crime – Page 413 – STE WILLIAMS

CERT, CISA Warn of Vuln in at Least 4 Major VPNs

library
crime | hacking | security

VPN products by Cisco, Palo Alto Networks, F5 Networks, Pulse Secure, insecurely store session cookies.

At least four major VPN vendors could be enabling attackers to do the very thing VPNs are made to protect against.

The US-CERT Cybersecurity and Infrastructure Security Agency issued a warning today after CERT Coordination Center reported that multiple VPN vendors store authentication and/or session cookies insecurely in memory and/or log files.

“If an attacker has persistent access to a VPN user’s endpoint or exfiltrates the cookie using other methods, they can replay the session and bypass other authentication methods,” the CERT advisory states. “An attacker would then have access to the same applications that the user does through their VPN session.”

CERT confirmed that Cisco, Palo Alto Networks, F5 Networks, and Pulse Secure products are affected by this vulnerability. However, the issue is repaired in the latest versions of Palo Alto’s products and partly fixed in F5’s.

Pulse Secure issued this statement Friday night:

Pulse was notified by the CERT Coordination Center with regards to a vulnerability. This vulnerability affects older versions of Pulse Secure Desktop and Network Connect clients. However, Pulse Secure had already fixed this vulnerability in the latest Pulse Desktop Client and Network Connect product. Pulse issued a related Security Advisory to disclose this to the public – Security Advisory – SA44114.

Checkpoint and pfSense are unaffected. Status is unknown for over 200 other vendors.

For more information, see here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/cert-cisa-warn-of-vuln-in-at-least-4-major-vpns/d/d-id/1334413?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The Single Cybersecurity Question Every CISO Should Ask

library
crime | hacking | security

The answer can lead to a scalable enterprise security solution for years to come.

In early December 2018, several major corporate breaches were made public. As the news was shared and discussed around my company, one of my colleagues jokingly asked, “I wonder if I can gift some of this free credit monitoring to my future grandchildren.” It was a telling comment.

Today, every organization – regardless of industry, size, or level of sophistication – faces one common challenge: security. Breaches grab headlines, and their effects extend well beyond the initial disclosure and clean-up. A breach can do lasting reputational harm to a business, and with the enactment of regulations such as GDPR, can have significant financial consequences.

But as many organizations have learned, there is no silver bullet – no firewall that will stop threats. They are pervasive, they can just as easily come from the inside as they can from outside, and unlike your security team, who must cover every nook and cranny of the attack surface, a malicious actor only has to find one vulnerability to exploit.

The security challenge is compounded by the security talent gap, which has reached crisis levels. That is why executives in every industry must ask themselves: How do I scale the resources I have to meet the cybersecurity needs of my organization? The hidden answer: IT operations.

Uniting for a Common Purpose
In a world in which security and IT operations are often at odds, this may seem counterintuitive, but the truth is what SecOps calls “the attack surface” is what IT ops calls “the environment.” And no one knows the enterprise environment – from the data center to the cloud to the branch and device edge – better than the team tasked with building and managing it.

Many of our most sophisticated customers already use IT operations to help build a more robust security posture. Drawing from conversations with these organizations, industry analysts, internal experts at ExtraHop, and my own experiences from decades working in business operations, here are some of the most important things CIOs and CISOs can do to create a co-operational framework for security and IT ops.

• Security cannot come at the expense of uptime: For any organization, ensuring the consistent availability and performance of business-critical systems is paramount. If a security measure compromises availability, the business itself is compromised. Security teams need to work with IT ops and line-of-business stakeholders to understand performance requirements and then build a security framework that accounts for an acceptable level of risk.

• It’s OK to fail if you can recover: Efficient business operations always require some level of risk, and that means accepting that some failures are going to happen. For security teams, this means accepting that malicious actors will get in. The question becomes how quickly you can detect, investigate, and stop that activity.

