STE WILLIAMS

Evil pixels: researcher demos data-theft over screen-share protocols

It’s the kind of thinking you expect from someone who lives in a volcano lair: exfiltrating data from remote screen pixel values.

The idea comes from Pen Test Partners’ Alan Monie, taking a break from sex toy hacks and wondering how to get data over a connection like RDP (remote desktop protocol) when the target had blocked file transfer (or the target is using a VMware console that can’t transfer files).

His approach: since the point of a remote desktop is that it’s the contents of a victim’s user’s screen that gets copied over the wire, encode the data you want to steal into the screen data, by flashing up a screen full of what looks like white noise.

Monie’s PTP-RAT proof-of-concept code to do this zips down to a mere 13 KB. At that size, a skilled attacker could upload during an RDP session without attracting attention.

The only stumbling block Monie had to deal with to create it is compression: RDP didn’t transmit screen colour data completely accurately.

However, restricting the exfiltration encoding rate to three bits per pixel (encoding just one bit on each of the Red, Green and Blue values) took care of the compression issue, allowing him to pull a 3 MB file off the target in “a few seconds”.

Here’s how PTP-RAT functions, pretty much in full:

Each screen flash starts with a header. This contains a magic string, “PTP-RAT-CHUNK” followed by a sequence number. When the receiver is activated, it starts taking screenshots at twice the transmission frequency (the Nyquist rate). When it detects a valid header, it decodes the pixel colour information and waits on the next flash. As soon as a valid header is not detected, it reconstructs all the flashes and saves the result to a file.

To transfer a file, you run an instance of the Rat locally on your hacktop, and set that up as a receiver. Another instance is run on the remote server and this acts as a sender. You simply click on send file, and select a file to send. The mouse pointer disappears and the screen begins to flash as the file is transmitted via the pixel colour values. At the end of the transfer, a file-save dialog appears on the receiver, and the file is saved.

As far as Vulture South can tell from Monie’s video, the victim won’t see the alteration – because that’s what’s sent over the wire to the attacker, and they’re expecting to see the screen flashes. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/11/09/evil_pixels_researcher_demos_datatheft_over_screenshare_protocols/

Marissa! Mayer! pulled! out! of! retirement! to! explain! Yahoo! hack! to! Senators!

Poor Marissa Mayer. After selling off Yahoo! and floating away on her golden parachute, she must have been looking for a nice rest. But US Congress wanted her to explain how every single user account on the portal got hacked.

On Wednesday, she testified before the Senate Committee on Commerce, Science, and Transportation on the matter, but reportedly wasn’t too keen to attend. The Hill reports that it finally took a subpoena to drag her to the hearing – an account Mayer’s personal staff reject, saying Mayer had decided to take part before receiving the subpoena.

In an early morning session Mayer apologized to customers over the hacking attack. Yahoo! originally thought 500 million accounts were compromised, then raised it to a billion, before admitting last month that all three billion accounts hosted by the company had been compromised.

“As you know, Yahoo was the victim of criminal, state-sponsored attacks on its systems, resulting in the theft of certain user information,” Mayer said, in a deadpan tone. “As CEO, these thefts occurred during my tenure, and I want to sincerely apologize to each and every one of our users.”

Mayer testified that Yahoo! still doesn’t know exactly how the attacks against it worked – although law enforcement claims that it does in its indictments of four people believed to be responsible. The attacks took place in August 2013 but Yahoo! only realized it had been hacked when police showed the company files that had been stolen from its servers.

Senator Bill Nelson (D-FL) said that he’d been in similar hearings in the past and asked Mayer if it was even possible to protect data against attack. She said that there was little anyone could do about a state-sponsored attack. Nelson wasn’t keen on that response.

Next up, Equifax

The former CEO of Equifax, Richard Smith, didn’t escape a grilling. In past testimony before Congress, Smith blamed a single technician for not installing a critical patch in Apache Struts and an automated network scan that failed to detect the flaw. Committee chairman Senator John Thune (R-SC) was skeptical about the response.

Smith claimed that Equifax had upgraded its scanning technology to catch future flaws but continued to blame the lone technician and the faults of open source software. Paulino de Rego Barros, Smith’s successor, said the firm had hired PWC to do a “top-down review” of the IT infrastructure and stronger policies are now in place, including encrypting its data (duh) and two-factor authentication.

Senator Brian Schatz (D-HI) was even more brutal. He pointed out to Smith that when Yahoo! screwed up, its customers could move but not in the case of the credit reference agency, giving it “zero incentive” to improve. He also pointed out that Lifelock, the service that checks for identity fraud, actually generated money for the errant company because it subcontracts to Equifax. He also questioned the attendee’s personal rewards system.

“People back home cannot understand how the CEO of Equifax and the CEO of Yahoo! walked away with $90m, or $27m, or possibly a quarter of a billion dollars in stocks – this is unfathomable to the average person,” he said.

“They don’t understand, Mr Smith, you harm consumers and you walk away with the amount of money that a small city or county uses for their annual operating budget. It’s not fair and it’s why this dais has an obligation to make a law and not just drag you back and forth and wave our fingers at you.” ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/11/08/marissa_mayer_yahoo_hack_congress/

The IoT Blindspot

Confusion over whether IT staff or line of business professions are responsible for IoT management and security plays big role in a lack of visibility into those devices.

IoT devices are rapidly populating enterprise networks but 82% of IT and line of business professionals struggle to identify all the network-connected devices within their enterprise.

According to a new Forrester study that queried 603 IT and business decision-makers across the globe with 2,500 or more employees, a key contributor to the IoT visibility problem may be confusion over who is responsible for IoT management and security.

While 50% of survey respondents – which include line of business (LoB) and IT security operations center professionals – say the SOC is responsible for default configurations and management of the devices, confusion exists when it’s time to configure the devices, according to the survey, which was commissioned by ForeScout Technologies.

LoB personnel, who are responsible for operational technology (OT)  that runs specific lines of business, often find their role falling under the broad category of connected devices, or IoT.

But when drilling down further on the question of which job titles should be responsible for IoT default configurations, 54% of LoB survey respondents feel it should be overseen by device manufacturers or LoB staff. And 45% of IT respondents agree.

As a result, according to the report, LoB users are deploying devices under the assumption all proper controls are in place without touching base with the SOC. Without SOC professionals involved in the initial setup of the IoT devices, it’s difficult to get a clear view into what devices are actually riding on the network.

“There is a lot of confusion and lack of clarity of who should own the security of IoT devices and determine what should happen,” says Pedro Abreu, chief strategy officer for ForeScout. “LoBs, like plant managers, have a lot of devices that connect to the network. But they tend to think of health and safety first and not security.”

Old Tools vs. New Tools

IoT visibility on the network is also impaired by the use of older security tools that do not scale in an IoT environment, says Abreu.

With traditional security tools, an agent can be installed onto a machine, which then communicates back to the SOC what it is seeing, he notes. But with a number of IoT devices, the ability to add software, let alone security updates, is impossible because the devices are closed in their design, especially in the healthcare industry, Abreu says, pointing to insulin pumps as an example.

“They  [insulin pumps]  connect to the network, but you can’t install a network agent on them,” Abreu says. “We call this a visibility gap.”

He advises companies to just not rely on IP addresses to identify devices that are on their network, but to also have an understanding what the device actually is.

“I need to know if it’s a Windows server or an MRI machine built using a Windows server,” he notes. “The second step would be to set policies around each device and limit what it can do on the network.”

Anxiety and Denial

While 54% of survey respondents feel anxious over the security of their IoT devices, line of business respondents have a somewhat higher degree of anxiety, 58%, compared to 51% for IT counterparts, the survey found.

The disconnect between the two groups may be in part due to LoBs having a greater understanding of the magnitude a breach can have on business operations and their concerns that IT can’t provide assurances that IoT devices are secure. Despite these anxiety levels, 59% of survey respondents are willing to tolerate medium- to high-risk levels in fulfilling IoT compliance requirements, the survey found.

And companies often miss the mark in meeting IoT compliance requirements.When a compliance auditor evaluates a company for all the IoT devices on their network, it’s fairly common to discover 30% to 60% more devices than the company knew they had, Abreu says.

Srinivas Kumar, vice president of engineering at Mocano, says he was shocked by the study’s findings. “The tolerance of risk should be a lot lower,” Kumar says. “I think it should be in the single digits of 10% or less [for] who would be willing to tolerate medium or high risk. The consequences could be the loss of life if it were an IoT device like a pacemaker. If safety is an issue or loss of life, then there should be zero tolerance.”

In the meantime, 90% of survey participants expect the volume of IoT devices on the network will rise over the next year to two years, the survey found.

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Related Content:

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/endpoint/the-iot-blindspot/d/d-id/1330354?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Siemens Teams Up with Tenable

ICS/SCADA vendor further extends its managed security services for critical infrastructure networks.

ICS/SCADA giant Siemens this week added another tool to its newly revamped managed security services for the industrial sector.

Siemens, which in September announced it had added anomaly detection technology from PAS to its existing network monitoring and security services, now will incorporate Tenable Network Security’s vulnerability detection and management technology into a new managed security service offering for critical infrastructure providers.

Managed security services has become an attractive new role for Siemens and other major ICS/SCADA equipment vendors, whose industrial customers are increasingly in the bullseye of malware infections and nation-state hackers looking for leverage against other nations. Industrial networks notoriously are short on cybersecurity expertise and technology as they continue to play catch-up in locking down their networks from attackers. So for Siemens and its competitors, offering managed security services is a logical next step in their strategies.

Siemens’ process control systems were infamously abused by the Stuxnet worm that ultimately sabotaged centrifuges in Iran’s Natanz nuclear facility and served as a major wakeup call for utilities worldwide after it hit seven years ago. In the wake of the attacks, Siemens was among the first ICS/SCADA vendor to build a secure software development program and roll out new products with built-in security features.

Leo Simonovich, Siemens’ vice president and global head of industrial cyber and digital security, says Tenable’s vulnerability management brings to the service the ability to find and prioritize vulnerabilities and fixes in an industrial network. “Our [industrial] customers today are overwhelmed with the number of notifications they get, and on the IT side, they don’t necessarily have the abilities and manpower to address them,” he says.

Tenable’s Nessus-based technology differs from PAS’s anomaly detection technology, which monitors all brands of industrial and computing equipment on a plant network. “Tenable provides the same problem set from a network point of view. It’s important to have both” points of view of the environment, he says.

“We’re focusing on identifying assets [in the network], so there’s a little overlap there with” PAS’s technology in Siemens’ managed security offering, says Ray Komar, vice president of technical alliances at Tenable. “We add a vulnerability perspective, so less on configuration like [PAS].”

Siemens earlier this year added network monitoring to its services via a partnership with Darktrace. Siemens’ new offering with Tenable will be available in early 2018, with oil and gas and other utilities as the main focus, Simonovich says.

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/cloud/siemens-teams-up-with-tenable-/d/d-id/1330370?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Employee surveillance – how far is too far?

Not happy with your job? Been LinkedIn-ing it up on work time, on the company’s network and your work-issued PC? Have you sent out your résumé and titled the message something straightforward? Like, say, “résumé?” Or maybe you’re smarter than that, and you move risky conversations and you-are-toast-if-they-find-out keywords to an encrypted app, like WhatsApp?

Oh, dear.

Sombody should have filled you in: you see, workplace surveillance has grown up. It’s put on its big-boy pants. It’s evolved past eyeballing email and eavesdropping on phone calls: that’s so old school.

According to a report from The Guardian, the technology has gotten to the point of a “digital panopticon” that includes tracking where employees browse online and what they say in text messages, capturing screenshots, recording keystrokes, nosing around in social media posts, surveilling “private” (ha!) messaging apps like WhatsApp, and even inserting itself into face-to-face interactions between co-workers.

Employee surveillance isn’t exactly new. As Bloomberg reported last year, companies including JPMorgan Chase and Bank of America have explored systems that monitor workers’ very emotions, all in the name of boosting performance and compliance.

In February, Bloomberg BusinessWeek reported on goings-on at the Daily Telegraph, where employees discovered mysterious “OccupEye” black boxes beneath their desks, set up to track exactly when each desk was occupied.

Another company, Humanyze, has microphone-equipped smart badges that track employee movements, creating a heat map of office activity to help companies plan more effective office redesigns. The badges don’t track conversation content, but they do track how often employees talk to each other, as well as each employee’s proportion of talking to listening.

Combined with big data technologies, Humanyze promises a whole raft of additional applications, such as better predictions of when valued employees are planning to quit, so companies can intervene to keep them.

Which gets us back to the use of that trigger word, “résumé.”

As the Guardian reports, it’s common, if old-school, for employers to use keyword detection, keeping an eye out for lists of predefined terms including swear words and slang that give off an ominous odor. Yes, it’s common for employers to set up keyword detection, in spite of the approach throwing off a good deal of false positives and being pretty easy for employees to skirt… well, except when they don’t.

That’s what happened when an All State Insurance franchise conducted a live demonstration of a package of employee monitoring tools from Awareness Technologies under the brand Interguard. The technology worked quite well in the demo. Almost immediately after starting to scan the network, it hit on an email with the words “client list” and “résumé”, the Guardian reports:

The demonstrator opened the email in front of a room full of peers to discover his best employee was plotting to move to another company.

Well, ouch. Old-school, but still, ouch.

Some of the newer, more cutting-edge employee spy apps:

  • Look for subtle forms of trouble like “context switching”, such as an employee suggesting a discussion is moved to an encrypted app, like WhatsApp or Signal.
  • Are placed on employee’s devices (with their consent) so that conversations can be followed if they do switch to encrypted messaging.
  • Track how much somebody flips back and forth between apps to see if they’ve unproductive multitaskers with a Facebook habit.
  •  Screen social media posts for potentially problematic content like references to bigotry, misogyny, violence or drug and alcohol references.

Is all this intrusive as hell? Oh yes, though by and large, it’s legal in the US. California and Maine have slightly stricter laws protecting employee privacy, but for the most part, employers can track you without worrying too much that they’ll get into legal hot water – barring spying on employees via webcam. However, there is one product, WorkSmart, that snaps photos of workers every 10 minutes, combines the images with screenshots of their workstations, mixes it all up with recorded app use and keystrokes, and bakes up a “focus score” and an “intensity score” to gauge whether freelancers are worth their salt.

Where the legality (possibly) stops is when the boss starts monitoring – or even asking about – employees when they’re off the clock, according to the legal site Nolo.com. The issue came up a few years ago when a former sales executive for the money transfer service Intermex sued her employer for firing her after she disabled a 24×7 monitoring app.

Nolo says that for public employers, both monitoring or merely inquiring about employees’ off-the-job life is largely off-limit.

As far as private sector companies go, some state constitutions, including California’s, prohibit employers from taking any job-related action against a worker based on whatever (legal) activity they do when they’re not working.

That’s not the same as forbidding monitoring of off-duty workers, though.

Of course, companies that handle money have a vested interest in keeping an eye on potential rip-off artists in their work force. As the Guardian notes, that’s why most surveillance tech providers focus their attention on the financial sector: that’s where companies are required, by law, to prevent insider trading by tracking staff communications.

One of the news outlet’s sources said his employer, a large consulting firm, was pondering whether it could look at employees’ Facebook pages to see if they could sniff out fraud. Say, if a trader changes their relationship status from married to divorced: would that put somebody under financial strain, leading them to fraud or theft?

It’s quite a leap, to assume that somebody whose marriage broke up is going to be turned into a thief and should be monitored, he said.

At any rate, don’t assume you’re free and clear if you don’t work at a stock brokerage or the like. These surveillance products are increasingly being sold to monitor employee productivity, data leaks, sexual harassment or other inappropriate behavior, the Guardian reports.

Many of us will balk at this surveillance state, particularly if we think of ourselves as knowledge workers. We don’t clock on and clock off at exactly the same time. There’s no production line that’s going to blow up if we aren’t standing on it at exactly the right time of day.

As knowledge workers, we’re always on the clock. We work on weekends. We read emails on our vacations and in the wee hours of the morning. Didn’t Silicon Valley already work this out? Don’t Google and the like tell employees to take time off whenever they need it? To go ahead and work from Starbucks if you want? Isn’t work about the outcome, as opposed to simply being busy?

“Do this to programmers and watch them leave,” Naked Security’s Mark Stockley says.

We can think that way if we’re knowledge workers, and if we’re lucky, our bosses will feel the same way.

Does that make it OK to stick cameras, heat and motion sensors, klaxons set to go off when they hit on keywords, and the like on the people we consider to be non-knowledge workers?

I’m thinking that factory workers, security guards, retail workers and the like would bristle at the notion just like anyone else.

No person is a collection of body parts, running in automatic mode, with their brain shut off and their knowledge put on a shelf.

But in a tough job market, and given a non-sympathetic legal landscape, what choice do workers really have?


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/1tZ7X0-h-RU/

Hijackers deface 800 school websites with pro-Islamic State messages

Early Monday morning, the websites for about 800 US schools and school districts were hijacked and replaced with an image of Saddam Hussein on a black background, a recruitment video in Arabic and the statement “I Love Islamic State” in English, according Jim Brogan, director of technology services for schools in Gloucester County, Virginia.

This should all ring a bell, given that hackers going by the same name have been more or less making the same defacements for years. Namely, a photo of Hussein accompanied by an Arabic message seen on an IS flag that reportedly reads “There is no god but Allah” and “Mohammed is the Messenger of God.”

According to the International Business Times, the web hosting company that services the sites – SchoolDesk, in Atlanta – confirmed the attack and said that a group going by the name “Team System DZ” claimed responsibility.

SchoolDesk’s statement:

Our technical staff discovered that a small file had been injected into the root of one of the SchoolDesk websites, redirecting approximately 800 school and district websites to an iFramed YouTube page containing an audible Arabic message, unknown writing and a picture of Saddam Hussein.

SchoolDesk said that it’s enlisted an outside security firm and is actively working with various local, state and federal law enforcement agencies, including the FBI.

Hackers using the name Team System DZ have pulled similar stunts in the past. The group, which was credited in the message displayed on the affected school sites, is associated with an account that boasted of breaching Zone-H: an archive of defaced websites where users can upload evidence of their online vandalism.

Zone-H classifies the hackers as a group of “anti-Israeli Arab teenagers,” according to a 2015 report from USA Today that screams of deja vu. In January 2015, the official website for the government of Isle of Wight County in, once again, Virginia, was hacked by a group calling itself Team System DZ, its website littered with propaganda videos, messages supporting IS, and an English message stating that “I love isis.”

They don’t change up that valentine very much: when hackers using the same name defaced the home page of the West Yorkshire Rugby League club’s Keighley Cougars in 2014, they put up a black screen that read “Hacked By Team System DZ” at the top and the message: “I love you isis”.

As the Washington Times reports, the group has taken credit for pro-IS defacements allegedly affecting hundreds of other targets, including companies, non-profit organizations and federal agencies, ranging from an Alabama gasket installer to the National Oceanic and Atmospheric Administration (NOAA). It’s also targeted websites running the same or similar versions of vulnerable applications, the newspaper reports, including a mass hacking campaign in June that affected government agencies in several states, including the Los Angeles Board of Supervisors and the office of Ohio Gov. John Kasich.

As far as the School Desk sites go, they were down for about five hours – between 2 am and 7 am – before School Desk fixed the problem. No Gloucester student records or other data was breached, Brogan said, given that such information is kept separate from the school’s site.

What to do?

If you run a website, regardless of its being politically oriented or completely apolitical, make sure you do everything you can to keep it as secure as possible.

Defacing a site isn’t rocket science. But, fortunately, neither is protecting a website from opportunistic vandals. SophosLabs has a paper that can help: “Securing websites”.

Another recent story about hackers hacking a hacking site gave us an opportunity to pass along a few obvious precautions you can take for your own online service:

  • Patch promptly. If the crooks know what server software version you’re using, and it has a known security hole, they may be able to break in automatically. In other words, if you haven’t patched, you’re the low-hanging fruit.
  • Choose decent passwords. If the crooks can guess your password, or if you used the same password on another site that already got hacked, then the crooks don’t need to do any hacking themselves – they can just login directly.
  • Use two-factor authentication (2FA). A one-time code that changes every time you login means that just guessing or stealing your password isn’t enough. If the code is calculated on or sent to your phone, then the crooks need your phone (and its unlock code) as well, which is a higher bar to jump over.
  • Check your logs. If you keep logfiles for auditing purposes – for example, so you can check who logged in when – examine them proactively in order to find security anomalies sooner rather than later.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/2iIh9nIWoTk/

Is Wi-Fi still safe to use? [VIDEO]

Remember the KRACK attack?

It was bug-of-the-week about a month ago.

KRACK documented a way that you could, in theory, snoop on wireless data – albeit typically only tiny amounts, and with quite a lot of difficulty – even on encrypted wireless connections.

The silver lining in the KRACK story was that it got people asking, “Just how safe is Wi-Fi in general, and what can I do to reduce my risk when I’m online?”

So, we asked Sophos security expert Luke Groves to talk us through the question, “Is Wi-Fi still safe to use?”

(Can’t see the video directly above this line? Watch on Facebook instead.)

(You don’t need a Facebook account to watch the video, and if you do have an account you don’t need to be logged in. If you can’t hear the sound, try clicking on the speaker icon in the bottom right corner of the video player to unmute.)


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/TY9Yo1cI970/

How Law Firms Can Make Information Security a Higher Priority

Lawyers always have been responsible for protecting their clients’ information, but that was a lot easier to do when everything was on paper. Here are four best practices to follow.

Some people think that law firms aren’t interesting targets for computer criminals. They don’t typically have terabytes of credit cards and bank accounts on file. But they do retain powerful clients, from wealthy individuals to big companies, and they often have privileged information about those clients, including details of business dealings and inside information about their negotiating positions and future plans.

Of course, law firms have always had an ethical responsibility to protect the confidentiality of their clients. This was a bit easier to do when everything was on paper; the only risk was if the attorney left a sensitive memo in a bar or if the firm didn’t have tight physical security to prevent a thief from gaining entry to the office — think Watergate. Clearly, things have changed, but like many other sectors, the adoption of new technology by law firms has outpaced the adoption of the security best practices needed to live with that technology safely.

There are now several prominent examples of how things can go wrong. Earlier this year, global law firm DLA Piper was hit by a strain of ransomware that forced management to shut down its offices for several days while IT dealt with the problem. In 2016, a breach referred to as the Panama Papers entailed a massive document disclosure of 2.6 terabytes of data from Panamanian-based law firm Mossack Fonseca. German newspaper Süddeutsche Zeitung got hold of the documents, resulting in coverage of celebrities’ and politicians’ financial transactions and other personal details. 

If events like these have a silver lining, it is the possibility that other firms might learn from them in hopes of avoiding the same fate. Here are four best practices law firms should consider as they seek to make information security a higher priority:

1. Prioritize information security in the right way. Unfortunately, when firms get serious about information security, they often do so by designating a person responsible for preventing breaches from occurring. While having a professional CISO is an important step that many firms ought to take, they should do so with a broader understanding of what that person is responsible for.

Breaches are going to occur. The CISO is not just responsible for reducing the risk that they’ll happen, but also leading the organization to adopt practices that will limit their impact and setting the organization up to respond properly and recover quickly when they do happen. And incidentally, CISO’s are most effective when the rest of the organization understands the importance of good security practices and is open to improving those practices rather than resisting them.

2. Reduce the firm’s information footprint. Through our day-to-day use of digital technology we tend to amass piles of valuable data, without even thinking about it. What will computer criminals be able to get access to if they compromise the computer or email account of a typical member of your firm? There may be a lot of old data, documents, and emails sitting on the laptops of your attorneys or on file servers that just don’t need to be there. Can you automatically archive old data to offline storage, where it isn’t readily available on the network?

3. Involve your employees as a part of the solution. When it comes to reducing the firm’s information footprint, a bit of personal awareness on the part of individual employees can go a long way. Tagging an email as “attorney client privileged” won’t stop computer criminals from reading it. They should constantly ask themselves, “Is this conversation with a client an appropriate conversation to have via email, where it might be permanently stored or exposed, or should I pick up the phone?”

Employees are also your front lines for detecting things such as phishing attacks. Some people aren’t very responsive to training, but others will learn, and report suspicious things they see. Often, sophisticated attacks will target multiple employees. The ones who are good at identifying them may be your first warning.

4. Build an organization that is resilient. Again, breaches are going to happen. The sensible approach is to put together a thorough incident response and recovery strategy. The advent of ransomware makes an especially powerful case for this: if your firm has been backing up all its files and systems daily or even continually, there’s no need to pay tens of thousands of dollars to the criminals hijacking your firm’s files.

Maintaining a highly secure and safe operation should be top of mind for partners and directors at law firms of all sizes. This is not a routine IT administration task but a smart business strategy that can keep your firm thriving and in good stead with clients for many years to come.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

 

Tom Cross is a highly experienced and respected information security leader who oversees all technical elements of OPAQ Networks and is responsible for communicating the technology strategy to partners, employees, and investors. He is the co-founder and former CTO of … View Full Bio

Article source: https://www.darkreading.com/endpoint/how-law-firms-can-make-information-security-a-higher-priority/a/d-id/1330337?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Inhospitable: Hospitality & Dining’s Worst Breaches in 2017

Hotels and restaurants are in the criminal crosshairs this year.PreviousNext

The good news for this year is that the megabreaches at large retail chains like the ones that plagued Target, Home Depot, TJX and the like have been largely absent from the news cycles in 2017. But that doesn’t mean we’re out of the woods with point-of-sale breaches just yet. In fact, the hackers may be turning their sights to hoteliers and restaurants as department stores, grocery chains and other traditional retailers start to improve their security practices. The following high-profile incidents are evidence of this mounting trend. 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full BioPreviousNext

Article source: https://www.darkreading.com/endpoint/inhospitable-hospitality-and-dinings-worst-breaches-in-2017/d/d-id/1330325?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cybercriminals Employ ‘Driveby’ Cryptocurrency Mining

Mining digital coins is a legal activity, but cybercriminals have discovered a new way to inject malware to perform the task.

Cyberthieves are using a new technique to cash in on cryptocurrency mining.

With so-called driveby cryptojacking, the attacker abuses browser-based cryptocurrency mining unbeknownst to the users and website operators, new research from Malwarebytes shows. 

Cryptocurrency mining is like panning for gold in the digital age and is considered legal. It demands hordes of computing power to process complex mathematical calculations, which in turn is used to create cryptocurrencies like Bitcoin, Monero, Zcash, and others.

In the past year, cybercriminals have used cryptojacking to snare needed computing power via the browser, says Jerome Segura, lead malware intelligence analyst for Malwarebytes.

This browser-based mining, which uses a simple JavaScript library and is sometimes called JavaScript Miners or JSMiners, is rapidly taking off with the bad guys since it was introduced in mid-September by Coinhive. JSMiners is an easy way for bad guys to infect websites via driveby cryptojacking as well, Segura notes, and it can potentially infect far more computers when they visit heavily trafficked websites than directly infecting victims’ devices.

Then and Now

Illicit cryptocurrency mining initially began in 2011, a few years after the birth of Bitcoin, Segura says. Cybercriminals up until last year would largely rely on infecting users’ computers without their knowledge to hijack, or harvest, the devices’ compute power. They typically used phishing scams to entice users to download malicious attachments or visit nefarious websites, where they could automatically load malware onto victims’ machines.

Once the device is infected – or devices as in the case of the Bondnet botnet that infected more than 15,000 machines at major institutions, including high-profile companies, universities, and city councils earlier this year – the computing power is used to crunch mathematical calculations and create digital currency.

Last year, however, Coinhive’s new technique for mining cryptocurrency emerged and the bad guys jumped on it, Segura says. Coinhive launched a JavaScript-based cryptocurrency mining service that allows website operators to legitimately use their visitors’ CPU power to mine for Monero cryptocurrency, with or without their knowledge. 

Coinhive has since released a new API to allow website operators to seek users’ permission before harvesting their CPU power, however.

But cybercriminals quickly latched onto Coinhive’s technology and began injecting its API into compromised websites, such as WordPress and Magento, without knowledge or consent from site operators, according to Malwarebytes’ new report.

“It’s easy to have great reach with this browser-based cryptocurrency mining. The criminals would target sites that get lots of traffic and inject malicious script onto the site,” says Segura. “Anyone connecting to the website will run the Javascript that can instruct the computer or phone to run the coin miner just like they were running a YouTube video.”

Coinhive is relatively easy to add to a site, given it only requires copying a few lines of JavaScript and embedding it into the site, says Segura.

The bad guys lose access to users harvested computer power each time they log off of an infected site. So cybercriminals like to target sites where visitors linger for hours, Segura notes.

Sizing Up the Risk

Security professionals facing an onslaught of attacks and alerts, however, aren’t likely to prioritize driveby cryptojacking because the amount of harm it creates to the enterprise is minimal, Segura acknowledges. Even so, enterprises should be sure to remove and block driveby cryptojacking from their websites.

“Hacking websites and mining digital coins is further fueling cybercriminals,” Segura says. “As a security professional, I look at the potential scale and how this can affect millions of people and it is a big problem because it can generate a lot of revenue for criminals, and we want to put a dent in it and stop it.”

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/endpoint/cybercriminals-employ-driveby-cryptocurrency-mining-/d/d-id/1330353?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple