STE WILLIAMS

The team sheds light on how their organization works and what they’re watching in the threat landscape.

CPX 360 – New Orleans, La. – Security research teams across the industry are always on the hunt for new threats and vulnerabilities so organizations can improve their defenses. But how do these experts decide what to research next? Which issues are of greatest concern to them?

The Check Point Research (CPR) team consists of 150 to 200 people focused on malware analysis and vulnerability research. CPR aims to drive broader threat awareness by discovering and understanding the latest attack techniques, and then sharing them with the industry. The group is divided into two parts: the people who discover new threats and those who investigate them.

In a space as complex and evolving as the modern threat landscape, it can be tough to decide what to research. Maya Horowitz, director of threat intelligence at Check Point, says some work is dictated by analysts’ interests. As an example, she describes one researcher with an interest in linguistics who discovered a cybercriminal from Libya using Facebook to spread malware. She noticed typos in one Facebook post and connected it to others that contained similar mistakes.

Some researchers’ work focuses on problems commonly known within the security industry but rarely discussed outside of it. Horowitz cites malicious mobile apps and cloud misconfigurations as two issues that demand greater public awareness, especially given the growing prevalence of mobile and cloud among consumers and businesses. If someone knows an app from a legitimate store could potentially contain malware, they may think twice before downloading it.

“We are driven by the things that are out there,” she says. In addition to researching common attacks and vulnerabilities, CPR also looks into rarer threats. Malicious files sent to customers in a specific country, for example, may not be a global issue but still merit a CPR investigation.

“In reality, you can’t sell products to defense infrastructures without really knowing how the hacker is working,” says Oded Vanunu, head of products vulnerability research at Check Point.

Vanunu breaks the process down into greater detail: Some researchers are responsible for analyzing infrastructure and sensors, from which they collect logs and raw data that tell them what’s happening on the Internet. “We’re talking millions of logs every hour; billions after one day,” he adds. Analysts dig into this trove of data to spot pattern breaks that could indicate an attack.

“If there are bad actors doing things, we can immediately intercept, we can attack back, or we can decide that we want to see what’s going on,” Vanunu says. These types of anomalies led researchers to discover vulnerabilities in TikTok, Fortnite, and more recently in the Zoom videoconferencing platform. All three investigations began with an unusual level of threat intelligence that led to bug discoveries in each platform.

“Today attacks are very complex,” Vanunu says. “Attacks are different. Attacks require multiple vectors today, moving between technologies. In order to prevent, you need to learn the attack; you need to learn what the attacker is doing.”

What Are You Most Worried About?
The CPR team works with troves of data indicating what attackers are up to, which begs the question: What do they see that is most concerning to them?

Horowitz first points to the increasing complexity of ransomware attacks. “We do see less ransomware attacks,” she says. “But the ones we are seeing are the more sophisticated ones, targeting companies that have lots of data and lots of money.”

As we’ve seen in the past year, she adds, a target doesn’t have to be a large business to have money or data they fear losing. “They’re not necessarily going after banks, but cities and hospitals that actually don’t invest too much in cybersecurity,” Horowitz continues.

Organizations that fail to adopt the proper tools may also be at risk: While most have invested in traditional security tools, even large enterprises have held back on cloud and mobile security, sandboxing, and other defensive technologies. “A large business might invest a lot in cybersecurity, but not always in the right places,” she says.

For today’s attackers, email is only the first stage of a ransomware attack. Many deploy a botnet and then install Trickbot so they can steal data from target machines and send it back to an attacker-controlled server. This access provides a wide base to deploy a ransomware campaign. Adversaries seek threat intelligence on victims to learn how much money they can demand.

Mobile threats, another concern, are growing more dangerous and pervasive. Attackers have moved beyond pesky adware and clickbait to threats designed for PCs. Adware is annoying, as Horowitz notes, but an info stealer on a mobile device can lift sensitive corporate information. Marketplaces for mobile malware are growing more common, making these threats accessible.

The cloud is evolving as an attack target as companies continue to adopt cloud technologies but fail to improve their security posture to protect the apps they use and develop.

“Everything today is connected to the cloud,” Vanunu says. “One of the worst things we’re seeing, all the time, is that vendors are creating software … and software today is easy to create, but around it are hundreds of APIs.” APIs are used for authentication, encryption, VoIP, statistics, payments, and myriad other tasks. This reliance on APIs means companies depend on software firms to do their job in securing APIs, but “it’s not working like that,” he adds.

Many common apps today are software-as-a-service (SaaS), meaning attackers only need one vulnerability to start moving between users and customers, he continues. Attackers know this, which is why security vulnerabilities are in high demand – and they’re willing to pay big for them. Enterprise cloud applications are in demand, but popular consumer apps could be more lucrative gateways.

“Business cloud applications are less relevant, because if I want to execute an attack, I’ll do it through the application that everyone has,” he explains. This is why vulnerabilities in apps like TikTok are particularly dangerous. At a time when people use the same devices at home and in the office, a consumer vulnerability can give attackers access to a larger pool of targets.

Related Content:
9 Things Application Security Champions Need to Succeed
Assessing Cybersecurity Risk in Today’s Enterprise
How to Manage API Security
Rethinking Enterprise Data Defense

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “7 Steps to IoT Security in 2020.”

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/cloud/inside-the-check-point-research-teams-investigation-process/d/d-id/1336909?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Songs by Ariana Grande, Taylor Swift, and Post Malone are the most popular places.

Criminals looking for ways to disguise malware have turned to Grammy Award-winning songs and artists for camouflage. And according to researchers at Kaspersky Labs, they have wrapped more than 30,000 malicious files in popular song titles.

The songs of Ariana Grande, Taylor Swift, and Post Malone are the most popular hiding places for malware, together accounting for more than half (55%) of the total, the researchers wrote. As artists become more popular with the listening public, their stock also rises within the criminal community. Billie Eilish, for example, saw malicious files sharing her song titles increase in number more than tenfold between 2018 and 2019.

Researchers recommend that consumers only download files from reputable sources, look carefully at file extensions, and beware of sites claiming exclusive content as ways of protecting themselves from online musical mayhem.

Read more here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “7 Steps to IoT Security in 2020.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/criminals-hide-malware-behind-grammy-winning-cover/d/d-id/1336910?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Servers worldwide that were used to control malware-infected systems jumped more than 71% compared to 2018, Spamhaus says.

For the second year in a row, the number of servers used by attackers worldwide to control malware-infected systems increased sharply.

The Spamhaus Project, which tracks both the domain names and the IP addresses used by threat actors for hosting botnet command-and-control servers (C2), identified 17,602 such servers hosted on a total of 1,210 different networks worldwide in 2019.

The number represented a big 71.5% jump over the 10,263 botnet C2 servers that Spamhaus detected and blocked in 2018, and a near doubling in number from the 9,500 servers in 2018. Botnet C2s, in fact, accounted for 41% of all the listings on Spamhaus’ block list in 2019, compared to just 15% in 2017 and 25% last year.

The sharp increase is an indication of the growing popularity of botnets as an attack vector among threat actors, Spamhaus said in a report this week. About 60% of the new botnet C2s that Spamhaus detected in 2020 were associated with credential-stealing malware such as Lokibot and AZORult. About 20% — the next highest proportion — were used to control data-stealing Remote Access Trojans (RATs), the most prolific of which was Nanocore.

The Spamhaus Block List (SBL) is a real-time database of IP addresses and URLs associated with known spam sources and threats like botnet C2s. Companies and ISP can use the database tandem with other block lists to block spam and other online threats.

As with previous years, Spamhaus’ data showed that some of the ISPs that hosted the highest number of botnet C2s last year were based in the United States. Over 1,580 botnet servers in 2019, for instance, were hosted on Cloudflare alone — more than double the 629 hosted by second-place Alibaba of China.

In many cases, the command-and-control servers were running on compromised websites and servers belonging to customers of ISPs such as Cloudflare. This likely made it difficult for them to spot the illegal activity. But a substantial proportion were also set up via fraudulent registrations, as a result of weaknesses in the ISPs customer-vetting and verification processes, Spamhaus
said.

But for the first time ever, Russia took the top spot among countries hosting the most number of command-and-control servers. The number of botnet C2s in the country soared 143% over 2018 to 4,712, compared to 4,007 in the United States.

Lax Customer Vetting

Spamhaus attributed the increase in Russia to threat actors taking advantage of the relatively lax registration procedures among Internet Service Providers in the country. China, too, leapt up the charts from 13th spot in 2018 to the fourth spot last year with 770 servers, an increase that Spamhaus attributed to lax registration procedures as well.

US-based Namecheap was once again the most abused domain registrar, with almost 25% of all botnet C2s detected and blocked last year – all registered via the company. But China and Russia both had more registrars on the top 20 list last year than the US. “They are mostly being legitimately abused,” says Vincent Hanna, a researcher at The Spamhaus Project. “The registrar market is one of very thin margins and lots of automation. Neither leaves much space for careful vetting of customers and orders.”

According to Spamhaus, its botnet data from 2019 showed that ISPs in the East in general are lagging behind their Western counterparts when it comes to sign-up procedures and in enforcement of their terms and conditions.

Western companies on the list of ISPs hosting the most botnet CCs have a high volume, but they are few in number. “At the same time many more eastern companies have fraudulent customers, signaling that abuse procedures and customer-vetting problems are more widespread there, and not limited to a handful of companies,” Hanna says.

The most abused Top Level Domains (TLDs) in 2019 were the .com and .net domains. More than 50% of botnet C2s were hosted on these two domains alone. Other heavily abused TLDs included dot ru, dot info, dot cm, and dot pw, the top level domain for Palau. Several other previously abused domains however fell off the most abused list including, .review, .stream, .bid, and .trade.

For registrars and ISPs, careful customer vetting is key. “Finding the fraudulent registrations is often not that hard, but it needs to be done,” Hanna says. “Registries that care about the reputation of the entire TLD will proactively go out and try to find problematic registrations themselves.”

Related Content:

Botnets Serving Up More Multipurpose Malware

What’s in a Botnet? Researchers Spy on Geost Operators

MasterMana Botnet Shows Trouble Comes at Low Cost

8 Ways Businesses Unknowingly Help Hackers

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/number-of-botnet-command-and-control-servers-soared-in-2019/d/d-id/1336914?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Pwn2Own Miami could help spur more research on and attention to the security of industrial control system products, experts say.

Down they dropped like frozen iguanas: SCADA gateways, control servers, human-machine interfaces (HMIs), an engineering workstation, and other industrial control system (ICS) software on stage in the first-ever ICS Pwn2Own contest last week in Miami.

The three-day contest held during the S4x20 ICS conference placed ICS products in the hacker hot seat in South Beach, where on day one a sudden cold front blew into the city and led to a National Weather Service warning that the city’s cold-blooded iguana population might fall from the trees as the chilly temperatures could temporarily paralyze the reptiles clinging to branches.

That there were mostly successful hacks in the 25 entries by eight teams of hackers in the contest should come as no surprise given the still-nascent state of security in ICS systems. TippingPoint’s Zero Day Initiative (ZDI), which sponsors the renowned Pwn2Own contests, shelled out $280,000 in total in prize money to the successful hacking teams.

ICS vendors overall remain in catch-up mode when it comes to security, ICS security experts say. And in that vein, not many are ready to launch a bug bounty program nor likely to enthusiastically embrace participating in hacking contests like Pwn2Own. “A lot of codebases aren’t ready for it,” notes Dale Peterson, CEO of Digital Bond, founder and sponsor of S4x20. “But there also are some with serious SDLs [secure development life cycles] and that have worked on it really hard and hired third-party offensive teams with great talent to bang on their systems. They’re ready for bug bounties.”

Peterson says the engineering teams of at least three ICS vendors tried to participate in the ICS Pwn2Own contest, where ZDI pays bounties to the researchers for the bugs but were thwarted by their own internal legal departments. As a matter of fact, only one ICS vendor, Rockwell Automation, voluntarily participated in the first-ever ICS contest in Miami last week, providing software licenses to its products for contestants for its FactoryTalk View SE HMI and Automation Studio 5000 engineering workstation.

The remaining vendor products had publicly available software that the contestants were able to download and test: Triangle MicroWorks’ SCADA Data Gateway; Iconics’ Genesis64 control server; Inductive Automation Ignition’s control server; and Schneider Electric’s EcoStruxure Operator Terminal Expert HMI. The contest also featured the OPC (Open Platform Communications) Foundation’s UA.NET standard for its UA server.

“A lot of [ICS vendors] have customers who will say ‘Why is your product in Pwn2Own? This is a bad thing.’ That’s probably going to happen,” Peterson notes. It’s only a matter of time, though, before the vendors start opening up and offering their own vulnerability award programs. “But I’m hopeful in the next year we’ll see one or more companies put out a bug bounty” program, he says.

Brian Gorenc, director of vulnerability research and head of Trend Micro’s ZDI program, says Pwn2Own’s first-ever ICS contest drew new researchers who hadn’t before participated in previous Pwn2Owns. “A lot of them don’t focus on ICS on a day-to-day basis,” he notes. “We worked on picking targets that would make the technology accessible. Rockwell preconfigured their VMs [virtual machines] and simulated PLCs [programmable logic controllers] to show the type of traffic a normal user with experience would have using those tools.”

That kind of access helps foster strong research into the security of these systems, he says.

Same Bugs, Different Platforms
Many of the vulnerabilities that were used in the working exploits were the same found in any software program, such as memory corruption and deserialization. As with other Pwn2Own contests, the contestants had a few months with the targets before the actual event to find the flaws and create the attack exploits they launched during the live contest.

The flaws they found are reported to the vendors, which were on-site and had to qualify them. They get 120 days to patch the bugs, Gorenc notes. “We expect to see formal patches shortly,” however, he says.

“There was definitely a mix of some software that didn’t have all of the modern exploit mitigations in them,” he says, although some had Microsoft’s Address Space Layout Randomization (ASLR), a Windows feature that prevents the exploitation of memory corruption vulnerabilities.

Gorenc says the bigger picture of the security of critical infrastructure likely will be the impetus that drives more-secure ICS products. “We need to protect our critical infrastructure,” he says. “This is the right time now for a contest like this to come out and put the software under test with new eyes and bring out new research to develop stronger critical infrastructure and strong” defense to attacks, he says.

The big difference between Pwn2Own and regular vulnerability awards or bug bounties, he says, is that this goes a step beyond bug hunting, with bounties on the exploits themselves. “That’s going to bring a different quality of work to the vendors. For the first time for us to come into this space and to have as many researchers come out shows a lot of people want to secure the software. Given a vehicle and platform like Pwn2Own is going to help step up” security work in ICS products, he says.

Renowned ICS security expert Jason Larson, ICS principal at IOActive, thinks events like Pwn2Own could help move the needle toward more-secure ICS software and products. “It’s long overdue in this space,” Larson says. “I’ve been working in ICS for 18 years and we’re still finding trivial exploits.”

Even so, the Pwn2Own bug bounty payouts in the contest are minuscule compared with underground markets, he says. “$20,000 is laughably low here,” he notes, citing one of the average payouts for a successful exploit in the contest. “There already are established markets” for ICS bugs that pay much more, he says.

Zero-Day Market Today?
Just how deep the third-party broker market is for ICS zero-days, however, is not quite clear. That’s a question that Sarah Freeman, of the Idaho National Laboratory, has been studying. Freeman tracks the activity of zero-day brokers such as Crowdfense and Zerodium, to try to determine whether those types of bugs are being purchased and sold. Bug brokers traditionally sell to high-dollar customers such as nation-states, in payouts to the tune of millions of dollars.

“There have conversations in whispers of private transactions of ICS” bugs, Freeman says. “But by and large if you look at the publicly available information, it doesn’t appear at first blush to be ICS” bugs that the brokers are purchasing, she notes.

Even so, a zero-day for a router that gets sold in that market could have security implications for an OT network, she says. Freeman predicts the market for ICS bugs to be at about $50 million in 2019 based on the data and trends she was able to uncover online for the period of 2015–2019.

Some 55% of bounties went to desktop, servers, and routers; 45% to mobile. Among operating systems — Android, Linux, Windows, iOS, and macOS — the bounties were fairly evenly spread, with around 21% to 22% apiece.

ICS products could fall into some of those categories, of course, so it was hard to suss out the full picture of that sector of bugs. Freeman says that SCADA vulnerabilities represented about 30% of bugs purchased by the brokers in 2018.

But given that most ICS systems are relatively easy to exploit, attackers are less likely to bother burning a zero-day when they can just exploit a Windows vulnerability, for instance. “You don’t necessarily need a zero-day to attack anything,” she notes.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “7 Steps to IoT Security in 2020.”

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/aftermath-of-a-major-ics-hacking-contest/d/d-id/1336915?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The oft-attacked city of Baltimore not only uses mind-bogglingly bad data storage. Its home state, Maryland, also knows how to swiftly propose mind-bogglingly bad legislation that would outlaw possession of ransomware and put researchers in jeopardy of prosecution.

It is, of course, already a crime to use the data/systems-paralyzing malware in a way that costs victims money, but proposed legislation, Senate Bill 30, would criminalize mere possession.

It’s not supposed to keep researchers from responsibly researching or disclosing vulnerabilities, but like other, similar “let’s make malware more illegal” bills before it, SB 30’s attempts to protect researchers could “use a little more work,” as pointed out by Ars Technica‘s Sean Gallagher.

It covers much of the same ground as does Federal law, but SB 30 would take it a step further by labelling the mere possession of ransomware as a misdemeanor that would carry a penalty of up to 10 years imprisonment and/or a fine of up to $10,000.

The draft could get yet more draconian still: Earlier this month, members of the Maryland Senate Judicial Proceedings Committee said they’d actually prefer to make the crime a felony, according to Capital News Service.

The problematic outlawing of “unauthorized access”

Besides mere possession of ransomware, the bill would outlaw unauthorized, intentional access or attempts to access…

…all or part of a computer network, computer control language, computer, computer software, computer system, computer service, or computer database; or copy, attempt to copy, possess, or attempt to possess the contents of all or part of a computer database accessed.

It would also criminalize acts intended to “cause the malfunction or interrupt the operation of all or any part” of a computer, the network it’s running on, and their software/operating system/data. Also verboten: intentional, willful, unauthorized possession or attempts to identify a valid access code, or publication or distribution of valid access codes to unauthorized people.

Where does that leave researchers? Partially protected by a thin blanket that doesn’t protect them from liability, experts say.

The bill does holler out an exemption for researchers, rendered in full caps in the draft:

THIS PARAGRAPH DOES NOT APPLY TO THE USE OF RANSOMWARE FOR RESEARCH PURPOSES.

But that doesn’t cover any of the extensive list of “thou shalt not touch without authorization” aspects of the bill that could spell trouble for researchers and keep them from reporting vulnerabilities. Well-known vulnerability disclosure policy expert Katie Moussouris – the founder and CEO of Luta Security and creator of Microsoft’s bug-bounty program – told Ars that as it’s now worded, the bill would…

…prohibit vulnerability disclosure unless the specific systems or data accessed by the helpful security researcher were explicitly authorized ahead of time and would prohibit public disclosure if the reports were ignored.

The truth is that organizations ignore responsible vulnerability reports all too often. That’s why responsible disclosure programs have reporting windows: once the clock ticks down, plenty of researchers give up on waiting for a response and go ahead and publish vulnerability details. The rationale: the longer a vulnerability exists, the higher the chance it will be exploited by hackers.

Maryland should follow Georgia’s lead and rethink this

SB 30 is currently still under review. Were it to pass in its current form, there is, of course, a chance that the governor might veto it. That’s what happened to the equally, similarly misguided hacking bill, SB 315, that was passed in Georgia in 2018.

From Governor Brian P. Kemp’s veto message:

Under the proposed legislation, it would be a crime to intentionally access a computer or computer network with knowledge that such access is without authority. However, certain components of the legislation have led to concerns regarding national security implications and other potential ramifications. Consequently, while intending to protect against online breaches and hacks, SB 315 may inadvertently hinder the ability of government and private industries to do so.

Hopefully, Maryland’s lawmakers will take a much closer look at the proposed bill and listen to experts like Moussouris. Hopefully, they’ll come to realize that the legislation may very well harm the very people who are working to protect the state.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/d9HY01sLptw/

Over the weekend, we received a short, sweet and simple note.

It arrived by email, but the crooks could easily – and for all we know, did – use the same content in an SMS or text message:

We weren’t tempted, not least because of the giveaway HTTP link – which was a fortunate blunder by the sender, because the redirector site they were using immediately transferred us to a more legitimate-looking HTTPS page, complete with security padlock.

(Remember: a web certificate and padlock doesn’t vouch for what’s actually on a web page – it’s called a TLS certificate, short for Transport Layer Security, because it protects the network traffic, even if the data ultimately served up is fake news, malware or a not-so-free gift..)

The other giveaway mistake by the senders of this email is that the amount is in dollars, yet we’re in the UK where a $100 McDonald’s voucher wouldn’t be redeemable.

What if you click?

But what happens if you are inquisitive and you do click through?

To save you the trouble, we decided to take a look on your behalf and report back what happened.

We tried many times from many different IP numbers, using many different permutations of the URL we originally received.

For what it’s worth, the blanked-out text after the / character in the image above seems to be a pseudo-random tracking code, not only because that’s what it looks like but also because removing it takes you to this blunt message:

When we appended tracking codes to the URL, there were several different themes of landing page we saw, all apparently run by the same company.

(Despite trying many times, including with the tracking code we originally received, the one company whose products never showed up was McDonald’s, the brand used by the sender to lure us in in the first place.)

Very commonly, we started off on a page with a “random” spinning wheel offering a range of prizes, where we always lost on the first spin and always won one of the high-value prizes on the “free” spin, like this £1000 Amazon voucher:

At this point, as rigged fake as the prize wheel was, the process had turned into a bit of a game, and it was admittedly tempting just to keep going.

Atter all, someone wins the lottery every week… so perhaps someone gets the gift voucher, too?

To soften you up a bit, the survey starts with three very general questions that don’t feel terribly personal, given that the answers merely divide the participants into broad categories.

You’re asked if you like shopping, your age range, and roughly how much you use Facebook:

But the detailed data collection starts straight after that, with the survey company asking for information including your home address and date of birth:

You’re still not there, of course.

In fact, all you’ve done is qualify to start making the commitments you need to “validate” your claim for the gift voucher (or iPhone 11, or Galaxy 10, or whatever it was when you started out).

The company calls this a “brief survey”, and it’s quick to complete, but you nevertheless end up giving a lot away, and you have to tell the truth, as we’ll see later on:

Now you need to sign up for “qualifying offers”, which is where the survey company starts making its revenue.

You not only have to click through to third-party products chosen by the survey company, but also to sign up for a given number of them.

The first offer in our tests was always a choice denoted as a “Silver Deal”, typically for a modest-looking price, as you see here:

At this point, you’re probably wondering how the survey company is going to make a profit if it hands out a £1000 Amazon card in return for a £2.50 scratchcard purchase.

The trap is that the conditions to qualify are a lot more onerous than just making a modest lottery purchase, as you’ll see if you scroll down and read the small print carefully:

These parts jumped out at us:

For […] incentives valuing more than £100, complete 1 Silver, 1 Gold and 8 Platinum offers. You must complete all offers within 20 days of completing your first offer. Completion of offers usually requires a purchase or entering a paid subscription program for goods or services. […] Failure to submit accurate registration information, complete the survey questions or comply with claim verification process will result in disqualification. […] We may verify your registration information and if it’s inaccurate, the Gold, Silver and Platinum offers may not be displayed. If that happens, you won’t be eligible to earn an incentive.

Dotting every i and crossing every t

You’re at the start of a journey that might lead you to a £1000 gift card – we’re assuming that if you dot every i and cross every t in the survey company’s playbook then they will pay out, or else this would be fraudulent – but it seems like a pretty tricky journey.

As far as we could see, there was no way to determine which Gold offers we were actually going to get unless we signed up for one of the Silver offers first.

This not only meant spending money but handing over our details again, including payment card information this time, to yet another company.

The survey company does provide a web page, linked to from the terms and conditions page we showed above, that gives you an idea of the sort of charges you’re likely to face – but without telling you which entries in this so-called Representative Offer Chart are Silver, Gold or Platinum.

There’s also no guarantee that you’ll actually see any offers listed, because the “chart is provided only for guidance and is subject to change without notice.”

We’re guessing that the most expensive offers on the chart are amongst the cheapest you’ll see at the Platinum level, and those range from about £20 to £60 a month.

And you’ll need eight of those offers completed and accepted before you can even think of applying for your gift card.

Remember also that all the personal data you give at any point throughout the whole process has to be consistent.

As far as we can see, if you answered that “brief survey” at the outset a bit too quickly or casually, for example by giving vague or incorrect answers to questions such as your employment or your credit rating, you’ve effectively blown your chances before you even start.

What to do?

In real life, the big financial commitment you’re likely to end up with – remembering that if you decide to call it quits anywhere before your eighth Platinum sign-up then you forfeit your “bonus” – is probably your foremost concern.

But there’s also the issue of having to share your personal data over and over again, lured on by that £1000 promise.

As we said in our guidance for Data Privacy Day:

[Put] your own value on your personal data – figure out how much you’re ready to give away, and what you get in return. If a company or a website asks for more data than it needs, don’t cave in and hand it over unless you want to.

For example, it’s reasonable for a car hire company to ask you to offer proof of address before handing you the keys to a $20,000 vehicle. But if a news site or a coffee shop hotspot demands your postcode or your birthday, ask yourself, “Why would they need that, and why would I want to hand it over anyway?”

Know your privacy limits, and stick to them.

And if you have friends or family who are in the habit of filling in surveys because they think they’re mostly harmless, show them this article!

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/xTic4Md05yA/

Forget the infamous Meltdown and Spectre chip flaws from 2018, the problem that’s tying down Intel’s patching team these days is a more recent class of side channel vulnerabilities known collectively as ZombieLoad.

These relate to a data leakage problem called Microarchitectural Data Sampling (MDS) affecting Intel’s speculative execution technology introduced in the late 1990s to improve chip performance.

ZombieLoad is also what Naked Security likes to call a BWAIN, or Bug With an Impressive Name.

BWAINs are everywhere with side-channel issues in microprocessor hardware proving particularly good at generating new ones.

ZombieLoad was originally made public by researchers last May (although Intel says it knew about them) as part of a triplet of hypothetical issues which included two others, Fallout and Rogue In-Flight Data Load (RIDL), affecting post-2011 Intel processors.

That generated four CVEs – CVE-2018-12126, CVE-2018-12130, CVE-2018-12127, and CVE-2019-11091 – which Intel and others addressed with OS-level mitigations.

Then in November, ZombieLoad got a version 2 in the form of Transactional Asynchronous Abort (TAA) affecting the most recent Cascade Lake microprocessor generation (CVE-2019-11135). Intel patched this by updating microcode.

This week the researchers announced they’d dug up more CPU data-extraction holes.

Another fine cache

The new attacks showed that the original May 2019 mitigations hadn’t been sufficient, with the first and most serious, CVE-2020-0549 (aka ‘CacheOut’ or what Intel calls L1D Eviction Sampling), first being reported to Intel at the time of the original ZombieLoad disclosure.

There are no fixes for these yet although Intel has said it will offer these “in the near future.”

Intel microprocessors are inside a lot of computers, so should users be worried?

MDS is a generic weakness through which an attacker might be able to access small amounts of data buffered as part of the speculative execution process (essentially a way of getting a microprocessor to do calculations ahead of time on the basis they might be needed later).

CacheOut concerns where this data is temporarily stored as part of this process, specifically when it’s in Level 1 chip caches.

This is theoretically significant because the data that might be in one of those buffers could be almost anything, including data normally protected by Intel’s SGX enclaves.

These enclaves are locked-down areas of memory that are typically used for storing sensitive data values – such as temporary cryptographic keys and the internal state of cryptographic calculations – where even the kernel itself can’t read them out.

To date, exploiting ZombieLoad weaknesses has been viewed as a complex undertaking that had only been shown to work under unusual lab conditions – no attacks exploiting these methods has ever been detected.

That’s still true for CacheOut although it lowers the bar somewhat. Nevertheless, an attack would still be difficult under real-world conditions because cybercriminals would need local access and would not be able to target a vulnerable cache with any precision.

Less clear is which Intel chips might be affected. The list provided on its website includes a wide range of Intel chips that might “potentially” be affected but it appears this has only been confirmed in ones released since 2017.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/9wzLWKs_aWI/

Apple has just announced its latest round of security updates.

As usual, Apple’s fixes arrived unheralded, given the company’s insistence that security fixes are best handled simply by publishing them when they’re ready, rather than following any sort of formal schedule.

Not everyone agrees – Microsoft has followed its Patch Tuesday process for many years (updates arrives on the second Tuesday of every month), for example, and Firefox has its own Fortytwosday calendar (major updates arrive every 42 days, i.e. six weeks, on a Tuesday).

But Apple’s theory seems to be that security updates fall into the “least said, best done” category, and that you should always play your patching cards close to your chest.

Whether a security update is delivered to a schedule or pushed out suddenly, we do know that both researchers and criminals alike scramble to work backwards from patches, using the differences between old and new program files to figure out the specifics of the errors that were fixed.

Microsoft’s Patch Tuesday for January 2020, for instance, fixed a bug in Windows 10’s certificate checking, whereby a crook could adopt the digital identity of someone else’s website, or pretend to be a well-known software vendor. Within about a day, security experts were publicly showcasing their reverse engineering skills by publishing tools allowing you to exploit the so-called CryptoApi or crypt33 hole by yourself, no research skills required.

The fixes

There are plenty of critical holes patched in this raft of updates – so we strongly advise you to patch right away, before anyone figures out how to abuse these newly-documented holes for fun or profit.

In particular, both iOS 13 and the most recent three versions of macOS get fixes for several kernel-level security problems (the relevant macOS versions are 10.13, 10.14 and 10.15, better known as High Sierra, Mojave and Catalina).

Five kernel bugs are listed for iOS (and iPadOS) and macOS alike, denoted as follows:

• An application may be able to read restricted memory. (x2) This sort of bug means that a regular app, which would normally not even be able to read data out of other apps, might be able to recover system-level secrets, such as temporarily-decrypted data, unique identifiers for the current user or device, or private information about what other software is up to.
• A malicious application may be able to execute arbitrary code with system privileges. (x2) RCE, short for remote code execution, is a sort-of Holy Grail for hackers, because it allows them to trick your device into implanting a malware program of their choice. You might not see any sort of warning or tell-tale sign at all – RCE usually means that crooks can bypass both the App Store and the operating system’s own security protections.
• A malicious application may be able to determine kernel memory layout. Many RCE bugs require an attacker not only to inject code into memory, but also to predict exactly where it will end up. Both iOS and macOS therefore use ASLR, short for address space layout randomisation, to make memory addresses hard to guess. So a memory layout disclosure bug combined with an RCE may turn a “this might work if you’re lucky” attack into a “works every time” exploit.

iOS 12 gets quiet patches

Interestingly, iOS 12, which is still supported for older iPhones such as the 6 and 6+ that can’t run iOS 13, also gets an update.

But the new version, iOS 12.4.5, wasn’t announced via Apple’s Security Advisory email service, which mystified us until we checked the overall Apple security updates webpage, where the update is officially listed but downplayed from a security point of view:

iOS 12.4.5: This update has no published CVE entries.

(iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch 6th generation, 28 Jan 2020.)

CVE, short for Common Vulnerabilities and Exposures, is a system, sponsored by the US government, that allocates unique numeric identifiers to bugs that are considered “publicly known cybersecurity vulnerabilities”.

Whether this means that the new iOS 12 contains only unimportant or minor fixes, or that it patches serious holes that simply haven’t been assigned CVE numbers yet, we can’t say – so we recommend you get the update anyway.

We applied it this morning – it was quick to download and didn’t take long to install – without any apparent issues.

Location tracking change for iPhone 11

A newsworthy change that arrived in iOS 13.3.1, but that Apple didn’t count as a security fix, is listed on Apple’s general About iOS 13 Updates page.

You may remember the brouhaha, back in December 2019, when well-known cybersecurity journalist Brian Krebs asked aloud why his iPhone 11 sometimes flashed up the “accessing location data” icon even if he had location tracking turned off in every app and all his system services.

Apple later clarified that the only way to turn off location tracking entirely was to turn it off with the main “Location services” toggle.

In other words, the individual “system services” toggles for the location-aware parts of the operating system didn’t necessarily cover all the features in the kernel – and that included a new high-speed data transfer feature added in the iPhone 11 known as UWB, short for Ultra Wideband.

As we explained at the time:

A few countries have regulated [the use of UWB], apparently for fear that it might mess with existing radio communications, and Apple therefore added system software [in the iPhone 11] that uses your location data, as long the master location switch is turned on, to disable UWB automatically as required.

Mystery unravelled!

Well, Apple has now provided a new system service toggle that “adds a setting to control the use of location services by the U1 Ultra Wideband chip.”

You can find the new toggle in the Settings Privacy Location Services System Services:

Note that to access the System Services list, you have to turn on Location Services first, or else all the per-app and per-service toggles are removed from the screen.

(We wish that weren’t the case, and that you could check your per-app location settings before turning location services on in the first place, but Apple doesn’t see it that way.)

What to do?

To check you’re up to date:

• On an iPhone or iPad, go to Settings General Software Update.
• On a Mac, go to the Apple menu, choose About This Mac and click Software Update…

If your device has already updated automatically, the update screen will tell you; if not it will let you know about the update and offer to intall it for you.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Z9hUCBoA6tw/

The NHS has suffered 209 successful ransomware attacks since 2014, according to new figures based on Freedom of Information requests, but with a dramatic improvement since 2017, the year WannaCry ransomware hit the health service.

The figures, posted in a report from research company Comparitech, show the following since 2014:

• 209 or more successful attacks, ranging from one computer to an entire system
• No ransoms reported to have been paid
• Estimated downtime of 206 days
• Only six attacks reported after 2017, the year of WannaCry, albeit with the caveat that
• 20 per cent of hospitals refused or failed to respond to the survey

Ransomware attacks on the NHS (click to enlarge)

The researchers surveyed 254 NHS Trusts, with 184 responding, 20 not responding and 50 refusing to hand over the information requested.

The WannaCry attack in 2017 – famously thwarted by Brit white hat hacker Marcus Hutchins – caused a spike to 101 incidents and we know many of these were severe. A September 2018 government report (PDF) estimates the cost of lost output and IT support caused by WannaCry, aka WannaCrypt, to be £92m – most of it in the aftermath rather than during the attack, for restoring data and systems.

What did the NHS do to improve its security? Following WannaCry, there was a “Lessons learned” review (PDF). The WannaCry incident was in May 2017, and the review noted: “None of the 80 NHS organisations affected by WannaCry had applied the Microsoft update patch21 advised by NHS Digital’s CareCERT bulletin on 25 April 2017 following the receipt of intelligence of a specific threat from BT on 24 April 2017.”

Some PCs running the unsupported and ancient Windows XP were compromised, but “the majority of NHS devices infected were running the supported, but unpatched, Microsoft Windows 7”. Since then, Windows 7 too has largely gone out of support. The review made numerous common-sense recommendations.

The September 2018 report states that NHS trusts have been asked to meet the Cyber Essentials Plus government standard. In addition, IBM was contracted to deliver a Cyber Security Operations Centre for monitoring and responding to threats, and a new Microsoft agreement included licences for Windows 10 and for Microsoft’s Advanced Threat Protection.

There are 22 recommendations including mandatory “cyber awareness training” for staff and a suggestion that “all organisations should consider whether access to IT systems and services should be removed from members of staff who have not successfully completed this mandatory training”.

Based on these figures, WannaCry was an effective wake-up call. That said, Comparitech’s statistics are less valuable than they might be because the incidents are not weighted by their severity and scope. Ransomware is not going away, though. Last year Symantec reported (PDF) that while overall ransomware was down by 20 per cent, enterprise ransomware was up by 12 per cent. A recent Coveware report states that average ransomware payments increased by 104 per cent year on year for the fourth quarter of 2019. Ransomware is getting smarter and more expensive and remains a high risk. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/29/ransomware_in_the_nhs_survey/

A Canadian insurance business struck by ransomware paid off the crooks via a cyber insurance policy – and their English reinsurers, having shelled out 109.25 Bitcoins, want it back from the alleged blackmailers.

After infection the unnamed Canadian company suffered a total lockdown of all of its systems and asked its reinsurance firm to pay the ransom so it could get back on its feet.

Paying off blackmailers holding a company to ransom is never advisable. Despite a negotiation that knocked the crooks down from an initial demand of $1.2m to $950k, the decryption tool provided had to be run on each and every affected device on the company’s network.

It took five days to decrypt 20 servers and “10 business days” to unlock 1,000 desktop computers.

Neither company was going to pay out and forget the incident. The English reinsurer hired Chainalysis Inc, a “blockchain investigations firm”, which eventually pinpointed the people responsible.

Although the full judgment was de-anonymised in January, having originally been handed down in December 2019, the judge did not lift an anonymity order on both the Canadian and English insurance companies. The latter, the plaintiff in the case, is designated as “AA” in the decision, while the “persons unknown who demanded Bitcoin”, and “persons unknown who own/control specified Bitcoin” are classified as defendants 1 and 2. Two companies who operate a cryptocurrency exchange are designated defendants 3 and 4. Reporting restrictions have now been lifted.

Mr Justice Bryan of London’s High Court said: “Whilst some of the Bitcoin was transferred into ‘fiat currency’ as it is known, a substantial proportion of the Bitcoin, namely, 96 Bitcoins, were transferred to a specified address. In the present instance, the address where the 96 Bitcoins were sent is linked to the exchange known as Bitfinex operated by the third and fourth defendants.”

FBI softens stance on ransomware: it’s (sort of) okay to pay off crims to get your data back

READ MORE

Bitfinex is a cryptocurrency exchange headquartered in the British Virgin Islands, though the court noted that one email address associated with the exchange was seemingly traced to China.

Mr Justice Bryan said: “At the present time there is no evidence that [Bitfinex] are themselves perpetrators of the wrongdoing, rather, it is said, they have found themselves the holder of someone else’s property.”

Nonetheless, the judge ruled that Bitfinex probably knew who the two alleged ransom receivers were, saying: “I have no doubt that Bitfinex has the ability to access its records and its KYC [know your customer, finance sector ID rules] material to identify the information that is sought” about the two alleged blackmailers.

In a statement Stuart Hoegner, Bitfinex’s general counsel, told The Register: “Bitfinex has robust systems in place to allow it to assist law enforcement authorities and litigants in cases such as this. In this case we have assisted the Claimant to trace the stolen Bitcoin and we understand the focus of the Claimant’s attention is no longer on the Bitfinex platform. It now appears Bitfinex is an entirely innocent party mixed up in this wrongdoing.”

Payoffs are bad but we gotta be realistic

In October 2019 the American FBI softened its stance on paying off ransomware. At least one prominent infosec firm, Malwarebytes, reckons refusing to pay in all circumstances probably doesn’t make a difference in this day and age.

Such a course of action is fraught with danger, however. A Scottish MSP was caught red-handed promising ransomware decryption services when in reality all they were doing was paying off the crooks and adding an eye-wateringly high margin. At least one study has found that less than half of companies paying off ransomware actually get their files back.

While the investigations in the High Court judgment above seem to be bearing fruit, keep in mind that insurance companies have a virtually guaranteed business model that leaves them drowning in cash. Tracking down crooks is expensive and civil legal action in the High Court comes in at five or six figures, assuming any judgment is enforceable. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/29/canadian_insurer_paid_ransomware_hunt/