test that found developers were the second most likely group of employees to click on a phishing link. Marketers were the most gullible, apparently.

To underscore that point, he recounted the 2013 hack of The Financial Times by the Syrian Electronic Army and an analysis posted by developer Andrew Betts, then director of FT Labs, that acknowledges as much.

“Developers might well think they’d be wise to all this – and I thought I was,” Betts wrote.

To highlight the risk, Podjarny reviewed several examples in which developers propagated malware.

Apple’s XCode IDE, presently a hefty 5.3GB, weighed in at about 3GB in 2015, he said. That was still too much for programmers in China who had to endure slow download speeds due the country’s Great Firewall. In response, someone placed a copy of XCode on a Baidu file sharing site, however, the software had been altered to include compiler malware called XCodeGhost.

XCodeGhost iOS infection toll rises from 39 to a WHOPPING 4,000 apps

READ MORE

The malware, which went undetected for four months and compromised hundreds of apps, modified a CoreServices object file with malicious code that infected iOS apps during compilation. It created extra interface elements designed to capture personal information.

“What’s interesting is how it propagated,” said Podjarny. “CoreServices not an executable. It is a library linked by the LLVM linker.”

Developers in effect were the distribution mechanism. They were the virus.

Malware exploiting developers and their tools goes back further still, Podjarny said. There was a similar attack on the Delphi compiler in 2009, known as Induc. And back in 1984, computing luminary Ken Thompson, wrote a paper, “Reflections on Trusting Trust,” describing how he created a C compiler that automatically inserted a backdoor in the programs it created.

“The moral is obvious,” Thompson wrote. “You can’t trust code that you did not totally create yourself.”

That sentiment poses a particular problem for the Node.js community, where developers often rely on dozens or hundreds of code libraries (each of which may incorporate other libraries) written by someone else.

Developer David Gilbertson touched on the issue in a blog post in January about how easy it would be to create an npm package to steal credit card data. And there have been several attacks on npm and other developer resources like Pypi and RubyGems in recent years.

Podjarny offered several mitigation strategies. He advocated automating security controls, as Apple and npm have done with malware scans, and adopting multi-factor authentication for accounts. Organizations, he said, should make it easy to be secure, by auto-expiring access tokens for example. And they should do more to educate developers about security.

Vladimir de Turckheim, lead Node.js engineer for security monitoring biz Sqreen, echoed this point in the session that followed, a roundtable discussion of Node.js security. “We are not good at evangelizing good practices in terms of coding,” he said.

Podjarny, also participating in the roundtable discussion, joked about that his CTO recently gave a presentation titled, “Stack Overflow, the vulnerability marketplace,” in reference to the insecure code examples that get copied and pasted from the coding community site into apps because they’re blessed with a green check mark as the accepted solution.

Podjarny’s message to developers was to be humble about the possibility that your code may be insecure.

“With great power comes great responsibility,” he said. “You’re trustworthy but you’re not infallible.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/25/developers_malware_vectors/

  • 25/07/2018
  • adm

US Homeland Security warns of latest hacker craze – ERP pwnage

Hackers are increasingly looking to target enterprise resource planning (ERP) systems to disrupt and steal data from large companies.

This according to a report (PDF) from security companies Digital Shadows and Onapsis, who say that hacktivists and state-sponsored groups in particular have been looking to exploit flaws in Oracle and SAP platforms.

“ERP applications are being actively targeted by a variety of cyber-attackers across different geographies and industries,” the report reads.

“Traditional controls of ERP application security such as user identity management and segregation of duties are ineffective to prevent or detect the observed TTPs used by attackers.”

The report has received the endorsement of DHS, who recommended companies read and follow its findings.

Because ERP applications are so heavily relied upon by companies and because they are increasingly exposed to the public internet as cloud services, the platforms are very attractive as both targets for sabotage and as the entry point for larger data-theft operations.

Because of this, the study found, the number of public exploits for SAP HANA and Oracle ERP software has doubled over the last three years. The researchers also note that demand for stolen credentials has also gone up, with some hackers repurposing banking malware to lift ERP system logins.

CPU thieves get in on the act

Even cryptominers are looking to get in on the act, say researchers. The paper notes a 2017 incident where hackers used an exploit for WebLogic to plant mining code on servers and rack up around $226,000 worth of Monero coins.

“While it is hard to know how widespread this activity is, we have detected individuals discussing the potential of using SAP servers to mine Monero on Internet Relay Chat (IRC) channels,” the report says.

“In January 2018, one IRC user discussed that ‘sap servers are well known to have high cores,’ and that ‘Sapadm’ could be used as a ‘combo’. Combos’ refer to username and password combinations that could be brute-forced to gain access to a particular server.”

DHS

No big deal… Kremlin hackers ‘jumped air-gapped networks’ to pwn US power utilities

READ MORE

To help prevent attacks, the two companies are advising administrators to take a careful look at their ERP applications for things like uninstalled patches and insecure configurations where users may have more privileges than needed.

The paper also recommends admins look to disable unused APIs and internet-facing logins that are not necessary. In general, admins should look to minimize the attack service on their ERP software.

“Given the complexity and high-degree of interconnectivity between different ERP applications, it is very important to stress that these controls and recommendations must be applied across the entire ERP application platform, including all instances/application servers of production environments as well as non-production ones (i.e., development, quality assurance, sandbox, pre-production),” the report concludes.

“A vulnerable setting in one QA application server can result in a full compromise of the entire ERP platform.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/25/latest_hacker_craze_erp_pwnage/

  • 25/07/2018
  • adm

The Good & Bad News About Today’s Cybersecurity Investment Landscape

Lots of things keep CISOs up at night. But instead of guessing what CISOs want, investors and vendors should incorporate customer feedback throughout product ideation and development cycles.

The global cybersecurity market is currently valued at over $120 billion, up from just $3.5 billion in 2004, and the dollar amount of cybersecurity venture capital investment has grown 12 times in response. Over the past decade, the number of cybersecurity vendors has grown 23 times, an overabundance on the supply side that has complicated the marketplace and spooked less-committed, more-traditional investors. With competition high and differentiation low, backing new ventures presents much greater risk. Startups are finding it difficult to stand out. CISOs can be overwhelmed by the flood of new options.

Now the good news: Today’s market dislocations present openings for those with foresight. More noise in the market doesn’t change the fact that the signal (i.e., the number of opportunities on an annual basis) is still the same or growing. Increased competition historically has pushed markets to improve, and there’s no reason to believe the current case is any different. Security teams that understand the market and openly communicate and align their efforts with the right partners can capitalize on the resulting growth. But first they have to understand the changing landscape.

Cybersecurity Increasingly Specialized
Much of the recent discussion surrounding cybersecurity, both optimistic and pessimistic, speaks about the industry in monolithic terms. This is reminiscent of how people spoke about the Internet 20 years ago. The reality now, as then, is far more complex. Stakeholders who simply focus on cybersecurity are likely not focused enough.

Cybersecurity has fragmented into a fractal of hypertechnical specialties and subspecialties. From a high level, each offshoot might blend indistinguishably into the overall landscape. But a deeper perspective reveals highly differentiated underlying patterns. Developing deep industry expertise and granular technical knowledge is the only way to evaluate opportunities at their appropriate depth and is the crucial first step to successfully filtering the signal from the noise.

Solving a Problem Is No Longer Enough
For better or worse, cybersecurity is a game of cat and mouse. According to Momentum Cyber, the number of threat types has gone from fewer than 50 to more than 1 million since 2007. And Cybersecurity Ventures predicts cybercrime damages will cost the world $6 trillion annually by 2021, up from $3 trillion in 2015. There is no shortage of problems desperately in need of solving.

The recent flurry of cybersecurity vendors has largely sought to combat this explosion of threats in a piecemeal, reactive way. However, such an approach is unsustainable, and a sea change is brewing. CISOs are feeling overwhelmed by the onslaught of “me-too” vendors and are seeking to simplify. According to research by Cisco, companies currently have up to 70 different security vendors installed and 62% are actively consolidating their security stack as a result.

For vendors, simply solving a problem is no longer enough. Unless a new technology either helps CISOs solve an unaddressed or imminent, high-priority problem or better utilize and operationalize their existing security stack, it won’t even register on their radar. Meeting either of these criteria requires both a workable technical solution and a viable market opportunity. Validating an idea or product along both of these dimensions requires extensive due diligence, technical expertise, and active engagement with customers.

CISOs Getting a Say in Product Development
There are a lot of things reportedly keeping CISOs up at night. But few articles on this topic are actually written by CISOs themselves. Instead of simply guessing what CISOs want, investors and vendors should incorporate customer feedback throughout product ideation and development cycles.

Cultivating and tapping a network of knowledgeable customers produces a powerful, virtuous cycle. Entrepreneurs and investors receive feedback that will both improve their product and maximize its chances of success. And CISOs, by virtue of participating, get access to a pre-vetted and decluttered sampling of promising vendors tackling relevant problems. Being a part of the product development process also allows CISOs to give voice to specific concerns other startups might have missed or that larger vendors have not properly addressed. Even high-profile CISOs have proven surprisingly willing to volunteer their time and expertise, illustrating the potential for innovative approaches to produce mutually beneficial relationships that improve the overall cybersecurity ecosystem.

High-Conviction, Value-Add Investment Is the New Standard
Cybersecurity is a complex, dynamic, and crowded market. Even the strongest products and brightest teams will need strategic, operational support until they gain their own momentum. Luckily, much of the expertise and skills that drive the investment process can be easily redirected toward amplifying the early efforts of founding teams. Whether it means fostering industry relationships to help guide business development, committing intelligence capabilities to analyze competition, or offering technical knowledge to facilitate product growth, investors should dedicate all resources possible to helping their portfolio teams succeed.

For their part, entrepreneurs should seek out partners capable of providing extensive, ongoing value-add support services and actively facilitating connections daily to potential customers. For example, our firm’s network advisory board, comprised of corporate CISOs, meets prospective cybersecurity startups almost every day.

Cybersecurity is an industry still brimming with potential. However, capitalizing on that potential requires deep knowledge and high conviction. The current, crowded marketplace presents new pitfalls for less-sophisticated players. But those committed and careful enough to sidestep these challenges can reap outsize rewards. Investors, startups, and CISOs who appreciate the industry’s complexity, anticipate the market’s needs, and prioritize strategic collaboration will be poised to win big in the rapidly changing cybersecurity landscape.

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info. 

Ofer Schreiber is a partner, at YL Ventures, which invests early in cybersecurity, cloud computing, big data, and software-as-a-service software companies, and accelerates their evolution via strategic advice and Silicon Valley-based operational execution. Ofer Schreiber has … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/the-good-and-bad-news-about-todays-cybersecurity-investment-landscape/a/d-id/1332361?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/07/2018
  • adm

Google Calls Out Insecure Sites in New Chrome Version

The latest version of the Chrome browser puts a label on unencrypted websites.

As of July 24, websites that aren’t encrypted will stand out for Chrome browser users with a “Not Secure” label in the address bar. The good news is that use of the unsecured HTTP protocol has diminished by more than 20 percentage points, according to Google, since it announced its intention to call out vulnerable sites more than two years ago.

In its blog post announcing the change, Google restated its desire to see the Web as an environment of 100% encrypted communications. Users of the latest version of Chrome (68) will see a new “not secure” notification when visiting HTTP pages. For the October release of Chrome (70), the company intends to call out unencrypted sites in bright red letters 

Google also pointed out that it offers encryption at no additional cost for website owners through Let’s Encrypt, a free and open certificate authority.

Read here, here, and here for more.

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/google-calls-out-insecure-sites-in-new-chrome-version/d/d-id/1332385?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/07/2018
  • adm

Google Security Updates Include Titan Hardware Key

At Next 2018, Google also launches context-aware access management, shielded VMs, and G Suite security center investigation tool.

Google is ramping up its security offerings with a wave of cloud and hardware announcements at the Next 2018 conference, taking place this week in San Francisco.

These updates arrive four months after Google rolled out cloud-based data and security controls. They tackle areas of security that officials report as top-of-mind for users: access management, platform security, data protection, and transparency.

“We want to give them a lot of visibility and transparency into operations – what we’re doing, how we’re doing it,” said Rob Sadowski, trust and security marketing lead at Google Cloud, during a virtual press conference about the security updates. 

Many of the updates focus on enabling more secure and convenient access. It’s a priority as more devices enter the workplace, says Google product management director Jess Leroy. Users expect seamless access to corporate resources, and network and security administrators need to maintain a certain security standard while maintaining that ease of access.

“You have different types of users connecting from all different types of places, with all different types of devices,” Leroy explains. “The ecosystem has changed pretty dramatically.”

Secure Access 
Traditional access management tools “often put security at odds with flexibility” by enforcing one-size-fits-all controls that limit users, says Jennifer Lin, product management director at Google Cloud, in a blog post about today’s announcements.

Google is addressing the problem with “context-aware access,” which will let businesses enforce granular access to Google Cloud Platform (GCP) APIs, resources, G Suite, and third-party SaaS apps based on a person’s identity, location, and context of the request. A managed device, for example, might have access to resources other devices don’t, Leroy says.

Context-aware security capabilities are available for certain customers using VPC Service Controls. They’re coming soon for customers using Cloud and Identity Access Management (IAM), Cloud Identity-Aware Proxy (IAP), and Cloud Identity.

Another component to secure access is the Titan Security Key, a FIDO security key built with a secure element to verify its integrity. It’s a phishing-resistant second factor of authentication for high-value users such as Google Cloud admins. Thirty percent of enterprise users open phishing emails, Leroy said, and 12% of them click on the malicious payload.

Google’s customers typically use the Titan key for high-value users or content – for example, administrators or root users for whom compromise would cause much greater damage. The Titan Security Key is available now for Google Cloud customers and will soon be available for anyone to purchase on the Google Store.

Secure Infrastructure
Other updates announced today are intended to strengthen the underlying cloud infrastructure, Leroy explains. One of these is Shielded VMs, which use advanced platform security to verify that no one has tampered with virtual machines. Admins can monitor changes to the VM baseline and its current runtime state. Shielded VMs are available now in beta.

Binary authorization, arriving soon in beta, lets users require signature validation when deploying container images. “It’s making sure the containers you expect to go to your production environment are always the containers that go to your production environment,” Leroy explains. It can be combined with Container Registry Vulnerability Scanning, which ensures images are safe and prevents deploying any containing vulnerable packages.

Data Protection
On the data security front, Google is rolling out Cloud HSM, a hardware security module hosted in the cloud. Cloud HSM lets users host encryption keys and perform cryptographic operations to protect sensitive workloads without worrying about managing an HSM cluster.

“The problem with HSMs is they are extremely onerous to manage,” Leroy said. “Once you’ve deployed, you have to manage them, you have to patch them, provide the right uptime and clustering and scalability … typically this is not a small investment from a time and money perspective.” Cloud HSM is Google’s way of addressing these problems, he notes.

The Cloud HSM service is integrated with the Cloud Key Management Service (KMS), Lin explains, so it’s easy to create and use keys that are generated and protected in hardware. Cloud HSM can also be used with customer-managed encryption keys (CMEK) integrated services, including Google Compute Engine, Google Cloud Storage, BigQuery, and DataProc.

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/cloud/google-security-updates-include-titan-hardware-key/d/d-id/1332389?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/07/2018
  • adm

Iranian Hacker Group Waging Widespread Espionage Campaign in Middle East

Unlike other threat actors that have a narrow set of targets, Leafminer has over 800 organizations in its sights, Symantec says.

Leafminer, a threat actor that appears to be operating out of Iran, is conducting a wide-ranging cyber espionage campaign against organizations in the Middle East using a mix of publicly available tools and custom malware.

While the group’s technical capabilities are average at best in comparison to other advanced persistent threat (APT) actors, its goals seem far more ambitious, according to Symantec, which has been studying the group.

The security vendor’s analysis of Leafminer’s activities shows the group has run targeted vulnerability scans against as many as 809 organizations across multiple industries in Saudi Arabia, United Arab Emirates, Egypt, Kuwait, Israel, and other countries in the Middle East.

The group’s major focus areas appear to be organizations in the financial, government, and petrochemical sectors, with half of its targest in those industries. Other targets include shipping and transportation, food services, utilities, and construction. Leafminer mostly has gone after email data, files, and database servers.

“[Leafminer’s] ambitious goal of targeting at least 800 different organizations across the Middle East is what sets them apart,” from other threat actors, says Vikram Thakur, technical director at Symantec. Most APT campaigns are typically focused on a far smaller set of entities with shared geopolitical interests.  

“As a group, Leafminer highlights the need for organizations to better protect their public-facing network infrastructure against known vulnerabilities and attack tools,” he says. Thakur estimates that Leafminer has conducted targeted attacks against dozens of organizations from the list of over 800 organizations against which it has run vulnerability scans.

Leafminer is the latest example of the increased cyber activity from Iran in recent years. Earlier this year, security vendor FireEye’s Mandiant unit reported a major surge in nation-state sponsored threat activity in the country in 2017. The vendor described Iran as the next China based on the extent of state-backed threat activity in the country last year.

Just this week, Palo Alto Networks issued a report on the OilRig Group, a previously known threat actor that is also based in Iran. Researchers spotted multiple attacks by OilRig between May and June 2018 directed at a technology services provider and a government organization. The attacks delivered a backdoor designed to help the threat actors steal data from the targeted victims.

Leafminer Living Off the Land

At a high-level, Leafminer’s tactics, techniques and procedures (TTP) are somewhat similar to the so-called “living-off-the land” approach that many threat actors have begun adopting, Symantec said. In addition to custom tools, the threat actor has shown a proclivity for using tools and techniques that are publicly available or have been used by others.

For instance, one of the tools that Leafminer has been using for collecting credentials is a rebranded version of the well-known Mimikatz post-exploitation tool. The method the attackers have adopted to deploy Mimikatz on compromised systems similarly is a technique known as Process Doppelganging that security vendor enSilo demonstrated at Black Hat Europe last year.

Leafminer has also taken advantage of the NSA’s Fuzzbunch toolkit that the Shadow Brokers group leaked last year, to develop exploit payload for delivering custom malware targeted at vulnerabilities in Windows SMB server, Symantec said.

Leafminer’s malware toolkit includes at least two custom malware products — a backdoor called Sorgu for enabling remote access to a compromised system and Imecab, a Trojan for establishing a persistent access account on an infected system.

The hacking team has been mainly using three techniques to gain initial access to a targeted network: watering hole attacks via compromised Web servers; scans for vulnerabilities in network services; and dictionary attacks against network service logins. In keeping with the group’s habit of borrowing techniques and tactics used by others, the approach that Leafminer has been using in its watering hole attacks are similar to that employed by the Dragonfly APT group, according to Symantec.

The tactics employed by threat groups like Leafminer highlight the need for organizations to pay attention not just to new and emerging threats but to previously known ones as well.

“Enterprises should take note of the fact that a foreign adversary is relying primarily on existing vulnerabilities and publicly available tools to target hundreds of organizations in multiple verticals, with a degree of success,” Thakur says.

In many cases, organizations can mitigate most of their exposure to such threats simply by applying known security practices, such as keeping systems updated and properly patched where possible, Thakur says.

Related Content:

 

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/iranian-hacker-group-waging-widespread-espionage-campaign-in-middle-east/d/d-id/1332388?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/07/2018
  • adm