STE WILLIAMS

A single server leaked 4 terabytes of personal data, including social media profiles, work histories, and home and mobile phone numbers.

Security researchers have discovered an unsecured server containing 4 terabytes of personal data — 1.2 billion records in total — exposed and easily accessible online, Wired reported today.

The open server held profiles of hundreds of millions of people. Leaked data includes home and cellphone numbers; social media profiles for Facebook, Twitter, LinkedIn, and Github; work histories seemingly pulled from LinkedIn; nearly 50 million unique phone numbers; and 622 million unique email addresses. It didn’t contain sensitive data such as credit card numbers, Social Security numbers, or passwords, which are considered relatively more valuable to attackers.

It seems this trove of information is made up of four separate datasets. Of these, three had labels indicating they were from People Data Labs, a data broker claiming to sell information on more than 1.5 billion people, including billions of email addresses and Facebook URLs and IDs.

Security researcher Vinny Troia discovered the server while scanning for exposures with researcher Bob Diachenko. It’s unclear who owned the server, which traced back to Google Cloud Services, or who stored the information there. It’s also unclear whether anyone had found and downloaded it. Troia alerted the FBI, and the server and data were taken down.

In these scenarios, the leaked data often comes from public records, and its exposure doesn’t necessarily mean it’s in criminal hands. Still, aggregating information like this can make it easier for fraudsters to steal identities or launch credential stuffing attacks and phishing scams. It’s likely some data will end up on the Dark Web, where it can be bought and sold by scammers. 

Read more details here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “In the Market for a MSSP? Ask These Questions First“

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/12b-records-exposed-in-massive-server-leak/d/d-id/1336439?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Anti-cheat software safeguards countless online game players every year, but it’s not bulletproof. At Black Hat Europe in London next month attendees will learn firsthand where the chinks are in the armor of modern anti-cheat solutions

In Unveiling the Underground World of Anti-Cheats, security consultant Joel Noguera will share what he’s learned from testing (and bypassing) the security measures built into popular anti-cheat tools like XignCode3, EasyAntiCheat and BattleEye. He recently spoke with Dark Reading about how he got involved with the anti-cheat software scene and what attendees can expect to get out of his Black Hat talk.

Alex: Tell us a bit about yourself and your path into security work.

Joel: I’m currently working as a security consultant at Immunity Inc. My day job consists mainly of pentesting engagements; however, I’m always looking into the reversing world, and every time I have an opportunity, I open my favorite reversing tool to get my hands dirty.

Alex: What is your favorite reversing tool, anyway?

Joel: I love trying new tools, but there are a few that I always use. I have been using IDA (Interactive Disassembler)a lot the last years and now I’m trying to adapt to Ghidra. I’m migrating some of my projects to this last one, so I can fully understand it and try its potential.

Alex: What inspired you to pitch this talk for Black Hat Europe?

Joel: I’ve never attended Black Hat before, and I always wanted to be part of it! Luckily this time, I will do it as speaker. I believe Black Hat gathers a lot of interesting people that you don’t see at other conferences, and I would love to be a part of that experience.

Alex: What do you hope Black Hat Europe attendees will get out of attending your talk?

Joel: The cheating community doesn’t tend to talk much about this topic. The public information that can be found on the Internet may be very limited, and the entry level for this niche is really high (because) there are so many techniques and tricks related to Windows internals topics that you must learn. This talk will allow security professionals to understand how this community is built, and learn about the technical aspects of game hacking. I will be talking from basic bypasses to complex kernel exploits used to successfully bypass anti-cheat protections, and all the drawback that you need to overcome.

Alex: What is the strangest or most interesting cheating technique or trick you’ve ever heard of?

Joel: Actually,that’s one of the interesting aspects of my talk! If I talk about them then I would be spoiling! But as you can imagine, there are plenty of different techniques. From simple tricks that allow cheaters to manipulate the game or a process without using the expected ways that Windows provides, to complex methods that modify how the Windows kernel behaves normally in order to confuse the anti-cheat software.

Learn more about Joel’s Briefing (as well as lots of other cutting-edge content) in the Briefings schedule for Black Hat Europe, which returns to The Excel in London December 2-5, 2019.

For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/black-hat-europe-qanda-unveiling-the-underground-world-of-anti-cheats/d/d-id/1336442?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

He’s a convicted Nigerian scammer, ensconced in the bowels of the Kirikiri Maximum Correctional Center in Lagos as he serves a 24-year jail term for internet fraud, but hey, details, details!

Bars didn’t stop him from getting a phone and an internet connection so he could allegedly run what Nigeria’s Economic and Financial Crimes Commission (EFCC) says was a $1m “mega-scam.”

The EFCC is scratching its head over this one. On Tuesday, the commission said that Hope Olusegun Aroke allegedly continued to ply his “ignoble trade” of internet fraud from prison, though it didn’t say just what, exactly, his alleged swindles were.

The immediate riddle that confronted the EFCC was how it was possible for the convict to continue to ply his ignoble trade of internet fraud from prison.

Preliminary investigation revealed that the convict, against established standard practice, had access to internet and mobile phone in the Correctional Centre where he is supposed to be serving his jail term.

What we do know is how Aroke wound up in jail in the first place: in 2012, he claimed to be a computer science student at the Kuala Lumpur Metropolitan University in Malaysia.

After a tip led to a search of his apartment and subsequent arrest, Aroke was convicted for masterminding a massive criminal operation spread out between Asia and Africa. He was found guilty on two counts of obtaining money by false pretence, forgery, check forgery and wire transfer fraud and was sentenced to 12 years in prison on each of those two counts.

The EFCC didn’t say how long that original fraud had been going on, but it did give a laundry list of what police found in Aroke’s apartment at the time: laptops, an iPad, travel documents, checkbooks, flash drives, an internet modem, and three luxury cars.

Fast-forward seven years, and if the EFCC’s allegations hold water, Aroke apparently still has a knack for acquiring stuff.

For starters, the convict is said to have gotten hold of a mobile phone and internet access in the Correctional Centre where he was supposed to have been serving his term. As in other countries, phones and internet connectivity are considered contraband for prison inmates.

There’s no shortage of stories about that kind of contraband getting to prisoners, though. We’ve seen prisoners allegedly pose as underage girls in a $560K sextortion scam, the “Iceman” hacker get charged with allegedly running a drone-smuggling ring from jail, and prisoners who gave away their phones (or their marijuana plant) by – what else? – posting selfies to Facebook.

Besides getting a phone and an internet connection, Aroke also allegedly managed to buy some property, as well as a fancy car for his wife.

He allegedly used a fake name, Akinwunmi Sorinmade, to open two bank accounts. Aroke also had possession of his wife’s bank account token while in prison, which he allegedly used to freely transfer funds.

In 2018, Aroke allegedly bought a property worth N22million ($USD60,689, £46,986). Investigations found that even before he was in jail, while undergoing trial, Aroke paid N48million for a four-bedroom duplex.

While serving his sentence, he also allegedly bought a 2018 Lexus RX 350 and registered it in his wife’s name.

Felons often acquire phones that are thrown over prison walls, but Aroke might not have had to play catch with this one. Rather, it sounds like he just popped out of prison and into a hospital. The EFCC says that Aroke got himself admitted to the Nigeria Police Hospital for what the commission called an “undisclosed ailment.”

From there, he’d slip out and stay in hotels to meet with his wife and children, and he’d go to parties: not exactly the kind of activities that convicts are supposed to engage in when they’re in maximum security prison.

The EFCC is investigating that hospital admission as it tries to get to the bottom of who helped Aroke to allegedly pull this all off.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ZeLPW2Cof14/

Fascinated by cryptocurrencies? Wishing you’d got in on the ground floor for the Bitcoin boom of 2017?

Many people would answer “Yes” to both those questions – and with good reason.

After all, the dramatic roller coaster ride that the Bitcoin (BTC) price has been through from 2017 onwards is kind of unimportant to anyone who mined their own bitcoins in the early days.

Ten years ago, bitcoins were almost worthless, with one historical chart claiming that a user going by the name SmokeTooMuch tried to sell BTC 10,000 for just $50 back in 2010, but couldn’t find a buyer.

Only in 2011 did one bitcoin go above $1, so if you have even a tiny stash of BTC from before that date, the very worst value multiplier you would have seen in the past two years would still be more than 3,000-fold (that’s 300,000% if you prefer percentages).

In other words, the currency’s recent volatility in flapping between a nadir of just over $3,000 and a zenith of just under $20,000 since December 2017 simply doesn’t matter to anyone with BTC 10,000 from back in 2010.

That’s not the difference between rich and poor, it’s the difference between rich and Richie Rich rich.

Simply put, people who got into BTC at the very start and held onto their bitcoins are, in theory at least, extra-super wealthy now as a result.

(The publisher of the system that makes Bitcoin work, the still-anonymous Satoshi Nakamoto, is claimed by one analyst to have mined about one million bitcoins in those heady, early days; all of them apparently remain unspent.)

Enter the ICO

So it’s not surprising that confidence tricksters – crooks with the gift of the gab, and an apparent fluency in the jargon of cryptocoins and blockchains – have found that promising “a brand new cryptocurrency that you can join at the very start” can be a great way to defraud well-meaning people of their hard-earned savings.

Cybercrooks of this sort often pitch what’s called an Initial Coin Offering, or ICO.

That’s a newly-minted term that’s meant to mirror the terminology IPO, short for Initial Public Offering, which stock markets use to describe a private company going public by putting up shares for sale on an open market.

IPOs can give investors a chance to realise rapid gains, for example by selling quickly if immediate demand for the new shares is high, or to make money in the long term by holding onto their early shares in a company that’s already well known.

But even IPOs by big, popular companies don’t guarantee that your investment will go up, and that’s in a market ecosystem that, in most countries, is fairly strictly regulated.

Not just anyone can set up an IPO; there are strict rules about what positives you are allowed to claim about your company, and which potential negatives you are obliged to disclose up front; there are controls on what you can say to the media during the lead up to the IPO, and who can say it, and when… and much more.

In contrast to the rules around IPOs, in many countries, ICOs are either scarcely regulated or not regulated at all.

Loosely speaking, someone who wants to “market” an ICO can promise the world – and can do so without needing any existing products, or prototypes, or stock, or patents, or intellectual property, or indeed anything much at all except a cool-sounding name for their new cryptocoins and a groovy-looking website.

Sadly, that makes it surprisingly easy for a cybercrook to invite “investments” – for example by using a bunch of fake testimonials and some judiciously chosen (and perhaps actually accurate) graphs showing how other cryptocurrency values have shot up to the apparently enormous benefit of those who joined in early on.

Building a pyramid

A wily cybercriminal might run a website that shows their new “currency” steadily gaining in value, based on some sort of unspecified “mining and trading” activity, perhaps with “real time transaction logs”.

The crook might even make regular “dividend” payments to early investors to “prove” that the product is doing well.

For example, you might login and see a page showing that your initial $10,000 investment is already worth $47,578, say – and you might even be encouraged to “withdraw” some of your “gains”, possibly subject to some sort of investment period limit that restricts you getting it all at once.

Of course, if you’ve put in $10,000 and the crook permits you to cash out out, say, $178.56 of “dividend” right now, after just a few weeks, it might feel as though you are living the dream…

…but in the unregulated world of ICOs and cryptocurrency investments, there may be few or no legal safeguards to ensure that the $178.56 you’ve extracted are genuine earnings, rather than just a tiny percentage of your own money back.

Some early adopters might actually get paid back more than they put in – so their delighted and very public claims that “they genuinely made money” might indeed be true, so far as they can tell.

But there may be no legal or operational safeguards by which you can be sure that those lucky few actually made their money because of a genuine increase in value of the cryptocurrency they think they bought.

For all you know, those lucky few might simply have been paid directly out of the money put in by subsequent investors, meaning that the product that they thought they had funded, and that had allegedly grown in value, didn’t exist at all.

That’s a classic pyramid or Ponzi scheme, named after an early perpetrator of the scam called Carlo Pietro Giovanni Guglielmo Tebaldo Ponzi, better known as Charles Ponzi.

A more recent perpetrator is Bernard Lawrence Madoff, who made off with billions of dollars in his own Ponzi scheme before getting a whopping 150-year prison sentence in 2009. According to Wikipedia, Bernie Madoff’s release date is in 2139, assuming 20 years off for good behaviour, and assuming he lives to be more than 200.

So, what can be done to discourage ICO scammers from stealing money from innocent but trusting victims in this comparatively simple yet high-tech-sounding fraud?

One thing is to find, arrest, convict and imprison those who practise this sort of deceit, and the good news is that the US Department of Justice (DOJ) is willing and able to do so.

Indeed, the DOJ this week announced the imprisonment of one Maksim Zaslavskiy for 18 months, with US Attorney Richard P. Donoghue stating that it was “an old-fashioned fraud camouflaged as cutting-edge technology.” The DOJ explained Zaslavskiy’s scam:

In July 2017, Zaslavskiy marketed RECoin as “The First Ever Cryptocurrency Backed by Real Estate,” and subsequently Diamond as an “exclusive and tokenized membership pool” hedged by diamonds. In reality, Zaslavskiy bought neither real estate nor diamonds, and the certificates he sent to investors were worthless. Zaslavskiy also falsely advertised that REcoin had a “team of lawyers, professionals, brokers and accountants” who would invest the proceeds from the REcoin ICO in real estate, and that 2.8 million REcoin tokens had been sold.

Caveat emptor?

Reading back this straighforward description, it feels as though anyone investing in Zasavskiy’s schemes ought to have seen through them at once, given that there wasn’t anything to rely upon except unsubstantiated statements from the crook himself.

But before you criticise the victims of this sort of crime for what might seem like a mixture of gullibility and short-sightedness, remember that successful cryptocurrencies such as Bitcoin are essentially backed by nothing but their blockchains – distributed digital ledgers that are maintained by a network of users who pay for the electrical power needed to perform what amount to verification or validation calculations to “approve” transactions into those blockchains.

With that in mind, the promise of a cryptocurrency that uses the same cryptographic technology for its digital transaction ledger, yet is allegedly backed by the actual purchase of real estate using the money of investors, is an understandably alluring one.

After all, if Bitcoin can (and has) made early adopters rich without any real estate in the equation at all, why shouldn’t a technologically similar scheme that includes some sort of real-world “value backstop” be an even better investment?

Hey, even if the real estate doesn’t go up in value much, or even at all, surely you’re already better off than just buying Bitcoin, because there’s at least something behind it? Not to mention that this time, you get in on the ground floor, just like Mr SmokeTooMuch did with his BTC 10,000 back in 2010.

What to do?

We’re not investment advisors, so we can’t comment on the value, or otherwise, of cryptocurrency investments.

The problem with the RECoin scam that netted Zaslavskiy an 18-month prison term is that it wasn’t an investment at all – it was just a tower of lies, given technological zing through its modern-sounding, blockchain-based, cryptocoin-flavoured description.

So, remember:

• Beware any online schemes that make promises that a properly regulated investment would not be allowed to do. Investment regulations generally exist to keep the lid on wild and unachievable claims, so be sceptical of any scheme that sets out to sidestep that sort of control in unregulated areas.
• Don’t be taken in by cryptocoin jargon and a smart-looking website. Anyone can set up a believable-looking website with what look real-time graphs, community endorsement and an online commenting system that seems to be awash with upvotes and positivity. Open source website and blogging tools make it cheap and easy to create professional-looking content – but those tools can’t stop a crook feeding them with fake data.
• Consider asking someone with an IT background whom you know and trust for advice. Find someone who isn’t already part of the scheme and doesn’t show any particular interest in it. Be wary of advice or endorsement from people who are (or claim to be) already part of the scheme. They could be paid shills, or fake personas, or they could be early winners who’ve been paid with money Ponzied from later investors
• If it sounds too good to be true, it probably is. That advice applies whether it’s an ICO, a special online offer, a new online service, a survey to win a prize, or even just the good old lure of “free stuff”. Take your time to understand what you’re signing up for.

If in doubt, don’t give it out, and that definitely includes your money!

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/PJnGzgGV8k4/

Developers working on open-source ad-blocker uBlock Origin have uncovered a mechanism for tracking web browsers around the internet that defies today’s blocking techniques.

A method to block this so-called unblockable tracker has been developed by the team, though it only works in Firefox, leaving Chrome and possibly other browsers susceptible. This fix is now available to uBlock Origin users.

The tracker relies on DNS queries to get past browser defenses, so some form of domain-name look-up filtering could thwart this snooping. As far as netizens armed with just their browser and a regular old content-blocker plugin are concerned, this tracker can sneak by unnoticed. It can be potentially used by advertising and analytics networks to fingerprint netizens as they browse through the web, and silently build up profiles of their interests and keep count of pages they visit.

And, interestingly enough, it’s seemingly a result of an arms race between browser makers and ad-tech outfits as they battle over first and third-party cookies.

Ooh, la la

Here’s where it all began: in a GitHub issue earlier this month, a developer who goes by the name Aeris online, said that French newspaper website liberation.fr uses a tracker crafted by French marketing analytics outfit Eulerian “that seems to be unblockable.”

What makes it so is that the domain referenced appears to be a first-party page element – associated with the website publisher’s domain – rather than a third-party page element – associated with a domain other than the visited website.

In response to privacy concerns, companies like Apple and Mozilla have, over the past few years, introduced tracking protection mechanisms in their respective browsers, Safari and Firefox, and have begun blocking third-party cookies – set by third-party trackers – by default.

Many marketers, keen on maintaining their tracking and data collection capabilities, have turned to a technique called DNS delegation or DNS aliasing. It involves having a website publisher delegate a subdomain that the third-party analytics provider can use and aliasing it to an external server using a CNAME DNS record. The website and its external trackers thus seem to the browser to be coming from the same domain and are allowed to operate.

As Eulerian explains on its website, “The collection taking place under the name of the advertiser, and not under a third party, neither the ad blockers nor the browsers, interrupt the calls of tags.”

But wait, there’s more

Another marketing analytics biz, Wizaly, also advocates this technique to bypass Apple’s ITP 2.2 privacy protections.

As does Adobe, which explains on its website that one of the advantages of CNAME records for data collection is they “[allow] you to track visitors between a main landing domain and other domains in browsers that do not accept third-party cookies.”

In a conversation with The Register, Aeris said Criteo, an ad retargeting biz, appears to have deployed the technique to their customers recently, which suggests it will become more pervasive. Aeris added that DNS delegation clearly violates Europe’s GDPR, which “clearly states that ‘user-centric tracking’ requires consent, especially in the case of a third-party service usage.”

A recent statement from the Hamburg Commissioner for Data Protection and Freedom of Information in Germany notes that Google Analytics and similar services can only be used with consent.

“This exploit has been around for a long time, but is particularly useful now because if you can pretend to be a first-party cookie, then you avoid getting blocked by ad blockers, and the major browsers – Chrome, Safari, and Firefox,” said Augustine Fou, a cybersecurity and ad fraud researcher who advises companies about online marketing, in an email to The Register.

“This is an exploit, not an ‘oopsies,’ because it is a hidden and deliberate action to make a third-party cookie appear to be first-party to skirt privacy regulations and consumer choice. This is yet another example of the ‘badtech industrial complex’ protecting its river of gold.”

The Register asked Eulerian to comment but as yet no one has replied.

Mozilla says Firefox won’t defang ad blockers – unlike a certain ad-giant browser

READ MORE

Using DNS records to make a third-party domain appear to be first-party was documented previously in a 2014 paper by Lukasz Olejnik and Claude Castelluccia, researchers with Inria, a French research institute. The technique is also discussed in a 2010 academic research paper, “Cookie Blocking and Privacy: First Parties Reman a Risk,” by German Gomez, Julian Yalaju, Mario Garcia, and Chris Hoofnagle.

Two days ago, uBlock Origin developer Raymond Hill deployed a fix for Firefox users in uBlock Origin v1.24.1b0. Firefox supports an API to resolve the hostname of a DNS record, which can unmask CNAME shenanigans, thereby allowing developers to craft blocking behavior accordingly.

“uBO is now equipped to deal with third-party disguised as first-party as far as Firefox’s browser.dns allows it,” Hill wrote, adding that he assumes this can’t be fixed in Chrome at the moment because Chrome doesn’t have an equivalent DNS resolution API.

Aeris said, “For Chrome, there is no DNS API available, and so no easy way to detect this,” adding that Chrome under Manifest v3, a pending revision of Google’s extension platform, will break uBO. Hill, uBO’s creator, recently confirmed to The Register that’s still the case.

Even if Chrome were to implement a DNS resolution API, Google has made it clear it wants to maintain the ability to track people on the web and place cookies, for the sake of its ad business.

Apple’s answer to marketer angst over being denied analytic data by Safari has been to propose a privacy-preserving ad click attribution scheme that allows 64 different ad campaign identifiers – so marketers can see which worked.

Google’s alternative proposal, part of its “Privacy Sandbox” initiative, calls for an identifier field capable of storing 64 bits of data – considerably more than the integer 64.

As the Electronic Frontier Foundation has pointed out, this enables a range of numbers up to 18 quintillion, allowing advertisers to create unique IDs for every ad impression they serve, information that could then be associated with individual users. ®

Sponsored:
What next after Netezza?

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2019/11/21/ublock_origin_firefox_unblockable_tracker/

Not all managed security service providers are created equal. These questions can reveal whether you are hiring the right people to help secure your business.

The timing was right to ask Michael Wylie my question about what organizations should ask a of a managed security service provider (MSSP). 

“This topic resonates well with me because I was just on the phone with one of my clients who’s evaluating SIEM and MSSP options,” responds Wylie, director of cybersecurity services at Richey May Technology Solutions and a former Department of Defense contractor.

An important topic indeed, he says, because he’s observed more organizations retaining managed services for security. While many large organizations have their own dedicated security team, small and midsize businesses increasingly know that they need a security strategy but also can’t afford in-house infosec security staff. In fact, research from MarketsandMarkets finds the managed security services market is expected to grow rapidly at a rate of over 14% and reach $47.65 billion by 2023.

But the growth of the market, the dire need, and the scramble to find skilled talent, says Wylie, are leading to a fast track for workers that cuts corners on quality and experience.

“I’m seeing more and more MSSPs trying to deliver SOC-as-a-service using subpar talent,” he says. “Authoring an offensive and defensive security course for a local California college, I saw a similar trend. My students who took their first security course and passed an entry-level log management certification were being gobbled up by MSSPs to work in their SOC. Having a 19-year-old security analyst who doesn’t know the OSI Model won’t provide much value to an organization outsourcing security services.” 

So, how do you know your MSSP has experienced security pros working for you? What do business IT decision-makers need to ask to ensure they are getting a MSSP that can bolster their cyber defenses and is worth the cost?

Obviously, each business, and each industry, will have different needs in terms of technology and compliance mandates. Those are part of the nitty-gritty details you should get into when evaluating an MSSP. But here are some higher-level questions to ask as you wade through your options that can give you an idea of whether or not an MSSP is worth a closer look.

How much is this going to cost?

Ryan Weeks, CISO with Datto, a cybersecurity and data backup company, says its critical to find out what kind of technology investment a provider might require up front. He suggests asking:

Are you open to using our existing technology and security stack?

Weeks suggests this query because many providers will expect that you either buy new technology, add their technology, or introduce duplicate technology because their architecture requires it. Finding out before an engagement will minimize unpleasant surprises.

What is the long-term cost?

Humberto Gauna, an information security consultant at BTB Security, says this question is essential because “if you are spending capital dollars on equipment, you will need operational money to maintain it, and also to replace it later. Technology has a life cycle and should be considered in long-term planning.”

What is not included in the service?

“Businesses should absolutely understand what their requirements are and how the service provider is meeting those requirements,” says Gauna. “Too often, we see a new technology and service and it really doesn’t meet business requirements.” 

(continued on next page: “How do you keep my stuff secure?”)

 

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online. View Full Bio

Article source: https://www.darkreading.com/theedge/in-the-market-for-a-mssp-ask-these-questions-first-/b/d-id/1336433?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The Cybersecurity and Infrastructure Security Agency has partnered with VotingWorks on an open source tool to aid election result audits.

Arlo the auditing tool may play a key role in securing next year’s elections. The open source tool, created by VotingWorks in partnership with the Cybersecurity and Infrastructure Security Agency (CISA) and departments from a number of states, is intended to provide an easy way to perform the calculations needed for the audit: determine how many ballots to audit, randomly select which ballots will be audited, compare audited votes to tabulated votes, and tell officials when the audit is complete.

Arlo will be provided at no cost to state and local election officials across the country. It will also be made available at no cost to private-sector election contractors. Arlo is designed to work with many different post-election audit procedures that can be used on systems and equipment from all major election technology vendors.

The first version of Arlo has already been released to pilot projects, including several election audits from this month’s elections. Current partners include election officials in Pennsylvania, Michigan, Missouri, Virginia, Ohio, and Georgia, with more scheduled to be announced in the coming weeks. 

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “What’s in a WAF?“

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/government-agency-partners-on-new-tool-for-election-security/d/d-id/1336434?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The wide availability of tools leaked by the Shadow Brokers and WikiLeaks in 2016 and 2017 have given emerging cyber powers a way to catch up, DarkOwl says.

The public leaks of classified NSA and CIA hacking tools in 2016 and 2017 appear to have leveled the playing field for nation-state cybercriminals to some extent, new research shows.

Threat intelligence firm DarkOwl recently analyzed Dark Web data gathered from public and proprietary sources and found the leaked cyber weapons have strengthened the ability of emerging nation-state actors to attack rivals and project attribution to others.

The NSA and CIA data — released publicly by a group called the Shadow Brokers and WikiLeaks, respectively — included an NSA espionage and mass-surveillance system called UNITEDRAKE, a multiplatform CIA malware suite called HIVE, and numerous documents describing sophisticated false-flag and other cyber-offense tactics.

The leaked cyber weapons have given adversaries new ways to capture text, video, and images from target systems, including the Internet of Things (IoT) and smart TVs; attack smart vehicles; hide implants in Windows and other operating systems; and conduct a range of other surreptitious actions. Significantly, the leaks also made widely available capabilities that let attackers conceal the origins of an attack or to make it appear as if an attack originated from somewhere else entirely.

Details on the NSA and CIA tools and processes have been extensively studied on the Dark Web and are now part of the arsenal of everyone from nation-state actors to ordinary cybercriminals, DarkOwl says. “The wide dissemination of cyber weapons from the NSA and CIA has changed the international cyber battle space considerably,” says Andrew Lewman, vice president at DarkOwl. “Sophisticated, weapons-grade cyber tools are available on the Dark Web and [are creating] numerous challenges in determining who could be behind various cyber campaigns.”  

The US, Russia, and China continue to be cyber superpowers in terms of skills, influence, money, and manpower. But other less powerful nations have acquired formidable strength because of their access to these previously unattainable tools. “At this time, we do not have enough intelligence to support a statement on what country has benefited the most from the leaks of these tools,” Lewman says. But a generalized leveling of the playing field since the NSA and CIA leaks is clear, he notes.

In DarkOwl’s assessment, Israel, Germany, and the UK rank behind the top three nations in their cyber capabilities, followed by Ukraine, France, Iran, and India. But it is Iran and North Korea that present a major threat to US interests in cyberspace, especially given their ongoing cooperation and collaboration in military and technology development, Lewman says.

Cyber proxies, specifically as contracted by the Kingdom of Saudi Arabia, are another increasing concern because previously the Kingdom displayed little to no cyber capabilities. “Financial resources and international influence is of concern for them and their role in international conflicts,” Lewman says.

Leveraging the Dark Web
DarkOwl’s research shows that nation-state funded threat groups are leveraging the Dark Web in multiple ways. One of the most common is for infrastructure disruption campaigns targeted at networks containing sensitive government or corporate information. Many are using the cover of the Dark Web — and tools from the NSA and CIA leaks — to go after critical infrastructure targets, as well.

Attacks earlier this year involving the use of Triton malware against Triconex industrial-control systems are one example, Lewman says. Triton — a tool the NSA has previously used — is designed specifically to exploit weaknesses in industry control systems.

The Dark Web also has been a source of credentials and other information for state-backed threat groups seeking to break into the networks of governments they perceive as being hostile or being of geopolitical or military interest.

“For example, the Dark Web is replete with US *.gov email addresses that could be exploited for brute-force network intrusion or targeted phishing campaigns,” DarkOwl said. According to the vendor, there were over a half-million Dark Web pages with credentials that included a .gov address.

“Nation-state actors, cyber proxies, and terrorists will continue to use the Dark Web for operations, albeit not in as straightforward means as we’d assume,” Lewman says.

Related Content:

• Shadow Brokers Offers Database Of Windows Exploits For Sale
• ‘Entire Hacking Capacity Of CIA’ Dumped On Wikileaks, Site Claims
• Triton/Trisis Attack Was More Widespread Than Publicly Known
• What You Need to Know About Zero Trust Security 

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “What’s in a WAF?“

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/leaks-of-nsa-cia-tools-have-leveled-nation-state-cybercriminal-capabilities/d/d-id/1336438?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

On 18 November, somebody swapped out the legitimate command line wallet binaries for the Monero (XMR) cryptocurrency and replaced them with software that stole users’ funds.

The malicious versions of the Linux and Windows binaries were first spotted by a user on Monday who noticed that the software failed an integrity check.

Like a lot of software vendors, The Monero Project publishes SHA-256 hashes of its software. Users can check their software download by running it through a SHA-256 hashing function to see if it matches the published hash.

In this case, it didn’t.

The Monero team confirmed the swap on Tuesday, assuring users that the malicious wallet binaries were up for only a short time – 35 minutes, to be precise.

The malware-impregnated binaries were immediately dealt with, according to binaryFate – a member of the XMR core team who said on Tuesday that the binaries were now being served from a new, safe, “fallback” source.

A half hour was long enough to lead to at least one wallet getting drained, however: one user claimed on Reddit that 9 hours after they ran the binary, a single transaction scooped $7,000 worth of coins out of their wallet.

Whodunnit? Howdunnit? For how much?

As of Wednesday, there were a number of unanswered questions. It wasn’t clear how the attacker(s) pulled off the compromise of the Monero site, nor how many users were affected, nor the total value of cryptocoins that were stolen. There are several people investigating the incident, Monero said.

When the security researcher BartBlaze analyzed the malicious binary, they found that it it had a few new functions not in the official software, one of which sent data – namely, stolen funds – to command and control servers. That one was immediately called after a user either opened or created a new wallet.

…and that’s about all it did, BartBlaze found:

As far I can see, it doesn’t seem to create any additional files or folders – it simply steals your seed and attempts to exfiltrate funds from your wallet.

A seed is like a passcode or phrase that gives a user access to their wallet. Anybody who gets their hands on one can vacuum out a wallet.

Check your binary hashes

As of Tuesday, binaryFate was telling Monero users who’d downloaded binaries in the previous 24 hours to check the files’ integrity – immediately.

If the hashes do not match, do NOT run what you downloaded. If you have already run them, transfer the funds out of all wallets that you opened with the (probably malicious) executables immediately, using a safe version of the Monero wallet (the one online as we speak is safe – but check the hashes).

For instructions on how to verify binaries on Linux, Mac or Windows, Monero has this how-to.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/RONNkXPrxDs/

Android users beware: rogue apps could be using your phone’s camera against you, taking pictures and videos without your knowledge and sending them to attackers. They could even record your phone calls and make others aware of your location.

News of the vulnerability, which affects the Android camera app used by millions of Google Pixel and Samsung Android users, comes courtesy of application security testing company Checkmarx which has been working with Google and Samsung to fix it. The company’s researchers figured out a way to hijack the camera on Android phones using a permission bypass vulnerability.

Aware that access to camera functions is highly sensitive, Google created a special set of permissions that the user would have to grant to an application before it could use the phone’s camera. These permissions are:

• android.permission.CAMERA
• android.permission.RECORD_AUDIO
• android.permission.ACCESS_FINE_LOCATION
• android.permission.ACCESS_COARSE_LOCATION

The vulnerability that Checkmarx discovered enables apps to bypass the need for those permissions as long as they have storage permissions that enable an application to access the SD card. In a report on the vulnerability, the company explained:

An application that has access to storage not only has access to past photos and videos (which it already had, by permission design, nothing new there), but also has a way to access newly taken photos and videos by abusing the Google Camera app exported components.

This means an app with SD card permissions gets access to the user’s phone, which enables an attacker to turn the camera into a remotely-controlled sensor:

By manipulating the specific actions and intents, an attacker can now control the Google Camera app to take photos and/or record videos through a rogue application that has no permissions to do so.

Certain conditions on the phone could enable them to harvest more data still, the report continued. If the phone’s location data settings embedded location information in the photos’ EXIF metadata, they could access that data and find out where the photos were taken (and therefore where the user has been).

The attack can use the phone’s front or back camera, and can also operate in stealth mode while the lock screen is on.

The team tested out the vulnerabilities by creating their own weather app, which bypassed permissions so that it could take photos and videos. The software had two parts: a client residing on the phone communicated with a back-end command and control (C2) server that enabled the researchers to control its activities on the victim’s phone.

Using the app, the researchers not only took videos and photos with geolocation information but also recorded both sides of a phone conversation, all without the user’s knowledge. The company produced a video detailing the project and outlining some real-world attack scenarios:

Google assigned the vulnerability a ‘moderate’ rating after Checkmarx’s first report in July but subsequently raised it to ‘high’. Then, late that month it agreed with the researchers that the bug might affect other Android OEMs. Samsung confirmed that its phones were subject to the flaw in August.

Both of these vendors have fixed the problem in their own implementations of the Android camera app. Google rolled out the fix in July this year to the Google Play store. Updating your Android OS and camera app to the latest version is always advisable, as is auditing the applications you’re using to see what permissions you’ve given them, and asking whether you’re really ok with that dodgy flashlight or fart app with no reviews having full access to your SD card.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/q4VNRcGzd0I/