STE WILLIAMS

Biometric systems could use the unique patterns from a person’s ECG reading for biometric sign-ons.

This is according to a study (PDF) emitted this month by a trans-Atlantic pair of brains at UC Berkeley in the US and the University of Edinburgh in Scotland, who reckon electrocardiogram results are easy enough to measure, and vary enough from person to person that a reliable authentication system could be built from consumer hardware.

“While existing research has focused on common modalities, such as fingerprints, face recognition, and iris scans, insufficient work has been done to explore novel biometrics,” said Berkeley’s Nikita Samarin and Edinburgh’s Donald Sannella.

“Past research has demonstrated that ECG is sufficiently unique to each individual and could be used for user authentication.”

To test whether an off-the-shelf authentication scheme would be viable, the researchers had to figure out just how well a small consumer ECG could both read and distinguish ECG patterns from person to person and from reading to reading. They enlisted a group of 49 volunteers to use a mobile ECG reader (specifically, this one) in two different sittings four months apart.

Using the datasets, the team then analysed the wave patterns from person to person and between the two settings. What they found was that the ECG readings could match the person with an error rate of about 2.4 per cent over short durations of time (roughly the same range as fingerprint readers), but found that over longer periods between readings, the error rate goes up to around 9 per cent.

Still, the study concludes that an ECG authentication would be feasible and reliable enough to work in things like smartphone cases or steering wheels as another way to authenticate the owner of the device, albeit with many of the same concerns and technical hurdles present in other bioauthentication methods.

“The introduction of low-cost sensors allows system designers to embed them into existing access control systems,” the duo concluded.

“Nevertheless, more research needs to be done on extracting features from ECG signals obtained from consumer-grade monitors, preventing spoofing attacks and guaranteeing that ECG-based biometric systems are socially accepted by the general public.”

The paper, A Key to Your Heart: Biometric Authentication Based on ECG Signals, is due to be presented during the “Who Are You?! Adventures in Authentication” workshop at the Symposium on Usable Privacy and Security in Silicon Valley in August. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/25/ecg_heart_biometric_authentication/

McAfee is suing former senior salespeople whom it alleges stole company trade secrets when they moved to a rival security vendor.

Three former “highly compensated” sales staffers, named in court documents as Jennifer Kinney, Percy Tejeda and Alan Coe, are said to have moved to rival antivirus endpoint security company Tanium.

“The job functions of each of the Employee Defendants required an intimate knowledge of the ‘secret sauce’ underlying McAfee’s sales tactics and customer strategies, and each of the Employee Defendants executed an Employment Agreement containing confidentiality and non-solicitation provisions as a condition of their employment,” alleged McAfee.

Tejeda is said to have moved to Tanium before convincing Kinney to follow, prompting McAfee to send a lawyer’s letter “to remind Tejeda of the continuing obligations not to use confidential information” from the well-known antivirus security solutions firm – and to complain that he was breaking his contractual non-compete clause.

Tanium’s lawyers wrote back informing McAfee that Coe, a former direct report of Tejeda’s, would also be joining them. An evidently aggrieved McAfee then “commissioned a forensic analysis” of the departing sales crew’s computers, allegedly discovering that Kinney had set up a Google Drive folder during her last week at the company.

The company claims she accessed it “concurrent with confidential McAfee files” and invited the US District Court for Eastern Texas to infer that she “copied information from files in those folders to the Google document.” The firm also alleged she had sent an Excel spreadsheet named Deak Desk Deal Tracker.xlsx to her personal email account shortly before departure.

Similarly, McAfee said in its complaint that Coe “also accessed numerous confidential files while using unauthorized USB devices on his last day at McAfee,” including a USB printer.

McAfee claims it paid Kinney and Coe “six figure base salaries” as well as bonuses, coyly admitting that Tejeda’s remuneration would have “exceeded those of Kinney and Coe”.

It was not explained in the court filings seen by El Reg why McAfee was apparently not enforcing straightforward security controls like preventing USB sticks from being used.

The case continues. You can read the original complaint here (PDF). ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/25/mcafee_sues_salesmen_ip_theft_allegations/

Cryptomining will exist as long as it remains profitable. One of the most effective ways to disrupt that activity is to make it too expensive to run cryptomining malware in your network.

Threat actors recently have been benefiting tremendously from leveraging tools developed by others, including legitimate vendors, to carry out their cyberattacks. In April, for example, Fortinet released a playbook on the Silence group, a threat actor that has been leveraging PowerShell and other legitimate tools in a long running campaign. In the most recent “Fortinet Threat Landscape Report,” threat analysts paid special attention to the Silence group as well as Coinhive, a cryptocurrency mining service that was suddenly terminated by its creators in March.

Coinhive Falls Victim to Its Own Success
Coinhive’s service launched in 2017 with the idea that its JavaScript file could be installed on websites to generate income for the site owners without resorting to traditional advertisements. Coinhive mines the cryptocurrency Monero, and unlike bitcoin, Monero transactions between two parties are undetectable.

This feature made it an attractive option for cybercriminals who took to installing it on compromised websites without consent. This “success” in the black market drove Coinhive to the top of the threat charts and caused it to be blacklisted in many security products.

Despite claims of raking in $250,000 per month and controlling 62% of the cryptojacking market, Coinhive publicized in February that the service “isn’t economically viable anymore” and that it would be shutting down. This is partly due to Monero crashing in value as well as the fact that Monero released an algorithm update that made the mining process slower.

Coinhive said the JavaScript variant would cease working on March 8, and true to its promise, none of the JS/Coinhive variants appeared in Fortinet’s data beyond that date. The effects of this shutdown in early March were obvious. Our detection of the two biggest Coinhive signatures began to slow down over the quarter. However, the Riskware/Coinhive version still shows some signs of life. We suspect this reflects a delay in remediating the many compromised servers that exist. Based on prior shutdowns, analysts suspect it will be a long time before Coinhive disappears completely. But it’s still good to acknowledge each victory as it comes.

Silence Group Expands Its Bank Exploit Capabilities
Silence, a name coined from its long intervals between attacks, was launched in 2016 as a cybercriminal organization that targets banks, specifically stealing information used in the payment card industry. The group is primarily known for targeting banks in Russia and Eastern Europe, but its support infrastructure spans the globe, with examples found in Australia, Canada, France, Ireland, Spain, and Sweden, with the US Silence group growing increasingly sophisticated and successful over time.

Silence typically executes attacks by using a combination of publicly available tools and utilities that exist on the target machine (such as PowerShell) combined with its own customized tools. As the different timelines in the Playbook created for the Cyber Threat Alliance suggests, Silence continues to add to its portfolio. If its growth in capability and effectiveness continues, the potential threat the group poses justifies continued vigilant observation of future Silence Group campaigns.

Defending Against the Illicit Use of PowerShell and Similar Services
Given current trends, it seems safe to say that the illicit use of PowerShell and other legitimate services will continue to expand. Because these tools are already embedded in most networks, enterprises must focus on averting this threat. Luckily, defending against illicit cryptocurrency mining does not require specialized security software or radical changes in behavior. In fact, organizations can employ well-known cybersecurity practices:

• Identify, monitor, and harden tools like PowerShell to prevent their exploitation.
• Apply application whitelisting.
• Blacklist network traffic (i.e., blocking domains of mining sites).
• Block communication protocols for mining pools
• Check text strings related to cryptomining, such as Crypto, Monero, etc.
• Identify abnormal behaviors and provide standards for real network traffic with the use of machine learning or other artificial intelligence technologies.
• Keep up to date with the latest vulnerabilities and patches
• Monitor firewall and web proxy logs and look for domains associated with cryptomining pools or browser-based coin miners.
• Monitor for unusual power consumption and CPU activity.
• Regulate administrative privilege policies.

Cryptomining will continue to exist as long as it remains profitable, which means that one of the most effective ways to disrupt that activity is to make it too expensive to run cryptomining malware in your network. Groups like Silence depend on organizations being lax when it comes to basic cybersecurity practices, and given the number of attacks that successfully target known vulnerabilities with available patches, they are making a safe bet. Effective cybersecurity strategies — ranging from simply patching tools and services to hardening or even removing systems that cybercriminals tend to exploit — force threat actors back to the drawing board or to look for easier prey.

Related Content:

• 7 Real-Life Dangers That Threaten Cybersecurity
• Sensory Overload: Filtering Out Cybersecurity’s Noise
• Cryptomining Continues to Be Top Malware Threat
• Cryptomining Malware Continues Rapid Growth: Report

Derek Manky formulates security strategy with more than 15 years of cyber security experience behind him. His ultimate goal to make a positive impact in the global war on cybercrime. Manky provides thought leadership to industry, and has presented research and strategy … View Full Bio

Article source: https://www.darkreading.com/perimeter/the-rise-of-silence-and-the-fall-of-coinhive/a/d-id/1334980?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Interview Andrew Sullivan, chief exec of the Internet Society, has condemned governments that “interfere in underlying technologies that people are allowed to build,” as regulators increasingly target net infrastructure to enforce their visions of how the online world ought to be.

Speaking to The Register, Sullivan warned that laws passed to ban, or force, the use of certain types of tech risked damaging confidence in infrastructure that is becoming ever more vital for the internet to function safely and securely.

“If you look at the internet right now, people have been responding to it in recent times primarily in a threat mode,” he said, contrasting it to the “everything is great” vibe of the 1990s and early 2000s.

“Now,” continued Sullivan, who previously worked at Dyn and has been credited with opening up the dot-org and dot-info domains to world+dog, “we’ve lived with this technology for long enough that all we see are the downsides. We’re forgetting the great benefits that it brings.”

His pitch is simple: governments and quasi-governmental regulators alike need to stop targeting internet infrastructure as a means of blocking certain types of content. If they continue doing it, he said, vital security protections will end up being weakened and innocent sites will be wrongly blocked.

D’oh! Amber Rudd meant ‘understand hashing’, not ‘hashtags’

READ MORE

“It’s all about the content and not the infrastructure. We’re talking about the thing we’re actually trying to regulate. What people are doing is reaching for the thing they’re trying to regulate, the underlying infrastructure.”

Top of the infrastructure-as-policy-tool agenda in the UK is the DNS over HTTPS (DoH) proposal made by browser builders Google and Mozilla. As we reported, the problem is that DoH would allegedly nobble the Internet Watch Foundation’s anti-child abuse imagery watch list, among other surveillance and blocking methods used in the UK. The IWF watchlist compares plaintext DNS requests to a master blacklist and sinkholes requests going to URLs of known child abuse imagery; the same method is used to block pro-terrorism websites.

DoH would see DNS requests from browsers implementing the tech going directly to DNS servers controlled by that browser-maker, which is what prompted near-incomprehensible outbursts by the British government about Google threatening children.

One of the proposals made in response to DNS-over-HTTPS showing up is to outlaw DoH – ‘You’re not allowed to use this protocol.’ A very strange thing for Parliament to do, to regulate specific tech over how bits travel over a wire…

While Sullivan doesn’t quibble with the premise of blocking pro-terrorism and child abuse websites, he argues that blocking them by “fiddling with some kind of infrastructure that also has all kinds of other uses,” is effectively opening a Pandora’s box.

“It tends to block the ability to look at these resolution attempts. By blocking the ability to look at the resolution attempts, you block the ability of that intermediate server to say, ‘Hey, you’re looking up something that’s evil’,” he said, warning that fiddling with or banning DoH could end up frustrating attempts to protect against DNS-hijacking malware that could, for example, “misdirect you to websites that impersonate your bank.”

Sullivan told The Register: “One of the proposals made in response to DoH showing up is to outlaw DoH – ‘You’re not allowed to use this protocol.’ A very strange thing for Parliament to do, to regulate specific tech over how bits travel over a wire,” he told us.

In contrast to the doom and gloom being pumped out in the UK in response to the DoH proposal, Sullivan was upbeat about the prospects for content blocking: “There’s other ways to do it. You could embed the blocklist in servers on the internet. So you could say, hey, if you’re serving content on the internet you should subscribe to this list too.”

In other words, rather than (effectively) subverting DNS queries as we do at present, or banning DoH because UK regulators haven’t got the imagination to think up a DoH-compliant filtering method, Sullivan proposes making all content hosts sign up to what would effectively be a public blacklist, something bound to go down badly among UK policymakers, who prefer the behind-closed-doors, just-between-us informality of the current IWF watchlist arrangement.

“It’s not that people disagree that content is bad,” Sullivan mused when we asked him whether he can see the side of the argument that says blocking bad content is inherently good, whether done at the transport layer or not. “I don’t agree massacres of people should be filmed and shown on the internet or elsewhere. I don’t think [child abuse images and footage] is OK. I don’t think, either, that we should permanently try to use the underlying infrastructure to stamp out content we don’t like.”

He adds that while people tend to say “this is an inconvenience”, a “problem we have to put up with to live in a democratic society and part of the cost,” the real problem lies with politicians who want to be seen to have done something – and who reach for infrastructure regulation in the process.

“This is a consistent pattern we see here, quite big interference in underlying tech that people are allowed to build, in response to bad content. The politicians who need to be seen to do something don’t bear any cost in this thing. That cost imposes negative consequences on the rest of the internet, it means the rest of the infrastructure is less reliable than it could be.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/25/andrew_sullivan_internet_society_interview/

Hackers infiltrated the networks of at least ten cellular telcos around the world, and remained hidden for years, as part of a long-running tightly targeted surveillance operation, The Register has learned. This espionage campaign is still ongoing, it is claimed.

Cyber-spy hunters at US security firm Cybereason told El Reg on Monday the miscreants responsible for the intrusions were, judging from their malware and skills, either part of the infamous Beijing-backed hacking crew dubbed APT10 – or someone operating just like them, perhaps deliberately so.

Whoever it was, the snoops apparently spent the past seven or more years inside ten-plus cellphone networks dotted around the planet. In some cases, we’re told, the hackers were able to deploy their own VPN services on the telcos’ infrastructure to gain quick, persistent, and direct access to the carriers rather than hop through compromised internal servers and workstations. These VPN services were not detected by the telcos’ IT staff.

“It is straight up brazen,” Cybereason principal security researcher Amit Serper told El Reg hours earlier. “They figured out there was a lot of lag in using hacked machines, and said: let’s install a VPN and get it over with. I don’t know if there is even [networking monitoring] coverage of those connections going in and out.”

Hundreds of gigabytes of personal information

The undetected VPN deployments underscore just how deeply the hacker crew was able to drill into the unnamed telcos and compromise pretty much everything they needed to get the job done. The gang sought access to hundreds of gigabytes of phone records, text messages, device and customer metadata, and location data on hundreds of millions of subscribers.

This was all done, we’re told, in order to spy on and gather the whereabouts of some 20 to 30 high-value targets – think politicians, diplomats, and foreign agents. The hackers and their masters would be able to figure out who their targets talk to, where they work and stay, and so on.

Having picked up signs of intrusions about a year ago, Cybereason’s team has been investigating ever since, dubbing the cyber-attacks Operation Soft Cell. They said they found the hackers had been extremely patient in their approach, stealthily operating spy campaigns for years at a time undetected by only periodically making precise moves. Internal data would be compressed and encrypted using a passphrase prior to exfiltration via multiple bounce boxes.

Typically, Serper said, the snoops would slip through a phone network’s defenses by exploiting a known vulnerability in one of the corporation’s public-facing servers, such as a web server running Microsoft IIS. From there, the crew would install a webshell – such as China Chopper, favored by the Middle Kingdom’s hackers – to execute arbitrary commands. From this foothold, the intruders would then very slowly tip-toe into other parts of the network, moving from system to system harvesting credentials, and using each freshly compromised machine to get into another.

A modified version of Mimikatz was used to extract login details out of hijacked Windows boxes, and a NetBIOS scanner was used to find computers to attack on the local network. Backdoors, such as the PoisonIvy remote-access tool, would be installed on systems to remotely control them and steal information.

China’s tech giants are a security threat to the UK, says Brit spy bigwig

READ MORE

To cover their tracks, the hackers would have long periods of inactivity.

“They come in, they do something, and they disappear for one to three months,” said Serper. “Then they come in again, disappear, and so forth.”

Such lulls in activity are not unprecedented, particularly when it comes to hacking groups from China. Espionage campaigns by the Middle Kingdom’s APT groups will sometimes be put on ice for years in between flurries of activity.

The thought of hackers sitting on a network undetected for years at a time with their own private tunnel into the most sensitive silos of company data should be enough to send any infosec pro through the roof, though Cybereason cautioned against being too hard on the compromised telcos – said to be based across the world, from Europe and Africa to Asia and the Middle East, though outside North America. More operators pwned by this particular gang may be discovered, bear in mind. Cybereason said it has alerted those that it knows have been broken into.

Even if the telcos had spotted the intrusions, keeping out a sophisticated, methodical hacking operation with the resources of the Chinese government, or similar, would be a tall order for many cellular operators.

“They [the intruders] have very talented people, and a lot of people, and time to do whatever they need to do,” Cybereason’s security practices veep Mor Levi told us. “That is versus a company that even, if their security team had 50 people, it is not something you can prepare against: it is David and Goliath.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/25/telco_security_hell/

Impact of FBI’s takedown of 15 ‘booter’ domains last December appears to have been temporary.

New data published this week demonstrates the troubling resilience of cybercriminals against mounting domestic and international efforts to stop them.

Nexusguard analyzed data gathered from multiple public and proprietary sources on distributed denial-of-service attacks during the first quarter of this year. The security vendor discovered that so-called booter websites offering DDoS services for hire more than doubled that quarter compared to the fourth quarter of 2018 – despite a major law enforcement crackdown on such sites in December.

DNS amplification attacks—one of the most popular booter services—soared 40% quarter-over-quarter amid uninterrupted demand among cybercriminals. Many of the DNS amplification attacks—where DNS servers are tricked into generating responses that are much larger than the original queries—targeted ISPs and telecommunications firms in Brazil.

Nexusguard’s analysis also showed a continued trend toward what it calls bit-and-piece DDoS attacks, where threat actors contaminate a large and diverse pool of IP address with almost negligible sizes of junk traffic that converge and block a targeted IP.

Such attacks can be hard to mitigate because of the negligible size of the DDoS traffic being routed through each one of the hundreds of IP addresses used in an attack, says Donny Chong, product director of enterprise security solutions at Nexusguard. 

“This form of attack hurts the service providers the most as it threatens to congest a service provider’s pipe and causes widespread collateral damage for anyone on this pipe,” he says.

In the first quarter of this year, such attacks became more automated and targeted, indicating that attackers have figured out how to launch them optimally, Nexusguard said in its report.

The growing popularity of bit-and-pieces attack may have also contributed to DDoS attack sizes overall—both average and peak—decreasing last quarter, Chong says. The maximum DDoS attack size that Nexusguard observed in Q1 of 2019 was 145.4GBps—a nearly 55% drop year over year. Average attack size at 0.823Gbps was almost 95% smaller than in Q1 of 2018.

Meanwhile, the trend toward the use of mobile devices and mobile botnets in DDoS attacks continued in the first quarter of 2019. Nexusguard’s data shows that more than six-in-10 DDoS attacks in Q1 targeted at the application layer originated from mobile gateways. The average duration of DDoS attacks involving mobile botnets was around 531 minutes, compared to 187 minutes last year. About 40% of DDoS attacks involving mobile devices originated from Android phones, while about 21% were from iOS devices, Nexusguard found.

“The resurgence of booters, the optimization of bit-and pieces and mobile sources overtaking desktop computers, are significant findings,” Chong says. But they are not unexpected. “If anything, it’s more a confirmation of the trend and evolution that we’re seeing.”

Booter Services Back With a Vengeance

The resurgence of booter sites in particular is notable. Last December, the FBI—in collaboration with international counterparts—seized 15 Internet domains associated with some of the world’s largest DDoS-for-hire-services.

Among the seized domains was Downthem, which either carried out or attempted to carry out, around 200,000 DDoS attacks between 2014 and 2018. Another seized domain—Quantum Stresser—had some 80,000 subscribers dating back to 2012 that in 2018 was used to launch over 50,000 actual or attempted attacks against targets around the world.

The FBI’s pre-Christmas 2018 crackdown succeeded in slashing the overall number of DDoS attacks globally by 11%, and average attack size by as much as 85% percent in Q4 last year.

However, Nexusuard and others at that time warned about a rebound in booter services due to the strong and growing demand for them in the cyber underworld. The latest numbers appear to confirm that expectation. “The resurgence of DDoS-as-a-service and the growing botnets reinforce the evolving cyber threat of DDoS attacks for enterprises and communications service providers,” Nexusguard said in the report Monday.

The same pattern has played out numerous times over the years. Law enforcement authorities in the US and other countries have taken down major underground marketplaces and dismantled organized groups engaged illicit activities online, only to see others swiftly replace them.

The recent takedown of the xDedic marketplace for stolen servers, for instance, and the similar shutdowns of AlphaBay and Hansa Market in 2017, represented huge wins for law enforcement. Yet the malware and other hacking tools and services once available on these sites now are sold on smaller, decentralized sites and other avenues.

Related Content:

• Inside the FBI’s Fight Against Cybercrime
• DDoS Attack Size Drops 85% in Q4 2018
• Feds Make New Arrest in Darkode Case
• 7 Recent Wins Against Cybercrime

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/perimeter/ddos-for-hire-services-doubled-in-q1-/d/d-id/1335042?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Researchers explore how modern security problems can be solved with an examination of society, technology, and security.

Cybersecurity challenges cannot be solved with computers alone. They demand a closer look at how social and technical systems overlap, and how this growing overlap influences security.

As it stands, many of these issues are being addressed separately. The general public and defense leaders understand the risk of online propaganda, but they know little about the techniques involved. The field of computational social science studies how digital media affects society, but it rarely tackles security. And the security community understands the protocols and services of tech platforms, but they know less about how these networks collectively influence society and politics.

Pablo Breuer, innovation officer at US Special Operations Command Donovan Group, and David Perlman, researcher at A Social Network, have developed an integrated view of socio-technical systems (STS) to which security principles can be applied. An STS consists of a social network, the population using it, and an output system (political system or economic market, for example) that feels the resulting effects.

Their idea is to create a framework that combines social and technical systems and can inform security operations. As disinformation campaigns and online propaganda continue to spread, STS can help defend and fight different types of cyberattacks with their roots in digital media.

“As I went through my schooling, I realized none of the really interesting problems about computer security can be answered with computers,” Breuer says. A mutual friend introduced him to Perlman, and the duo began exploring mass influence and weaponized information. They wanted to educate people and government on why everybody should be involved.

“We realized that anybody who’s in the field recognizes that this is a huge problem and that this is a train wreck, but nobody’s actually doing anything,” he explains. “Everybody’s just admiring the problem.” The issue isn’t limited to any single part of computer science, policy, or law, Breuer continues. “It’s not a silver bullet problem – it’s a thousand-bullet problem,” he says.

Placing security in the context of a social network offers a different perspective, Perlman adds, because at the center are interactions among many people’s minds. Researchers see how people interact with technology and one another. “You can’t ignore any of those parts of the equation,” he says. Before, the way people interacted with systems wasn’t considered.

The Information Revolution Continues
The rise of the Internet – specifically, social networks like Facebook, Twitter, and Instagram – have enabled anyone to speak to mass audiences. Breuer and Perlman use the term “radical leveling technologies” to describe how the Internet has shifted the power of balance online. Before social media, few people could speak to a large populous. Now just about anyone can.

“It’s just a fundamental shift in the landscape,” Breuer says. The transmission of messages has changed, but receptors are still human. “That’s where the socio-technical comes in,” he adds.

Digital media has accelerated the reach and speed of propaganda online: People can automate the process of creating new messages, then see how effective they are and the kind of responses they generate. “The whole thing has to be considered as a security question,” Perlman says.

The idea of large groups of people communicating with one another seems benign, Perlman continues, and it is – if everyone acts in good faith. Problems occur when bad guys figure out how to game the system before the good guys know they do. Now they have, he adds, and the result is a new adversarial aspect to digital communications that is now possible. Cybersecurity issues, propaganda, and the Internet are intertwined in a web of interconnected problems.

“It’s the combination with modern technology and the Internet, that whole is greater than the sum of solving each of the parts,” says Breuer, and the security industry isn’t tackling it as a larger problem. Conferences may focus on policy or computer science, but not both.

“Very rarely do you get legal and policy and tech all in the same room,” he notes. “And this is one of those problems where you have to have that or you won’t make any inroads to making it better.”

Offense and Defense in STS Security
In their upcoming Black Hat USA briefing, “Hacking Ten Million Useful Idiots: Online Propaganda as a Socio-Technical Security Project,” Breuer and Perlman will discuss their framework, how security principles apply to STS, how red team and blue team processes could look in the context of STS security, and examples of red team analyses of influence operations.

Breuer explains an example of blue team operations, or how a company could defend themselves from a digital media-based attack. Most companies have some idea of what will happen if they suffer a data breach; however, they aren’t prepared for social media attacks.

He cites an incident the Associated Press handled this past December, when the publication was covering yellow jacket protests in France. One of its stories included an up-close image of a fire. A separate blog obtained pictures the AP had posted in a previous story; those photos also included a fire, but they were panned back so it seemed smaller. The blog’s narrative said the AP had misrepresented the fire’s size with an up-close photograph and not to believe it.

What happened “almost instantly,” Breuer says, is the AP replied with a series of tweets saying both were AP photos but were taken at different times during different events. The publication highlighted aspects of each photo to demonstrate they were from separate occasions.

“That kind of forethought allows for very rapid response,” he continues. It shows how the AP had considered the possibility someone might take its stories out of context and planned its reaction. Any company on social media should consider the chance they’ll have to do the same.

Related Content:

• 10 Notable Security Acquisitions of 2019 (So Far)
  
• Patrolling the New Cybersecurity Perimeter
• 7 2019 Security Venture Fund Deals You Should Know
• Cybersecurity Accountability Spread Thin in the C-Suite

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/perimeter/a-socio-technical-approach-to-cybersecuritys-problems/d/d-id/1335043?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Hackers operating on behalf of the Iranian government have turned destructive, the US Department of Homeland Security has claimed.

A statement issued over the weekend by Cybersecurity and Infrastructure Security Agency (CISA) director Christopher Krebs describes how Tehran-backed miscreants have gone from simply attempting to harvest blueprints, sensitive data, and account credentials from American systems, to actively working to wipe clean Uncle Sam’s PCs, servers, and network infrastructure in their wake.

The attackers are, it is claimed, targeting the IT infrastructures of US government agencies and their private-sector contractors. While cyber-raids by Iran are nothing new, the aggressive deleting of data from hard drives and other storage gear is apparently cause for concern.

We’re not at all surprised by it. Rather than covertly and silently snooping on Western computers, Iranian hackers are, we’re told, just going for broke and making their presence known loud and clear, by trashing file systems, and thus sending a message to the White House.

“Iranian regime actors and proxies are increasingly using destructive ‘wiper’ attacks, looking to do much more than just steal data and money. These efforts are often enabled through common tactics like spear phishing, password spraying, and credential stuffing,” Krebs warned.

“What might start as an account compromise, where you think you might just lose data, can quickly become a situation where you’ve lost your whole network.”

Nine Iranians accused of cyber-swiping 30TB+ of blueprints from unis, biz on Tehran’s orders

READ MORE

The alert comes as tensions between America and Iran have spiked: the two nations have basically been, and this is a technical term here, dicking around with each other for ages. Besides the whole Stuxnet thing and earlier trade sanctions, Japanese and Norwegian oil tankers were blown up near Iran this month, a US military spy drone was shot down by the Iranians, and today President Donald Trump approved fresh “hard-hitting” sanctions against the Mid-East nation.

Now, as the pair of countries find themselves increasingly hostile to one another, Homeland Security said the animosity is spilling over to cyberspace.

“In times like these it’s important to make sure you’ve shored up your basic defenses, like using multi-factor authentication, and if you suspect an incident, take it seriously and act quickly,” Krebs said.

The digital saber-rattling is not a one-sided battle, either. Uncle Sam is said to be launching its own cyber-strikes after the White House last-minute called off a plan to launch actual missiles at Iran.

A report from Yahoo! News over the weekend claimed that US government agents have in recent days hacked and taken down online spy networks operating out of Iran, in retaliation for the downed drone, while the Washington Post reports that a separate cyber-attack is specifically targeting the same missile systems Iran used to take down the US drone. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/24/iran_cyberattacks_america/

A Scottish managed services provider is running a lucrative sideline in ransomware decryption – however, a sting operation by a security firm appears to show that “decryption” merely means paying off the malware’s masterminds.

The services provider, Red Mosquito (tagline: “Your IT Department”), advertises itself as doing “all the technical stuff, properly, allowing you to concentrate on your business.”

Some probing by researchers at infosec outfit Emsisoft, however, cast Red Mosquito’s activities in a different light. By setting up two email accounts and using them to pose as both a ransomware author and a victim of ransomware, Emsisoft said it discovered that Red Mosquito’s RM Data Recovery (RMDR) offshoot appears to be negotiating discounts with ransomware-slinging crooks to unlock scrambled files before charging the victims thousands in decryption fees.

Barrister Tim Forte opined to The Register that entering a payoff agreement with a ransomware author could be seen as facilitating blackmail, explaining that it would be “nothing more than an agreement that between them, the author and RMDR, they would continue to seek monies from the victim, with the threat that, absent payment, the data would not be disinfected, released, or decrypted.”

“By their apparent agreement with the author, RMDR are, at least arguably, agreeing on that criminal course of conduct, with a view to obtaining a share of the illicit profits,” Forte, who practises criminal law at 3 Temple Garden chambers in London, added. He also said that as well as blackmail, ransomware authors would be committing criminal offences under the UK’s Computer Misuse Act 1990.

Emsisoft CTO Fabian Wosar told El Reg: “Ransomware incident response companies can provide a very valuable service and help minimize downtime and costs, but you should choose carefully and ensure the company is entirely transparent upfront as to how they restore your files and provide a complete breakdown of the costs involved.”

Red Mosquito did not respond to multiple emailed and telephoned requests for comment. A phone operative told El Reg that if senior management weren’t responding, they probably weren’t interested.

Baiting the trap

Emsisoft set up two throwaway email inboxes. One posed as the ransomware author. The firm created some junk files that, they explained, would pass superficial inspection by a human as encrypted data even though they were not encrypted and contained nothing but random bytes.

“To be 100% clear here,” Wosar told us, “it is impossible to decrypt the files I provided to the data recovery company at all, because they contain nothing that could be decrypted to begin with. Reason for that is so they don’t try to weasel their way out of it by saying they did find a flaw or that they have a magic decryption tool that only they have that could decrypt it.”

Emsisoft then dressed up these files to appear as though they were scrambled by ransomware made by a fictitious gang called Team Gotcha!, and did some light social media and Google astroturfing to make the fake Gotcha! ransomware outfit look real. Emsisoft also put contact details for their fake ransomware developer persona in the ransom note. Having emailed the files and the note to RMDR as a victim seeking help, they then sat back and waited.

Ping

Sure enough, their fake victim email address got a reply from RMDR promising action. Very shortly afterwards, someone using a Protonmail account – [email protected] – contacted the ransomware author.

“How much for decrypt?” asked the one-line email.

“$1200 in Bitcoin. You pay, we provide key and decriptor [sic] to recover data” replied Emsisoft. After some negotiation, to keep it looking real, Emsisoft dropped the price of their fake ransomware decryption to $900.

Meanwhile, RMDR had contacted the victim again. Someone using the name Conor Lairg replied by email, seen by The Register:

I am pleased to confirm that we can recover your encrypted files.

The cost for our data recovery service is as follows:

Priority Recovery Service (estimate 1-3 business days) 3950 USD

Red Mosquito’s email also asked the victim to install Teamviewer, a IT support tool that allows a remote user to take full control of a target machine with the user’s consent.

At the time that El Reg began investigating this, the RM Data Recovery website said, on its FAQ page, that customers could “schedule a secure remote session onto a computer with access to the data” in order to carry out the decryption process. RMDR’s FAQ also noted:

We do not recommend dealing with the ‘hacker’ directly (see advice on our home page). In many cases, paying the ransom may be the only option to get your data recovered and it is best to get an experienced consultant to assist with this process.

That same page even provides a link to an online reviews website full of comments from RMDR customers apparently unaware that RM Data Recovery Ltd was charging whopping great markups on the prices it paid blackmailers to unlock encrypted files.

One reviewer was not so convinced, though. “Chisel” wondered: “But I have to say in all fairness that the cost of about $5000 for approx two hours work (remotely) left me wondering if we were taken advantage of. That’s $2500 an hour. I’m grateful that the files are back but at a huge cost.”

Cha-ching!

Red Mosquito’s “data recovery” business appears to be lucrative. In accounts for fiscal year 2017, RM Data Recovery Ltd had more than £300,000 in the bank, according to Companies House records – several orders of magnitude higher than the £300 in the previous year.

In contrast Red Mosquito Ltd had a relatively measly £100,000 in its coffers for FY2017. Both limited companies are small enough to benefit from accounting exemptions, meaning details of their revenues and profits are not required to be reported, though RM Data Recovery’s reported net assets of £283k compared very favourably with the MSP business’ net worth of just £15k.

Red Mosquito Ltd and RM Data Recovery Ltd share the same directors: Neil Rowney, Derek Smith, and Andrew Stark. Both firms are registered to the same business address in Panorama Business Village, Glasgow.

Next time you consider engaging a third-party decryption service, it’s worth bearing this yarn in mind. Emsisoft’s Wosar mused: “Using a data recovery service to recover from ransomware is a bit like buying a car. It can help to bring someone experienced along to help with the negotiation, but you want that person to be a trustworthy relative, not a twat waffle shyster who’ll get you to pay more than necessary and split the difference with the salesman.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/24/red_mosquito_rm_data_recovery_ransomware/

NASA report shows exfiltration totaling more than 100 GB of information since 2009.

Auditors’ reports tend to make for dry reading. But NASA’s Inspector General has delivered a report on “Cybersecurity Management and Oversight at the Jet Propulsion Laboratory” that includes twists and turns — like a hacker using a vulnerable, unapproved Raspberry Pi as a doorway into JPL systems.

That Raspberry Pi was responsible for 500 megabytes of NASA Mars mission data leaving JPL servers. The intrusion resulted in an advanced persistent threat (APT) that was active in JPL’s network for more than a year before being discovered.

This was the most recent breach listed in the report. Other breaches noted date back to 2009 and include exfiltration totaling more than 100 gigabytes of information. Several of the intrusions feature command-and-control servers with IP addresses located in China, though the responsibility for the latest attack was not assigned to any country or actor.

The Inspector General’s report makes a number of suggestions, including greater network segmentation, more rigorous external device approval, and an improved trouble ticket process, for improving cybersecurity at the lab.

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/raspberry-pi-used-in-jpl-breach/d/d-id/1335034?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple