STE WILLIAMS

US President Donald Trump’s main campaign website was one of more than 100 domains found vulnerable to attack recently because its developers had apparently forgotten to disable the debug mode in a tool that was used to develop the site.

The issue with Trump’s site was addressed Wednesday after researchers from Comparitech informed the campaign about it. Had the security weakness been left open, attackers would have had – among other things— an opportunity to hijack the site’s email server and send out messages on behalf of email.donaldtrump.com, Comparitech said.

According to the vendor, it is not clear when the debug mode was enabled on the Trump website. But the potential consequences of even a short exposure would have been severe. “Trump’s campaign website is used to solicit donations, after all,” the vendor noted. “Attackers could have intercepted correspondence with Trump supporters or phish campaign contributors, among other crimes.”

The problem on Trump’s site and on hundreds of others has to do with their use of a popular PHP framework called Laravel.

Laravel includes a suite of tools that can be used to build, test, and deploy Web applications, says Paul Bischoff, lead researcher at Comparitech. Many people use it to speed up the website development process. “Laravel is one of, if not the, most popular PHP frameworks,” Bischoff says.

Laravel, like other frameworks, incorporates a debug mode that developers can use to identity misconfigurations and other errors on their sites before they go live. Developers can access the debug interface via a standard Web browser.

Problems can arise when developers inadvertently leave the debug mode enabled after the site has gone live. This can expose critical site details, including passwords, encryption keys, API credentials, and database locations.

Adversaries can use the data to develop further attacks on the site or to steal data from it, Comparitech said. By leaving the Laravel debug mode enabled on the Trump site, for instance, developers exposed in plain text a mail server configuration that was visible from any browser though the debug interface.

Anyone could have accessed it from a Web browser by going to a special subdomain. “It’s a subdomain that the average user might not come across,” Bischoff says. “But it was visible on search engines like Shodan that can scan for such vulnerabilities. It was easy for hackers to find.”

The issue is not confined to Laravel, and neither is it the software vendor’s fault. Developers often leave websites vulnerable by inadvertently failing to disable the tools they use for identifying problems when building it. The key takeaway for organizations is to “disable debug mode before going live,” Bischoff says.

Comparitech, working with two independent security researchers, conducted an Internetwide search and found a total of 768 websites with active Laravel sessions. Of them, between 10% and 20% had exposed their debug APIs, making them vulnerable to attack. A similar effort by one of the security researchers last year unearthed 566 websites with the Laravel debug mode enabled.

Bischoff says Comparitech, which scans the Web for misconfigured websites and vulnerable databases, is still in the process of notifying all impacted websites discovered from its latest scan of the issue. Presently, it remains unclear how many might have addressed the problem, he says.

With the exception of the Trump campaign site, most of the vulnerable websites that Comparitech discovered in its latest scan were small businesses and charities.

Related Content:

• Typosquatting Websites Proliferate in Run-up to US Elections
• New Attacks Target Recent PHP Framework Vulnerability
• Security Training That Keeps Up with Modern Development
• 7 Steps to Web App Security

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/application-security/debug-feature-in-web-dev-tool-exposed-trump-campaign-site-others-to-attack/d/d-id/1336116?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Som old Amazon devices contain an even older Wi-Fi vulnerability that can be exploited in man-in-the-middle attacks.

The vuln – KRACK, or Key Reinstallation Attack – is a flaw in the four-way WPA2 handshake that begins the protected transaction. The vulnerability  leaves the wireless traffic encrypted, but routed through a malicious middle actor that decrypts the data, stores it for use, and then re-encrypts the stream and sends it on its way.

The ESET Smart Home Research Team discovered that first-generation Amazon Echo devices remain subject to the vulnerability, designated CVE-2017-13077, as do Kindle 8th generation e-book readers.

Amazon has issued and distributed a new version of the wpa_supplicant — the vulnerable part of the operating environment. Both Amazon and the researchers strongly suggest that all users make sure that the patch has been applied to their devices.

For more, read here.

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/older-amazon-devices-subject-to-old-wi-fi-vulnerability/d/d-id/1336120?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The news last month that Google agreed to pay $170 million to settle alleged privacy violations related to YouTube and children and an October 7 Federal Trade Commission review of Children’s Online Privacy Protection Act (COPPA) are bringing a critical focus on protecting minors, who can’t take action or understand the concept of privacy enough to protect their data. 

The COPPA review, which is coming several years ahead of schedule, aims to bring US privacy regulations up to speed with the latest technologies and trends, including growing numbers of minors using online services and being targeted with ads. It’s a clear acknowledgement that traditional legislative and regulatory standards and processes are failing to keep up with the rapidly evolving digital landscape. Not only have online services changed greatly since COPPA was last revised in 2013, but the nature of data has changed, as have notions about what constitutes “personal information.” There are more data sources and types of information being collected from everyone, particularly children. And the uses of data today have increased beyond what we could have imagined six years ago. All of this means companies need to rethink the nature of their role; they are data stewards, responsible for securing and caring for their customers’ information, and not owners of the data. This is a crucial distinction. 

COPPA critics who dismiss the regulations as onerous for business are overlooking an important duty of online providers — that of protecting children who can’t provide legal consent for data use. Society has a responsibility to its most vulnerable group of online citizens. The California Consumer Privacy Act (CCPA) has an opt-in standard for the sale of data belonging to minors, requiring websites to explicitly get permission from parents of children under 13 and from teenagers themselves up to age 16. This will become the norm going forward. To comply with both COPPA and CCPA, online providers will need to ask users to confirm that they are 16 or older. This won’t solve all the privacy issues for minors, but it’s a step in the right direction. With COPPA, the conversation about data privacy gets right to the heart of the matter: why and how things need to change.

So, knowing that changes in COPPA will be coming in the near future, and given the requirements of CCPA and the General Data Protection Regulation (GDPR), what steps can companies take? At the highest level, companies need to be prepared to embrace consumer data privacy both culturally and technologically — and do so in a way that allows their organization to evolve alongside technology and regulatory changes. There are three keys to making this vision a reality:

Step 1: Make Data Privacy Part of Corporate DNA
Embracing consumer data privacy starts with culture change, and it must come from the top. This means aligning the company’s culture and values with the privacy program and reinforcing this in internal and external messaging, product design choices and engineering. From the board of directors and the CEO, to the chief information security officer and chief privacy officer and on down, everyone needs to be committed to making data privacy a business priority. Companies should integrate the data privacy program into the code of conduct and existing business processes; conduct regular privacy trainings with employees; add risk management assessment to new business, mergers, and other business arrangements; and regularly assess the efficacy and performance of data privacy processes and practices throughout the organization.

Step 2: Create the Competency to Become (and Stay) Compliant
Don’t wait for regulators to come knocking. The sooner you get ahead of data compliance, the more readily you can adapt to changes in the regulatory environment. First, you need systems in place to help you understand what data you have and where it’s stored. Ask important questions such as: Should we be collecting it? Is it properly secured? Who is it being shared with? Companies need to understand identity based on whose data they have, where it resides, and how it is used. Companies can’t just rely on manually doing surveys of their data and filling in spreadsheets for privacy assessments.

Because GDPR, CCPA, and other regulations are predicated on the notion of user consent, the inability of children to provide consent underscores one of the key challenges — the need to locate both PI (personal information) and PII (personally identifiable information). Most children don’t have credit cards or even email addresses that can be linked with their identity, but their online activities generate lots of personal data that can be indirectly tied back to their identities. GDPR and CCPA require businesses to be able to know what PII and PI they collect, where it is, and how it’s being used. This data is typically scattered around different applications and in both structured and unstructured formats in the data center and the cloud. Companies must be able to discover and manage all of it.

Step 3: Be Good Data Stewards
For too long, companies have made use of and built businesses around customer data without acknowledging that they are merely guardians of the data, not owners. In a post-Cambridge Analytica and post-GDPR world, companies can’t be careless with data. They need to be transparent about what information they are collecting and recognize customer rights to control how their data is used. This shift is vital for businesses to keep customers happy.

Protecting data privacy isn’t just about being compliant, it’s also smart business. Consumers are increasingly attentive to how companies treat their data and upset when companies show a disregard for data privacy. A survey late last year of US consumers found that nearly 40% were cutting back on social media use due to privacy concerns and 80% or more want to know where the data is and would like a say in whether their data is sold or shared.

Companies that don’t prioritize their responsibilities related to data ownership and care — particularly regarding children’s data — will lose customer trust and harm their brand, as well as face fines and other penalties that will no doubt come with a revised COPPA. Companies that respect the privacy of individuals and especially minors and view data privacy as a fundamental business objective and not just an obligation will have a strong competitive advantage. 

Related Content:

• 6 Actions That Made GDPR Real in 2019
• ‘Phoning Home’: Your Latest Data Exfiltration Headache
• Privacy 2019: We’re Not Ready

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “How to Build a Rock Solid Culture“

Dimitri Sirota is a 10+ year privacy expert and identity veteran. He is CEO and cofounder of data protection and privacy software company BigID. Prior to starting BigID, Dimitri founded two enterprise software companies focused on security (eTunnels) and API management (Layer … View Full Bio

Article source: https://www.darkreading.com/endpoint/data-privacy-protections-for-the-most-vulnerable---children-/a/d-id/1336062?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Following its compromise of the network and servers of the Democratic National Committee (DNC) in 2016, the Russia-linked espionage group Cozy Bear, also known as APT29 and the Dukes, has focused on staying off the radar of intelligence services and security companies.

Yet the group has remained active, using covert communications — such as hiding information and commands in images, a technique known as steganography — to remain largely undetected. According to a report published today by security firm ESET, the group has compromised three European ministries of foreign affairs and the Washington, DC, embassy of an EU member. The report suggests that even after Cozy Bear was in the spotlight following the DNC breach, it recovered and rebuilt most of its tools and operations.

“Even if the group has managed to avoid public scrutiny for several years, they actually were very active compromising high-value targets and developing new tools,” says Matthieu Faou, a malware researcher with ESET. “They have been operational for around 10 years, starting around 2008 [or] 2009. Since then, they have been active almost all the time.”

As the United States starts another election cycle, this one promising to be even more chaotic than the last, signs of cyberattacks have garnered increasing attention. Cozy Bear has typically targeted Western countries or nations that had been part of the former USSR.

“Besides governments, the group also has targeted various organizations linked to NATO, think tanks, and political parties,” ESET stated in the report. “This targeting suggests a clear interest in collecting information allowing a better understanding of future international political decisions, which would seem of most interest to a government.”

The ESET report is not the only research to attribute attacks to the group. In 2018, security and incident-response firm FireEye linked phishing attacks purporting to be from the US Department of State to APT29 — its monicker for the Cozy Bear group. The attacks attempted to compromise systems in the government, defense, pharmaceutical, and transportation sectors, the company said at the time.

The connection to Cozy Bear, however, was circumstantial. The attackers used some tools and techniques that were hallmarks of the Cozy Bear group but could have been co-opted by another attacker as part of a “false flag” operation. In the current investigation, the group tracked by ESET used a spear-phishing campaign to kick off the attacks — a technique linked to Cozy Bear.

This time around, Cozy Bear — which ESET refers to as The Dukes — has used a variety of covert and public channels for communication in an attempt to escape detection. 

The group has used Twitter, Imgur, and Reddit as a primary way to issue commands to systems immediately after compromise. Cozy Bear generates new Twitter handles using an algorithm generator, from which compromised machines will fetch encrypted URLs.

The group also has used public cloud services, such as OneDrive, to hide communications in legitimate services. Often, the group hides data inside of images, which is very hard to detect, says ESET’s Faou.

“[Steganography] is quite complex to implement, so it is not that common,” he says. “It’s hard to detect because even after the image is altered to contain commands or payloads, it is still valid. So by looking at the network traffic only, it is hard to detect that something suspicious is ongoing.”

In addition, the group is using three new malware families in its current operations, dubbed by ESET as PolyglotDuke, RegDuke, and FatDuke. ESET also discovered a fourth malware sample, LiteDuke, used in older campaigns that had not previously been described.

PolyglotDuke uses Twitter and other websites to fetch the address of the command-and-control server. RegDuke establishes persistance by hiding in the registry and using Dropbox to reconstitute a connection back to an attacker-controlled server. FatDuke is a client that is installed after the MiniDuke backdoor, offers a great deal of functionality, and uses obfuscation to make its code difficult to decipher.

The previously known MiniDuke is a backdoor that gets installed after the initial infection and allows the attacker to issue commands to the infected system. In the past, LiteDuke was used to further compromise systems after MiniDuke, but it is seems to be outdated, ESET stated.  

The group also widely uses credentials to move throughout a network, compromising additional systems and reinfecting systems while a company is still responding to an incident.

“When responding to a Dukes compromise, it is important to make sure to remove every implant in a short period of time,” ESET stated in the report. “Otherwise, the attackers will use any remaining implant to compromise the cleaned systems again.”

While ESET based its attribution on an accumulation of evidence, the company also stressed that it comes with a caveat and that the company does not link attacks to specific actors.

“We cannot discount the possibility of a false flag operation,” the company stated in the report. “However, this campaign started while only a small portion of the Dukes’ arsenal was known. In 2013, at the first known compilation date of PolyglotDuke, only MiniDuke had been documented and threat analysts were not yet aware of the importance of this threat actor.”

Related Content

• Russia Chooses Resiliency Over Efficiency in Cyber Ops
• Russia Linked Group Resurfaces With Large-Scale Phishing Campaign
• FBI, DHS Report Implicates Cozy Bear, Fancy Bear In Election-Related Hacks
• Russian Cyber Espionage Under The Microscope
• CosmicDuke: Cosmu MiniDuke Mash-Up

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “How to Build a Rock-Solid Cybersecurity Culture.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/cozy-bear-emerges-from-hibernation-to-hack-eu-ministries/d/d-id/1336111?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Yahoo account holders who were among the 3 billion affected in a series of data breaches between 2013 and 2016 could qualify for a cash payout or two years of free credit monitoring.

The settlement is still awaiting approval by the California courts, CNN reports, and the process could take more than a year. If it is approved, Yahoo may divide more than $117.5 million among people whose information (names, email addresses, and passwords) was compromised.

Members of the settlement class had a Yahoo account between Jan. 1, 2012, and Dec. 31, 2016, received a notice about the security incidents, and are residents of the United States or Israel.

Those who qualify may submit claims to yahoobreachsettlement.com and file for a $100 payout if they can prove they use a credit monitoring service that will protect them for at least a year. The final amount may be more – up to $358 – depending on how many people submit claims, though it’s expected the payout will be less given the total amount of people affected.

Read more details here.

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/yahoo-breach-victims-may-qualify-for-$358-payout/d/d-id/1336113?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple