STE WILLIAMS

While we’re all distracted by stockpiling latex gloves and toilet paper, there’s a bill tiptoeing through the US Congress that could inflict the backdoor virus that law enforcement agencies have been trying to inflict on encryption for years.

At least, that’s the interpretation of digital rights advocates who say that the proposed EARN IT Act could harm free speech and data security.

Sophos is in that camp. For years, Naked Security and Sophos have said #nobackdoors, agreeing with the Information Technology Industry Council that “Weakening security with the aim of advancing security simply does not make sense.”

The first public hearing on the proposed legislation took place on Wednesday. You can view the 2+ hours of testimony here.

Called the Eliminating Abusive and Rampant Neglect of Interactive Technologies Act (EARN IT Act), the bill would require tech companies to meet safety requirements for children online before obtaining immunity from lawsuits. You can read the discussion draft here.

To kill that immunity, the bill would undercut Section 230 of the Communications Decency Act (CDA) from certain apps and companies so that they could be held responsible for user-uploaded content. Section 230, considered the most important law protecting free speech online, states that websites aren’t liable for user-submitted content.

Here’s how the Electronic Frontier Foundation (EFF) frames the importance of Section 230:

Section 230 enforces the common-sense principle that if you say something illegal online, you should be the one held responsible, not the website or platform where you said it (with some important exceptions).

EARN IT is a bipartisan effort, having been introduced by Republican Lindsey Graham, Democrat Richard Blumenthal and other legislators who’ve used the specter of online child exploitation to argue for the weakening of encryption. This comes as no surprise: in December 2019, while grilling Facebook and Apple, Graham and other senators threatened to regulate encryption unless the companies give law enforcement access to encrypted user data, pointing to child abuse as one reason.

What Graham threatened at the time:

You’re going to find a way to do this or we’re going to go do it for you. We’re not going to live in a world where a bunch of child abusers have a safe haven to practice their craft. Period. End of discussion.

One of the problems of the EARN IT bill: the proposed legislation “offers no meaningful solutions” to the problem of child exploitation, as the EFF says:

It doesn’t help organizations that support victims. It doesn’t equip law enforcement agencies with resources to investigate claims of child exploitation or training in how to use online platforms to catch perpetrators. Rather, the bill’s authors have shrewdly used defending children as the pretense for an attack on our free speech and security online.

If passed, the legislation will create a “National Commission on Online Child Sexual Exploitation Prevention” tasked with developing “best practices” for owners of Internet platforms to “prevent, reduce, and respond” to child exploitation online. But, as the EFF maintains, “Best practices” would essentially translate into legal requirements:

If a platform failed to adhere to them, it would lose essential legal protections for free speech.

The “best practices” approach came after pushback over the bill’s predicted effects on privacy and free speech – pushback that caused its authors to roll out the new structure. The best practices would be subject to approval or veto by the Attorney General (currently William Barr, who’s issued a public call for backdoors), the Secretary of Homeland Security (ditto), and the Chair of the Federal Trade Commission (FTC).

How would the bill end end-to-end encryption?

The bill doesn’t explicitly mention encryption. It doesn’t have to: policy experts say that the guidelines set up by the proposed legislation would require companies to provide “lawful access”: a phrase that could well encompass backdoors.

CNET talked to Lindsey Barrett, a staff attorney at Georgetown Law’s Institute for Public Representation Communications and Technology Clinic who said that the way that the bill is structured is a clear indication that it’s meant to target encryption:

When you’re talking about a bill that is structured for the attorney general to give his opinion and have decisive influence over what the best practices are, it does not take a rocket scientist to concur that this is designed to target encryption.

If the bill passes, the choice for tech companies comes down to either weakening their own encryption and endangering the privacy and security of all their users, or foregoing Section 230 protections and potentially facing liability in a wave of lawsuits.

Kate Ruane, a senior legislative counsel for the American Civil Liberties Union, had this to say to CNET:

The removal of Section 230 liability essentially makes the ‘best practices’ a requirement. The cost of doing business without those immunities is too high.

Tellingly, one of the bill’s lead sponsors, Sen. Richard Blumenthal, told the Washington Post that he’s unwilling to include a measure that would stipulate that encryption is off-limits in the proposed commission’s guidelines. This is what he told the newspaper:

I doubt I am the best qualified person to decide what best practices should be. Better-qualified people to make these decisions will be represented on the commission. So, to ban or require one best practice or another [beforehand] I just think leads us down a very perilous road.

The latest in an ongoing string of assaults on Section 230

The EARN IT Act joins an ongoing string of legal assaults against the CDA’s Section 230. Most recently, in January 2019, the US Supreme Court refused to consider a case against defamatory reviews on Yelp.

We’ve also seen actions taken against Section 230-protected sites such as those dedicated to revenge porn, for one.

In March 2018, we also saw the passage of H.R. 1865, the Fight Online Sex Trafficking Act (FOSTA) bill, which makes online prostitution ads a federal crime and which amended Section 230.

In response to the overwhelming vote to pass the bill – it sailed through on a 97-2 vote, over the protests of free-speech advocates, constitutional law experts and sex trafficking victims – Craigslist shut down its personals section.

But would it stop online child abuse?

Besides the proposed bill containing no tools to actually stop online child abuse, it would actually make it much harder to prosecute pedophiles, according to an analysis from The Center for Internet and Society at Stanford Law School. As explained by Riana Pfefferkorn, Associate Director of Surveillance and Cybersecurity, as it now stands, online providers proactively, and voluntarily, scan for child abuse images by comparing their hash values to known abusive content.

Apple does it with iCloud content, Facebook has used hashing to stop millions of nude children’s images, and Google released a free artificial intelligence tool to help stamp out abusive material, among other voluntary efforts by major online platforms.

The key word is “voluntarily,” Pfefferkorn says. Those platforms are all private companies, as opposed to government agencies, which are required by Fourth Amendment protections against unreasonable search to get warrants before they search our digital content, including our email, chat discussions, and cloud storage.

The reason that private companies like Facebook can, and do, do exactly that is that they are not the government, they’re private actors, so the Fourth Amendment doesn’t apply to them.

Turning the private companies that provide those communications into “agents of the state” would, ironically, result in courts’ suppression of evidence of the child sexual exploitation crimes targeted by the bill, she said.

That means the EARN IT Act would backfire for its core purpose, while violating the constitutional rights of online service providers and users alike.

Besides the EFF, the EARN IT bill is facing opposition from civil rights groups that include the American Civil Liberties Union and Americans for Prosperity, Access Now, Mozilla, the Center for Democracy Technology, Fight for the Future, the Wikimedia Foundation, the Surveillance Technology Oversight Project, the Consumer Technology Association, the Internet Association, and the Computer Communications Industry Association.

Earlier this month, Sen. Ron Wyden, who introduced the CDA’s Section 230, said in a statement that the “disastrous” legislation is a “Trojan horse” that will give President Trump and Attorney General Barr “the power to control online speech and require government access to every aspect of Americans’ lives.”

Read my full statement on the disastrous EARN IT Act, which will give Bill Barr and Donald Trump more control over… twitter.com/i/web/status/1…

—
Ron Wyden (@RonWyden) March 05, 2020

Wyden’s statement didn’t specifically mention encryption, but his office told Ars Technica that when “[the senator] discusses weakening security and requiring government access to every aspect of Americans’ lives, that is referring to encryption.”

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/SqOImXCXz8A/

Law-abiding folks like us applauded Texas for its bravery – but would we have the steel will to stand on the side of justice if it happened to us? Probably not.

There’s no justice in the world — at least that’s how it must feel for security admins in small towns, school districts, and other local government bodies. Already strapped for cash and operating on shoestring budgets, these organizations and institutions have become the prime target for ransomware hackers.

There is little doubt that ransomware has become a major plague for enterprises; hackers long ago discovered that most organizations would rather pay than fight. Fortunately for them, they have the resources to do so. But that’s not the case for local governments. According to an August report from Barracuda, “a recent analysis of hundreds of attacks across a broad set of targets revealed that government organizations are the intended victims of nearly two-thirds of all ransomware attacks.”

It’s low-hanging fruit for hackers, but money is money.

Without the resources to mitigate or prevent these attacks, governments and their institutions tend to pay. Unlike a business that can declare bankruptcy or a medical practice that can disband and start from scratch when attacked, governments can’t just walk away. Usually.

But when hackers took on Texas last summer, they didn’t take into account the “don’t tread on me” spirit of that state’s residents. To refresh your memory, hackers targeted 22 municipalities in that state with ransomware and demanded $2.5 million to free up the systems, but state officials refused to pay. Instead, the state’s IT officials decided to restore the affected systems. By mid-September, half of the affected towns had restored their services. The attack prompted a major re-evaluation of how Texas could avoid attacks in the future and recover more quickly if an attack succeeded.

Law-abiding folks like us applauded Texas for its bravery — but would we have the steel will to stand on the side of justice if it happened to us? Texas didn’t say how much it cost the state to rebuild its systems or whether it would have been cheaper to just pay the damn ransom. And what about the days or even weeks systems were offline until they were restored? Could we — managers of businesses large or small — afford an outage of that length? Probably not. So, does that mean we have no choice but to pay?

Double-Edged Defense
The answer to that question is “yes” — unless. The only sure way to prevent ransomware attacks is to catch them before they take place — that is, before hackers are able to embed their malware into IT systems that eventually will get locked up when the malware is activated. That prevention must entail a double-edged defense: preventing ransomware from slipping into a system and preventing ransomware already inside the system from activating itself.

To keep ransomware, or any malware, out of a network is ostensibly simple: To embed itself, ransomware must be installed on a computer or device that has access to the network. E-mail is the most common delivery method; according to studies, spearphishing accounts for 91% of all cyberattacks. When a person opens a rogue attachment or clicks on a link that leads to a suspicious site, hackers can install malware, ransomware, keyloggers, or a whole host of rogue applications that can be used to steal data, shut down operations, or extort a ransom.

If you can’t keep ransomware out of the system, the only alternative is to stop it before it can activate itself. One way to do that is to use artificial intelligence to take a “status photo” of a system or network: what applications are operating, what systems are in use, and how much processing power is being used in relation to the activities taking place in a system.

A security system that is constantly scanning those activities could be programmed to detect when rogue activity — not associated with any legitimate process or application — is taking place. When that activity is detected, the security system would intervene to shut down the associated process, thus mitigating what might turn out to be an attack.

Another way to prevent attacks is to set up a very strict whitelist of connections that can be made into the organization. For example, many ransomware attacks are routed through servers in China and Eastern Europe; blocking out those IP addresses for connection to the network will automatically keep out all dangers associated with those addresses. Firewalls are not sufficient because there is plenty of malware that can beat them; the messages and links that are interdicted are going to have to be examined manually.

Finally, another proactive way to avoid having to pay should a ransomware attack occur is to make sure you have up-to-date, isolated, and secure backups that are scanned by a variety of anti-malware tools on a continuous basis.

It’s unfair that hackers pick on the weakest organizations, the ones with the least resources. It’s also unfair that they just have to dispatch a suspicious e-mail to put their plan in motion, while we have to work very hard to prevent them from succeeding. And it’s certainly unfair that our choices are either pay or work for months to repair the damage, as Texas is doing. But using the methods described here, we might have a chance to bring a little justice back into our relationship with hackers.

Related Content: 

• How We Enabled Ransomware to Become a Multibillion-Dollar Industry
• Targeted Ransomware Attacks Show No Signs of Abating
• Towns Across Texas Hit in Coordinated Ransomware Attack
• Ransomware Upgrades with Credential-Stealing Tricks 

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “CASB 101: Why a Cloud Access Security Broker Matters.”

Valik is a product management leader with a strong technical background, specializing in cyber resilience, security, and hardening of critical data systems for enterprise organizations, both on-premise and in the cloud. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/advanced-threats/texas-chose-to-fight-ransomware-and-not-pay-what-about-the-rest-of-us/a/d-id/1337244?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The number of vulnerabilities in open source projects surged almost 50 per cent in 2019, according to security biz WhiteSource, which can be seen as good news in the sense that you don’t find what you’re not looking for.

In its annual vulnerability report, the biz attributes the growing vulnerability count with increased awareness of open source security. That’s a consequence of widespread adoption of open source components and the overall growth of the community in recent years, not to mention media attention of data exposure.

In other words, the bugs were always there but they’re more visible because we’re paying closer attention.

Over 6,000 open source vulnerabilities were reported last year, up from just over 4,000.

“No code is perfect and there are always vulnerabilities that can be found,” said Rami Sass, CEO and co-founder of WhiteSource, in an email to The Register.

“The problem with open source vulnerabilities is that, like everything in the open source community, once something is reported all the information is public and every beginner hacker can learn the vulnerability and it’s exploitation and then execute it on a large number of applications.”

On the plus side, 85 per cent of these vulnerabilities get disclosed with a fix, a good sign for responsible disclosure.

But community awareness of vulnerabilities has not translated into effective communication about them. Only 84 per cent of known open source vulnerabilities eventually show up on the National Vulnerability Database (NVD), and often after some delays.

And when vulnerabilities get reported outside the NVD, only 29 per cent eventually get published there, according to WhiteSource’s figures. That means vulnerability information may not be easy to find and fewer flaws are likely to get fixed in a timely manner.

Nonetheless, WhiteSource credits community-focused initiatives like GitHub’s Security Lab with helping security researchers, project maintainers, and software users report issues and centralize information more easily.

The survey also looked at the number of open source project vulnerabilities by programming language and how those numbers have changed over time.

WhiteSource says C still has the highest percentage of vulnerabilities because it’s the most popular language in terms of lines of code, but has trended downward as other languages have become more popular.

The report notes, however, that “PHP’s relative number of vulnerabilities has risen significantly, while there’s no indication of the same rise in popularity. “

Python meanwhile has managed to have a low percentage of vulnerabilities with high popularity. “Hopefully, this is a result of secure coding practices and not lax security research for Python projects,” the report says.

The most common Common Weakness Enumerations (CWEs) for 2019 were:

When analyzed by programming language, the top three for all but C were:

WhiteSource attributes the commonality of these flaws across languages to the use of automated scanning tools that know how to find these specific issues. Also, the firm notes, that Information Exposure is just a general issue across languages.

“CWE-79 (cross site scripting) is one of the easiest vulnerabilities to exploit for attackers, since there are many automated tools which make it approachable even for a ‘rookie’ hacker,” said Sass, noting that CWE represents a category rather than a specific flaw.

HTTP/2, Brute! Then fall, server. Admin! Ops! The server is dead

READ MORE

“Following the huge usage growth in the open source community, attackers are starting to see the potential in exploiting open source vulnerabilities. CWE-79 vulnerabilities are the go-to vulnerability for an easy and effortless hack. Taking this in mind, it’s quite logical that this massive increase occurred.”

With a rising number of vulnerability reports, development teams benefit from being able to prioritize the fixing of critical bugs before looking at less severe ones. That has become more complicated, thanks to changes in the way the Common Vulnerability Scoring System (CVSS) rates the severity of flaws.

CVSSv2 debuted in June 2007 and CVSSv3 appeared in June 2015, with CVSSv3.1 showing up in June 2019. Each offers a slightly different definition of what constitutes a high severity vulnerability.

According to WhiteSource, the biggest change came with the shift from v2 to v3, which redefined a 7.6 severity bug (out of 10) under v2 as a 9.8 bug under v3.

Under v3.1, the severity distribution is not a normal distribution, WhiteSource contends, with 17 per cent of vulnerabilities being critical and only 2 per cent rated low.

That means more than half of rated bugs are either critical or high-severity, which makes it difficult to prioritize when pretty much everything should be fixed right away.

“As the number of reported vulnerabilities increases, the urgency to patch those vulnerabilities rises,” said Sass. “However, development teams are struggling to keep up with the pace.” ®

Sponsored:
Quit your addiction to storage

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/13/open_source_bugs/

Microsoft has released an out-of-band emergency patch for a wormable remote-code execution hole in SMBv3, the Windows network file system protocol.

On Thursday morning, Redmond emitted the update to Server Message Block 3.1.1 to kill off a critical flaw word of which leaked out inadvertently this week.

Designated CVE-2020-0796, the bug can be exploited by an unauthenticated attacker to execute malicious code, at administrator level, on an un-patched system simply by sending the targeted system specially crafted compressed data packets. A hacker thus just needs to reach a vulnerable machine on the internet or network to fully compromise it.

Systems running 32 and 64-bit Windows 10 v1903, Windows 10 v1909, Windows Server v1903 (Server Core), and Windows Server v1909 (Server Core) – and just those versions – need to get patched right now. This flaw is wormable, in that once a box has been hijacked, it can automatically seek out more victims to infect and spread across organizations and the globe.

“While we have not observed an attack exploiting this vulnerability, we recommend that you apply this update to your affected devices with priority,” Microsoft said of the update.

Stuck at home? Need something to keep busy with? Microsoft has 115 ideas – including an awful SMBv3 security hole to worry about

READ MORE

The SMB bug fix was a late addition to Microsoft’s March edition of Patch Tuesday – after the security hole was accidentally disclosed by the Cisco Talos research team in a blog post recapping this month’s updates: Cisco thought Microsoft had fixed the bug this week as part of March’s Patch Tuesday, and alerted the world to the bug’s presence to get people to install their updates. In reality, Microsoft hoped to patch the hole later this year, no patch was available, and now everyone knew there was a hole in the compression part of the SMBv3 code.

The revelation sent Microsoft scrambling to post a fix for the flaw, dubbed SMBGhost, just hours after it had emitted updates for 115 other CVE-listed security vulnerabilities.

Designed to allow shared access to files, printers, and hardware ports, SMBv3 is a network protocol included in desktop and server editions of Windows.

“If you are running Windows 10, versions 1903/1909 or Windows Server, version 1903/1909 and have automatic updates enabled, you are automatically protected and do not need to take any further action,” Microsoft said. “If you are managing updates on behalf of your organization, you should download the latest updates from the Microsoft Security Update Guide and apply those updates to your Windows.” ®

Sponsored:
Quit your addiction to storage

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/12/smb_patch_microsoft/

As the world tackles the COVID-19 coronavirus pandemic, ransomware creeps have knocked offline a public health agency’s website that served nearly a quarter of a million people in the US.

The Champaign Urbana Public Health District (CHUPD) in Illinois, covering 210,00 folks, including the state’s biggest university, said today it has had to set up an alternate website as it deals with a ransomware infection that took down its primary site. “We are working to get our website up and running,” the district said in a post to a Facebook page that has now become its preferred outlet.

A spokesperson for the district also confirmed an earlier report from Mother Jones that the outage, which began Tuesday morning, was caused by a ransomware infection rather than a crush of traffic. “CUPHD can confirm that our system was attacked by a ransomware virus [called] Netwalker,” El Reg was told.

Also known as MailTo, the Netwalker ransomware emerged earlier this year in targeted attacks.

Maersk prepares to lay off the Maidenhead staffers who rescued it from NotPetya super-pwnage

READ MORE

At the time of writing, the district’s alternate website was operational and displaying some basic contact information about the deadly coronavirus outbreak. The organization’s Facebook page remains active with advice on how to prevent and report further infection.

The Urbana-Champaign area in particular will be affected by the outbreak as the area is home to the University of Illinois, which brings in students from all over. The school, currently on its Spring Break, said yesterday that when classes resume, they will do so online.

The horrible timing of the ransomware attack – right as people turn to state officials for advice and information on a biological virus outbreak – is likely a coincidence, as ransomware infections have for months been spreading on various local government networks.

Ransomware masterminds in particular have found local governments to be easy prey due low IT staffing and a lack of basic security protections. Places as sparsely populated as Nunavut, Canada and as large as Baltimore, Maryland have had to deal with ransomware hijackings that shut down critical city services. ®

Sponsored:
Quit your addiction to storage

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/12/ransomware_illinois_health/

Avast has disabled a component in its Windows anti-malware suite that posed, ironically enough, a significant security risk.

The software maker switched off the JavaScript interpreter in its toolkit after Google Project Zero’s Tavis Ormandy, and his colleagues, alerted the developer to design flaws in the code.

According to Avast, Ormandy potentially found a remote-code execution vulnerability in the software, the details of which were not publicly shared. Five days later, the Googler released a shell for poking around in Avast’s JavaScript engine for anyone interested in assessing the antivirus suite. He also revealed that if miscreants were able to exploit any holes in Avast’s JS engine on a victim’s computer, they would be able to run malware on that PC with system-admin-level privileges.

1/2-Last week, 3/4 @taviso reported a vulnerability to us in one of our emulators, which in theory could have been abused for RCE. On 3/9 he released a tool to simplify vuln. analysis in the emulator. Today, to protect our hundreds of millions of users, we disabled the emulator.

— Avast (@avast_antivirus) March 11, 2020

“Despite being highly privileged and processing untrusted input by design, it is unsandboxed and has poor mitigation coverage,” Ormandy explained earlier this week. It should be noted Ormandy did not disclose any specific bugs.

A couple days after the analysis tool was released, the vendor opted to do away with the emulator entirely. It does not believe the removal will significantly impact the suite’s ability to detect malware. The swift action was applauded by Ormandy.

Wow – Avast decided to disable their JavaScript interpreter globally!

The vulnerability report they mention wasn’t just me, it was a Project Zero collaboration with @natashenka 🔥🔥🔥

I think this is the right decision, it was a *lot* of attack surface. https://t.co/iFyry17HD0

— Tavis Ormandy (@taviso) March 11, 2020

Praise from the security community has been hard for Avast to come by lately. Earlier this week, the vendor took heat after it was revealed its AntiTrack tool contained security blunders that could have been exploited by man-in-the-middle snoopers to eavesdrop on supposedly secure website connections. ®

Sponsored:
Quit your addiction to storage

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/13/avast_javascript_security/

The costs associated with data breaches climb alongside the amount of data managed by the enterprise according to the latest Global Protection Index Snapshot.

Organizations are, on average, managing nearly 40% more data than one year ago. And 80% see that data having value. Unfortunately, 81% don’t think their cybersecurity is up to future challenges. These are just some of the conclusions in the Global Data Protection Index 2020 Snapshot released today by Dell Technologies.

The snapshot, based on interviews of 1,000 executives in organizations with more than 250 employees, shows that the amount of data the enterprise must manage has exploded in recent years. In 2019, the average organization was keeping track of 13.53 petabytes (PB) of data, an 831% increase from the 1.45PB they were managing in 2016. And the cost of security failures is increasing as the data size goes up.

According to the report, both the average cost of the downtime associated with a breach, and the cost of the breach itself, went up in 2019. The average cost of downtime went up by 54% from 2018 to 2019, with the estimated total cost hitting $810,018 in 2019, up from $526,845 in 2018. For data loss, the total also increased, from $995,613 in 2018 to $1,013,075 in 2019. In an interesting note, both costs were higher for organizations with multiple data protection vendors than for those depending on a single source for protection.

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “Keys to Hiring Cybersecurity Pros When Certification Can’t Help.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/new-report-shows-breach-costs-continuing-to-grow/d/d-id/1337305?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Threat actor’s practice of using known malware and tactics gives an opening for defenders, says Recorded Future.

The activities of Turla Group, a stealthy Russia-based threat actor associated with numerous attacks on government, diplomatic, technology, and research organizations, may be trackable because of the group’s penchant to use older malware and techniques alongside its arsenal of newer custom tools.

Researchers at Recorded Future recently came to that conclusion after conducting an in-depth analysis of Turla’s activities using data from its threat intelligence platform and several other sources, including open source intelligence. The vendor’s goal was to see whether it could develop methods — including scanning rules and indicators — for identifying Turla malware and infrastructure.

Recorded Future’s analysis showed Turla (aka Snake and Venomous Bear) to be a group that is continuing to develop its own advanced custom malware tools and adopting new attack and obfuscation methods all the time. In 2019, the group began ramping up its use of PowerShell scripts via PowerSploit and PowerShell Empire. It also developed a custom PowerShell backdoor dubbed PowerStallion, all in an apparent effort to make discovery harder for defenders.

However Recorded Future also found that in several lengthy campaigns, Turla had a pattern of using older malware and methods that researchers had previously identified as being used by the threat actor. This habit gives defenders an opening to proactively track and identify Turla’s infrastructure and activities, Recorded Future said.

“Turla is a bit unusual in continuing to use old, well-known malware that they have laying about,” says John TerBush, senior threat intelligence researcher at Recorded Future’s Insikt Group. There are a handful of other examples of continued use of older malware, such as Winnti and PlugX by groups associated with China. “[But] most advanced actors will move on to newer malware once they have been publicly reported on and evaluated by researchers,” TerBush says.

According to TerBush, the reason simply could be that the older, tried-and-tested methods are continuing to work for Turla in most attacks. While the group is continuously adding to its malware portfolio, Turla is also very smart about how to use them and do very specific targeting in order to limit exposure.

Hijacking Malware and Infrastructure
At least twice in the past, Turla has leveraged malware and infrastructure belonging to other threat groups to carry out its own missions. The first time was back in 2012 when Turla members reused malware belonging to a China-based threat actor called Quarian, TerBush says.

“In that instance, Kaspersky researchers assessed that Turla actors downloaded, then uninstalled, the Quarian malware in an attempt to divert and deceive incident responders post-discovery,” TerBush says.

More recently, in 2019 Symantec and later the United Kingdom’s National Cyber Security Center (NCSC) reported on Turla group members using malware and command-and-control (C2) infrastructure associated with APT34, a well-known Iranian threat actor. The NCSC described Turla as using APT34’s malware tools — Nautilus, Neuron, and an ASPX webshell called TwoFace — in attacks against UK organizations. The incident marked the first time one state-backed actor managed to take over another nation-state actor’s malware and infrastructure.

According to TerBush, Recorded Future’s analysis suggests that Turla’s takeover of APT34’s assets may have been opportunistic in nature and facilitated by data that another threat actor released in 2019.

Recorded Future found that while Turla frequently targets Windows systems, they have also deliberately targeted email servers using custom backdoors for Microsoft Exchange and other mail servers in order to take control of email traffic. The group also has been using compromised WordPress sites for command-and-control purposes and WordPress-focused URLs for delivering payloads. “This tendency enables the profiling of their C2s and payload URLs to discover new Turla infrastructure,” Recorded Future said.

As part of its Turla investigation Recorded Future researchers analyzed two malware types associated with the group — a remote access Trojan called Mosquito and the TwoFace webshell that Turla hijacked from APT34. The vendor concluded that many of the TwoFace webshells that are currently operational are now under the control of the Turla group and not APT34.

Recorded Future’s report provides a study in how others might similarly analyze nation-state malware and create sound detection methods, TerBush says. “Using these findings, we hope that organizations will utilize these and other detection methods for Turla malware,” he says.

Related Content:

• Russian Hackers Using Iranian APT’s Infrastructure in Widespread Attacks
• Russian Nation-State Group Employs Custom Backdoor for Microsoft Exchange Server
• Turla Threat Group Uses Email PDF Attachments to Control Stealthy Backdoor
• 8 Ways Businesses Unknowingly Help Hackers

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “CASB 101: Why a Cloud Access Security Broker Matters.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/russia-based-turla-apt-groups-infrastructure-activity-traceable/d/d-id/1337306?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Researchers have discovered another big database containing millions of European customer records left unsecured on Amazon Web Services (AWS) for anyone to find using a search engine.

A total of eight million records were involved, collected via marketplace and payment system APIs belonging to companies including Amazon, eBay, Shopify, PayPal, and Stripe.

Discovered by Comparitech’s noted breach hunter Bob Diachenko, the AWS instance containing the MongoDB database became visible on 3 February, where it remained indexable by search engines for five days.

Data in the records included names, shipping addresses, email addresses, phone numbers, items purchased, payments, order IDs, links to Stripe and Shopify invoices, and partially redacted credit cards.

Also included were thousands of Amazon Marketplace Web Services (MWS) queries, an MWS authentication token, and an AWS access key ID.

Because a single customer might generate multiple records, Comparitech wasn’t able to estimate how many customers might be affected.

About half of the customers whose records were leaked are from the UK; as far as we can tell, most if not all of the rest are from elsewhere in Europe.

How did this happen?

According to Comparitech, the unnamed company involved was a third party conducting cross-border value-added tax (VAT) analysis.

That is, a company none of the affected customers would have heard of or have any relationship with:

This exposure exemplifies how, when handing over personal and payment details to a company online, that info often passes through the hands of various third parties contracted to process, organize, and analyze it. Rarely are such tasks handled solely in house.

Amazon queries could be used to query the MWS API, Comparitech said, potentially allowing an attacker to request records from sales databases. For that reason, it recommended that the companies involved should immediately change their passwords and keys.

Amazon began investigating the breach on the day it was disclosed to them with the third-party company involved shutting down the database on 8 February.

While there is no evidence anyone accessed the data during the days it was left unsecured it is impossible to be sure of that.

It’s simply the latest example of how easy it is to leave sensitive data sitting in an unsecured state on cloud storage platforms.

Previous examples discovered by Comparitech and Diachenko include:

• A total of 250 million Microsoft customer support records dating back to 2005 left exposed on Elasticsearch.
• A database containing 267 million Facebook user IDs, phone numbers and names left exposed on Elasticsearch.
• An email database of 5 million Adobe Creative Cloud customers left exposed in an Elasticsearch server (October 2019).
• The personal details of 57 million Americans left on a marketing database on Elasticsearch.

The number of these breaches seems to be growing in scope and number in the last year. The current defence against them right now is simply that researchers publicise them before the criminals do. That needs to change before real damage is done.

LEARN MORE – WATCH NOW ON OUR YOUTUBE CHANNEL

(Watch directly on YouTube if the video won’t play here.)

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/UIaEL0DexEM/

Russia’s infamous Turla hacking crew looks to be gearing up for a new offensive, according to researchers with ESET.

The European security firm said that the fingerprints of the state-backed crew have been found all over previously unseen malware samples collected from compromised government websites in Armenia.

Data from ESET telemetry suggests that, for this campaign, only a very limited number of visitors were considered interesting by Turla’s operators

Though only recently discovered, the attack may have been active for some time and appears to be highly focused. The two compromised government websites and another pair of poisoned civilian websites have been active since early 2019.

Part of the reason the attack may have gone unnoticed for so long is the discerning nature of the infections. In the watering-hole attacks, the compromised sites carefully collect information on each user and only attempt to place the malware on the systems of high-value users like government officials.

“If the visitor is deemed interesting, the CC [command-and-control] server replies with a piece of JavaScript code that creates an IFrame,” explained ESET researcher Matthieu Faou.

“Data from ESET telemetry suggests that, for this campaign, only a very limited number of visitors were considered interesting by Turla’s operators.”

Once the target is singled out, the infection attempt itself is rather unremarkable. The trojan is delivered as a fake Flash Player update, a common but tried-and-true method of getting malware up and running on targeted PCs.

“A fake Adobe Flash update pop-up window warning to the user is displayed in order to trick them into downloading a malicious Flash installer,” said Faou.

“The compromise attempt relies solely on this social engineering trick.”

While a small, localised attack against an Eastern European government isn’t particularly earth-shattering news, given Turla’s history and reputation, it could be a sign of larger operations to come. The group has in the past targeted bigger fish, such as the US and Czech Republic, with similar operations.

The Turla crew, believed to be connected to Russian military and intelligence operations, has been active for more than a decade, carrying out targeted malware attacks and network intrusions.

The group is particularly well-versed in social engineering and manipulation, relying mostly on tricks such as the mentioned watering-hole attacks and fake installers, rather than complex technical operations.

Indeed, last year the crew was found trying to throw investigators off its trail by disguising one of its intelligence operations as an Iranian hacking campaign. ®

Sponsored:
Quit your addiction to storage

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/12/eset_spots_turla_hackers/