adm – Page 738 – STE WILLIAMS

Doctor, doctor, I feel like my IoT-enabled vacuum cleaner is spying on me

library
crime | hacking | security

Vulnerabilities in a range of robot vacuum cleaners allow miscreants to access the gadgets’ camera, and remote-control the gizmos.

Security researchers at Positive Technologies (PT) this week disclosed that Dongguan Diqee 360 smart vacuum cleaners contain security flaws that hackers can exploit to snoop on people through the night-vision camera and mic, and take control of the Roomba rip-off.

Think of it as a handy little spy-on-wheels.

The security issues, discovered by PT’s Leonid Krolle and Georgy Zaytsev, likely affect products sold under other brands as well.

The first vulnerability (CVE-2018-10987) involves remote code execution. A hacker can discover the vacuum on the same wireless network by obtaining its MAC address, and then send a UDP request, which, if crafted in a specific way, results in execution of a command with superuser rights on the vacuum. A miscreant must first log onto the device, but this process is trivial because many still have the default username and password combination (admin and 888888).

Attackers need physical access to exploit the second vulnerability (CVE-2018-10988). A microSD card could be used to exploit weaknesses in the vacuum’s update mechanism.

Hackers could write an attack script and place it on a memory card in the upgrade_360 folder. If the vacuum is restarted with the SD card inserted, the appliance’s update system installs files from the upgrade_360 folder into its firmware with superuser rights, without any digital signature or legitimacy checks.

This script could easily be a hacking utility or tool, such as a sniffer to intercept private data sent over Wi-Fi by other devices.

These vulnerabilities may also affect other IoT devices using the same video modules as the affected Dongguan Diqee 360 vacuum cleaners. Vulnerable kit includes outdoor surveillance cameras, DVRs, and smart doorbells, according to PT.

Leigh-Anne Galloway, cyber security resilience lead at PT, outlined the potential consequences of the vacuum’s security shortcomings: “Since the vacuum has Wi-Fi, a webcam with night vision, and smartphone-controlled navigation, an attacker could secretly spy on the owner and even use the vacuum as a ‘microphone on wheels’ for maximum surveillance potential.”

Smart? Don’t ThinQ so! Hacked robo-vacuum could spy on your home

El Reg relayed PT’s findings to Diqee along with a request for comment. We’ll update this story as and when we hear more.

It’s not the first time security researchers have warned that hacked robo-vacuum cleaners could spy on users’ homes. Check Point went public with such a set of vulnerabilities in LG SmartThinQ smart home devices last October, shortly after the manufacturer had fixed the flaws.

We’re reliably told by an IoT security expert that the Diqee case is something of an outlier and that the security of bigger brands’ vacuum cleaners is these days “actually fairly secure”.

Which is nice.

Eurocrats bottle it on IoT regulations

In related IoT insecurity news, security experts and consumer groups have slammed EU proposals to make security certification for IoT devices voluntary for consumer devices.

Ken Munro, a director of security consultancy Pen Test Partners, described the proposals as “yet another missed opportunity to sort out the mess of IoT”.

Munro’s criticisms are echoed by those of European consumer organisation BEUC. “The [EU] parliament regrettably missed an opportunity to establish mandatory security requirements for connected products such as smart watches, baby monitors or smart locks,” it said.

Munro – who has hacked internet-connected devices ranging from so-called smart kettles to a Mitsubishi Outlander electric car – told El Reg that he was hopeful forthcoming UK IoT cyber-security guidelines would have more teeth. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/20/iot_insecurity_robo_vacuum_cleaners/

Crypto gripes, election security, and mandatory cybersec school: Uncle Sam’s cyber task force emits todo list for govt

library
crime | hacking | security

The US Department of Justice (DOJ) this week released the first report from its Cyber Digital Task Force – which was set up in February to advise the government on strengthening its online defenses.

The report [PDF], compiled by 34 people from six different government agencies, examines the challenges facing Uncle Sam’s agencies in enforcing the law and protecting the public from hackers. It also lays out what the government needs to do to thwart looming threats to its computer networks.

Here are a few of the highlights from the 156-page document:

Locking down elections

With the US midterm elections just months away and fears of foreign meddling already on people’s minds, the task force told the government to buckle down and prepare for even more attempts from Russia – and maybe others – to mess with voters and disrupt the election.

“Malign foreign influence operations did not begin in 2016, but the Internet-facilitated operations in that year were unprecedented in scale,” the task force says.

“The threat such operations pose to our society is unlikely to diminish.”

The Task Force says that measures are already being planned for election day to prevent attacks and fraud attempts. They revealed that a team of agents and executives from the FBI along with the DOJ’s Public Integrity Session, its Civil Rights Division, the Department of Homeland Security and states attorney generals will coordinate under a single banner to help ensure the integrity of the vote count.

“In the weeks and months leading up to the 2018 midterm elections, these components will plan responses to election-related issues and identify lines of coordination and communication,” the report reads.

“On Election Day, they and a commissioner from the US Election Assistance Commission will arrange regular secure video teleconferences with Department leadership and other agencies, including the National Security Council.”

Let’s (not) Encrypt

If you’ve been following the news for the last few years it will come as no surprise that the Justice Department is not a fan of the common man having access to encryption.

The report bemoans the current state of encryption and its ability to keep the government from gathering and analyzing traffic for criminal investigations. The word ‘encryption’ comes up 17 times in the report, not once in a favorable light.

“In the past several years, the Department has seen the proliferation of default encryption where the only person who can access the unencrypted information is the end user,” the report reads.

“The advent of such widespread and increasingly sophisticated encryption technologies that prevent lawful access poses a significant impediment to the investigation of most types of criminal activity.”

The report also takes a shot at Tor, which is a bit ironic seeing as the anonymization service got its start as a US government project.

“Tor not only anonymizes criminals’ Internet traffic, but also allows them to host websites, called Hidden Services, on servers whose location is similarly masked using Tor,” the report notes.

“Criminals have exploited Hidden Services to facilitate numerous forms of illicit commercial and other criminal activity.”

Defend like the DOJ

So what is the government doing to protect itself from cyber attacks? The report notes that, in addition to creating a number of internal groups that focus exclusively on information security, it also mandates training across the board, requiring every person working in its ranks to attend annual cybersecurity training.

“Adequate training ensures that everyone within the Department has a basic understanding of the relevant threats, their role in protecting our information and information systems, and how to detect and respond to cybersecurity events,” the report notes.

Trump wants to work with Russia on infosec. Security experts: lol no

“Typical web-based training is most common; however, many training delivery mechanisms are used to get the broadest penetration of the material.”

Ultimately, however, the DOJ notes that there is only so much the government can do on its own, and the report underscores how important it will be going forward for the department to partner with private companies to both gather intelligence on new threats and protect critical information from foreign attackers.

“Virtually every instance of cyber-related crime implicates the private sector in some way, whether the private sector is the target of malicious cyber activity, the provider of technology or services through which cybercrimes are committed or concealed, or the repository of evidence (such as communications) relating to cyber-enabled criminal activity,” the task force concludes.

“As such, the relationship that the Department, including the FBI, builds and maintains with the private sector is critical to our efforts to combat cybercrime.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/20/us_government_cybersecurity/

Friday FYI: 9 out of 10 of website login attempts? Yeah, that’ll be hackers

library
crime | hacking | security

Up to 90 per cent of the average online retailer’s login traffic is generated by cybercriminals trying their luck with credential stuffing attacks, Shape Security estimated in its latest Credential Spill Report.

The biz crunched the numbers [PDF] on 51 organizations across a range of global sectors that reported having an eye-watering 2.3 billion credentials snatched by miscreants during 2017. That’s actually a slightly lower total than the outfit reported in 2016, but still equivalent to an average of 47.5 million credentials per spill.

Organizations featured in the report include high-profile names such as Yahoo! (two billion), Edmodo (77 million), Chinese streaming service Youku (101 million) and Equifax (which affected 145 million personal records yet, surprisingly, only 14,961 logins).

The MO for credential stuffing is simple – attackers try passwords stolen from hacked account databases on lots of other websites in the hope they also work.

In other words if you use the same email address and password for websites A and B, and A is hacked, the crooks will try to use the stolen login data to access your account on website B. It sounds like a long shot but, Shape estimates, it’s effective up to three per cent of the time, an excellent rate of return for professional criminals.

Database intrusions are be bad enough, however, the larger damage is compounded by the length of time it takes for victims to report that an attack has been successful. Shape found that this now averages 15 months from the moment a password is snatched to the day the hacking is made public, more than enough time for credential stuffers to try logging into other accounts.

“What most people don’t realise is the domino effect of damage that a single breach is capable of producing,” said Shape’s CTO, Shuman Ghosemajumder.

Time, time, time

The enemy here is delay, he said. If victims were able to alert one another to a breach soon after it occurred, credential stuffing would lose much of its power.

“To fight back, organizations have started banding together to build a collective defense to be alerted when credentials stolen from one breach are being used to log in to another, effectively blocking attackers attempting to access their platforms with compromised credentials.”

Almost as extraordinary is that companies can see the credential stuffing traffic from failed logins. For example, while all business sectors face a threat from credential stuffing, some see far more attacks than others.

Based on Shape’s own customer analysis, for e-commerce 91 per cent of login traffic was from credential stuffing, while for airlines it was 60 per cent, banking on 58 per cent and hotels 44 per cent.

Either my name, my password or my soul is invalid – but which?

Not surprisingly, losses from credential stuffing fraud are high, reaching $5bn a year in the US alone, as attackers exploit account takeover to buy goods, make in-store payments, or purchase e-gift cards. Personally Identifiable Information (PII) resulting from successful attacks can also be sold on criminal forums.

A deeper question is why, given the weak state of credentials, companies don’t adopt better security? Options here include mandatory use of multi-factor authentication (MFA), better detection of credential stuffing and more data sharing.

More long-terms solutions include WebAuthn, an emerging standard that would abandon traditional credentials completely in favor of physical and biometric authentication mechanisms. The advantage of that would be that there are no credentials to steal.

This might take longer than some realize, note the report’s authors: “Companies with high competition are loathe to introduce additional friction into their experience in the form of MFA, lest they lose out on potential revenue.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/20/credentials_login_slurp/

Microsoft: The Kremlin’s hackers are already sniffing, probing around America’s 2018 elections

library
crime | hacking | security

Microsoft says it has already uncovered evidence of Russian government-backed hacking gangs attempting to interfere in the 2018 US mid-term elections.

Speaking at an event in Aspen, Colorado, earlier this week, Microsoft vice president of security and trust Tom Burt revealed that the FancyBear hacking group has already begun setting up the infrastructure to perform targeted phishing attacks on multiple candidates.

In other words, the sort of mischief Moscow’s intelligence agents got up to in 2016 to interfere with the US presidential election, allegedly.

“Earlier this year we did discover that a fake Microsoft domain had been established as the landing page for phishing attacks, and we saw metadata that suggested those phishing attacks were being directed at three candidates that were all standing for election this year,” Burt said.

“These are all people who, because of their positions, might be interesting targets from an espionage standpoint as well as an election disruption standpoint.”

Burt declined to name the candidates being targeted, citing Microsoft’s policy of preserving the anonymity of its clients. In the past, Fancy Bear largely focused its efforts on targeting computers belonging to the Democrats and Hillary Clinton’s campaign, and leaking the Dems’ internal emails in the hope of swinging the balance of Congress for the GOP, and the White House race for Donald Trump.

Redmond is a tool for Russia

Microsoft’s services play a prominent role in Fancy Bear’s meddling, Burt said. To help make its phishing pages more believable, the GRU-backed hacking crew often registers domains whose names resemble Microsoft services and then uses those to create fake login or download pages impersonating Redmond’s own. These pages can trick victims into installing malware, or handing over the usernames and passwords for their email inboxes and other sensitive accounts. Additionally, the domains are used for the command and control servers for data-harvesting spyware.

Trump wants to work with Russia on infosec. Security experts: lol no

Because of that, Burt explained, Microsoft has made a habit of tracking the group, and using its legal team to have those domains seized and either shut down or handed over to Microsoft’s security team, who then use them to gather information about the inner-workings of the operation.

Burt said that, after two years of tracking the gang, Microsoft has become efficient enough that a new domain can be challenged and seized in as little as 24 to 48 hours. “The goal here is to say stop using Microsoft domain names,” Burt said. “If you keep using them, we are going to make it more costly for you.”

This is also why securing your Microsoft Office 365 accounts with multi-factor authentication is crucial, to help thwart password phishing attempts.

Burt’s comments also come as the US Department of Justice issued a report warning that attacks on the mid-term elections are all but assured. The report notes that the government has created a task force, including multiple agencies and states attorney generals, that will focus on detecting and prosecuting attempts to affect the outcome of the mid-term vote. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/20/microsoft_fancy_bear_warning/

HR Services Firm ComplyRight Suffers Major Data Breach

library
crime | hacking | security

More than 7,500 customer companies were affected, and the number of individuals whose information was leaked is unknown.

ComplyRight, a company that provides human resources functions to businesses, has begun notifying individuals of a data breach that may have exposed names, addresses, phone numbers, email addresses, and Social Security numbers taken from employee tax forms the company processed.

According to ComplyRight, the company has more than 76,000 customers, though it has not yet said how many were involved in the breach.

KrebsOnSecurity, which broke news of the breach on Wednesday, writes that it appears to be a compromise of the website itself, rather than customer communications to and from the website. In its report, KrebsOnSecurity said it could find no ComplyRight employee with a security title on LinkedIn.

In a statement provided to Dark Reading, Jeannie Warner, security manager at WhiteHat Security said, “As a human resources firm, ComplyRight handles forms overflowing with personally identifiable information, such as 1099s and W2s. The fact that the company touts its security prowess, yet Brian Krebs couldn’t identify a single employee with a security title, is deeply concerning – and just another reason for consumers to question their trust in digital businesses.”

A Qualys SSL Labs scan of the site efile4biz.com conducted by Dark Reading shows an overall score of “B”, capped because the server doesn’t support forward secrecy or AEAD cipher suites. It must be noted, however, that this was a scan of the public-facing site (which does contain login provisions for customers); customers transacting business with the company may be re-directed to other servers upon authentication.

Nevertheless, the fact that the page still support outdated protocols such as TLS 1.0 for sign in indicates that there may be other legacy vulnerabilities still in place in the site application code.

In the Web page disclosing the breach, ComplyRight notes that the breach occurred in late May 2018, while the disclosure occurred on July 18. Ryan Wilk, vice president of customer success at NuData Security, a Mastercard company, said, “One of the many dangerous things about breaches is the amount of time it takes for companies and end users to know their data is out in the open. From the moment a breach happens, hackers have ample time to broker the stolen names, Social Security numbers, tax data and other identifying information on the dark web – leaving customers and employees open to the impacts of identity theft.”

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/application-security/hr-services-firm-complyright-suffers-major-data-breach/d/d-id/1332345?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft: Three Hacking Attempts Made on Midterm Elections

library
crime | hacking | security

Microsoft detected data indicating three congressional candidates were being hit with cyberattacks – the first to target midterm elections.

The first hacking attempts have been made on the 2018 midterm elections, reports Microsoft, which detected phishing attacks against three congressional candidates and helped block them.

Microsoft’s Tom Burt, vice president for security and trust, discussed the attacks at this year’s Aspen Security Forum. Earlier this year, experts found a fake Microsoft domain had been registered as a landing page for phishing campaigns against candidates. He did not name the candidates and confirmed the attacks did not succeed against any of them.

“They were all people who, because of their positions, might have been interesting targets from an espionage standpoint as well as an election disruption standpoint,” Burt explained in a panel discussion on election security, as reported by NBC News.

Security researchers, at Microsoft and across the industry, agree the cyber activity preceding this year’s midterm elections is not the same level of activity detected ahead of the 2016 presidential election. Attackers are not targeting academia or think tanks, Burt said.

Singapore Health Services Data Breach Exposes Info on 1.5 Million People

library
crime | hacking | security

Attackers, repeatedly and specifically, targeted Singapore Prime Minister Lee Hsien Loong’s medication data.

Personal information belonging to about 1.5 million patients who visited Singapore Health Services’ specialist outpatient clinics over the past three years has been compromised in a data breach that is being described as the biggest of its kind in the country.

The attackers specifically and repeatedly looked for data on medication being used by Singapore Prime Minister Lee Hsien Loong, though their motivation for doing so was not immediately apparent.

“Perhaps they were hunting for some dark state secret, or at least something to embarrass me,” Loong wrote on his Facebook page. “If so, they would have been disappointed. My medication data is not something I would ordinarily tell people about, but there is nothing alarming in it.”

Singapore’s Ministry of Health Friday said the breach stemmed from a “deliberate, targeted and well-planned cyberattack.” In a statement, the Ministry pointedly noted the attack was not the work of criminal gangs or casual hackers – seemingly implying in the process that a nation-state actor was behind the incident.

The data that was taken included national registration identity card numbers, names, birthdates, addresses, gender, and race information on 1.5 million people who had visited SingHealth’s clinics between May 2015 and July 4, 2018. Other data such as patient diagnosis information, doctor’s notes, and test results remained untouched. However, information on medications that were dispensed to some 160,000 patients was also compromised in the incident.

The attack is familiar to countless others in recent years targeting the healthcare industry. Just this week, LabCorp, one of the largest healthcare diagnostics firms in the US disclosed in an SEC filing that it had to take several systems offline – disrupting test processing and customer access as a result – after discovering suspicious activity on its network. Privacy Rights Clearinghouse, which maintains a database of publicly disclosed breaches, counts 167 breaches so far this year involving healthcare, medical providers, and health insurers. A lot of the activity is being fueled by the high value of medical data in the criminal underground.

In the Singapore incident, the apparent fact that the attackers specifically targeted data belonging to the nation’s prime minister is concerning, says Itzik Kotler, CTO and co-founder of SafeBreach. “The healthcare vertical in particular is very interesting to attackers because their networks are often a key part of the national critical infrastructure, as in the case of SingHealth,” he says. “The fact that the attackers targeted the Singapore PM’s personal information and outpatient medicine information is a concern,” he notes. In the hands of the wrong people such data could potentially be used literally to trigger a life or death situation, Kotler says.

Unlike many data breach disclosure notices, the Singapore Ministry of Health’s disclosure offered at least some details of the incident based on investigations by the Cyber Security Agency of Singapore (CSA) and the country’s Integrated Health Information System.

According to the statement, database admins at SingHealth first spotted unusual activity on their network on July 4 and acted immediately to end it. A subsequent investigation showed that attackers had broken into the network and exfiltrated data between June 27, 2018 and July 4, 2018. The attackers had apparently accessed the SingHealth system by breaching a front-end workstation and using that foothold to obtain credentials for gaining privileged access to the backend database.

Following the incident, IT and security administrators at SingHealth have implemented several measures to shore up security, including additional controls on workstations and servers and resetting user and system accounts. Officials have also temporarily implemented “Internet surfing separation” as a precautionary measure, the SingHealth statement said.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/singapore-health-services-data-breach-exposes-info-on-15-million-people/d/d-id/1332347?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

US Intel Officials Share Their National Cybersecurity Concerns

library
crime | hacking | security

Leaders in the security sector discuss the most pressing cyberthreats threatening the United States and what can be done to mitigate them.

National Intelligence director Dan Coats put the threat to national cybersecurity into context on July 13, 2018, when he said “the warning lights are blinking red again” in a speech before the Hudson Institute, a Washington, DC-based conservative think tank.

Coats was trying to get our attention, says Tonya Ugoretz, director of the Cyber Threat Intelligence Integration Center at the Office of the Director of National Intelligence. She was one of several national security experts to take the stage today at Cyber Live 202, an event hosted by The Washington Post and focused on modern cyber threats to national security.

The system was also “blinking red” back in 2001, when intelligence and law enforcement agencies detected activity signifying a threat to the United States. Now it’s happening again, but it’s our digital infrastructure that could be under attack, Ugoretz explained. She cited Russia as the most aggressive foreign actor the department sees in cyberspace, “with good reason.”

“Aggression is widespread, it’s against multiple sectors, it’s against multiple types of networks,” she said. If we create a dialogue around sharing information, notifying victims if they’re hit with intrusion or influence campaigns, we can better plan our defense.

For example, the DHS and FBI issued alerts this year about Russia’s efforts against the US and allies, warning defenders to protect against Russian activity in critical infrastructure. The Justice Department now has a brand-new policy to disclose the existence of information warfare attacks against the US political system when there is high confidence in the foreign actor behind it.

These practices are helpful but ultimately weak without leadership from the top. “The President himself does not take seriously the capability of Russian intelligence services,” said Mike Rogers, former chairman of the House Intelligence Committee and national security commentator for CNN. “It’s very, very concerning to me.”

Rogers was referring to the recent meeting between President Trump and Russian President Vladimir Putin in Helsinki, during which the US President dismissed Russian interference indictments related to activity during the US presidential election. While Putin was prepared for the meeting and knew what he would get out of it, Trump “was not prepared,” Rogers said.

The meeting played right into the information operations Russia had been conducting and will continue, he added. “They’re getting better at it and they’re getting more aggressive about it … this is what I worry about,” Rogers emphasized. Intelligence officials monitor Russian bot operations trying to influence different topics every day, and the volume is getting bigger.

Intelligence experts agree a full government approach is needed to tackle the threat. “One of the things no one’s really done a good job of so far is imposing a cost on bad state actors for their activities,” said Chris Painter, former and first-appointed cyber coordinator for the US State Department. The cost would both punish them and deter them from future activity, he said.

“The President hadn’t said, ‘If this happens again there will be consequences’ … and I think a lot of people in government are waiting for that leadership,” Painter continued.

Jason Matheny, director of the Intelligence Advanced Research Projects Activity (IARPA), spoke to the future and said one of cybersecurity’s biggest threats “is sort of boring”: 70-80% of threats from nation-states and cybercriminals are social engineering attacks, he noted.

Within the next 5- to ten years, both threats and defenses will become more sophisticated due to machine learning, which is being used to detect phishing emails as they arrive. “There’s now an arms race,” he said, as people developing phishing attacks use the same technology to create subtle attacks that bypass advanced filters.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/us-intel-officials-share-their-national-cybersecurity-concerns/d/d-id/1332348?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

What the Incident Responders Saw

library
crime | hacking | security

New report on IR professionals’ experiences reveals just how advanced attackers, such as nation-state hackers, dig in even after they’re detected.

When incident response teams shut down an advanced attack, most of them then find a backup command-and-control infrastructure lying in wait to trigger after the first one gets taken down. Overall, nearly half end up battling attackers who try to thwart incident response and remediation efforts.

That’s just some of the activity IR professionals say they experience, according to a new Carbon Black study of 37 large incident response teams running Carbon Black’s next-generation endpoint security tool. The new Quarterly Incident Response Threat Report is based on surveys and interviews with large IR partners – such as Kroll and Rapid7 – who on average conducted one IR engagement per day in 2017, and handle three to five IR engagements per quarter.

“Sixty-four percent found a secondary C2 on sleep cycle,” says Tom Kellermann, chief security officer at Carbon Black. “This highlights how the adversary has gone from burglary to home invasion: they intend on staying and will take counter attempts … and could get destructive.”

Russia and China, not surprisingly, are the main sources of attacks: 81% of IR pros say Russia is the number one offender, and 76% say China. But that doesn’t mean all of the security incidents they investigated were cyber spying: just a third of responders say the cases were cyber espionage. Nearly 80% say the financial sector is the most targeted industry, followed by healthcare (73%) and government (43%).

Close to 60% of attacks involve lateral movement, or where the attacker travels from its initial victim machine to other machines in a targeted organization. PowerShell is one of the most popular tools for moving about the victim’s network: 100% of IR pros say they’ve seen the Microsoft Windows automation and configuration management tool employed by attackers, and 84% see Windows Management Interface (WMI) as a key tool weaponized by attackers.

This so-called “living off the land” approach of running legitimate tools to remain under the radar is classic behavior of persistent hacker teams such as nation-states. Some 54% of IR pros say legit operating system applications like these are being abused by attackers. In addition, 16% have spotted attackers running Dropbox to assist in their movements.

“The uptick of WMI is concerning,” notes Kellermann, as well as the use of process-hollowing and unsigned digital certificates. “It speaks to the level of sophistication [being used] to colonize that infrastructure.”

Meanwhile, 36% say victim organizations are mainly hacked for the purpose of reaching their supply chain members (think customers and partners).

A key technique for defending against attackers who are burrowing in for the long haul is to quietly investigate and hunt them so they don’t have time to switch gears and retool their attack, according to Kellermann. “The number one thing we need to evolve in as defenders is to become more quiet and clandestine in how we hunt,” he says.

That means, for example, not immediately shutting off a C2 you discover if you can further study its activity with deception or other advanced techniques, he says.

According to Carbon Black’s report, “Deciding when to reveal oneself is critical, as counter-incident response measures as destructive attacks are becoming the norm.”

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/endpoint/privacy/what-the-incident-responders-saw/d/d-id/1332349?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Privacy – can you have too much of a good thing? [PODCAST]

library
crime | hacking | security

Here’s #4 of this week’s Security SOS Week podcasts, right here #ICYMI.

In this episode: Privacy – can you have too much of a good thing?

Should we have more privacy to protect us from cybercriminals, or less privacy so those selfsame cybercrooks can’t hide so easily?

Join Sophos security expert James Burchell for a lively discussion that is informative, entertaining – and just a touch controversial!

If you enjoy our podcasts, please share them with other people interested in security and privacy, and give us a vote on iTunes and other podcasting directories.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/k_iLJQBK81U/