IT operations, with its working knowledge of system behaviors and interactions, can play a vital role in helping to detect threats before they result in disaster. They just need the tools and understanding to know what to look for. Just as line-of-business stakeholders work cross-functionally to scale knowledge and improve outcomes, security and IT ops will better serve the business through collaboration.

• Responsibility for secure operations can and should be shared: If you provide IT ops with the right tools, it’s possible for SecOps to use IT ops for some important security activities. These should be lower on the risk scale, and they should be things that don’t require a high degree of specialized knowledge.

• Cooperation benefits compliance as well: While breaches grab headlines (and garner record-setting fines), compliance failures can also have significant business consequences. Regulations such as GDPR and HIPAA require organizations to meet strict standards for protecting data and privacy. While SecOps and IT ops play their own roles in ensuring clean and compliant practices, sharing both knowledge and resources is a smarter way of scaling to meet compliance demands.

Moving Forward
From the interactions between applications to how to create secure configurations, far too often we find that IT ops and SecOps fail to share important knowledge. As too many organizations have learned the hard way, this siloed, sometimes oppositional model can have serious consequences.

There is no perfect fix for cybersecurity, and nothing will ever be 100% secure. Threat actors are highly motivated to find new and innovative ways around every solution that tries to keep them out. But with a combination of strategy, structure, staffing, and systems, it’s possible to gain an advantage that will evolve and scale to keep disaster at bay.

Finding talented security professionals is becoming increasingly difficult. But when you promote an environment of cooperation and communication, you can build a more scalable enterprise security solution for 2019 and beyond. At the end of the day, the best team wins.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Arif Kareem is CEO and president of ExtraHop Networks. He holds over 30 years of experience formulating and executing business and operational strategies to accelerate growth in the enterprise and technology markets. Before joining ExtraHop, Kareem served … View Full Bio

Article source: https://www.darkreading.com/application-security/the-single-cybersecurity-question-every-ciso-should-ask-/a/d-id/1334376?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Facebook admits “supply chain data leak” in new Oculus headsets

library
crime | hacking | security

Oculus, Facebook’s virtual reality subsidiary, has fessed up to what might be the weirdest ever data leak.

OK, so it might not actually be a data leak at all, even though messages that weren’t supposed to be released seem to have got out.

And even if it is a data breach, it’s kind of cool – did we say that aloud, or just think it? – and may end up making the affected devices more sought after, and worth more money on online auction sites, than vanilla ones.

At any rate, if we were a Data Privacy Officer – a job that we suspect might be thin on opportunities for fun, games and humour – we’d be cracking a smile at this one, if not breaking into laughter, instead of reaching for our breach report forms.

The leaked messages are, literally and physically, printed characters that ended up hidden inside “tens of thousands” of new Oculus motion controllers.

We’re not big VR fans ourselves, but we think that motion controllers are the things you strap onto your hands so you can waft your way through virtuality, rather than the masochistic-looking faux diving goggles [Can we just say ‘sinister’ or ‘peculiar’ instead? – Ed.] that you wear while immersed in unreality.

Supposed to be found

The hidden messages were presumably there to be found by the more obsessive among the journalists and developers who received prototype and pre-release versions for review.

When you give cool new hardware out hoping to attract publicity, the techies who get it [a] haven’t had to pay for it, [b] don’t have to give it back, and [c] want to know what’s inside, so the ~~second~~ first thing they are going to do is…

…TAKE IT APART!

Forget about the illusory access control provided by weird pentalobe security bolts, or so-called security screws hidden behind warranty stickers, or those fantastically fine tolerances that are supposed to keep even the thinnest guitar picks and spudgers away from the clips that keep the case together.

The word spudger isn’t in Oxford’s British or American Dictionaries yet, but it should be. You’ll find the word used right back in the 1920s to describe hand-crafted, non-conductive wooden tools used to tweak radio receivers while they were electrically live; these days, spudgers are usually made of soft, springy plastic to prevent scratches rather than to avoid short circuits. Modern spudgers generally resemble dainty-looking bicycle tyre levers, and are used for easing apart tight-fitting plastic components held together by internal clips that are intended to convince you that there really are “no user serviceable parts inside”.

If it can be taken apart, it will be; and if it can’t, well, it will be anyway – there is no can’t.

So, why not leave secret messages inside for the early adopters to find and enjoy?

That’s exactly what happened, according to Oculus supremo Nate Mitchell, except that the plans went slightly awry:

The messages on final production hardware say “This Space For Rent” “👁The Masons Were Here.👁” A few dev kits ship… twitter.com/i/web/status/1…

—
Nate Mitchell (@natemitchell) April 12, 2019

As officially admitted by Mitchell above, the “early adopter” messages that went where they were supposed to – into the hands of reviewers and developers – were as follows:

   👁Big Brother is Watching👁 

   Hi iFixit! We See You!👁

The second message pays homage to device deconstruction experts iFixIt, who publish gloriously neat and detailed teardowns of just about everything, even absurdly jammed-full devices like Apple’s Retina Macbooks, which rate 1/10 for “repairability”.

But some devices that have already been sent out into the consumer market supply chain inadvertently shipped with these words inside:

   This Space For Rent

   👁The Masons Were Here.👁

This sort of hidden “feature” is known in the technology industry as an Easter Egg, because it’s there for techies to hunt down and cheer about when found.

Today, by the way, is Palm Sunday, exactly one week out from Easter itself, but that’s a coincidence. [Are you sure – Ed.]

Easter Eggs considered harmful

The problem with IT-related Easter Eggs these days, especially if they’re programmatically embedded into software, firmware or websites, is that hidden features are generally regarded as a very bad thing indeed.

Firstly, backdoors – secret, undocumented, insecure ways past login screens or cryptographic protections – count as “hidden features”, and we all know what we think about backdoored products and algorithms.

Secondly, Easter Eggs are supposed to be little-known and hidden, so they tend to get a lot less testing than regular code, and may even bypass entirely the code review and sign-off processes that are supposed to happen before release.

Thirdly, Easter Eggs often get forgotten about, and jokes that might have been appreciated at one time by a select audience end up weird at best and creepy at worst if they survive past their use-by date.

What to do?

In general, if you’re a developer, avoid Easter Eggs in your code – they’re more trouble than they’re worth.

In this specific Easter Egg story, however, there’s nothing you need to do. (If you insist on taking some action, a smile wouldn’t hurt.)

This isn’t a misfeature that’s part of the firmware in the new Oculus devices; it’s not a software vulnerability; and even if you get one of the misprinted devices, you’re not going to see the message unless you are determined to do so by prising the device apart.

In fact, we wouldn’t be surprised to see devices that contain the Masons were here message fetching well-above-retail prices on online auction sites.

As Twitterer @dr_oculus quickly said:

@natemitchell This is awesome! I’ll take 10

—
Dr oculus vr (@dr_oculus) April 12, 2019

What we can’t tell you, if you’re a collector who values that kind of thing, is how you’d tell a genuine dodgy Touch controller from a counterfeit dodgy controller if you came to buy one.

We also can’t be sure…

…but maybe we just got zuckered into a funky PR campaign, along with everyone else?

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/CbOhkzYRYTw/

Can you detect hidden cameras in hotel rooms? [VIDEO]

library
crime | hacking | security

Last week, we wrote about a New Zealand family that stumbled across a snoopy spycam in an AirBnB they’d paid for while vacationing in Ireland.

The Emerald Isle is a long way from the Land of the Long White Cloud, so they couldn’t just cut their holiday short, get in the car and head back home.

Instead – and in a glorious irony – they used the insecurely configured spy camera itself to stream and capture a video of themselves as evidence, jammed up the lens of the hidden camera with toilet paper, and found somewhere else to stay.

One side effect of this article was that we received a raft of questions – from colleagues, friends and family; from you, our readers; and via social media – asking, “Can you reliably detect hidden cameras? Is there an app for that?”

The answer, as with so many issues in cybersecurity, is a rather indecisive “Yes and No,” so we decided to cover the issues in this week’s Naked Security Live video:

(Watch directly on YouTube if the video won’t play here.)

By the way, if you like the shirt in the video (who doesn’t?), head to https://shop.sophos.com/ to buy one of your own.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/JBs1w8PbVyI/

IE under fire, Triton goes under the microscope, and Norsk Hydro reeling from ransomware attack

library
crime | hacking | security

As April hits its stride, we saw a week of Wi-Fi bugs, Assange’s public eviction and King’s College warnings.

These things also happened.

Need another reason to quit using Internet Explorer? How about this XXE zero-day?

Microsoft has all but killed off Internet Explorer, but more than a few PC owners continue to hold out. Hopefully a bug unveiled this week will help to change a few minds.

A vulnerability discovered by researcher John “hyp3rlinx” Page would allow an attacker to potentially spy on a victim’s machine by exploiting an XML External Entity flaw. To do this, the victim would have to open a specially-crafted MHT file.

While information disclosure flaws that require user interaction are hardly critical vulnerabilities, the report should serve as motivation for anyone still using IE to make the switch to Edge (or consider a non-Microsoft browser). Only one version of Internet Explorer, IE11, is still even supported, and Microsoft has already moved Edge to a new engine. Now is the time to finally migrate.

Tenable blows hole in Verizon routers

If you were wondering why your Verizon FiOS router was updating this week, it turns out there was a serious security vulnerability in the nearly ubiquitous home gateway.

Tenable took credit for sussing out a handful of vulnerabilities in the Quantum Gateway routers Verizon supplies customers (unless you opt to buy and use your own unit).

The bugs include login replay, command injection and the disclosure of salted passwords. There is some mitigation, as the bugs would all require the attacker to already be on the network to exploit, but if targeted, they could allow a bad guy to get admin access.

Tenable is recommending all Verizon FiOS customers check their firmware and make sure they have the latest version, 02.02.00.13. Verizon should have already pushed the fix out.

Triton malware rides again with another industrial system hack

Back in 2017, an attack on an oil and gas plant in the Middle East was attributed to piece of industrial Control system malware known as Triton. Since then, the targeted attack crew was pretty silent. Until this week.

APT specialists FireEye say they are responding to another attack from Triton at a “critical infrastructure facility. This latest attack has let the security house get a closer look at the malware and the methods its controllers use to get into their targeted facilities.

Now, FireEye is issuing its first set of guidelines on how to spot the attack and the ways admins and managers can protect vital industrial sites.

“Using the methodologies described in this post, FireEye Mandiant incident responders have uncovered additional intrusion activity from this threat actor – including new custom tool sets – at a second critical infrastructure facility,” FireEye says.

“As such, we strongly encourage industrial control system asset owners to leverage the indicators, TTPs, and detections included in this post to improve their defenses and hunt for related activity in their networks.”

Oh geez! Hacker hits Minnesota DHS, don’t you know

An attack on a single employee of the Minnesota state government may have lead to thousands of peoples’ data being exposed.

A targeted attack from Spring of last year is said to have lead to an employee at the state’s Department of Human Services having their email account breached. At some point in the last year, that attacker then took over their account, which had access to the personal details of 11,000 citizens.

Fortunately, it does not look like identity theft was the primary aim of the attacker. The compromised account sent two emails to other employees in an attempt to get a wire transfer sent out. Still, because the compromised account had access to files containing the personal details, the department has had to issue an alert to the state.

“State and local governments are highly susceptible to phishing attacks, as we see from the rolling spate of SamSam ransomware attacks,” noted Colin Bastable, CEO of Lucy Security. “This looks like a business email compromise (BEC) attack, which takes more planning than a standard phishing attack but can be very profitable.”

Greenville, NC locked up by ransomware

Another week, another city government crippled by a ransomware infection.

This time, it’s the town of Greenville, North Carolina that is reporting much of its IT system has had to shut down after an unspecified ransomware attack locked down one or more machines.

“The city has shut down the majority of its servers for the foreseeable future,” the local Daily Reflector reports. “There was no word on Thursday about when the system would be up and running again.”

So now it’s time for the obligatory warnings on ransomware: don’t pay the demands (there’s a good chance you will not be getting your data back either way) and opt instead to completely wipe and restore any infected system. To that end, you should be making regular backups of systems for this reason.

Princeton pushes home IoT scanner

Eggheads at Princeton University have developed a tool they say can help even non-technical users get a grip on what devices are transmitting data in their homes.

The self-explanatory IoT Inspector is a simple app (currently only for MacOS) that allows homeowners to run a full scan of their networks and get a report on what devices are using it, and where they are sending their data.

The idea is to allow people to see exactly what their IoT devices are up to, and perhaps even spot potential IoT botnet infections before they can do serious damage. More importantly, it is being aimed at other researchers and security devs who want to see how devices are behaving in the field.

“We have also built IoT Inspector to help academic researchers. In particular, it is difficult to produce generalizable results in the study of IoT security and privacy,” the Ivy-leaguers said.

“Although a researcher can purchase a few devices and conduct penetration tests on them in lab settings, the conclusion may not apply to diverse devices that are actually being used in consumer homes or enterprise networks.”

Norsk says malware menace is pushing back its financials

Last month, Norwegian metal and power specialist Norsk Hydro was hit by a nasty ransomware attack that caused it to shut down much of its industrial operations. While that infection has since been corralled, the fallout continues to the point where Norsk Hydro says it can’t post its quarterly numbers on time.

“The delayed Q1 2019 reporting date is a result of the previously communicated cyber attack, impacting the availability of certain systems and data to produce the quarterly report,” the Norwegian biz says. “The revised date is conditional upon the planned timeline for restoring operational and reporting systems.” ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/04/13/security_roundup_120419/

IE under fire, Triton goes under the microscope, and Norsk still reeling from ransomware attack

library
crime | hacking | security

As April hits its stride, we saw a week of Wi-Fi bugs, Assange’s public eviction and King’s College warnings.

These things also happened.

Need another reason to quit using Internet Explorer? How about this XXE zero-day?

Microsoft has all but killed off Internet Explorer, but more than a few PC owners continue to hold out. Hopefully a bug unveiled this week will help to change a few minds.

Tenable blows hole in Verizon routers

If you were wondering why your Verizon FiOS router was updating this week, it turns out there was a serious security vulnerability in the nearly ubiquitous home gateway.

Tenable took credit for sussing out a handful of vulnerabilities in the Quantum Gateway routers Verizon supplies customers (unless you opt to buy and use your own unit).

Tenable is recommending all Verizon FiOS customers check their firmware and make sure they have the latest version, 02.02.00.13. Verizon should have already pushed the fix out.

Triton malware rides again with another industrial system hack

Now, FireEye is issuing its first set of guidelines on how to spot the attack and the ways admins and managers can protect vital industrial sites.

Oh geez! Hacker hits Minnesota DHS, don’t you know

An attack on a single employee of the Minnesota state government may have lead to thousands of peoples’ data being exposed.

Greenville, NC locked up by ransomware

Another week, another city government crippled by a ransomware infection.

This time, it’s the town of Greenville, North Carolina that is reporting much of its IT system has had to shut down after an unspecified ransomware attack locked down one or more machines.

Princeton pushes home IoT scanner

Eggheads at Princeton University have developed a tool they say can help even non-technical users get a grip on what devices are transmitting data in their homes.

“We have also built IoT Inspector to help academic researchers. In particular, it is difficult to produce generalizable results in the study of IoT security and privacy,” the Ivy-leaguers said.

Norsk says malware menace is pushing back its financials

Last month, Norwegian metal and power specialist Norsk Hydro was hit by a nasty ransomware attack that caused it to shut down much of its industrial operations. While that infection has since been corralled, the fallout continues to the point where Norsk says it can’t post its quarterly numbers on time.

“The delayed Q1 2019 reporting date is a result of the previously communicated cyber attack, impacting the availability of certain systems and data to produce the quarterly report,” the Norweigan company says. “The revised date is conditional upon the planned timeline for restoring operational and reporting systems.” ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/04/13/security_roundup_120419/

Senate Report on Equifax Raises Questions Ahead of FICO Product Announcement

library
crime | hacking | security

Equifax is slammed in a Senate subcommittee report ahead of the announcement of a joint service with FICO.

When your company is named in a Senate subcommittee report headline that also includes the words “neglected” and “devastating” it’s rarely a good thing. Equifax finds itself in just that situation this week, though the company is not letting that keep it from announcing a partnership that has some observers concerned about consumer privacy.

The staff report issued by the United States Senate Permanent Subcommittee on Investigations of the Committee on Homeland Security and Governmental Affairs is titled How Equifax Neglected Cybersecurity and Suffered a Devastating Data Breach. And the title isn’t even the most blunt statement of the report. In the conclusion of the report, the staff writes that Equifax didn’t prioritize security, didn’t follow its own policies for patching a critical vulnerability, and left itself open to attack due to poor cybersecurity practices, among other faults.

The report also notes that Equifax could have minimized damage had it put basic controls and policies in place, rather than allowing the personal information of millions of individuals to be compromised.

Within the report there are a couple of findings that seem at odds with one another. First, the report states that Equifax executives are firm in their belief that they did everything possible to avoid the breach — in particular, the CIO who served from 2010 to 2017 said that he doesn’t believe Equifax could have done anything differently.

However, fellow credit bureaus TransUnion and Experian each used the same product that was the source of the Equifax vulnerability (Apache Struts) — and yet they avoided a breach by responding to the vulnerability very quickly and patching it long before the Equifax attack was underway.

This report is a prelude to the announcement that Equifax and FICO are joining forces in a Data Decisions Cloud that will provide deeper, more detailed financial information on consumers to companies that subscribe to the big data product. FICO is traditionally a data analysis firm best known for the credit score that’s used for everything from approving loans to setting insurance rates. Equifax reports on consumers with data that includes the FICO score, and the combination of the two is seen by some privacy advocates as the worst of all possible worlds — a company with known security issues developing (and storing the data for) products that involve more personal data than ever before.

In the announcement of the new service, the two companies said that they are, “…focused on a connected, end-to-end development and decisioning management platform that allows customers to quickly explore, develop, test and deploy powerful insights into production systems across the organization.” The question may not be whether the service can deliver on this promise to customers, but whether Equifax has taken sufficient action based on its huge breach to avoid being the subject of another Senate security investigation in the future.

Related content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/senate-report-on-equifax-raises-questions-ahead-of-fico-product-announcement/d/d-id/1334415?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Bucharest’s Bayrob boys blasted based on bogus buys, Bitcoin banditry, bound to be behind bars

library
crime | hacking | security

Two Romanian nationals face the prospect of years in a US prison after being convicted for their roles in a malware-based financial fraud ring.

Bogdan Nicolescu, and Radu Miclaus, both of Bucharest, were found guilty Thursday on counts of conspiracy to commit wire fraud, conspiracy to traffic in counterfeit service marks, aggravated identity theft, conspiracy to commit money laundering, and 12 counts of wire fraud. In total, each man caught convictions on 21 charges.

They will be sentenced on 14 August.

Over the 12-day trial in the Northern Ohio US District Court, prosecutors outlined how the two men, along with the already-convicted Tiberiu Danet (due to be sentenced next month), orchestrated a scheme to infect machines with spyware and then used that to harvest financial account details, redirect traffic to phishing sites, mine cryptocurrency and register bogus email accounts.

Known as Bayrob, the operation extracted money from its victims on a number of fronts.

Bayrob: Romanian auction fraud suspects extradited to the US

In addition to swiping bank accounts and selling personal information on darknet markets, the trio would use the malware to redirect infected machines from sites like eBay to look-alike pages on servers they owned. Believing they were purchasing items from legitimate auction sites, victims were instructed to pay money to an “escrow agent” who actually a money mule.

“It began in 2007 with the development of proprietary malware, which they disseminated through malicious emails purporting to be legitimate from such entities as Western Union, Norton AntiVirus and the IRS. When recipients clicked on an attached file, the malware was surreptitiously installed onto their computer,” the DOJ said.

“This malware harvested email addresses from the infected computer, such as from contact lists or email accounts, and then sent malicious emails to these harvested email addresses.”

The group would also look to turn a quick buck by using the compute power of their malware-infected machines to mine cryptocurrency. It is estimated that, at its peak, Bayrob enlisted more than 400,000 infected PCs in its ranks.

The scheme ran from 2007 until 2016, when the group was arrested sent to the US to face trial. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/04/12/romanian_crims_caught/

US-Cert alert! Thanks to a massive bug, VPN now stands for “Vigorously Pwned Nodes”

library
crime | hacking | security

The US-Cert is raising alarms following the disclosure of a serious vulnerability in multiple VPN services.

A warning from the DHS cyber security team references the CMU Cert Coordination Center’s bulletin on the failure of some VPN providers to encrypt the cookie files they place onto the machines of customers.

Ideally, a VPN service would encrypt the session cookies that are created when a user logs in to access the secure traffic service, thus keeping them away from the prying eyes of malware or network attacks. According to the alert, however, sometimes those keys were being kept unencrypted, either in memory or on log files, allowing them to be freely copied and re-used.

From directory traversal to direct travesty: Crash, hijack, siphon off this TP-Link VPN box via classic exploitable bugs

“If an attacker has persistent access to a VPN user’s endpoint or exfiltrates the cookie using other methods, they can replay the session and bypass other authentication methods,” the post explains. “An attacker would then have access to the same applications that the user does through their VPN session.”

To be clear, the vulnerable cookies are on the user’s end, not on the server itself. We’re not talking about a takeover of the VPN service, but rather an individual customer’s account. The malware would also need to know exactly where to look on the machine in order to get the cookies.

So far, vulnerable parties include Palo Alto Networks GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS, Pulse Secure Connect Secure prior to 8.1R14, 8.2, 8.3R6, and 9.0R2, and Cisco AnyConnect 4.7.x and prior. Palo Alto has already released a patch.

Check Point and pfSense, meanwhile, have confirmed they do encrypt the cookies in question.

Possibly dozens more vendors are going to be added to the list, however, as this practice is believed to be widespread. The site notes that over 200 apps have yet to confirm or deny that their session cookies are left unencrypted.

“It is likely that this configuration is generic to additional VPN applications,” the notice explains. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/04/12/uscert_vpn_alert/

Romanians Convicted in Cybertheft Scheme

library
crime | hacking | security

Working out of Bucharest since 2007, a pair of criminals infected and controlled more than 400,000 individual computers, mostly in the US.

Two Romanian men have been convicted of conspiracy to commit wire fraud, conspiracy to traffic in counterfeit service marks, aggravated identity theft, conspiracy to commit money laundering, and 12 counts each of wire fraud.

The convictions were in association with a scheme to infect victims’ computers with malware, then steal credit card and other information to sell on dark market websites, mine cryptocurrency, and engage in online auction fraud. According to court documents, Bogdan Nicolescu and Radu Miclaus, along with a third co-conspirator who has pled guilty, operated their scheme from Bucharest beginning in 2007. The defendants ultimately infected and controlled more than 400,000 individual computers, primarily in the United States.

Nicolescu, Miclaus, and their co-conspirator earned money from their victims by selling credentials on the Dark Web, advertising fraud using email accounts created in the victims’ names, cryptocurrency mining, and stealing money and cryptocurrency through credit card fraud.

Sentencing is scheduled for August 24 in the Northern District of Ohio.