STE WILLIAMS

A gift from Craigslist’s founder Craig Newmark is funding the development of cybersecurity toolkits for journalists and elections offices ahead of the 2020 US elections. The toolkits, which will be developed by the Global Cyber Alliance (GCA), are intended to “protect journalists and media outlets from cyber-attacks that are designed to either manipulate public opinion or expose sources, enable election boards or other bodies to leverage the latest in cybersecurity protections to preserve election integrity and help ensure that all votes are accurately recorded and counted, and secure nonprofit community organizations that work to uphold the right to vote,” according to the announcement of the gift.

“Our country is under attack by some really bad actors and we need to help protect the people who keep our democracy safe. That includes journalists and that includes people who run our elections,” says Newmark, founder of Craigslist and of Craig Newmark Philanthropies, which  is providing a gift of $1.068 million to the GCA for developing toolkits. Asked why he sees journalists as worthy of the type of defense he’s funding for election offices, Newmark says, “in high school US history I learned that a trustworthy press is the immune system of democracy. The press helps keeps us safe by telling us what’s going on.”

Philip Reitinger, president and CEO of the GCA says that his organization will be able to use expertise from developing the small business toolkit to develop separate toolkits for journalists, elections offices, and the NGOs that monitor elections. “We’re going to use the same approach with regard to elections officials and media journalists but they’ll be distinct things. The capabilities in our toolkit will be tailored for the particular audience,” he says. “Our goal is to take the resources that Craig Newmark has given us, and customize and direct a set of unique capabilities for each of these audiences that will help them solve their problem.”

Each toolkit will contain operational tools, clear guidance, and recommendations, and will be built following guidelines set out in the Center for Internet Security’s (CIS) top Critical Controls. The toolkits will be available at no charge from the GCA.

“Americans need to work together to protect the country and among other things that means better support for journalists and better support for the people who make our elections run. This is serious,” says Newmark.

“I think people have lost sight of the importance of media and journalists in the free exercise of the basic functioning of democracy,” says Reitinger, “So I think it’s really critical that we all work together to to move cybersecurity forward so we can have trustworthy elections.”

Related content:

• Could Beto O’Rourke Become the First Hacker President?
• Cyberattack Hits Australian Parliament
• Election Security Isn’t as Bad as People Think
• Redefining Critical Infrastructure for the Age of Disinformation
• The Coolest Hacks of 2018

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/craigslist-founder-funds-security-toolkit-for-journalists-elections-/d/d-id/1334381?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

As software, aka applications, microservices, and workloads, increasingly moves into the cloud, its protection has become paramount. Recent research highlights this need, pointing to application vulnerabilities as the leading source of security breaches in 2018. The “Verizon Data Breach Investigations Report,” for example, confirms that a vast majority of breaches happen either due to spear-phishing or application vulnerability exploits. These are the two seminal challenges for cybersecurity in the coming decade.

Yet the ugly truth, according to a recent SANS Institute survey titled “Secure DevOps – Fact or Fiction?,” is that only 10% of organizations report repairing critical vulnerabilities satisfactorily and in a timely manner. Clearly something has to change.

In order to understand what that change is, we first need to have a clear view of the current state of application security. Application security operates in the development (dev) and production (prod) phase of the software development life cycle (SDLC). In dev, the goal is to find and fix vulnerabilities before releasing insecure code. In prod, the goal is to protect the application from all of its vulnerabilities. Theoretically, software providers need only one or the other, but since neither is foolproof, most companies cover their bases with some form of both.

Gartner identifies three available code analysis techniques:

1. SAST: Static application security testing analyzes the application from the inside-out by inspecting its source code. SAST’s advantages are that it leverages fundamental knowledge of vulnerabilities to inspect the source code and is therefore the most thorough of all AST techniques. It can be used for any code as long as the programming language is supported, and it’s performed closest to dev, making it the least expensive way to find and fix vulnerabilities.

On the flip side, traditional SAST scan times are slow, requiring hours or even days to complete, which doesn’t work well in increasingly automated continuous integration and continuous delivery (CI/CD) environments. False-positives are also an inherent part of the SAST process. Moreover, traditional SAST does not analyze an entire application, forcing organizations to buy a separate tool for software composition analysis (SCA). Even SCA merely identifies publicly known vulnerabilities; unknown vulnerabilities in open source, third-party APIs, or frameworks is out of scope for both SAST and SCA.

2. DAST: Dynamic application security testing probes the application from outside in, treating it as a black box and testing exposed interfaces for vulnerabilities. DAST generally results in low false-positives and can be performed even when the application’s source code is not available (for instance, with third-party applications). It is particularly good at accurately identifying externally visible vulnerabilities. DAST can be performed for any application, regardless of programming language, as long as the test scripts are available, and it can find vulnerabilities in open source software, third-party APIs, and frameworks.   

That said, DAST requires test scripts to test everything, which is impossible from a practical standpoint and requires heavy reliance on experts to write tests, making it difficult to scale. More importantly, by definition it only analyzes exposed interfaces, which presumes an attacker only has external access – yet insider threats and complex “peel-the-onion” attacks are some of the most dangerous. DAST also provides insufficient information to the developer about why and where a vulnerability exists, requiring considerable time to identify the root cause. The efficacy of DAST is thus directly proportional to the quality and volume of QA, making it ill-suited for modern, fast-paced DevOps pipelines.

3. IAST: Interactive application security testing aims to improve on DAST by instrumenting the application to allow deeper analysis (beyond just exposed interfaces) and can be considered a superset of DAST. Its advantages and disadvantages are similar to those of DAST, with the added drawback that the application instrumentation means it needs to support the application programming language. In particular, it can only be performed on languages that have a virtual runtime environment, such as Java, C#, Python, and NodeJS. It cannot support languages such as C, C++, and Golang.

A New Approach
Clearly each approach has advantages and disadvantages. But if the appsec industry as a whole were to develop a better AST solution from scratch, what might it look like? First, its analysis would mirror the more comprehensive inside-out paradigm of SAST but be much, much faster. Like DAST, it would analyze the entire application, including dependencies, third-party APIs, and frameworks. After all, a hacker only needs one vulnerability in an entire application to wreak havoc.

The analysis also wouldn’t be generic. Developers would be able to leverage their application knowledge to write new custom queries or edit existing ones. For instance, if a team has written a custom API to escape inputs, the tool needs to take this API into account. A better approach would understand the flow of an application so even when no clear vulnerability is identified (a false-negative), monitoring of runtime behavior compared to the inherent flow of the application can identify when an application has been successfully exploited.

As noted earlier, SAST in itself is incomplete, so it should be combined with the ability to take data from the production environment to address otherwise inherent reachability challenges. This would require a microagent that deeply instruments the application (like IAST) and is designed around the stringent performance and stability requirements of a production environment. Because this microagent is designed for production, it should easily run in QA where, if tested with QA/security test scripts, can function as an “enhanced” IAST. Yet, unlike IAST, the microagent should learn from SAST where it needs to instrument the application. So, for example, if the application is not vulnerable to SQL injection, why instrument the application and alert on SQL injection patterns?   

Given that only 10% of organizations today report satisfactory and timely repair of critical vulnerabilities, regardless of how good an AST tool chain is, there will be unfixed vulnerabilities deployed into the production environment. In other words, AST does not eliminate the need for a tool to protect applications in production.

Yet today’s typical security approach is to deploy a tool or appliance that continuously alerts on threats, regardless of whether the application itself is vulnerable to that particular threat. Even if the alert is relevant, it demands considerable time spent investigating if, and where, the vulnerability exists. Worse, when a vulnerability is not relevant or has been fixed, the security tool will continue generating alerts regarding the same, now benign traffic.

In contrast, this better approach instruments the application based on SAST findings, ensuring the protection is high-performing and accurate. It will also tell the developer about the vulnerability and the specific location in code that needs to be fixed.

That’s the point of continuous improvement: code analysis informs runtime and runtime traffic informs code analysis. And it should be the key goal of every application security program.

Related Content:

• Tidying Expert Marie Kondo: Cybersecurity Guru?
• 6 Ways Mature DevOps Teams Are Killing It in Security
• 4 Ways At-Work Apps Are Vulnerable to Attack
• Security Pros Agree: Cloud Adoption Outpaces Security 

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Manish Gupta is the CEO and co-founder of ShiftLeft Inc. He was previously the chief product and strategy officer at FireEye, helping grow the company from approximately $70 million to more than $700 million in revenue and expanding the product portfolio from two to more than … View Full Bio

Article source: https://www.darkreading.com/application-security/a-new-approach-to-application-security-testing/a/d-id/1334309?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Baldr is a fairly new stealer on the threat landscape, though researchers say its rapid development signifies authors are preparing to cultivate a long-term problem.

The team at Malwarebytes Labs has been monitoring the heightened growth and development of stealers for the past few months; it reports Baldr first appeared in January. Analysis indicates Baldr’s developers are investing time and effort into their product, which, like many stealers, is becoming more popular as cybercriminals hunt for easy means to snag valuable data.

Stealers are sneaky, and victims rarely know they’re hit unless it’s detected at delivery. Upon infection, stealers typically scan the target machine and grab what they need – browser history, screenshots, passwords, cookies – in as little as a minute, explains Malwarebytes threat intelligence lead Jerome Segura. They may also seek out files containing sensitive information.

Unlike banking Trojans, stealers are nonresident, he continues. “They’re not going to stay on the computer for long periods of time,” Segura says. Once the stealer has what its author is looking for, it zips the files, uploads them to the attacker’s server, and vanishes. Victims who scan for a stealer after its disappearance will likely never know it was there, he points out. 

Not A Script Kiddie’s Work
Baldr is likely the product of three threat actors: Agressor for distribution, Overdot for sales and promotion, and LordOdin for development. Overdot, which was previously linked to the Arkei stealer, markets Baldr on message boards, helps customers via Jabber, and addresses complaints in boards’ reputational systems. Baldr has proved popular on Russian hacking forums, researchers point out, and has a reputation for decent communication with authors.

Since it was first detected, Baldr has evolved from version 1 to version 2.2, the latest edition analyzed by the Malwarebytes team. Researchers collected a few different versions of Baldr, which has short development cycles and was most recently updated on March 20.

Baldr’s main functionality can be described in five steps: It first collects a list of user profile data, from the user account name to OS type. After that, it goes through files and folders in key locations on the machine, keeping an eye out for sensitive info. Baldr then conducts “ShotGun” file grabbing, grabbing the contents of .doc, .docx, .log, and .txt files it finds. The last step in data collection is to grab a screenshot of the user’s computer. Finally, it exfiltrates the package.

While there’s nothing especially groundbreaking about how Baldr works on target machines, it’s worth noting the developers seem invested in crafting this threat for long-term success. “It is not the work of a script kiddie,” as researchers warn in a blog post on their analysis.

When it was first rolled out, Baldr “had what you’d expect in terms of capabilities,” Segura says. As its customer base grew, authors introduced bug fixes and improved the back end. Baldr sold for $100, which included the stealer along with a control panel to track the number of victims, download stolen data, and view stats like victims’ location and operating systems they used. He anticipates Baldr’s authors will continue to add new features and bug fixes in future versions.

Stealer Upgrade: Targeting YouTube, Bitcoin
Attackers have several means of targeting victims with Baldr; one of the primary vectors is the use of malicious applications masked as hacking tools. Researchers found YouTube videos offering fake programs to create free Bitcoin, which turned out to be Baldr stealers in disguise.

“There is no such thing as free Bitcoin, but some people will still look for them,” Segura says. Plenty of YouTube videos promise get-rich-quick hacks accompanied with a malicious link. “People will download and try to do what they do in the video, but in actuality they’re going to infect themselves,” he adds. 

While stealers aren’t a new threat, old ones were more focused on passwords and browser histories. New stealers are beginning to focus on cryptocurrency wallets and their passwords, and to seek them out when scanning target machines. Segura speculates there could potentially be a link between the YouTube videos promising free Bitcoin and the targeting of cryptocurrency wallets once Baldr lands on a victim’s machine.

Related Content:

• Craigslist Founder Funds Security Toolkit for Journalists, Elections
• ‘Digital Doppelganger’ Underground Takes Payment Card Theft to the Next Level
• ‘Exodus’ iOS Surveillance Software Masqueraded as Legit Apps
• Credential-Stuffing Attacks Behind 30 Billion Login Attempts in 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/meet-baldr-the-inside-scoop-on-a-new-stealer/d/d-id/1334382?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft today issued its April batch of security fixes, which patches 74 vulnerabilities including two Windows zero-days under active attack.

CVE-2019-0803 and CVE-2019-0859 both patch Windows elevation of privilege bugs found exploited in the wild. Microsoft describes both patches in a similar manner: In short, a vulnerability exists when the Win32k component doesn’t properly handle objects in memory. An attacker could exploit this to run malicious code in kernel mode and install programs; view, change, or delete data; or create a new account with full user rights.

If this sounds familiar, it’s likely because last month’s Patch Tuesday also addressed two zero-day elevation-of-privilege vulnerabilities in Windows. Both were rated Important in severity, enabling an attacker with system access to increase their privileges and take over the system.

“This has been a trend in several Patch Tuesday releases, where researchers have reported Win32k elevation of privilege bugs leveraged by attackers as zero-days, which begs the question of just how many of these vulnerabilities attackers have stockpiled,” notes Satnam Narang, senior research engineer at Tenable, in response to today’s security updates.

As in March, one of these flaws (CVE-2019-0859) was reported by Kaspersky Lab. CVE-2019-0803 was found by the Alibaba Cloud Intelligence Security Team. Both are classified as Important in severity. There is no indication of how the bugs are being used in the wild; however, the discovery by Kaspersky Labs is a sign either or both could have been used in targeted malware.

Windows zero-days aside, a few other patches warrant attention to this month. One of these is CVE-2019-0853, a GDI+ remote code execution (RCE) bug categorized as Critical. A bug exists in how the Windows Graphic Design Interface handles objects in memory. Attackers who successfully exploit the bug could take over an affected system, and they could do so by tricking people into visiting a malicious website or downloading a bad attachment.

Several Microsoft products, including Windows and the Office suite, use the GDI+ component. Given how this bug can be exploited remotely, security admins are advised to prioritize this one when rolling out updates.

Among the other remote code execution vulnerabilities patched this month is CVE-2019-0822, an RCE flaw that exists in the way the Microsoft Graphics Components handle objects in memory. To exploit it, an attacker could send the victim a specially crafted file. There are also a handful of RCE bugs (CVE-2019-0824, CVE-2019-0825, CVE-2019-0826, CVE-2019-0827) that exist when Microsoft Office Access Connectivity Engine improperly handles objects in memory.

Related Content:

• A New Approach to Application Security Testing
• $20 Million Investment Round Shows Growth of Risk Assessment Market
• Credential-Stuffing Attacks Behind 30 Billion Login Attempts in 2018
• 8 Steps to More Effective Small Business Security

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/microsoft-patch-tuesday-fixes-windows-bugs-under-attack/d/d-id/1334384?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Verizon has patched a trio of vulnerabilities in a router commonly used by millions of customers of the company’s Fios bundled Internet access, phone and TV service.

The flaws, in Verizon’s Quantum Gateway routers, if exploited, could give attackers complete control over and visibility into all devices connected to it, a researcher from security vendor Tenable reported Tuesday.

The most significant of the three flaws is a command injection flaw (CVE-2019-3914) because it allows an attacker to gain root access to the router, Tenable’s security researcher Chris Lyne wrote in a blog Tuesday. An attacker can trigger the vulnerability “by adding a firewall access control role for a network object with a crafted name,” he said.

In most cases an attacker would need local network access and be authenticated to the router’s administrative Web application interface in order to perform the command injection. An attacker with that kind of access would then be able to configure the router for remote administration so the flaw can be exploited remotely.

The command injection flaw allows an attacker to create back doors on the router, record information and to access other devices on the same network. By exploiting it an attacker could modify security settings on the device and change firewalls rules. They could also take advantage of the flaw to sniff network traffic for banking credentials and passwords to online accounts.

Proof of exploit code for the vulnerability is available. “The exploit can be launched by providing either a plaintext password or a salted password as a command line parameter,” Lyne said.

Of the three flaws that Lyne uncovered, one in fact allows an attacker to get the password by using a password sniffer to intercept login requests. That flaw (CVE-2019-3915) results from the fact that HTTPS is not used on the Web administration interface thereby giving attackers a way to replay login requests.

The third flaw (CVE-2019-3916) that Lyne discovered gives attackers a way to retrieve the value of a password salt simply by visiting a URL in a Web browser.

The type of attack enabled by the flaws doesn’t require an advanced skill set. “An attacker with an intermediate level of skill could exploit these flaws,” Lyne says in comments to Dark Reading.

Verizon has issued a firmware update patching the three flaws, which are present in routers that the company supplies to new customers of its Fios service. “Users should disable remote administration on their routers and also change the router’s administrator password, so that it is different than the one” that comes with the device, Lyne notes.

Users can verify if they have the latest router firmware from Verizon by logging into the router’s web interface and clicking on “System Monitoring.” The firmware version that is displayed should be 02.02.00.12, which is the latest version, he says.

Small and home office routers have become ripe targets for criminals because of how easy they are to break into and use for spying on people, stealing data and launching DDoS attacks and spam at others. Adding to the lure is the fact that people have begun connecting a growing number of devices—such as IP cameras, storage devices, DVRs, and thermostats—to these devices in recent years.

Just last week, security researchers reported on a campaign where attackers are changing DNS settings on thousands of home routers so traffic to them is routed through malicious servers. Last year, a threat group believed to be sponsored by a nation-state infected some 500,000 routers and network-attached storage devices with a stealthy, modular malware packaged dubbed VPNFilter.

Many small and home office routers are relatively easy to crack because of inherent security deficiencies and seldom updated or maintained once installed. So vulnerabilities in them can persist for a long time.

Research that security vendor Avast conducted last year showed that 60% of users globally have never once updated the firmware on their routers, leaving them potentially exposed to basic attacks. In addition to using compromised routers to launch DDoS attacks, criminals are increasingly using them for cryptomining and spam forwarding as well, the Avast research showed.

“The router is the central hub of all Internet activity and a prime target for cybercriminals,” Lyne says. In this particular instance, the vulnerabilities impacted home routers. “But we’re increasingly seeing targeted attacks against both consumer and business routers because they are rarely, if ever, updated,” he notes.

Related Content:

• Destructive ‘VPNFilter’ Attack Network Uncovered
• Ongoing DNS Hijack Attack Hits Consumer Modems and Routers
• Most Home Routers Are Full of Vulnerabilities
• 8 Ways IoT Manufacturers Can Improve Security

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/verizon-patches-trio-of-vulnerabilities-in-home-router/d/d-id/1334385?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple