adm – Page 734 – STE WILLIAMS

‘Password Check Required’? Not So Fast

library
crime | hacking | security

The most successful phishing emails tell users to check their passwords or investigate security alerts.

Hackers are exploiting their increasingly security-savvy targets by sending emails disguised with subject lines about security alerts and password verification. Consumers are taking the bait.

For the “Top 10 Global Phishing Email Subject Lines” report for Q2 2018, researchers at KnowBe4 pulled data from simulated phishing tests and real-word phishing emails reported to IT departments. The most successful messages target users’ commitment to security as attackers bank on the likelihood such emails will make people feel alarmed or needed.

“Password Check Required Immediately” is the most effective subject line, with 15% of users clicking, followed by “Security Alert” (12%) and “Change of Password Required Immediately” (11%). Other common lines included “A Delivery Attempt was Made” (10%), “Urgent press release to all employees” (10%), and “Deactivation of [[email]] in Process” (10%).

Intel Xeon workhorses boot evil maids out of the hotel: USB-based spying thwarted by fix

library
crime | hacking | security

Ex-Intel security dragons have breathed fresh fire into the old maxim: if someone has physical access to your machine, you’re pwned.

US-based Eclypsium, founded by former Chipzillans Yuriy Bulygin and Alex Bazhaniuk, confirmed this week it is possible to pull off a classic evil maid attack against Intel-powered servers and workstations by abusing a USB-based system debugging mode to commandeer a vulnerable box.

In effect, you can jam a widget into a vulnerable machine’s USB port and run some crafty code to take over the system and install a rootkit, spyware, or whatever you like. This requires a special debug mode in the chipset to be enabled, and you to be left unattended with the box.

The exploitation of USB-based debugging to hijack systems has been previously documented. What’s new here is that on Monday, Eclypsium blogged that Intel has issued a patch – specifically, an updated Direct Connect Interface policy – to thwart USB-based debugging attacks on certain Xeon-powered systems.

The vulnerability was designated CVE-2018-3652, and Chipzilla credited its discovery to Eclypsium principal researcher Jesse Michael, also ex-Intel.

Intel left a fascinating security flaw in its chips for 16 years – here’s how to exploit it

“Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors, and Intel Xeon Processor D Family can potentially allow a limited physical presence attacker to access platform secrets via debug interfaces,” Intel noted in its advisory.

It added that client chips – such as those used in desktop PCs and laptops – should be unaffected because USB-based debugging is expected to be disabled by default. If in doubt, check your firmware settings.

According to Team Eclypsium, “debug access over USB enables installation of persistent rootkits in UEFI firmware and runtime SMM firmware on systems that do not securely set debug policy. This weakness would allow an attacker with physical access to the device to perform an ‘Evil Maid’ attack without opening the case.”

Again, this particular attack is against Xeon-based systems, rather than Intel-powered client computers. For the latter, you’ll have to pop the case, as demonstrated in this video.

That’s what makes debug mode valuable: if it’s enabled, “it is possible to halt the system inside SMM and make arbitrary changes to memory from that context. This grants complete control of highly privileged SMM execution to the attacker,” the Eclypsium team said. At that point, a miscreant has total control over the hardware.

According to the researchers, ensure in your firmware settings that CPU debugging is “disabled and locked,” and the Direct Connect Interface is disabled, because “if enabled, the chipset will provide debug capability over USB.”

If a target falls short on these controls, an attacker who can get near your gear can plug a cable into the USB port and pwn a machine with a script. “An attacker may infect firmware with their own malware or rootkit, and they can do it without opening the case,” the team warned.

In short: it’s not the end of the world, however, it’s why physical security and UEFI settings matter. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/25/intel_xeon_usb_debugging/

Intel Xeon workhorses boot evil maids out of the hotel: USB-based spying thwarted by fix

library
crime | hacking | security

Ex-Intel security dragons have breathed fresh fire into the old maxim: if someone has physical access to your machine, you’re pwned.

The vulnerability was designated CVE-2018-3652, and Chipzilla credited its discovery to Eclypsium principal researcher Jesse Michael, also ex-Intel.

Intel left a fascinating security flaw in its chips for 16 years – here’s how to exploit it

Again, this particular attack is against Xeon-based systems, rather than Intel-powered client computers. For the latter, you’ll have to pop the case, as demonstrated in this video.

In short: it’s not the end of the world, however, it’s why physical security and UEFI settings matter. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/25/intel_xeon_usb_debugging/

Want a $200k TIP? ZDI sticks bounties on bugs in big-name server code

library
crime | hacking | security

A bunch of new bug bounty rewards are up for grabs from the Zero Day Initiative, in a first-come, best-dressed program kicking off on August 1.

The Trend Micro-backed operation announced on July 24 what it called the Targeted Incentive Program (TIP). Besides the mention of Microsoft Windows Server 2016, the TIP focuses paying out cash for vulnerabilities found in open-source server-side products.

Bounty hunters, armed with fuzzers and exploits, will be rewarded if they’re the first to exploit previously unseen bugs in one of the target platforms shown in the table below.

The ZDI stated once a target is pwned, it will be removed from the list and replaced by another.

A harmless proof-of-concept demo won’t fill a white-hat’s bank account: the TIP seeks fully functioning exploits of zero-day vulnerabilities, affecting “the core code of the selected target.”

Along the way, a winning attacker has to defeat mitigations including sandboxes, Address Space Layout Randomization (ASLR), operating system protections, and so on, and a vulnerability must lead to arbitrary code execution to qualify. Reported flaws will be passed on to vendors to patch. Good luck. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/25/zdi_server_bounty_rewards/

New Free Chrome Plugin Blocks Cryptojacking Browser Attacks

library
crime | hacking | security

Qualys also plans Firefox, Safari, IE versions.

Qualys has developed a free extension for Google Chrome to protect browsers from cryptojacking attacks, Dark Reading has learned.

The new BrowserCheck CoinBlocker Extension uses both domain blacklists for cryptocurrency mining sites as well as heuristics features to detect unknown cryptojacking attack types. Qualys will officially roll out the plugin on Wed., July 25, but it’s already available on the Google Chrome Web Store.

Cryptojacking attacks often occur when an attacker infects a website with JavaScript, and an unsuspecting user visitor to the site unknowingly downloads that malicious code via a browser. The victim’s machine is then used to mine cryptocurrency, which the attacker pockets. The process can eat up more than 70% of a machine’s CPU, according to Qualys researchers.

Ankur Tyagi, senior malware research engineer at Qualys and one of the creators of the tool, says while there are other existing Chrome extensions for cryptojacking protection, most rely soley on a blacklist of IP addresses and not heuristics. Qualys’ BrowserCheck CoinBlocker Extension also was built to detect the popular CryptoNight family of cryptomining software, Tyagi says, the most pervasive of which is Monero.

Among the other coin types under the CryptoNight umbrella are ByteCoin, Digital Note, AEON, Loki, and BitTube. Tyagi says the heuristics feature in the plugin can spot patterns that indicate cryptomining algorithm activity.

“Attackers are trying to create JavaScript-based attacks that can be launched on clients that visit” crypto malware-infected sites, he says.

BrowserCheck CoinBlocker works like this: When a user browses a website, the plugin checks for the telltale malicious JavaScript. If it detects it, it stops the browser from downloading the JavaScript and also blocks the mining site. Qualys also plans to later roll out versions of the plugin for the Firefox, Safari, and Internet Explorer browsers.

Google has been well aware of cryptocurrency mining abuse. In April, Google removed and banned cryptocurrency mining extensions in the Chrome Web Store after 90% of these apps violated its policy of properly informing users of the the apps’ purpose.

The worldwide overall cryptocurrency market capitalization hit $270 billion this month, according to Qualys, demonstrating just how lucrative it is for abuse. Meantime, malicious coin-mining samples increased by 629% in the first quarter of this year, according to McAfee, from 40,000 samples in Q4 2017 to 2.9 million in Q1 2018.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/new-free-chrome-plugin-blocks-cryptojacking-browser-attacks/d/d-id/1332381?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

OpenWhisk at Risk: Critical Bug Leaves IBM Cloud Exposed

library
crime | hacking | security

IBM and Apache have issued patches for a vulnerability that let attackers overwrite any company’s serverless code with malicious content.

A vulnerability in Apache OpenWhisk exposed IBM customer data through IBM Cloud Functions, which is one of thousands of services relying on the open source serverless platform.

Apache and IBM have each issued a patch for the critical vulnerabilities, tracked as CVE-2018-11756 and CVE-2018-11757, which attackers could exploit to replace a company’s serverless code with their own malicious code. In doing so, they would be able to leak sensitive customer data, edit or delete files, mine cryptocurrency, or launch a DDoS attack.

The vulnerability was detected by PureSec researchers, who found under certain conditions, a remote hacker could overwrite the source code of a vulnerable function being executed in a runtime container, and control future executions in the same function in the same container.

Read more about how the exploit works and PureSec’s suggested fix here.

Article source: https://www.darkreading.com/threat-intelligence/openwhisk-at-risk-critical-bug-leaves-ibm-cloud-exposed/d/d-id/1332371?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

DHS Officials: Hundreds of US Utility Victims Infiltrated by Russian Hackers

library
crime | hacking | security

Federal government officials up their count of US energy sector victims from dozens to hundreds, according to a Wall Street Journal report.

The US Department of Homeland Security, which earlier this year warned of Russian nation-state hacking teams targeting energy and other critical infrastructure organizations, in a briefing this week provided more details on the attack campaign.

The Wall Street Journal reported that DHS officials said there were hundreds of victims: an increase from their original count of a few dozen targets who had been hacked by Dragonfly, aka Energetic Bear, via supply-chain attacks.

The attackers hopped from commercial supplier networks to the energy organizations and siphoned information on how the utility sites operate and were trying to remain under the radar, appearing as “people who touch these systems on a daily basis,” Jonathan Homer, chief of industrial-control-system analysis for DHS told the WSJ.

“The DHS has done a great job amplifying what was previously identified by the private sector and adding their own information. This relates to activity already previously communicated to the electric community, but highlighting ongoing risk is important,” said Rob Lee, CEO of Dragos.

But, Lee says, the WSJ report’s reference to “throwing switches” and “causing blackouts” was misleading. It’s more of a cyber espionage operation: “What was observed is incredibly concerning, but images of imminent blackouts are not representative of what happened which was more akin to reconnaissance into sensitive networks,” Lee says.

72% of CEOs Steal Corporate IP from Former Employers

library
crime | hacking | security

Employees often take corporate IP because they feel ownership over their work, a trend security experts say is a problem.

Higher security budgets and advanced new tech won’t protect your data from a CEO who decides to bring it outside the enterprise – and it turns out many have a habit of doing just that.

There remains a great disparity between how business leaders claim to approach cybersecurity and how they act, researchers found in Code42’s 2018 Data Exposure Report, which surveyed 1,034 security and IT leaders (CSOs, CTOs, CISOs, CIOs) and 600 CEOs and business leaders.

Most (78% of) CEOs and 74% of business leaders say intellectual property (IP) is the most valuable asset in the enterprise; however, 72% of CEOs admit to taking IP from a past employer. Nearly half of business leaders and 71% of CMOs claim to have done the same thing.

“I think we all know when people leave companies they take information with them,” says Code42 CISO Jadee Hanson. “The startling stat in here is the amount the C-suite executive level answered and said, ‘Yes, I take information when I leave a company.'”

The security side is concerned: 78% of CISOs polled say greatest risk to organizations is people who disregard policies and rules to do their jobs the way they want. But it’s tricky to convince employees to change dangerous habits when many don’t think they’re doing anything wrong.

Three-quarters of CEOs say “it’s not just corporate data, it’s my work, my ideas.” Seventy percent of business leaders agree. Both CEOs and businesses leaders feel ownership because, as they state, they “impart” themselves into their work and it should be considered theirs. Nearly all (93% of) CEOs keep a copy of their work on a personal device or storage account.

“People don’t even think of it as stealing information and taking it with them,” says Hanson.

The motivation is understandable but their actions are still dangerous. Three-quarters of CEOs know employees copy files onto multiple devices but feel powerless to stop it, and 86% of IT and security leaders think the extent to which files are stored externally poses a serious risk.

You Can Click, But You Can’t Hide

Half of business leaders and 63% of CEOs admit they’ve clicked links when they didn’t mean to or thought they shouldn’t have. As a result, 34% of CEOS had to change their passwords, one-quarter lost control of their accounts and 25% paid ransomware, researchers report.

Accidents happen and it’s certainly common to click malicious links. The problem is, 14% of CEOs and 36% of business leaders don’t report these incidents because they thought they could sort it out themselves (36% and 38%), didn’t think it posed a security risk (20% and 24%), feared the repercussions (26% and 23%), or “hoped nothing would happen” (27% and 22%).

Think Before You Download

Nearly 60% of CEOs admit to downloading software without knowing whether it’s security-approved, which marks a decline from 75% in 2017 but still signifies a major problem. Of the CEOs who download unapproved software, 77% think it would be considered a security risk.

It’s not only leadership who’s going behind security’s back: 70% of CISOs and 62% of IT and security leaders believe all employees are downloading unapproved software. The reasons are varied; employees claim they use unapproved apps because they use the same tools in their personal life, those apps make things easier, or the company-provided software isn’t as good.

“The Apple App Store, the Google Play Store … you can find an app for just about anything and with a couple of clicks, you can have it downloaded on your machine,” Hanson says. “It’s just so easy to do, people are bypassing company-approved software that does [the same things].”

Business and security execs are gearing up for breaches they believe are inevitable. Sixty-four percent of CISOs and 56% of CEOs think they company will be attacked in the next year. Ransomware is their biggest concern, followed by APTs, phishing, and malicious insiders.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/72--of-ceos-steal-corporate-ip-from-former-employers/d/d-id/1332376?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

How ‘Projection’ Slows Down the Path to Security Maturity

library
crime | hacking | security

A little bit of self-awareness goes a long way when it comes to evaluating a company’s security maturity level. It’s also a prerequisite to improving.

Recently, I observed a somewhat intense conversation between two acquaintances about a parenting issue. In this conversation, one person was critical of the other’s childrearing approach. I happen to know both individuals, who are both good people. But like any human being, neither of them is perfect. Putting aside the fact that it generally seems best not to judge or comment on another person’s behavior, particularly when it comes to parenting, this exchange highlighted an important concept for me: projection.

Wikipedia defines psychological projection as “a theory in psychology in which humans defend themselves against their own unconscious impulses or qualities (both positive and negative) by denying their existence in themselves while attributing them to others.” I am not a psychologist and don’t know all of the background information and details around this particular exchange. But after reading more about the topic of projection, it seemed to be a possible explanation for what I witnessed.

OK. But what does psychological projection teach us about security? I would argue quite a bit, in the sense that security organizations are often most critical toward other organizations regarding the very weaknesses that they themselves exhibit. This is important because only when organizations are aware of their own behavior and attitudes can they hope to improve. In this spirit, I offer five ways in which projection slows down the path to security maturity.

1. “They don’t know what they’re doing.” I’ve lost count of the number of times I’ve heard phrases to the effect of “so and so has no idea what he’s doing,” “that place is clueless when it comes to security,” and “if only they knew what they were doing like we do.” Of course, it is entirely possible that your organization is leaps and bounds beyond your peer organizations. But, it is also quite possible that your peer organizations are more or less just as on top of security as you are. What if instead of taking the easy out of looking down upon other organizations, your organization turned its gaze inward?

2. “Their leadership has no vision or direction.” Unfortunately, there are a fair number of people in security leadership positions who are not really leaders. Not surprisingly, you won’t find a tremendous amount of vision or direction coming from these people. Of course, I haven’t found that to be the case in the majority of instances. In my experience, there is almost always something (or several things) that we can learn from others in leadership positions. It’s easy to be dismissive of those individuals. But there is much more to be gained by looking honestly at our own leadership abilities, our own strengths and weaknesses, our own vision and direction.

3. “Their team isn’t adequately staffed or trained.” No organization is able to provide the level of staffing and training that it would like to in an ideal world. As with so many things in business, the issue becomes a game of prioritization and resource management. There are certainly a good number of organizations that, for whatever reason, do not staff and train in a way that will allow them to mitigate risk appropriately. But many organizations make good use of whatever resources they have available. Whether your organization is resource strapped, could staff and train better, or both, a lot can be learned by stopping the finger-pointing and looking internally to see where changes can be made.

4. “Their security technology stack is problematic.” I have yet to meet a security organization that doesn’t hold strong opinions about the security technology stack it has chosen (or was handed) to deploy and operate. The truth of the matter is that the security technology stack should support and serve the organization’s risk mitigation strategy. As long as that is the case, there are many different choices around security technology that the organization can make to meet its goals. I’ve sometimes heard organizations poke fun at and/or mock the security technology in place elsewhere. This doesn’t help anyone advance the state of their security program. A far better use of this energy is to look inwardly in an attempt to understand if the security technology your organization uses is helping you meet your risk mitigation goals, both strategically and tactically.

5. “They aren’t as mature as we are.” It’s far too easy to consider our own security organizations to be very mature. It’s even easier to look at other organizations in our sector, geographic area, or of a similar size and see them as less mature than we are. To be perfectly honest, nearly all the security organizations I meet with consider their security maturity level to be above average. For some of those organizations, that is definitely a realistic view of the situation. Unfortunately, the laws of statistics don’t allow for nearly all security organizations to be of above average maturity. A little bit of self-awareness goes a long way when it comes to evaluating one’s own security maturity level in earnest. It’s a prerequisite to improving.

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info.

Josh (Twitter: @ananalytical) is an experienced information security leader with broad experience building and running Security Operations Centers (SOCs). Josh is currently co-founder and chief product officer at IDRRA and also serves as security advisor to ExtraHop. Prior to … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/how-projection-slows-down-the-path-to-security-maturity/a/d-id/1332369?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Trend Micro Launches Targeted Server-Side Bug Bounty Program

library
crime | hacking | security

Targeted Incentive Program will pay anywhere from $25,000 to $200,000 to researchers who are first to demonstrate exploitable vulnerabilities.

Trend Micro, the operator of the Zero Day Initiative (ZDI) and Pwn2Own bug bounty programs, wants security researchers to pay more attention to finding bugs in widely used server-side software.

The security vendor Tuesday announced a new “Targeted Incentive Program” through which it is offering monetary rewards of up to $200,000 to researchers who are the first to report critical flaws in specific targeted products within a certain time frame.

The goal is to try and acquire a greater number of critical server flaws across a broader range of products than has been possible with its other programs, says Dustin Childs, communications manager for Trend Micro’s ZDI team. “With Pwn2Own, we’re able to acquire specific types of bugs through the various categories of the contest. This is great, but the contest is only a couple of days,” Childs says.

The Targeted Incentive Program gives researchers more time to look for specific types of bugs in targeted products, he notes. “We’re looking to get researchers focused on specific targets with highly impactful bugs,” Childs says.

Starting Aug. 1, Trend Micro will offer bounties ranging from $25,000 to $200,000 for bugs reported in a total of six server products. Five of them are open source technologies: Joomla, Drupal, WordPress, NGINX, and Apache HTTP Server, all on Ubuntu Server 18.04 x64. The sixth is Microsoft IIS on Windows Server 2016 x64.

Trend Micro will award $25,000 to the first security researcher who can demonstrate a working exploit against a previously unknown flaw in either Joomla or Drupal on or before Sept. 30. To qualify for the award, the vulnerability will need to be what the vendor describes as a true zero-day flaw affecting the source code of the targeted software. Flaws in Joomla or Drupal plug-ins and add-on components do not qualify.

The exploit itself should modify the standard execution path of the program or process and allow for execution of arbitrary code. The exploit must also defeat whatever mitigations might exist on the targeted platform, such as sandboxing, address space layout randomization (ASLR), and Data Execution Prevention (DEP).

Similarly, the first researcher who submits a fully functioning exploit demonstrating remote code execution against WordPress before Oct. 31 will qualify for $35,000 under Trend Micro’s new program.

The security vendor has reserved its highest bounties for bugs in Microsoft’s IIS, NGINX, and Apache HTTP Server. The first security researcher to disclose a working exploit against any of these technologies will be eligible for a $200,000 monetary award so long as the disclosures are made within the qualifying period. Trend Micro’s deadline for submitting a flaw in NGINX is at the of end of November; for Apache HTTPS Server flaws, end of December; and for Microsoft IIS, Jan. 31, 2019.

The monetary awards available through the new program are substantially higher than what is generally available through Trend Micro’s standard ZDI, Childs says. However, he declined to discuss the specifics on pricing.

Under the Targeted Incentive Program, once the award for a particular target has been claimed, the software will be removed from the target list and replaced with a new one. Researchers will still be able to claim bounties on subsequent submissions, but those bounties will only be available through Trend Micro’s standard bug-reporting process.

For the moment, at least, Trend Micro has earmarked more than $1 million on additional targets, some of which will fetch bounties of up to $250,000. The total award amount available under the program could increase in the future.

“We wanted to start this initiative by focusing on some of the most popular open source server-side products used by our customers and community,” Childs notes. Future targets will be chosen with this in mind as well, he says.

“We want to guide research to different targets, so having new categories keeps researchers looking at different areas,” Childs adds.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/endpoint/trend-micro-launches-targeted-server-side-bug-bounty-program/d/d-id/1332378?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple