STE WILLIAMS

We’re in an arms race with cybercriminals. Adversaries are becoming stealthier and more dangerous, constantly improving their attack techniques to evade the best security defenses. From malicious mobile apps to exploited cloud misconfigurations and devastating Remote Desktop Protocol (RDP) exploits, there’s no shortage of threats we need to protect against. 

As security practitioners, it’s our mission not only to build the new tools needed to arrest and detect threats effectively, but to help make sense of the wide-ranging nature of what constitutes security. That starts with threat awareness. After all, you can’t defend against what you don’t understand.

Here are some of the major threat landscape changes we’ve seen in the last year and will continue to see this year and beyond.

Evading Security Controls with Automated, Active Attacks
Automated, active attacks are on the rise. These types of attacks involve a mix of automation and human-directed hacking to evade security controls.

Attackers in the recent Snatch ransomware attacks, for example, gained access by abusing remote access services, like RDP, and then used hand-to-keyboard hacking to complete the attack. Recently, attackers have upped the ante by exfiltrating data before beginning encryption and rebooting machines into Safe Mode during the attack in order to circumvent endpoint protection. These changing attack methods are part of the growing trend of defense evasion and highlight the need for protection at every layer of the environment.

On the detection side, the problem is that it’s challenging to determine what’s a malicious versus legitimate use of those tools. This method has been used successfully by the criminals behind the SamSam and MegaCortex ransomware attacks.

Raising the Stakes with Ransomware
Ransomware creators know that if they can’t get past detection systems, their operation has little chance of success. Therefore, they’re putting a lot of effort into figuring out ways to evade detection systems altogether. One of the most effective methods is changing their appearance — often by obfuscating their code — to disguise their true intent.

For example, attackers may digitally code-sign ransomware with an Authenticode certificate. Anti-ransomware defenses give code with signatures a less thorough examination, and some endpoint security products may even choose to trust it.

At the same time, attackers exploit vulnerabilities to elevate their privileges to an administrative credential. This way, their privileges will meet or exceed the access permissions necessary to ensure that encrypting files will be successful.

Scamming Through Stealthy, Malicious Apps
Smartphones, tablets, and other mobile devices are rich environments for attacks. Not only can attackers steal user information and cash or cryptocurrency, but they can also use mobile devices to gain access to corporate resources.

Fraudulent banking apps, referred to as bankers, continue to plague users by stealing credentials for financial institutions. Downloaders — apps that appear to be finance-related but are really downloading banker payloads in the background — are increasingly common. Some bankers even steal credentials by abusing accessibility features to virtually monitor keystrokes when a user logs in to legitimate banking apps.

Unscrupulous developers are also finding success exploiting the legitimate in-app advertising model found on mobile devices, creating apps whose sole purpose is to maximize ad revenue. The most nefarious types of adware, known as Hiddad, hide themselves from the app tray and launcher, so they’re impossible to find and remove. Hiddad malware often takes the form of a legitimate app, like a QR code reader, but makes money through aggressive advertising.

Fleeceware is another example of how developers take advantage of legal models to scam unwitting consumers. These apps vastly overcharge users for app functionality that’s already available for free or at low cost, often relying on free trials that are nearly impossible to cancel to lure users into paying $275 for a simple calculator app. It’s an ongoing, widespread issue, with researchers recently uncovering 20 new fleeceware applications that may have nearly 600 million downloads.

Exploiting Misconfiguration in the Cloud
The strengths that make cloud such a valuable platform for computing and business operations — flexibility, speed and ease of use — are also what makes it challenging to secure. With changes happening at the rapid pace of cloud, operator error is a growing risk. All it takes is one misstep in configuration to expose the entire customer database to attack.

Attackers are taking note. Most cloud-based security incidents are a result of misconfiguration of some kind. Attackers know that companies struggle with a general lack of visibility into their cloud environments, so they can sneak in and carry out an attack before anyone notices. That’s why they’ve seen success with Magecart malware, which infected retailers’ “shopping cart” pages without their knowledge to steal customer information from businesses like Ticketmaster and Cathay Pacific.

As more and more companies turn to the cloud for backups, these attacks are becoming increasingly common. Businesses need visibility into the consequences of configuration changes, as well as the ability to monitor for malicious and suspicious activity in the cloud.

Abusing Machine Learning
Attacks against machine learning security systems are moving from an academic possibility into the toolkits of attackers. Machine learning systems have their own weaknesses, and it’s only a matter of time before attackers figure out how to evade them. Research shows how attackers could trick models, highlighting the need for multiple layers of protection.

With machine learning becoming as a regular part of defense, we’re also seeing the first signs of using machine learning models on offense. Imagine using text-to-speech machine learning models to evade security measures like voice authentication. Such technology, like the technology underlying “deepfakes,” has already allegedly been used in a CEO vishing (voice phishing) scam. In the future, attackers might also use machine learning to optimize attacks, like phishing email click-through rates.

The Road Ahead
As we look ahead, one thing seems certain: Attackers are only getting more devious and lethal. We expect to see more advanced attacks, like the weaponization of machine learning. In the meantime, awareness of existing threats gives companies the information they need to design effective protection.

Related Content:

• How Enterprises Are Developing and Maintaining Secure Applications
• 8 Things Users Do That Make Security Pros Miserable
• 7 Tips to Improve Your Employees’ Mobile Security
• Users Have Risky Security Habits, but Security Pros Aren’t Much Better

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “The Perfect Travel Security Policy for a Globe-Trotting Laptop.”

Dan Schiappa is Executive Vice President and Chief Product Officer with Sophos. In this role, Dan is responsible for the overall strategy, product management, architecture, research and development, and product quality for the network security, enduser security, and Sophos … View Full Bio

Article source: https://www.darkreading.com/cloud/threat-awareness-a-critical-first-step-in-detecting-adversaries/a/d-id/1337155?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

(Image: Adam121 – stock.adobe.com)

As organizations transition to cloud environments, so too do the cybercriminals targeting them. Learning the latest attack techniques can help businesses better prepare for future threats.

“Any time you see technological change, I think you certainly see attackers flood to either attack that technological change or ride the wave of change,” said Anthony Bettini, CTO of WhiteHat Security, in a panel at last week’s RSA Conference. It can be overwhelming for security teams when organizations rush headfirst into the cloud without consulting them, putting data and processes at risk.

Attackers are always looking for new ways to leverage the cloud. Consider the recently discovered “Cloud Snooper” attack, which uses a rootkit to bring malicious traffic through a victim’s Amazon Web Services environment and on-prem firewalls before dropping a remote access Trojan onto cloud-based servers. As these continue to pop up, many criminals rely on tried-and-true methods, like brute-forcing credentials or accessing data stored in a misconfigured S3 bucket. There’s a lot to keep up with, security pros say.

“When you’re taking your existing security skills and you’re moving into an entirely different environment, then it’s an incredible challenge to figure out what you really need to focus on, as well as what’s going on out there in the real word,” said Rich Mogull, analyst with Securosis and CISO of DisruptOps, in an RSA Conference talk about attack kill chains in the cloud.

Here we discuss some of these common kill chains, as well as other cloud attack techniques, that are top-of-mind for security pros and cybercriminals alike. Anything you’re worried about that we didn’t list here? Feel free to share your thoughts in the Comments section, below.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/cloud/7-cloud-attack-techniques-you-should-worry-about/d/d-id/1337259?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Researchers have discovered a new ransomware variant that they say has significantly different behavior and characteristics than most other ransomware types.

The ransomware, called PwndLocker, was found by The Crypsis Group in February during a client engagement. Subsequent analysis showed it was developed entirely as shellcode—something that malware authors have traditionally reserved for more specialized purposes.

The malware also implemented a custom encryption algorithm that the researchers discovered was potentially breakable, and in fact has already been broken. However, according to Crypsis, the malware authors can easily swap out the existing encryption algorithm with a stronger one at any time.

Matt Thaxton, senior consultant with The Crypsis Group, says PwndLocker’s use of shellcode – or location-independent code – makes it a more complex and harder-to-spot ransomware variant than others. “The reason these types of code are harder for automated tools to spot is because they usually don’t reside on disk and because they are often injected into other legitimate processes such as native, signed Windows-processes,” he says.

Shellcode can sometimes be classified as fileless malware. But in the case of PwndLocker, it wouldn’t be classified as fileless because it loads from a fake avi file, Thaxton noted.

Many exploits use shellcode to force vulnerable legitimate processes to use or to run illegitimate code. But typically malware authors have used shellcode only in secondary malware downloaders and sophisticated implants because of how complex and time-consuming it can be to create and implement such code. This is the first time, however, that ransomware has been developed using shellcode, Thaxton says.

“I’m not sure why this threat actor decided to write their ransomware in this way,” he says. “My only guess would be that they wanted it to be very unique so that it is harder to spot through the usual [methods].” Also, it is possible that the malware authors wanted to be distinctive simply for the sake of differentiating from other variants.

Another noteworthy feature with PwndLocker is its use of a relatively weak custom-developed encryption algorithm rather than the more robust Windows crypto API, Thaxton notes. There’s no real reason why they couldn’t have just used the API like almost every other ransomware in the wild currently does, he says. “There may have been a reason for creating it this way that is yet to be determined. But at this point, it’s not clear,” Thaxton says.

In an alert Friday, security vendor Emsisoft said it has developed a way to decrypt files that PwndLocker might have encrypted. However, each decryptor requires customization before use. That means that victims of PwndLocker who want their files decrypted will need to send the ransomware executable that was used in the particular attack, Emsisoft said. “While the ransomware automatically deletes the executable, it is often possible to recover it using file recovery tools,” the vendor said.

According to Emsisoft, PwndLocker has been observed mainly targeting business and government organizations and demanding ransom of more than $500,000. The malware has numerous variants, all of which are designed to delete shadow copies of data, which makes recovery harder.

“There is always going to be a mix of old and new ransomware variants as threat actors work to gain fast cash or put their unique stamp on an evolving threat landscape,” Thaxton says. “Enterprises can’t ‘guess’ what is going to come next.”

The best approach is to adhere to best practices across the enterprise, and pay attention to end-user training within the security program, he says.

Related Content:

• Ransomware Situation Goes From Bad to Worse
• Ransomware Damage Hit $11.5B in 2019
• 8 Head-Turning Ransomware Attacks to Hit City Governments
• 5 Security Resolutions to Prevent a Ransomware Attack in 2020

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “The Perfect Travel Security Policy for a Globe-Trotting Laptop.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/new-ransomware-variant-developed-entirely-as-shellcode/d/d-id/1337260?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The security of our elections is top of mind for practically every voter in the US. With the state primaries underway, all eyes are on our electronic (and in some cases mobile) voting systems to understand if malicious attacks are happening — and if our systems are able to defend against them. Most experts agree that we are unprepared and underfunded when it comes to securing our elections — which should concern us all.

A big problem is that when we look at the entire ecosystem of the national election process, we don’t treat it the same way we treat business systems. This is a mistake. Voting is a business of our state governments. And the most valuable asset for states is voter information — similar to the customer information and data assets of a for-profit business (which are increasingly safeguarded by data privacy regulations). To modernize our current model of election management, trust, and security, it’s important to examine three interrelated pillars for state governments: technology, people, and attitudes.

1. Technology: Making Cybersecurity More Proactive
To address the growing security threats that many players in the broader election system ecosystem face, proactive cybersecurity technology and policy must take center stage in three important ways:

Cybersecurity hygiene of individual companies and agencies
Greater transparency and data-driven assessments of election system hardware and software providers should be mandated in order to measure each company’s cybersecurity hygiene against an established baseline. In addition, there needs to be increased monitoring of the deployment and implementation of technology in state and local election systems to ensure that misconfigurations aren’t creating additional vulnerabilities.

A “layered defense” approach to cybersecurity
Given the complicated, interdependent nature of government systems and databases, security measures should be established to minimize the likelihood of an attack — particularly from internal staff. For example, an ill-intentioned employee could access and hack a state voter registration database through a vulnerability in the Department of Motor Vehicles network. Implementation of a layered defense approach and incorporating a “least privileged principle” that limits an individual’s access to only very specific parts of a network or election system makes internal access more difficult and successful hacking more unlikely.

Ongoing validation of effectiveness of security controls
As is true in the business world, any government agency or organization playing a role in the election ecosystem cannot afford to assume that established security technology and protocols always work as they’re supposed to. With such a complex array of interrelated software elements from multiple vendors, each with different settings and procedures, and with continually changing network and access protocols, ongoing changes in the IT environment – what I call “environmental drift” — can negatively affect security performance. When left unchecked, there is tremendous risk that security controls will not provide the necessary defenses when an attack occurs. Frequent and regular evaluations to validate the effectiveness of security controls should be a key component of the overall process.

2. People: New Roles and Relationships for the state CIO and CISO
Typically, the role of chief elections officer is filled by the secretary of state, who oversees testing and certifying all voting equipment for security, accuracy, reliability, and accessibility. States also have a CIO and a CISO, but they don’t currently have a formal direct working relationship with the secretary of state or state elections commissions. I believe that they should — especially now, with the prominence of e-voting. State CIOs and CISOs can be of tremendous value to the secretary of state and election commissions in helping them understand the evolving cybersecurity threat landscape, while tracking its potential threat impact on a daily basis.

Governors should also have cyber-protection teams that know how to scan the environment for the bad guys and look for flaws, before an attack occurs. The right place for this cybersecurity resource to exist and collaborate with the state CIO and CISO would be in “Fusion Centers” set up to deal with any kind of emergency, regardless of origin. I have seen this work already underway in Michigan, Virginia, Rhode Island, and Louisiana, and believe other states should follow their lead.

3. Attitudes: Moving from Naivete to Thoughtful Experimentation
There are several attitude challenges that we face today. While most state and local governments understand that threats are out there and vulnerabilities exist, they don’t understand their nature or magnitude, or how best to address them. At the local level, there is often a perception that individual precincts are too small to be viable targets. In a democracy where every vote must count, a broader mindset is required. And when security technology is brought in as the solution, there is too often an overreliance placed on it and a false assumption that it’s working as it’s supposed to in order to protect election integrity. When cyber hygiene is one of the top priorities in business organizations today, why should state/local election systems be different?

There are forward-looking states experimenting with electronic and mobile voting to reflect current technology and cultural change — with a dual purpose of deterring voter fraud and boosting voter turnout. Initiatives and experiments to enable people to vote by mobile phone — anywhere, anytime — require deep attention to proactive cybersecurity and digital identity. In the 2018 midterm elections, West Virginia became the first state to introduce purely online voting for overseas military voters with a mobile app that used blockchain technology, with identity authentication through a fingerprint or facial recognition. With the security concerns inherent to this kind of experiment, more research should be done and trials conducted to make mobile voting a more viable way for people to vote. 

From Ideas to Action
To increase trust, accountability, and security around our election process and systems, it will take a combined and concerted effort from many different parties — on both the state and local government side as well as from the technology community. State governments and election officials should take the lead, but others involved in the process share an equal responsibility — from the federal government and technology companies in both the election systems and cybersecurity spaces, all the way down to individual citizens. Only when we all come together can we ensure that every vote counts.

Related Content:

• Don’t Let Iowa Bring Our Elections Back to the Stone Age
• 5 Measures to Harden Election Technology
• Forget Hacks… Ransomware, Phishing Are Election Year’s Real Threats
• How Enterprises Are Attacking the Cybersecurity Problem

Major General Earl Matthews, USAF (Ret.), is an award-winning retired Major General of the U.S. Air Force with a successful career influencing the development and application of cybersecurity and information management technology. His strengths include his ability to lead … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/securing-our-elections-requires-change-in-technology-people-and-attitudes/a/d-id/1337200?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Most Intel processors produced in the past five years have a vulnerability in the component of the chip responsible for securely executing security services, threatening the system’s so-called root of trust, warns Positive Technologies.

Intel fixed the vulnerability in the Intel Converged Security and Management Engine (CSME) in May 2019 and updated its guidance in February, but it has not released enough details for companies to assess their risk, says Mark Ermolov, lead specialist of operating system and hardware security at Positive Technologies. The security firm has produced a proof-of-concept attack for the flaw but will not release it yet, he says.

“The worst-case scenario is that a hacker gains access to the chipset key, which would enable him to access all information stored on the computer, encrypted or otherwise, and even run a keylogger on Intel CSME to track everything a victim types into the affected computer,” Ermolov says. “Exploitation is difficult but possible. Most importantly, now, in order to get the root key, you do not need multimillion-dollar equipment or much time. Using this vulnerability, a qualified specialist can get the master key in just a few hours using only software tools and then do whatever he wants with this system.”

The severity of the vulnerability remains to be seen. Because the CSME is the root of critical security functions on the system — handling encryption and secure boot — a compromised system, and the information on that system, can no longer be trusted.

On unpatched systems, an attacker who already compromised the operating system could exploit the issue, assigned CVE-2019-0090, in the Intel CSME to undermine the system’s fundamental security. For patched system, only physical access will allow such a compromise. Yet the vulnerability itself cannot be patched because it’s in the hardware and part of the chip’s architecture, says Ermolov, who considers the issue worse than the speculative execution flaws Spectre and Meltdown.

“Since this is a hardware vulnerability, the situation cannot be fixed with updates,” he says. “Intel has issued a mitigation, which greatly complicates the attack but does not make it impossible.”

Intel considered the flaw to be critical but, with patching, not a risk for companies. Intel acknowledged the issue, but highlighted the fact that patched systems that are not run in Intel Manufacturing Mode — an undocumented execution mode meant for manufacturers to test their systems — can only be attacked at the keyboard. 

“Intel recommends that end users adopt best security practices by installing updates as soon as they become available and being continually vigilant to detect and prevent intrusions and exploitations,” the company said in a statment sent to Dark Reading. “End users should maintain physical possession of their platform.”

Security researchers have heavily scrutinized Intel’s CSME because compromising the hardware allows the security of a system to be undermined at a fundamental level. Two years ago, a collection of researchers published two attacks, Meltdown and Spectre, that took advantage of the speculative execution of Intel processors to allow attackers to gain access to any information flowing through the hardware. Since then, at least six other similar flaws have been found.

In reaction to the vulnerabilities, Intel has committed to putting security first and has recently published an analysis of all the 236 vulnerabilities reported in 2019. Two Intel security experts also discussed the companies approach to securing the CSME during a talk at the 2019 Black Hat Security Conference.

Postive Technologies has focused on Intel’s Management Engine and, now, Intel’s Converged Security and Management Engine. In 2017, the company found a stack overflow bug in the Intel ME that could be used by insiders and supply chain attackers to gain and retain total control of a system. 

With the latest vulnerability, Positive Technologies researchers focused on the input-output memory management unit (IOMMU), finding that the boot order of the devices allowed external drivers to gain control of execution too early to ensure secure booting. 

“Researchers found that there is a very big bug: The IOMMU is activated too late after x86 paging structures were created and initialized,” Ermolov says. “Only Intel can mitigate all of known exploitations vectors by blocking all integrated devices that are known to have DMA [direct memory access] capabilities [to the CSME].” 

Positive Technologies found it could exploit the issue through the Integrated Sensors Hub. Intel’s patch has closed that vector, eliminating any current way of exploiting the bug using local code execution — that is, after an attacker has already compromised the system.

“Intel blocked ISH [Integrated Sensors Hub], so now it can’t issue DMA transactions to the CSME,” Ermolov says. “But we’re convinced there other exploitation vectors, and they will be found soon.”

Related Content:

• Intel Analyzes Vulns Reported in its Products Last Year
• Intel Previews Newest ‘Zombieload’ Patch
• Intel’s CPU Flaws Continue to Create Problems for the Tech Community 
• New Intel Vulnerabilities Bring Fresh CPU Attack Dangers 
• How the Major Intel ME Firmware Flaw Lets Attackers Get ‘God Mode’ on a Machine

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Perfect Travel Security Policy for a Globe-Trotting Laptop.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/physical-flaws-intels-root-of-trust-issue-mostly-mitigated/d/d-id/1337254?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple