STE WILLIAMS

SOC 2 audits and third-party technical assessments are useful tools for an organization to use in navigating the security risks it may face. But these security road maps also can provide direction to a plaintiff’s counsel suing your organization in a later lawsuit related to a data breach. If the assessment describes your organization as being riddled with security vulnerabilities and, after the assessment, one of these unrepaired vulnerabilities is utilized to infiltrate your network, the assessment becomes proof that your organization knew about the risk and did not fix it.

On the flip side, engaging a third party to assess your security risk can also be used as a defense in court proceedings, showing that your organization engaged unbiased third parties to determine what risks it might face. In that way, an assessment can be a powerful tool in later court proceedings.

How do you mitigate against this potential future risk? Here are two strategies you can employ.

1. Think hard about who you’re engaging and the services they provide.
In the last few years, there has been a proliferation of service providers claiming to offer technical security assessments. In determining who to hire, budget can’t be your primary driver. Are your own customers requiring you to have a SOC 2 audit? Then you will need to engage a CPA firm that offers auditing services covering the Systems and Organizational Controls 2 (SOC 2) as put forward by the American Institute of Certified Accountants. Outside of a SOC 2, you may engage technical firms to perform assessments based on a variety of approaches, including the matrix from the National Institute of Standards and Technology.

But keep in mind that not all technical firms are created equal and that you need a reputable provider to put forward an assessment. Cheap sometimes means shoddy work. And if a service provider is looking for a later “up-sell” of services, be aware of that, too. Offering an array of services is not bad per se, but be cognizant of what could be motivating some of the findings. For instance, if the provider sells firewalls and suddenly your assessment comes back suggesting you need an upgrade, you may wonder whether the assessment was motivated by an unbiased opinion.

Create a list of questions to conduct diligence on providers and interview multiple providers. Develop a document trail of the process that went into engaging the audit team. This can be beneficial later to show your organization was thoughtful about security risk and wanted a truly unbiased opinion.

2. Arrange the engagement to protect the findings.
Attorneys have two special powers when it comes to confidentiality and protecting information. The first is the attorney-client privilege. Under the attorney-client privilege, communications between a lawyer and a client seeking and providing legal advice are protected from disclosure. The second is a nuanced doctrine called the work-product doctrine. Under this doctrine, a lawyer may engage a consulting expert to support the lawyer’s legal work on behalf of a client. This too, in most cases, is considered confidential and privileged.

So, what does all this have to do with getting an assessment? Organizations are now hiring outside counsel to work with them on obtaining an assessment in order to shield assessments with confidentiality. The process works like this: An organization engages outside counsel to assist in reviewing the organization’s cybersecurity risk. Outside counsel then engages the third-party assessment team to provide a technical assessment or SOC 2 to the lawyer. The engagement letter is set up so that the lawyer receives the technical assessment to support the lawyer’s legal work. The lawyer and the client discuss the findings of the report together.

What does this do? It insulates, as best we can, the findings from being disclosed in a later lawsuit by using both the attorney-client privilege and the work-product doctrine. I’ve seen assessments come back with score cards of 35/100. The last thing any defendant in a data breach lawsuit needs is a 35/100 assessment scorecard blown up as an exhibit in front of a jury box, with an impassioned plaintiff’s lawyer talking about how the company received a F on its assessment and did nothing to repair the risk before the breach occurred.

Without a lawyer, there is no privilege. Marking the document “confidential” and exchanging it may keep it confidential within your organization. But it won’t protect the assessment from being disclosed to a plaintiff’s lawyer in a later data breach lawsuit. The only way to try to do that is to work hard on the front end of obtaining assessments and have a lawyer involved in the process.

Related Content:

• 8 Trends in Vulnerability and Patch Management
• Practical Principles for Security Metrics
• Why Multifactor Authentication Is Now a Hacker Target
• How Does Your Cyber Resilience Measure Up?

Beth Burgin Waller is a lawyer who knows how to navigate between the server room and the board room. As chair of the cybersecurity data privacy practice at Woods Rogers, she advises clients on cybersecurity and on data privacy concerns. In this capacity, she … View Full Bio

Article source: https://www.darkreading.com/risk/soc-2s-and-third-party-assessments-how-to-prevent-them-from-being-used-in-a-data-breach-lawsuit/a/d-id/1336496?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

As 2019 draws to a close, it’s a good time to take stock of the year in security. The numbers tell us these past 12 months will likely be another record-breaker for breaches. According to Risk Based Security’s “2019 Midyear Quickview Data Breach Report,” about 4.1 billion records were exposed through June alone. Those figures represent a 54% increase over the same period in 2018.

Another year, a whole ‘lotta data stolen. What’s it going to take turn the numbers around? We might start by retiring some of the outdated thinking among security professionals. We asked several veterans to tell us which security chestnuts they would roast in 2020.

(image: exclusive-design, via Adobe Stock)

(Continued on next page)

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online. View Full Bio

Article source: https://www.darkreading.com/edge/theedge/10-security-chestnuts-we-should-roast-over-the-open-fire-/b/d-id/1336531?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Threat actors believed to be operating out of Iran are once again targeting energy and industrial-sector organizations in the Middle East with a destructive disk-wiping malware similar to “Shamoon,” which destroyed more than 35,000 Windows systems at Saudi Aramco a few years ago.

Researchers from IBM’s X-Force team who have been tracking the new malware have dubbed the malware “ZeroCleare.” In a report this week, the vendor described ZeroCleare as similar to Shamoon in some ways, but sufficiently different enough from it in other ways to be considered a completely new threat.

“Our reverse engineers performed a comparative analysis of the two attacks, which showed that they do not appear to be related at a code level,” says Limor Kessem, global executive security adviser at IBM.

As with Shamoon, the new malware is designed to overwrite the master boot record (MBR) and disk partitions on Windows systems. Also like its predecessor, ZeroCleare uses EldoS RawDisk, a legitimate toolkit, to carry out its mission. MITRE describes EldoS as a driver for interacting with files, disks, and partitions. It allows users to circumvent Windows OS security features and directly modify data on a computer, making it attractive to attackers.

Available evidence suggests that ITG13, a threat group also known as APT34/OilRig, and at least one other Iran-based group is behind the attacks. ITG13’s mission appears to be to enable initial access to targeted systems. One or more other Iran-based groups have then been deploying the disk-wiping ZeroCleare on them. The attacks appear to be targeted and designed specifically to disrupt operations at critical infrastructure organizations in multiple Middle East countries.

Kessem says there are a variety of reasons why nation-states might want to target the natural resource infrastructure of another country. “The repercussions of attacks on the oil industry specifically span issues related to money, trading, transportation, and geo-political tension that could be building up in a region,” she says.

Kessem estimates the ZeroCleare attacks have impacted thousands of devices in the oil and gas sector in the Middle East. “We don’t know the exact number of organizations that were impacted,” Kessem says. “However, we do know that at least 1,400 hosts were affected by ZeroCleare.”

Shamoon, which first surfaced in 2012, is believed to have infected many more systems. The last time security researchers observed the malware being used was in December 2018, when it suddenly re-emerged after a two-year hiatus. Symantec and others that tracked the attacks described them as being targeted once again at Middle East organizations. The attacks involved a new wiper that deleted files from infected systems before Shamoon then wiped the master boot record.

A Multifaceted Threat
According to IBM, the new ZeroCleare threat is designed to work on both 32-bit and 64-bit Windows systems, but the manner in which it deploys on each is different.

Because 64-bit Windows systems only allow Microsoft-signed drivers to run on the device, the EldoS RawDisk driver, which is unsigned, cannot run on them by default. To overcome this obstacle, ZeroCleare first loads a signed, but vulnerable, driver on the targeted system and then exploits the vulnerability to load the unsigned EldoS driver, IBM said. Once installed, the RawDisk driver proceeds to wipe the master boot record clean.

Destructive attacks like ZeroCleare are growing, Kessem says. The number of cases that IBM has responded to, where disk-wiping and other destructive malware was involved, has jumped 200% in just the past six months, she says.

“These attacks can be launched to fulfill everything from financial gain to military objectives,” Kessem notes. “The effects can be crippling, especially as attackers target specific sectors that countries heavily rely on.”

Most destructive malware attacks so far have focused on organizations in the Middle East. Motivations have ranged from financial — pressuring victims to pay by threatening to wipe their systems clean — to the geo-political. Some nation-state campaigns, for instance, have had military objectives, such as denying access to critical systems, degrading or disrupting operational capabilities, and destroying devices and data, IBM said.

Significantly, these campaigns pose a threat to organizations in any country. “US organizations need to be cognitive of their security preparedness,” Kessem says. This means testing incident response plans, reassessing access management controls, and ensuring proper data backup and recovery processes are in place.

In many of these attacks, threat actors have exploited weakly protected access credentials and privileged accounts to gain an initial foothold on a target network and to then expand their access on it. So controls such as multifactor authentication, strong passwords, and least-privileged access are critical, IBM said.

Related Content:

• Disk-Wiping ‘Shamoon’ Malware Resurfaces With File-Erasing Malware in Tow
• Inside The Aftermath Of The Saudi Aramco Breach
• APT34 Toolset, Victim Data Leaked via Telegram
• 13 Security Pros Share Their Most Valuable Experiences 

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “A Cause You Care About Needs Your Cybersecurity Help.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/shades-of-shamoon-new-disk-wiping-malware-targets-middle-east-orgs/d/d-id/1336520?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Researchers who discovered one of the largest Android banking botnets to date also found its attackers’ chat log, which they have been watching for nearly a year to learn the inner workings of this cybercrime operation, how its illicit business is structured, and how members interact.

The botnet, dubbed “Geost,” was first detected in 2018. A team of security researchers representing Czech Technical University in Prague, UNCUYO University, and Avast Software noticed one of Geost’s botmasters logging into a C2 domain while using the insecure proxy network created by HtBot malware. Machines infected with HtBot create an illegal network of proxies later sold to customers; the researchers’ lab had one HtBot instance capturing traffic.

What they found was a massive botnet targeting Russian citizens. Geost has nearly 1 million victims, 15 C2 servers, thousands of domains, and thousands of malicious Android application packages (APKs), which are used to distribute and install applications on the Android OS. It has connections to victims’ SMS data and direct links to the systems of five major European banks. Geost also sells and redirects traffic, harvests data, and accesses premium SMS services.

The discovery of Geost was made possible, in part, due to several OpSec failures by the attackers, says Avast Software researcher Anna Shirokova. One of their first mistakes was relying on proxies: “They assumed by default that it was secure,” she explains. “They didn’t expect researchers like us were going to be watching.” This slip-up helped the research team uncover not only this banking botnet, but other criminal groups as well, she adds.

Geost’s operators also failed to use encryption, Shirokova continues, and all of their chat communication was in cleartext and HTTP. This was hugely helpful given the content they shared, which included passwords, usernames, and geographical locations. They also reused the same nicknames across online platforms, making members easy to track.

These may seem like basic mistakes to make, but Sebastián García, researcher with the Czech Technical University in Prague, points out the attackers may have considered them unnecessary. “You can imagine that to apply some OpSec protections, you need to be aware you may be compromised and somebody may be watching you,” he says of the operators.

To the attackers, it may seem unlikely an external party would discover their illicit operations. Who, other than a fellow cybercriminal, would go to the trouble of buying and tracking HtBot malware on the Dark Web? Even if a law enforcement officer or security researcher found them, chances are Geost’s operators wouldn’t lose any money. “Even if someone is watching, there is no impact,” he adds.

Inside a Botnet: How Criminals Operate
During their analysis of the Geost botnet, the research team uncovered a chat log of a cybercriminal group related to the operation. The log exposed 6,200 lines of text between June 2017 and April 2018 and revealed conversations among 20 people, about 10 of whom were involved with Geost and the rest of whom were connected to other operations. Conversations were in Russian, which García notes is “very unusual” considering the victims are also Russian.

It’s important to note this chat log was not a public forum but a more private chat among members of the criminal group where they felt more secure in their communications, García points out. The team is still conducting research and did not disclose how they found it online, though they did say it’s publicly available.

This chat log gave researchers significant insight into how the Geost business operation worked, human relationships between the criminals, their daily tasks, motivational issues, money laundering, decisions made, and challenges faced. Their criminal projects included pay-per-install, phishing website hosting, C2 development, malicious APKs, and fake game development.

“The ecosystem is super complex,” García explains, and there were several similarities between the Geost botnet operation and traditional businesses: Members were worried about where the money was going, how much they were paying employees, and keeping their operation staffed. Hiring people is complicated, and because they don’t use contracts, workers often leave at will.

Like any business, the Geost botnet employs developers, managers, people who handle illicit funds, and people in charge of buying and selling traffic. The owner and controller of the chat log, for example, knows money launderers and creates websites. Another member is tasked with subcontracting others, tracking payments, preparing APKs, and creating websites. These two both set up domains and pay developers to create websites. Most aren’t highly technical, Shirokova adds. While “they know some stuff,” they outsource technical tasks to developers.

The interactions among members ranged from polite, formal conversations to casual chats among friends. Some members used slang, which Shirokova says indicates they may be younger. It’s unclear whether the members know one another outside the operation, as they were often discussing each other’s geographical locations. Researchers hypothesize the group met while seeking devices and services on an underground forum and formed the operation.

What stood out most to the researchers was how Geost’s operators treated the botnet not as an attack, but as a business. Most people have the perception that adversaries are fighting us, says García, but their mindset is completely different. “They are not fighting,” he explains. “For them, it’s a job.”

There were only a handful of times they mentioned what they are doing is illegal. The people behind the botnet never said things like “I attacked” or “let’s attack,” says Shirokova.

“We are expecting them to say, ‘We are infecting’ or ‘We are getting money,'” García adds. Whether it’s because they’re young or because this activity is not illegal in many countries, Geost’s operators appeared more concerned with how their money was flowing than whether they’d face any consequences.

Researchers broke down the operators’ activity into three categories: those that are definitely illegal (malware development, phone infection, attacking others, potentially avoiding taxes), those that are probably not illegal (creating fake websites, mirroring third-party websites, premium SMS, and traffic redirection), and those that are legal (website creation and backend development).

García, Shirokova, and their fellow researcher María José Erquiaga, also of the Czech Technical University in Prague, presented their findings today at Black Hat Europe.

Related Content:

• When You Know Too Much: Protecting Security Data from Security People
  
• Attackers Continue to Exploit Outlook Home Page Flaw
• When Rogue Insiders Go to the Dark Web
• 10 Tips for Building Compliance by Design into Cloud Architecture

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “A Cause You Care About Needs Your Cybersecurity Help.”

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/whats-in-a-botnet-researchers-spy-on-geost-operators/d/d-id/1336521?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Security services firm Trustwave has released an open source project aimed at companies that want to provide password-cracking as a service to their security teams and red teams, the company announced today at the Black Hat Europe conference.

Using the new CrackQ platform, companies can run periodic checks on their own systems or give red teams a resource for cracking password hashes taken from clients during an engagement, providing businesses with metrics on password quality and statistics on the tool’s use. Written in Python and based on the Web-application framework Flask, the platform is extensible and already includes a graphing library for creating plots in the dashboard, says Dan Turner, principal security consultant at Trustwave’s SpiderLabs 

“The dashboard really helps to visualize the weaknesses there [in password selection],” he says. “A viable use case is a security team using it internally to check passwords, but it is primarily for offensive teams to use during an engagement.”

