adm – Page 754 – STE WILLIAMS

China-based hackers take an interest in Cambodia’s elections

library
crime | hacking | security

AUS-based security researcher has accused China of interfering in Cambodia’s forthcoming national election.

Security vendor FireEye says it has spotted a large-scale Chinese phishing, intrusion, remote access trojan (RAT), and data exfiltration operation targeting the poll.

FireEye attributed the activity to a group dubbed “TEMP.Periscope”, previously more closely associated with targeting American engineering and maritime operations.

FireEye hacked off at claim it hacked Chinese military’s hackers

The FireEye post says TEMP.Periscope footprints were found on a number of election-related entities in Cambodia: various ministries including the National Election Commission; an MP for the Cambodia National Rescue Party; human rights advocates; two Cambodian diplomats in overseas posts; and multiple media outlets.

Its analysis was based on three servers it ran over with the fingerprint brush: “chemscalere[.]com and scsnewstoday[.]com operate as typical C2 servers and hosting sites, while the third, mlcdailynews[.]com, functions as an active SCANBOX server.”

SCANBOX is an advanced persistent threat that FireEye has seen in various campaigns since 2015.

The company believes the servers were administered from Hainan in China, and they hosted malware from two new families, DADBOD and EVILTECH, as well as “previously identified malware families (AIRBREAK, EVILTECH, HOMEFRY, MURKYTOP, HTRAN, and SCANBOX)”.

The lynchpin of this campaign was the Javascript-based AIRBREAK backdoor, which “retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services”.

The other most active tools were the HOMEFRY password cracker and dumper; the LUNCHMONEY uploader, which sends docs to Dropbox; and a command line reconnaissance tool called MURKYTOP.

FireEye says it had seen these in previous campaigns, and it also spotted two new tools in the Cambodian operation. There’s a backdoor called EVILTECH, a Javascript-based RAT; and the DADBOD credential stealer.

Attribution to China came from IP addresses logged on a server available to the company: “One of the IP addresses, 112.66.188.28, is located in Hainan, China. Other addresses belong to virtual private servers, but artifacts indicate that the computers used to log in all cases are configured with Chinese language settings.”

The SCANBOX server suggested TEMP.Periscope was also planning future campaigns targeting individuals with an interest in US-East Asia politics, Russia, and NATO affairs.

Cambodia appears to be heading for likely single-party rule, as the main opposition party has been banned and cannot run candidates in the July 29th poll. The current regime has supported Beijing in its maritime disputes in the South China Sea, annoying neighbours by doing so. Just why China would want to mess with nation’s elections given the all-but-certain outcome is anyone’s guess. “To show it can” may be as good an answer as any! ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/11/china_cambodia_hacking/

Ticketmaster Breach Part of Massive Payment Card Hacking Campaign

library
crime | hacking | security

Threat actor Magecart has infiltrated over 800 e-commerce sites with card skimming software installed on third-party software components, RiskIQ says.

Cybersecurity vendor RiskIQ’s investigation of a recently disclosed breach at Ticketmaster UK showed that the online ticket seller is just one of hundreds of victims of a huge campaign to steal payment card data by a threat group called Magecart.

RiskIQ says it found that Magecart has compromised over 800 e-commerce sites worldwide by secretly installing digital card-skimming software on third-party components and services used by these sites. One of Magecart’s campaigns dubbed SERVERSIDE, alone has claimed at least 100 top-tier ecommerce websites and suggests the group has amassed a huge treasure trove of payment card data. “Magecart is bigger than any other credit card breach to date and isn’t stopping any day soon,” the security vendor said.

In Ticketmaster’s case, Magecart installed the card-skimming malware in a customer support software component from third-party supplier Inbenta. The rogue software was designed to capture payment card data being entered into online forms on Ticketmaster’s site and ship it to a remote server controlled by the attackers. The command-and-control server that Magecart used in the Ticketmaster breach has been operational since at least late 2016.

Inbenta itself has said the breach resulted from a single piece of JavaScript code that was customized for Tickemaster that the attackers modified. According to the vendor, the code is not part of any Inbenta products or in any of its implementations at other websites. In addition to Inbenta, Magecart appears to have breached the systems of SociaPlus, another third-party supplier integrated with several Ticketmaster websites. As it did with Inbenta, Magecart modified a custom SociaPlus JavaScript module with its card-skimming software, RiskIQ said.

Ticketmaster, which discovered the breach June 23 and disclosed it about a week later, has described it as impacting less than 5% of the company’s global customers. According to Ticketmaster, only UK customers who purchased tickets or attempted to purchase tickets via its site have been impacted. But RiskIQ says its investigation shows that Magecart has managed to compromise Ticketmaster sites in Ireland, Turkey, New Zealand, and Australia as well. Ticketmaster did not respond to a Dark Reading request seeking comment on RiskIQ’s report.

Ticketmaster is just one of hundreds of e-commerce sites that Magecart has infiltrated with its card-stealing software. And Inbenta and SociaPlus are not the only third-party suppliers that the threat actor has exploited to get there: RiskIQ says Magecart has broken into and installed card-skimming malware onto software from other widely used third-party vendors such as PushAssist, CMS Clarity Connect, and Annex Cloud.

RiskIQ has been tracking Magecart’s activities since 2015 and says the threat actor’s strategy of targeting third-party suppliers marks a dangerous new shift from its previous practice of targeting individual websites.

“They seem to have gotten smarter,” RiskIQ said. “Rather than go after websites, they’ve figured out that it’s easier to compromise third-party suppliers of scripts and add their skimmer.”

For organizations, the breach at Ticketmaster breach and other sites are another reminder of the risks involved in using services and software from third parties without constantly vetting them for security issues.

Mandates like PCI, the General Data Protection Regulation (GDPR), and others make clear that organizations can no longer say a breach resulted from a third party and expect to avoid responsibility, says Justin Jett, director of audit and compliance for Plixer.

Under GDPR, Ticketmaster was required to disclose the breach publicly within 72 hours even though it was the result of malicious software in a third-party software components. “This makes it much more important to properly vet these third-party vendors because ultimately the organization is also liable,” he says.

Risky Business

Given the extensive use of third-party software and services by most organizations these days, expecting a consistent level of security across the entire supply chain can be challenging, say security experts. But rather than shooting for 100% risk elimination, the goal instead should be to manage third-party risk in a manner that is aligned with business interests.

That means having a formal vendor risk management program that details the people, processes, and tools to execute it, says Chris Olson, CEO of The Media Trust. Organizations need to maintain a constantly updated inventory of all the third parties that directly or indirectly support their website. They need to conduct a risk assessment before bringing a supplier on board and then follow through with periodic audits.

Also critical are clearly spelled-out security policies and standards for third parties, Olson says.”[Use] contract clauses and SLAs to ensure third parties align with those policies and standards and stay compliant with laws and regulations,” he notes.

The key is to treat third parties as an integral part of your own company, adds Elad Shapira, head of research at Panorays. In doing that, realize that some suppliers will pose less of a security risk than others, he says.

“Security visibility is key to understanding the risk that the third party poses to your company,” Shapira says. “Once you have that visibility, you can demand a certain level of security that’s reflective of the risk appetite of your company.”

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/ticketmaster-breach-part-of-massive-payment-card-hacking-campaign/d/d-id/1332266?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Another Spectre CPU vulnerability among Intel’s dirty dozen of security bug alerts today

library
crime | hacking | security

Exclusive Intel will today emit a dozen security alerts for its products and code – including details of another vulnerability within the family of Spectre CPU flaws.

This bundle is the start of the processor giant’s efforts to move to a quarterly cadence of updates, we understand. Rather than drop surprise alerts onto its security advisory page at irregular intervals, Intel hopes to gradually adopt a routine similar to Microsoft’s monthly Patch Tuesday, albeit once every three months.

Urgent security updates will be pushed out in between these quarterly batches. Some fixes may be emitted outside of this quarterly cadence if they are due to be released on a specific date in a coordinated disclosure with other organizations, and that date falls outside Intel’s schedule.

Motherboard manufacturers, computer makers, operating system developers, and other Intel partners, will privately get a long heads up before these quarterly updates are made public. For instance, today’s patches were shared with manufacturers in March, allowing them to prepare to roll out fixes to customers.

From what we understand, Intel hopes to give folks – from IT administrators to ordinary netizens – time and notice to plan for installing security updates at regular-ish intervals, rather than relying on them to look out for sporadic patches.

Speculative execution continues to haunt

The new Spectre-class side-channel vulnerability to be disclosed today in Intel’s processors can be exploited through bounds-check bypass store attacks.

This means malicious code already running on an Intel-powered computer can leverage speculative execution to potentially alter function pointers and return addresses in other threads to hijack applications. At that point, the malware can extract secrets from the system, and cause other merry mischief.

The good news is that software mitigations available today for Spectre variant 1 will thwart bounds-check bypass store attacks. Thus, web browsers and other applications employing anti-Spectre mechanisms should be safe.

For programmers and compiler writers, this means slipping LFENCE instructions into code, before it reads from memory, to act as a barrier, or clipping array bounds using a bitmask, as described here, in section four.

The other good news is that there is little or no malware known to be circulating in the wild exploiting Spectre vulnerabilities to steal information: it is far easier for miscreants to persuade people to download and install software nasties disguised as legit applications, trick them with phishing emails, or attack holes in email clients and PDF readers, to commandeer their PCs.

Instead, Spectre, for now, remains a fascinating insight into the world of CPU design, where engineers across the industry trade off a little security for a little more performance.

Streamlining

“As we continue working with industry researchers, partners and academia to protect customers against evolving security threats, we are streamlining security updates and guidance for our industry partners and customers when possible,” a spokesperson for Intel told The Register on Tuesday.

“With this in mind, today we are providing mitigation details for a number of potential issues, including a new sub-variant of [Spectre] variant 1 called Bounds Check Bypass Store, for which mitigations or developer guidance have been released.

“More information can be found on our product security page. Protecting our customers’ data and ensuring the security of our products is a top priority for Intel.”

More than half of today’s Chipzilla advisories were the result of research carried out by its own staff, whose minds have been doubly focused on the security of their products following the Meltdown and Spectre disclosures earlier this year. The alerts will cover things from firmware to Intel’s flavor of Python. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/10/intel_security_spectre_advisories/

Thomas Cook website spills personal info – and it’s fine with that

library
crime | hacking | security

Holidaymakers who used Thomas Cook Airlines had their personal information spilled onto the internet no thanks to basic coding cockups.

Norwegian programmer Roy Solberg came across an enumeration bug that leaked the full name of all travelers on a booking, the email addresses used, and flight details from Thomas Cook Airlines’ systems using only a booking reference number. Simply changing the booking number unveiled a new set of customer details.

The exposed info covered trips booked through the travel agency Ving, which is owned by Thomas Cook.

Thomas Cook Airlines has closed the privacy hole, technically known as a Insecure Direct Object Reference (IDOR), a common enough and basic problems on poorly-designed web applications.

Solberg reckoned on Sunday that data of bookings made with Thomas Cook Airlines through Ving Norway, Ving Sweden, Spies Denmark and Apollo Norway were affected by the vulnerability. Data going back to 2013 was obtainable before the hole was closed. Simple scripts might easily have been used to download the exposed data before the security hole was resolved, he adds.

Everything’s fine! Nothing to see here

A spokeswoman for Thomas Cook was at pains to emphasise “this did not affect UK customers,” before forwarding a canned statement further downplaying the incident, which it is not treating as a notifiable privacy breach.

We take any breach of our customer data extremely seriously. After being alerted to this unauthorised access to our online duty free shopping website in Norway, we closed the loophole and took responsible actions in line with the law.

Based upon the evidence we have, and the limited volume and nature of the data that was accessed, our assessment is that this was not an incident which is required to be reported to the authorities. For the same reasons we have not contacted the customers affected.

We regularly test our systems using third party agents and since becoming aware of this incident we have taken further steps across our IT systems to ensure that we don’t have a similar loophole elsewhere.

Robert Wassall, data protection lawyer and head of legal services at ThinkMarble, explained the basis in which Thomas Cook might have decided it was legally permissible not to notify customers or the regulator.

MyTravel’s website woes

“Thomas Cook has used Article 33 of the GDPR to avoid reporting this incident both to the ICO and its customers. This refers to the fact that organisations do not need to report a breach of personal data where the risk to customers is low.

“It appears that in making this assessment Thomas Cook has used the fact that only 100 of its customers’ data was compromised, and that it was done so as part of non-criminal ‘test’ by a cyber researcher. Arguably, whether affected customers number 1 or 1000 harm is still harm, and risk is still risk,” he added.

More commentary on the incident from security pundit Graham Cluley can be found here. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/10/thomas_cook_privacy_flap/

AT&T abducts AlienVault to bolster business end of its security probing

library
crime | hacking | security

ATT has agreed to acquire security intel specialist AlienVault for an unspecified pile of cash.

The two companies announced the deal on Tuesday, saying that AlienVault would join ATT Business as part of its enterprise and SMB security services. Specifically, the telco giant says that after the deal wraps up it will offer AlienVault’s Unified Security Management (USM) service to ATT Business subscribers.

A threat intelligence specialist, AlienVault allows admins to track and monitor possible malware infections and attacks on their networks. ATT said after the deal closes it will also continue to support Open Threat Exchange, AlienVault’s public service for tracking malware threats and attacks in the wild.

“AlienVault’s expertise in threat intelligence will improve our ability to help organizations detect and respond to cybersecurity attacks,” ATT Business CEO Thaddeus Arroyo said of the deal.

“Together, with our enterprise-grade detection, response and remediation capabilities, we’re providing scalable, intelligent, affordable security for business customers of all sizes.”

Injection

AlienVault, meanwhile, says it will use the cash infusion from the acquisition to expand its business under the ATT banner.

“We’re thrilled to join forces with ATT. They bring a robust cybersecurity portfolio with an industry-leading technology ecosystem,” said AlienVault president and CEO Barmak Meftah.

“This deal accelerates our ability to deliver on the AlienVault mission, which is to democratize threat detection and response to companies of all sizes.”

The deal is expected to close by the end of September. While ATT isn’t giving the dollar amount it is paying for AlienVault, the telco says the bill is not enough money to have an effect on its bottom line.

The deal comes as ATT is looking to revamp a business services group that saw revenues decline by 5 per cent last quarter as more customers are moving off of its legacy wireline services. To help make up for this, ATT is stepping up its wireless and business services.

This where AlienVault comes in, giving the company another IT service to offer customers and luring them towards adopting the larger, more profitable packages. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/10/att_abducts_alienvault_to_bolster_business_security_line/

AT&T to Buy AlienVault

library
crime | hacking | security

Terms of the deal – which closes in Q3 – were not disclosed.

ATT today announced that it will acquire threat intelligence company AlienVault in a move to extend its security offerings to small-to-midsized organizations.

While terms of the deal were not disclosed, ATT said it plans to invest in the evolution of AlienVault’s Unified Security Management platform and Open Threat Exchange community, and the integration of AlienVault’s offerings into ATT’s.

“Regardless of size or industry, businesses today need cyber threat detection and response technologies and services,” said Thaddeus Arroyo, CEO of ATT Business, in a statement. “AlienVault’s expertise in threat intelligence will improve our ability to help organizations detect and respond to cybersecurity attacks. Together, with our enterprise-grade detection, response and remediation capabilities, we’re providing scalable, intelligent, affordable security for business customers of all sizes.”

ATT said the acquisition is scheduled to close in the third quarter of this year.

Businesses Struggle to Build ‘Security-First’ Culture

library
crime | hacking | security

New Accenture study finds half of businesses provide cybersecurity training for new hires and only 40% of CISOs prioritize building or expanding insider threat programs.

More than half of businesses base their cybersecurity investments solely on today’s known risks and security needs. That’s a good move for defending against modern cyberattacks but won’t help much with attacks on the horizon, experts say.

Businesses who want to fully defend against these future threats need to let security influence the entire organization and stop letting the CISO and their team operate in silos.

“Companies today are waging war with outdated, backward-looking battle plans,” researchers report in a new Accenture study entitled “Securing the Future Enterprise Today – 2018.” The study polled 1,400 C-suite executives, including CISOs, to learn about current and future cyber risks and what companies are doing to prepare for cyberattacks they know will happen.

Consider the insider threat. Accidental and malicious insiders pose a growing risk to enterprise security, yet only 40% of experts polled say building or expanding an insider threat program is a high priority. It’s imperative for CISOs and the C-suite to get on the same page when it comes to infosec, says Kelly Bissell, Accenture managing director and security global lead.

“[They] can see bad things occurring in their organization faster than before … the time from detection to eradication is getting better,” he explains, adding that for many, this timeframe has gone from months to days.

In most organizations, security is a separate function dedicated to protecting core IT systems and data. Security strategies are more focused on detecting threats and decreasing damage rather than building products and processes to be more secure by design, researchers say.

CISOs of the future need to have business savvy, Bissell continues. They should know how the business makes money, where the enterprise “crown jewels” are located, including those used by third parties, and they should understand who their largest clients are.

The Danger of Siloed CISOs

Most companies are not governed, organized, and managed to handle risks of the future, Accenture reports. Security is left to the CISO and security team; business leaders are rarely asked to build security into product design or take responsibility for cybersecurity.

Only 22% of experts surveyed report business-unit leaders are held accountable for security. About 40% of security teams don’t confer with business leaders to understand their goals before implementing a new security approach. Sometimes this is because the security team thinks they know the answer, says Bissell. Sometimes it’s because security employees are under IT and politically separate from the business unit, which he says is still fairly common.

“If they don’t collaborate well with the business unit they may not always have a shared vision for how to solve the problem, and that’s what they’ve got to get to,” he emphasizes.

A poor relationship between security and business teams leads to worse behavior, Bissell says. Mistakes are swept under the rug and go unreported, and the two blame one another when problems occur. Positive relationships make things easier but both teams have to contribute.

“The best CISOs are the ones who work with a business unit leader, and go to the audit committee together as one team to solve the problem,” he explains. “Better alignment is critical … it’s a two-way street.” Security teams should proactively reach out to understand the business goals, and vice versa, for the relationship to work.

Breaking Down Silos, Building Bridges

An important step toward breaking security out of its silo is to embed security employees within business units, says Bissell. While this is more feasible for larger companies than smaller ones, it can help the two teams better understand one another.

Security pros of the future will require business risk skills and consultant skills, on top of technical expertise, and this strategy can help them learn how they can better protect the business. Some leading CISOs are hiring security employees who used to be mortgage processors or insurance claims adjusters because they have business backgrounds.

“That can really help shorten the learning curve of how the business works and where the risks are,” he explains.

It’s also important for security experts to be business-savvy so they can provide awareness training tailored to each business unit. For example, Bissell says, financial experts are educated on wire transfer fraud and other cyber risks specific to finance. The same goes for operations.

“Regular awareness around security risk to that particular business unit is key,” he adds. “This is why it’s so critical for the security group to understand the business in a very deep way.”

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/businesses-struggle-to-build-security-first-culture/d/d-id/1332259?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Bomgar Acquires Avecto

library
crime | hacking | security

Purchase adds layers to privileged access management system.

Bomgar, a company specializing in identity and access management, today announced its intention to acquire Avecto, a firm with products and services in endpoint privilege management. Linking the products of the two companies will, according to Bomgar, allow companies to implement least-privilege access.

Products from the two companies will work in concert: Bomgar systems protect the accounts, credentials, and passwords of privileged users in both local and remote connections. Avecto removes the necessity for privilege inflation by allowing privileges to be raised for specific applications and processes.

Bomgar has been growing by acquisition in 2018, buying Lieberman Software earlier in the year. Terms of this transaction, which is expected to close July 31, 2018, will not be disclosed.

For more, read here.

Article source: https://www.darkreading.com/endpoint/privacy/bomgar-acquires-avecto/d/d-id/1332261?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Asian APT Groups Most Active in Q2

library
crime | hacking | security

Researchers at Kaspersky Lab published data on the most prolific threat groups and campaigns, compiled from private intelligence reports developed this quarter.

The threat landscape for Q2 2018 was largely dominated by Asian actors, specifically Lazarus Group/BlueNoroff and Scarcruft, while the most notable activity was the VPNFilter campaign.

Kaspersky Lab’s Global Research and Analysis Team (GReAT) today published key findings pulled from private intelligence reports compiled throughout the quarter. The idea is to highlight different APT activity and attacks, emphasize the details researchers believe are most significant, and discuss how prominent threats relate to one another.

Looking back at Q2, the most prominent threats came from Asia and were primarily driven by financial gain. Analysts also noticed previously quiet groups resurface with new activity. One example is LuckyMouse (also known as APT27 and Emissary Panda), which exploited Asian ISPs for watering-hole attacks on high-profile websites. The same group was found targeting Asian government groups around the same time they met for a summit in China.

“[It’s a] new approach but in this case, quite bold, in our opinion,” says Vicente Diaz, security researcher with Kaspersky Lab’s GReAT, in a webcast on the report. “We see they are following different approaches [and] techniques to target different high-profile victims in this region.”

Researchers tracked more than 100 advanced threat actors to compile 31 reports this quarter. Here’s a closer look at APT activity from the past few months:

Lazarus Group: What They’re Up To

Lazarus Group and BlueNoroff, a subset of Lazarus Group focused on financial institutions, were both active in Q2, but the new role of Lazarus is unclear given the new geopolitical landscape, Diaz notes. The recent peace agreement between North Korea and South Korea, as well as talks between North Korea and the United States, could influence Lazarus Group’s activity as we head into the second half of 2018.

“All these new geopolitical situations for an actor that has been traditionally linked to nation-state interests … we don’t know how this will affect things,” Diaz explains. “It’s too soon to say.”

While its geopolitical standing may be in limbo, Lazarus Group’s financial drive is alive and well. BlueNoroff was suspected of hitting Turkish financial institutions with the Bankshot attack, and it’s believed to have launched a destructive campaign against an online casino in Latin America. Kaspersky Lab’s telemetry also detected attacks on Asian financial organizations.

The group has been showing a preference for Manuscrypt malware, which was recently used in a spearphishing campaign against South Korea. US-CERT issued a warning against this threat in June but referred to the malware as Typeframe. An older version was called Fallchill.

Scarcruft vs. DarkHotel: Overlaps and Differences

Researchers also detected “relatively intense activity” by Scarcruft, a group also known as Group123 and Reaper. Scarcruft was discovered using zero-day CVE-2018-4878 in January to target South Korea; in the past few months, it has been using Android malware.

“We believe that Scarcruft is one of those actors which are important to watch out for and track in a regular fashion,” says Costin Raiu, director of the global research and analysis team at Kaspersky Lab. Raiu notes the group has “been very active throughout Q2” and its access to, and use of, zero-days is a sign they are quite capable of advanced attacks.

Scarcruft tends to overlap with a separate ATP group called DarkHotel, researchers explain, and there are situations where it’s tough to distinguish between the two. For example, it was first believed Scarcruft was behind the CVE-2018-8174 zero-day, which turned out to be DarkHotel’s work.

The overlap between Scarcruft and DarkHotel dates back to 2016, when researchers detected Operations Daybreak and Erebus. Both used the same hacked site to deploy exploits. What was believed to be the work of one group turned out to be the work of two: DarkHotel’s Operation Daybreak used spearphishing emails to target Chinese victims with a Flash zero-day, while Scarcruft used CVE-2016-4117 to target South Korea.

VPNFilter Campaign: Whodunnit?

Researchers report the most notable event of the quarter was the VPNFilter malware campaign. The attack hit a massive array of network hardware and storage tools; it serves as an example of how networking hardware is a prime target for advanced attackers.

“[We] can confirm almost every single country has traces of this infection,” says Diaz, noting that every single vendor had been affected in the attacks, which were first reported by Cisco Talos back in early June.

One of the interesting and relevant features of this campaign was its ability to inject traffic not only routers and networked storage devices, but also endpoint devices connected to them. A VPNFilter module injects malicious code into Web traffic going through an infected device.

The FBI attributed the VPNFilter attack to Sofacy and Sandworm (Black Energy) APT groups, but Diaz says it’s “tough to know, at this moment, who exactly is responsible.”

Microsoft July Security Updates Mostly Browser-Related

library
crime | hacking | security

Patch Tuesday includes 53 security updates, including mitigation for the latest side-channel attack.

Microsoft issued a range of security patches today, including its anticipated exploit-mitigation update for the so-called Lazy FP State Restore vulnerability in Intel microprocessors.

Intel late last month disclosed Lazy FP State Restore (CVE-2018-3665), the latest speculative execution side-channel vulnerability to be discovered since the first two, Meltdown and Spectre. This class of microprocessor flaws lets an attacker steal data, including cryptographic secrets.

Microsoft’s new mitigations for Lazy FP provide protections from the attack for Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and x64-based Windows 8.1 and 10. Microsoft last month published information on the attack, which, like other Meltdown/Spectre-type vulnerabilities, requires the attacker to execute code on the vulnerable computer.

“These are all mitigations and not really remediations,” says Jimmy Graham, director of product management at Qualys. “So they are really just preventing exploitation, even though the vulnerability is still there.”

In all, Microsoft issued 53 CVE updates today, 17 of which were critical. Meanwhile, Adobe released a whopping 105 updates, with the majority of critical ones for Acrobat and Reader. Just one critical vuln fix was issued for the notoriously buggy Flash. Microsoft issued several patches for Flash updates on its platforms as well.

Microsoft patched Internet Explorer (IE), Edge, ChakraCore, Windows, .NET Framework, ASP.NET, PowerShell, Visual Studio, and Microsoft Office and Office Services. Among the critical bugs were memory corruption vulns in IE and Edge browsers, as well as its Chakra platform.

Browsers were the main theme in this month’s Patch Tuesday, mainly because there were relatively and uncharacteristically few Windows patches, notes Graham. He recommends that organizations prioritize the browser patches for workstations and workstation-type devices. “There are systems that could get overlooked [here], like multiuser servers like Citrix. They are behaving like workstations and need to be patched as well,” Graham says.

Meantime, Adobe’s continued high volume of vulnerabilities has echoes of previous Windows problems.

“In the past, we saw Microsoft implement mitigations for certain types of vulnerabilities that shut down entire classes of bugs. To address the substantial number of bugs we continue to buy in Adobe products, they may need to take a similar approach,” says Dustin Childs, communications manager for Trend Micro’s ZDI team.

Qualys’ Graham notes that there were more than 50 critical CVEs associated with Acrobat and Reader.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/cloud/microsoft-july-security-updates-mostly-browser-related/d/d-id/1332258?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple