STE WILLIAMS

Optiv ramps up its growth strategy with an acquisition of Conexsys, security and networking firm based in Toronto.

Optiv Security has announced plans to accelerate growth into the Canadian market with an acquisition of Conexsys, a security and networking solutions provider based in Toronto. Terms of the transaction are not being disclosed.

The purchase will help Optiv better service public and private businesses in Canada, where Conexsys has operated for 30 years, by bringing more local resources and immediate access to Optiv services. The company also plans to leverage Conexsys’ business relationships with the Canadian government to improve its vertical presence in government markets.

“Together, Optiv and Conexsys provide expansive local coverage in Canada to help organizations navigate a myriad of products and technologies, and evaluate their infrastructures and operations to develop safer, saner and more strategic paths forward,” says Cheryl McGrath, Optiv’s country general manager for Canada.

Read more details here.

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/perimeter/optiv-buys-conexsys-for-canadian-market-growth/d/d-id/1330404?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

IBM researchers uncover a new form of banking malware distributed as a second-stage infection via the Emotet Trojan.

A newly discovered banking Trojan called IcedID looks a lot Gozi, Zeus, and Dridex – but without any code overlap.

IcedID, which was discovered by IBM X-Force researchers, has capabilities similar to those older financial-stealing malware. “Overall, this is similar to other banking Trojans, but that’s also where I see the problem,” says Limor Kessem, executive security advisor for IBM Security.

It’s rare to see new banking Trojans not based off existing variants, Kessem explains. Indeed, this year has already seen the spread of Scylex, which also shares similarities with Zeus, as well as a Trojan called Silence, which mimics techniques from the Carbanak hacker group to steal from financial organizations.

IcedID – which first emerged in September of this year – targets banks, payment card providers, mobile service providers, payroll, Web mail, and ecommerce sites in the United States and Canada. Two major banks in the United Kingdom are also on the target list.

One sign of IcedID’s sophistication is its distribution through the Emotet Trojan, which is designed to amass and maintain botnets. Emotet arrives on target machines via spam emails and is typically disguised in productivity files containing malicious macros. It infects the target endpoint and remains there as a silent tool for cybercriminal groups to distribute malware.

Now it’s being used to serve up IcedID, which has a few tactics, tricks, and procedures (TTPs) that stand out from other common Trojan features.

IcedID can propagate over a network, which researchers say is a sign its creators intend to target large businesses. Nation-state attackers commonly use network propagation but banking Trojans rarely do, Kessem explains. The malware can move to other endpoints and infect terminal servers, an indication it targets employees’ email to get onto business machines.

Similar to the GootKit Trojan, IcedID monitors victims’ online activity by setting up a local proxy to listen and intercept communication from targeted endpoints. Attack tactics include both Web injection attacks and advanced redirection attacks, similar to the strategy employed by Dridex, researchers explain in a blog post.

The redirection scheme is designed to appear as seamless as possible. The legitimate bank’s URL is displayed in the address bar and the bank’s correct SSL certificate is visible. The malware listens for the target URL and when it encounters a trigger, executes a Web injection. Victims are redirected to fake banking websites and tricked into submitting their credentials, which are sent to the attacker’s server.

From this point forward, the attacker controls the session and typically uses social engineering to fool victims into sharing transaction authorization data.

Who broke the ice?

“The company it keeps is already a telling sign that this is not an amateur group,” Kessem says. “The sophistication of the code is modular, and it has different details reminiscent of other organized crime groups.”

Emotet, originally a banking Trojan and precursor to Dridex, has been used among Eastern European cybercrime groups. Comments in IcedID’s code indicate the actors are from Russian-speaking areas, so experts can deduce they are from a certain region.

While researchers believe this is the work of a new attacker, it’s difficult to say with certainty. A few malware groups have disappeared from the scene, Kessem explains, and there aren’t too many developers who know how to create this Trojan. It’s possible the actors are related to another previously disbanded malware but because the code isn’t copied, it’s tough to tell.

Right now, IcedID deploys on endpoints running various versions of Windows. It does not have any advanced anti-virtual machine or anti-research techniques, aside from requiring a reboot to complete full deployment and possibly evade sandboxes, and communicating via SSL for extra security and to bypass intrusion detection systems.

Researchers believe IcedID’s authors aren’t done, however, and will add anti-forensic features into the malware over time.

Related Content:

• New Locky Ransomware Takes Another Turn
• Cybersecurity Staffing Shortage Tied to Cyberattacks, Data Breaches
• Hypervisors: Now a Tool to Protect against Security Blind Spots
• Data Breach Record Exposure Up 305% from 2016

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/endpoint/new-banking-trojan-similar-to-dridex-zeus-gozi/d/d-id/1330407?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A rundown of some of the hottest security product areas, and vendors helping to shape them.

Image Source: Who is Danny via Shutterstock

Information security technology is evolving rapidly, with brand-new technologies and product categories emerging and older technologies being re-cast for today’s threats.

To help navigate these shifts in cybersecurity, Dark Reading has selected 13 hot technology areas that many enterprises are either implementing or considering. To illustrate these product sectors, with the help of industry analysts we’ve chosen two example vendors in each category – CASB (Cloud Access Security Brokers), Endpoint Detection and Response, Next-Generation Endpoint Security, Deception, Threat Intelligence Analysis, Artificial Intelligence/Machine Learning, Orchestration, IoT Security, ICS Security, DevSecOps, SOC-as-a-Service, Authentication, and Cloud Security Services.

This is not a best products or market leaders list, nor is it a comprehensive one. It’s a look at what these emerging technologies are, and how some example vendors are tackling the same problem in different ways. There are several larger vendors also adding these technologies to their portfolios, of course, but we have chosen mainly young, smaller companies focused on these sectors as examples. The goal is to provide a sampling of emerging vendors in this space; there are obviously many more. 

Here’s a look at these security sectors. 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/cloud/emerging-it-security-technologies-13-categories-26-vendors/d/d-id/1330400?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

What exactly are we to make of videos that are targeted at kids but that feature a) cartoon characters that turn into monsters and try to feed each other to alligators, b) a Claymation Spiderman urinating on Elsa of “Frozen”, or c) Nick Jr. characters in a strip club?

The lesson is that human-free, automatic filters that are supposed to strip out any YouTube content that’s not child-friendly, so that it can be streamed on what’s supposed to be the kid-safe YouTube Kids site, are far from foolproof.

Earlier in the month, the New York Times reported that a startling collection of disturbing videos are slipping past the algorithms erected to keep out bad actors on YouTube Kids.

The NYT included links to several videos, including those listed above, most of which have since been removed. One exception that’s still up is a live-action video showing parents rough-housing with their daughter, featuring a scene in which the parents shave the young girl’s forehead, causing her to wail and to apparently bleed.

This isn’t how it was supposed to be. In February 2015, YouTube announced it was launching a kid-friendly zone: one in which youngsters would be spared the hair-raising comments that have turned YouTube into a fright fest.

According to the NYT, parents and kids have flocked to YouTube Kids since then. It’s pulling in more than 11 million weekly viewers, attracted by a seemingly bottomless barrel of clips, including those from kid-pleasing shows by Disney and Nickelodeon. Those viewers include parents who assume that on YouTube Kids, their kids will only see age-appropriate content that’s been scrubbed of the muck that you can find on the main YouTube site.

That muck includes content that can be racist, anti-semitic, homophobic, sexual, or horrifically violent. Some YouTube content denies the Holocaust or seeks to justify terrorism or crimes against humanity. Such content has, in fact, put YouTube in the cross-hairs of groups that are seeking legal sanctions against not only YouTube but its social media brethren Facebook and Twitter, in countries such as France or Germany, where the content is illegal.

Who is evading YouTube Kids’ filters to target children with these bizarre videos? And why are they doing it? To what end does someone want to feature Mickey Mouse lying in the street in a pool of blood as Minnie Mouse looks on?

Apparently, the NYT reports, there’s money being made. These bizarre videos come laced with automatically placed ads. That means that both the creators and YouTube are profiting.

But YouTube’s been fighting it: in the months leading up to August, it announced that content creators could no longer make a tidy profit from inappropriate use of family-friendly characters (bye-bye, Spiderman urinating on Elsa).

As the NYT reports, the videos are “independently animated, presumably to avoid copyright violations and detection.” Some recently uploaded clips have millions of views on the main YouTube site. It’s not clear how many of those views came from YouTube Kids.

YouTube is both addressing the problem and trying to minimize it. It claims that the fraction of videos on YouTube Kids that were missed by its algorithmic filters and then flagged by users during the last 30 days amounted to a miniscule 0.005% of videos. According to The Verge, YouTube has dismissed reports that inappropriate videos racked up millions of views on YouTube Kids without being vetted. The company says that those views came from activity on YouTube proper, which makes clear in its terms of service that it’s aimed at users who are at least 13 years old.

YouTube last week announced that it’s implementing a new policy that age-restricts this type of content in the main YouTube app when flagged. Juniper Downs, YouTube’s director of policy, told The Verge that “Age-restricted content is automatically not allowed in YouTube Kids.” The policy has been in the works for a while, so the rollout isn’t a direct response to recent coverage of the inappropriate content, YouTube says.

The first step in keeping this stuff off YouTube Kids are the algorithmic filters. Then, YouTube says it has a team of humans reviewing flagged videos. If a video flagged in the main app contains children’s characters, it will be sent to the policy review team. YouTube says it has thousands of people, including volunteers, working to review flagged content around the clock, around the world. If the review concludes that a video violates the new policy, it will be age-restricted, automatically blocking it from showing up in the Kids app.

YouTube is hoping that within the window of time between content making its way from YouTube onto YouTube Kids – a matter or days – users will flag clips that could potentially disturb children. The Verge reports that YouTube will soon start training its review team on the new policy, which should be live within a few weeks.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/jjHmnZcqFkA/

A common framework will help in the development of cyber-risk management efforts.

“What threats are you seeing?”

“What tool did you buy?”

“Did you know an exploit for that vulnerability is in the wild?” 

Do these questions sound familiar? If you’re a cybersecurity practitioner, they likely do. Historically, many organizations conduct information sharing that sounds a lot like this.

Unfortunately, these conversations are limited in scope and confined to a specific security concern, which means they rarely expand across multiple teams to achieve true organizational collaboration. You’ll usually see governance folks talking to other governance folks, or security operations teams reaching out to other security operations teams.

These siloed conversations hinder an enterprise-wide ability to see the big cybersecurity picture. The good news is that cyber practitioners no longer have to take part in the same old song and dance.

With the recent mandate for public sector organizations to use the National Institute of Standards of Technology (NIST) Cybersecurity Framework (CSF) combined with increased adoption expected of the private sector, we have reached a potential tipping point for information sharing. The entire cybersecurity community — across the public and private sectors — can work together in developing more effective cyber-risk management processes that benefit everyone involved.

Redefining Information Sharing across the Enterprise
In May, the much-anticipated Cyber Executive Order called for broader adoption of the NIST CSF, which was initially introduced in 2014 to help critical infrastructure organizations manage cyber-risk more effectively.

The adoption rate of the NIST CSF has been strong. Gartner estimates that about 30% of U.S. organizations embraced the CSF in the first two years it was available, and forecasts expect that number to hit 50% by 2020.

A recent survey of attendees at this year’s Amazon Web Services (AWS) Public Sector Summit found widespread support for the NIST CSF, with 80% saying that it effectively helps organizations manage risk. One of the drivers for this support is the desire for a common set of cybersecurity standards across both the public and private sectors. A remarkable 96% of those surveyed said a common language would benefit their organization.

Why is there such strong support for the NIST CSF and common standards? Well, it essentially solves the usual problems surrounding enterprise-wide information sharing. Matt Barrett, program manager for the NIST CSF, in a recent QA with our CSO, Rick Tracy, said that the CSF’s purpose is “a way of bridging the gap between cybersecurity professionals and people who are experts in other fields.”

The CSF provides a way for everyone, at every level of an organization, to understand cybersecurity in terms that are widely accepted, changing the tune of the typical cybersecurity dialog. Internally, this means that IT professionals from the server room can have an effective, worthwhile conversation with executives in the boardroom. 

In other words, it creates a universal language for cybersecurity. Similar to Rosetta Stone software making it easy to quickly learn a new language, the CSF provides a simple way for anyone to quickly pick up the intricacies of cybersecurity and a robust cyber-risk management plan. 

The CSF becomes the common lexicon that adds sorely needed context, especially when discussing gaps in security defenses and residual risks. In some cases, conversations are not enough if you don’t understand the place your colleagues are coming from. As enterprises aim to improve their cyber-risk management processes, information sharing will take on new depth and meaning, empowered by a common language that is understandable both vertically within organizations as well as horizontally among other companies.

Automation Encourages Enterprise-Wide Collaboration
Despite the fact that the CSF has received significant support in the public sector, too many organizations in both the public and private sectors still see it as “just another framework” because they’ve seen many previous attempts at developing a common cybersecurity language fall to the wayside.

This is due in part to headaches associated with compliance. That same survey asked participants to name their biggest compliance challenge and two rose above the rest — 46% percent said it takes too much time and 45% said it is too complex. These responses were not surprising, unfortunately. Time and complexity are the compliance woes that have plagued cybersecurity leaders for years, and have inhibited any sustained efforts to modernize, innovate, and develop a much-need common cybersecurity language.

Thanks to technology improvements, the answer to overcoming those compliance hurdles has arrived in the form of automation. Organizations are now able to automate compliance standards such as the NIST CSF, which leads to dramatic savings in cost and time. By doing so, there can be an added focus on empowering employees to spend their time on more critical tasks, like responding to threats and risks. Similarly, automation frees up resources that can instead be devoted to innovation, research, and training.

Truly forward-leaning organizations with a focus on security that want to alleviate the burdens of complex compliance activities can implement automated processes that can reduce the time and effort needed by half.

Despite the challenges associated with compliance, automation presents an opportunity to streamline the compliance process. It’s time that organizations become empowered to better utilize technologies that vastly improve cyber-risk management and allow for the necessary collaboration that will drive the future of cybersecurity. 

Related Content:

• 8 Older Companies Doing New Things in Security
• 4 Ways the Next Generation of Security Is Changing
• The Power of the Crowd: 3 Approaches to Sharing Threat Intel

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

 

Stephen Horvath is Vice President of Strategy and Vision at Telos Corporation, a leading provider of continuous security solutions and services for the world’s most security-conscious agencies and organizations. Within this role, he is responsible for leading the development … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/how-to-leverage-the-rosetta-stone-of-information-sharing/a/d-id/1330375?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Sex-toy maker Lovsense has told its customers to stop moaning about one of its products, which recorded audio of users as they – ahem – played, and stored it on their Android phones.

News of the recording emerged on Reddit where an entity by the name of “tydoctor” wrote “control vibrator app (used to control remote control sex toys made by Lovense, such as this one) seems to be recording while the vibrator is on. I was going through my phone media to prepare it for a factory reset and came across a .3gp file named ‘tempSoundPlay.3gp’ in the folder for the App.”

“The file was a FULL audio recording six minutes long of the last time I had used the app to control my [significant other’s] SO’s remote control vibrator (We used it at a bar while playing pool).”

Your correspondent is now done with pool. And bars. Just done.

But we digress.

“The app permissions allow for mic and camera use, but this was supposed to be for use with the in-app chat function to send voice clips on command. At no time had I wanted the app to record entire sessions using the vibrator.”

“tydoctor” says he/she has “deleted the app, and will no longer be using its Bluetooth functions.”

“It’s unfortunate, because there’s no other way to control the vibrator without the app.”

Lovesense’s response says “Regarding the sound file in question, it has already been confirmed that this is a minor bug – a temporary file that is created when someone uses the Sound Control feature. Your concern is completely understandable. But rest assured, no information or data is sent to our servers.”

“This cache file currently remains on you phone instead of deleting itself once your session is finished. Also, when the file is created it overwrites itself (no new files are created).”

The company’s promised “an update that will … make this file automatically delete after you stop using the sound function” and says it’s implemented in this update to its Android app.

This is the second time Lovsense has been caught with its pants down in recent weeks, after it spanked hackers who accused its devices of being easy to hack and then to activate remotely. That exploit earned itself the classy name “screwdriving”.

The company took its turn by saying Bluetooth is never secure and defending its devices on the grounds that the worst outcome from a hack was their machine being turned up to 11. That outcome, the company argued, was far less unpleasant than having a bank account hacked.

Lovsense isn’t the only electrified sex toy maker to hit trouble: We-Vibe recently agreed to pay $3.75m to settle a class action over tracking users of its device. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/11/13/lovesense_fixes_audio_recording_bug_in_adult_toy/

The folk in charge of the hardened Android distribution CopperheadOS have run into problems with licence violations. Over the weekend, they temporarily disabled over-the-air updates for Nexus devices, and pulled some downloads from their website.

The company complained it discovered a knock-off business – people taking its OS images, flashing them onto Nexus phones, and selling them outside its licence terms.

The operating system is licenced under a non-commercial Creative Commons licence (here, for example), but the company found people flashing and selling Nexus phones by the hundreds.

The CopperheadOS business model is either to onsell Pixel or Nexus devices with the operating system pre-installed, or for customers to buy their own phone and send it to the company for flashing. Third parties can also sell the hardened OS – if they negotiate a licence with the company.

The update server for Nexus devices has been disabled until we can find a way forward from the ongoing license violations.

It’s not okay to disrespect our non-commercial licensing terms for those official builds by flashing and selling it on hundreds of phones. That’s over now.

— CopperheadOS (@CopperheadOS) November 10, 2017

On Sunday, OTA updates returned:

We’ve enabled over-the-air updates again to avoid impacting our remaining customers on Nexus devices and other legitimate users. However, downloads on the site will no longer be available and we’ll be making changes to the update client for Nexus devices. https://t.co/jJTI6fpy5b

— CopperheadOS (@CopperheadOS) November 11, 2017

As the Tweet notes, the company also disabled the Nexus 6P and Nexus 5X links on its Website, although an individual with sufficient skill can still get the source code from the GitHub repos. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/11/12/copperheados_stops_updates/

Boston-based ride-hailing hopeful Fasten has coughed to a million-customer data breach that happened because someone left a database lying around unsecured.

The breach was turned up by cloud-crowd Kromtech, whose Bob Diachenko wrote late last week that the company had a misconfigured Apache Hive database exposed on the Internet. Hive is a data warehouse system built on top of Hadoop.

“The server was left open for end-user access and this also let anyone with an internet connection access Fasten’s internal data”, he wrote.

The exposed customer data included names, e-mails, telephone numbers, IMEI codes, trip details (pick-up and drop-off points), and links to photos. Corporate data, including a few thousand driver profiles, routes, comments about drivers, car registration, and photos of drivers’ vehicles.

Diachenko notes that the only payment information in the database was the last four digits of credit cards.

The company told Diachenko the database was created on October 11 of this year, but it wasn’t populated until later, and as far as Fasten can tell, it was only accessible for 48 hours. Fasten doesn’t believe anybody other than Kromtech’s people accessed the data before it was deleted.

Fasten’s Jennifer Borgen told Kromtech it was “old production data”, and the company is reviewing its security processes to keep data safer in future.

The company only operates in Boston and Austin, Texas. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/11/13/rideshare_upstart_fasten_data_breach/

Privacy-minded Firefox users who are tired of websites keeping tabs on their browsing habits should keep their eyes peeled for the Firefox 57 update, also known as Quantum, due out 14 November.

This next major update is expected to include an option to turn on Tracking Protection, which—as the name implies—protects you from tracking. Specifically, it stops sites from loading code that can be used to track you across multiple websites:

Firefox will ship with a list of sites which have been identified as engaging in cross-site tracking of users. When tracking protection is enabled, Firefox will block content from sites in the list.

These scripts are often used by advertisers and website owners who want to gather as much information on their visitors’ demographics and browsing habits as they can, usually to serve up targeted advertisements or to tweak their website’s content.

Although the Firefox bug tracker indicates that the new Tracking Protection option will make its debut in version 57 it isn’t in the version 57 beta, although it is visible in the browser’s nightly builds.

The nightly build shows that the Tracking Protection option is still only applied to private windows by default but can, for the first time, be enabled for all browsing by going to Preferences Privacy Security Tracking Protection, and clicking Always.

Users can make themselves even more stealthy by clicking Change Block List… and choosing the strict protection list instead of the standard basic protection list.

Not everyone wants their information and web habits tracked so closely, by an ever-increasing number of websites, so those that have the tech-savvy have leaned on third-party fixes: browser extensions that block scripts or ads, or custom browser builds that have adblockers built-in.

Adblockers, and particularly script blockers like NoScript, can be a blunt solution though and as they’ve become more popular we’ve also seen an increase in websites trying to outwit them, or nagging users to put up with ads or pay up.

The default Tracking Protection list, basic protection, is Firefox’s attempt to be more scalpel than cudgel: it disables only known tracker scripts, not all scripts (including many that can be core to how contemporary websites function), and “allows some known content trackers to reduce website breakage”.

Likely though users will use Tracking Protection in conjunction with their existing ad blocker, not instead of it.

Blocking ads and tracking scripts from third parties has the added benefit for users of protecting them from malvertising (ads or scripts hijacked to deliver malicious content), as well as stopping plain old annoying banner ads.

And because ads and tracking scripts take time to download and run, blocking them can also boost performance, something Mozilla, makers of Firefox, are happy to talk up:

Since Firefox does not download and render content from tracking domains, Tracking Protection also enjoys performance benefits of a 44% median reduction in page load time and 39% reduction in data usage in the Alexa top 200 news sites.

Previously, Firefox users who wanted to enjoy the privacy, protection and performance improvements of the Tracking Protection capability could only do so within Private Browsing mode.

Private Browsing disables a number of features that some users might want to keep, like stored site logins or preferences, and that can put people off from using it for day-to-day browsing.

With the Firefox 57 update, Mozilla unboxes a popular privacy-centric feature that was previously confined to Private Browsing and brings it a step closer to normal browsing (provided your remember to turn it on).

Follow @mvarmazis
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/aQUk_VA_pLU/

After apparently failing several times to get a response from printer manufacturer Brother, security researchers at Trustwave have gone public with details of a vulnerability (CVE-2017-16249) they discovered in certain models of Brother printers that lets an attacker render the devices temporarily unusable.

The attack exploits a flaw in the printer’s embedded Debut httpd server to cause a DoS (Denial of Service) attack, freezing any print jobs and blocking access to the web interface.

All an attacker has to do is send the printer’s web server a single malformed HTTP POST request and the printer will hang for some time before eventually timing out with a status code of 500, indicating a server error.

At this point, another booby-trapped request will hang up the printer again, and so on.

The advisory does not indicate how the request is malformed but the proof-of-concept code accompanying it appears to have an incorrect Content-Length header, suggesting that the printer ends up waiting for data that never arrives.

Any Brother printers that use the Debut-based web interface are apparently vulnerable to this attack.

Although you’d expect this bug to be exploitable only by users on the same network, printers are often left open to the internet.

So while this may sound more like an opportunity for mischief than a stop-the-presses exploit, a remote attacker could use this vulnerability as a stepping stone to something more damaging than an unmoving print queue.

A printer that keeps going wrong can distract a busy IT team, or even serve as a pretext for someone with social engineering skills to talk their way into the organisation to “fix” the problem.

The Trustwave advisory suggests the following:

No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation.

To which Brother added the following, in recent comments made to SC Computing:

We recommend that the printer password feature is always activated. For those with advanced requirements, Brother offers industry standard protocols such as IPsec, SSL, TLS, SNMPv3 and more, which can be enabled to further secure the printing environment … We encourage any customers with questions about their Brother printer security and set up to contact our customer services team for assistance and guidance.

Or, to put all that advice another way, the principle of least privilege applies here, just as it does everywhere else: the only people who should have access to your printer’s web interface, no matter who made it, are the people who need to have that access.

Follow @mvarmazis
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ynulAZzZqlo/