Because they are chosen by users, passwords have always been a weak link in corporate security. A study by Virginia Tech, for example, found slightly more than half of users reused passwords or used variants of the same password. Fifty-six percent of passwords only required 10 guesses to crack, according to the study.

Trustwave regularly finds similar numbers. More than half of the passwords the company’s red teams have taken from Windows Domain Controllers usually can be broken by password-cracking tools, such as Hashcat, the program that powers CrackQ, Turner says. Often, the failure rate is closer to 70%. 

Even with common best practices, such as enforcing password complexity and timing out logon attempts, passwords continue to be a weak link in system security.

“The problem is that there are still a a large body of insecure passwords within organizatioons, and it only takes one weak password for a network to be compromised,” he says.

The password cracker does not need to be reinvented, Turner adds. Instead, he wanted to solve the problem of cracking passwords as a team.

Built as a client-server system with a JavaScript front end and multiple mechanisms for authentication, CrackQ allows teams to access a password-cracking server running Hashcat and based on GPU-accelerated hardware. Because the platform is based on Python and the Flask Web-application framework, the software can be extended very easily. 

“At the click of a button, CrackQ will generate a password analysis report from the results of a password-cracking job — a Windows Active Directory domain store. for example,” Turner wrote in a blog post on the tool. “This includes information relating to timings and speed, but crucially insecure password choices and patterns within an organization.”

The software, for example, will also analyze the probable nationality of a user by the words used in their password or if the passphrase mentions specific geographic locations. 

CrackQ also uses Hashcat Brain, a feature that prevents the password-cracker from trying the same password multiple times, but turns this off when it becomes a bottleneck, which it can be for slower algorithms.

The platform will be useful for password-cracking in an enterprise context, as it allows the security team the ability to easily create reports and spot weaknesses in password selection, Turner says.

“For us, every penetration test with a significant password store compromise will include a detailed report analyzing weak areas in a password policy,” he says. “CrackQ will help to visualize that and perhaps help drive home the message about poor password choices.”

Interested users and contributors can download or clone the tool on GitHub.

Related Content:

• More Than Half of Users Reuse Passwords
• 6 Active Directory Security Tips for Your Poor, Neglected AD
• New Technique Makes Passwords 14M Percent Harder to Crack, Nonprofit Claims
• New Side-Channel Attacks Target Graphics Processing Units
• Beyond Passwords: Why Your Company Should Rethink Authentication

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “A Cause You Care About Needs Your Cybersecurity Help.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/operations/identity-and-access-management/password-cracking-teams-up-in-crackq-release/d/d-id/1336522?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

To effectively manage cyber-risk, organizations need to gain visibility into existing application and infrastructure vulnerabilities while also learning how to manage them proactively. This can feel like an insurmountable task at times, but thankfully, the cybersecurity industry does a commendable job of sharing intelligence about the common bugs and vulnerabilities to watch.

In fact, there are organizations whose sole mission is to find zero-day vulnerabilities and other instances of malicious cyber activity, such as Google’s Project Zero and the United States Computer Emergency Readiness Team (US-CERT), providing valuable resources for cyber-risk.

All this said, the reality is strikingly different. Rather than actually remediating vulnerabilities, organizations today end up spending the bulk of their time trying to make sense of conflicting and/or duplicate vulnerability data. From a risk management perspective, they are failing to establish the visibility they need. And from a financial perspective, organizations are racking up significant expenses trying to employ enough skilled people to manage these disparate tools and cover the various software licensing fees.

Consider this: Unpatched vulnerabilities remain a chronic and persistent problem; they are responsible for many of the high-profile global data breaches in recent years, with the 2018 Equifax hack and 2017 WannaCry disaster serving as prime examples. Research from the Ponemon Institute also indicates that about 60% of all organizations suffering from a data breach between 2016 and 2018 cited a known, unpatched vulnerability as the attack culprit. While these statistics should not be viewed with fear, it is worth remembering the far-reaching implications of a single vulnerability.

Wildfire-Like Growth of Vulnerability Scanning Tools Isn’t All Good News
The reason unpatched vulnerabilities persist and continue to wreak havoc is relatively simple — organizations are managing their application and infrastructure risk backward. In other words, companies are focusing, first and foremost, on purchasing a slew of different tools to scan various areas of their network environment and identify problematic areas. While this may help to fill scanning gaps across the software development lifecycle (SDLC), the various tools deployed rarely produce results that are easily correlated, leaving companies with a huge pile of data that is extremely hard to take action upon.

To complicate things further, the vulnerability scanning technology market is exploding. For scanning web application vulnerabilities, just one possible component of an organization’s entire environment, the Open Web Application Security Project (OWASP) lists more than 50 tools available. With this kind of aggressive market growth, organizations are overdosing on the number of vulnerability scanning tools they use—and it’s not working.

Acquiring technology to shore up weak points seems like the responsible and admirable thing to do, but the sheer number of vulnerability scanning tools organizations are implementing makes keeping pace impossible. Remember, each scanning tool reports and scores risk factors differently, which means these tools may likely indicate the same vulnerability more than once. And because scanners also name or prioritize them differently, bugs and flaws can go unrecognized completely, leading to wasted resources spent investigating repeat issues.

Implementing to Ensure Tools Work Well Together Is Key
To realistically identify and remediate application and infrastructure vulnerabilities, organizations need to take a step back. Before putting any additional tools to work, assess your environment’s footprint and review the ones you already have, including what they cover. Identify any vulnerability scanning overlaps, keeping in mind that every environment is unique. Only retain or implement tools your organization truly needs rather than hanging on to popular solutions that promise enviable results.

After taking stock of your environment’s footprint and vulnerability scanning needs, it’s important to develop a cohesive strategy for managing your scanning tools, one that is scalable and allows them to work well together. For example, to address the challenge of various tools scoring vulnerabilities differently, consider transcoding your tool output to the Common Vulnerability Scoring System (CVSS) , an industry-standard framework for ranking the characteristics of a vulnerability and its risk. To gain a more holistic view of risk, track software and infrastructure throughout their respective life cycles rather than using an individual discovery technique such as simply correlating static application security testing (SAST) and dynamic application security testing (DAST). Instead of consolidating the outputs of multiple vulnerability discovery tools in a single stream, try consolidating vulnerabilities in a view that allows developers to address a single “unit of work,” such as focusing on the important issues in need of immediate remediation.

A Risk-Based Approach to Vulnerability Management Is Paramount
When organizations prioritize vulnerability scanning technology over mindfulness, they not only waste valuable resources, they also forfeit a solid understanding of their security posture. Without being able to clearly identify where they’re most at risk or where they need to prioritize remediation across applications and infrastructure, it’s no surprise that many organizations detect and remediate as little as 10% of vulnerabilities.

Businesses today must adhere to a risk-based approach to vulnerability management if they hope to continue the fight against perpetual cyber-risk. Before incorporating any additional scanning tools, think strategically about what’s actually needed to defend your organization’s unique environment and devise a plan to ensure all necessary tools can work together productively. In doing so, organizations can proactively manage their application and infrastructure risk by accurately prioritizing what’s most critical and equipping themselves to take swift, decisive action every time.

Related Content:

• 13 Security Pros Share Their Most Valuable Experiences
• The 5-Step Methodology for Spotting Malicious Bot Activity on Your Network
• Employee Privacy in a Mobile Workplace
• How Does Your Cyber Resilience Measure Up?

John Worrall has more than 25 years of leadership, strategy, and operational experience across early stage and established cybersecurity brands. In his current role as CEO at ZeroNorth, he leads the company’s efforts to help customers bolster security across the software life … View Full Bio

Article source: https://www.darkreading.com/risk/application-and-infrastructure-risk-management-youve-been-doing-it-backward/a/d-id/1336455?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A 2-year-old vulnerability in Microsoft Outlook continues to cause headaches for companies, as attackers are able to use a specific feature of the program to execute code and persist on previously infected systems, according to an advisory published by cybersecurity services firm FireEye.

The attack, which uses the Microsoft Outlook Security Feature Bypass Vulnerability (CVE-2017-11774) patched in October 2017, abuses the Outlook Home Page feature that allows a customized view to be shown for any e-mail folder. When exploited, the vulnerability allows code to run whenever an Outlook client homepage is opened. 

While the issue was patched, and the vast majority of companies have the update, attackers have been able to circumvent the fix to gain persistence on already-compromised systems, says Matthew McWhirt, senior manager at FireEye.

“We definitely continue to see the Home Page functionality being used by attackers, even though it was patched back in 2017, over two years ago,” he says. “We are also seeing attackers attempting to disable protections that the patch provides by circumventing some controls by modifying the registry on endpoints.”

The alert comes after the United States’ military warned in July that Iranian cyber espionage groups were using the issue as part of their attacks on targets in the United States, Europe, and the Middle East. Two Iranian groups — APT33 and APT34 — have used the attack since June 2018, according to FireEye. APT33, also known Elfin, has attacked industries and government agencies in the United States, Saudi Arabia, and South Korea, focusing the aerospace and oil-and-gas sectors. APT34, also known as Helix Kitten, has focused on financial, government, energy, chemical, and telecommunications targets in the Middle East and has operated since 2014.

Both groups seem to use the Outlook vulnerability as a way to gain persistence on systems that are already compromised. In addition, a recent submission to VirusTotal included an automated version of the attack for working around patched Outlook systems, FireEye stated in its alert.

“APT33 is a heavy user of this technique, and we have also seen APT34 using it as well,” McWhirt says. “I wouldn’t call it an ‘uptick’ — that is not why we are calling this out — but companies may think they are safe because they applied the Outlook patch, and they are not.”

In the automated version, submitted as an Excel file to VirusTotal, the persistence technique aims to modify the WebView registry key with an external URL in a type of cloud storage common to Azure, known as a storage blob, and has a method to “walk through the registry and reverse the … patch,” FireEye stated. Dark Reading could not confirm the existence of the file through a search on the hash provided by FireEye, but the company stated that the file appears to be attributable to an authorized red-team operation.

To foil such attacks, companies should enforce specific values for the registry keys used by the attack, or the use of Group Policy Objects (GPOs) in Windows. In its alert, FireEye listed the complete hardening guidelines that companies can put in place to prevent attackers from bypassing the Outlook patch.

“Without continuous reinforcement of the recommended registry settings for … hardening [against the attack], an attacker can add or revert registry keys for settings that essentially disable the protections provided by the patches,” FireEye warned in the alert.

While the specific attack appears to be industry-generated — with one security company detecting another security company’s exploit — malicious attackers and groups often adopt techniques pioneered by security researchers.

FireEye cautioned organizations to check to ensure that the specified registry changes do not break third-party applications that use the Outlook Home Page functionality. 

Because rolling back the patch’s hardening measures requires “some form of initial access,” the issue is not considered a failure of the patch by Microsoft, according to FireEye’s alert.

“However, the technique is under-reported, no public mitigation guidance is available, and — as a fresh in-the-wild example demonstrates … — initial access and patch overriding can be completely automated,” the alert stated.

Related Content

• US Military Warns Companies to Look Out for Iranian Outlook Exploits
• Companies on Watch After US, Iran Claim Cyberattacks
• MITRE Changes the Game in Security Product Testing
• Disk-Wiping ‘Shamoon’ Malware Resurfaces With File-Erasing Malware in Tow
• Microsoft Fixes Two Security Flaws in Outlook

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “A Cause You Care About Needs Your Cybersecurity Help.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/attackers-continue-to-exploit-outlook-home-page-flaw/d/d-id/1336513?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple