STE WILLIAMS

The ever-vigilant folk at the Internet Storm Centre (SANS) have spotted yet another campaign trying to drop the Locky ransomware using compromised Word files.

As Internet Storm Center handler Brad Duncan writes, the vector in the Word documents uses Microsoft Dynamic Data Exchange (DDE), a feature that lets Office application load data from another Office file. This is the kind of attack that last week was spotted in a phishing campaign launched at Freddie Mac.

Duncan outlines the attack approach in this flowchart:

Image: Brad Duncan, SANS

The phishing messages carrying this attack come from the Necurs botnet, he writes, and as with other DDE attacks the aim is to convince users to OK through the security warnings. A fake invoice is the scammers’ preferred weapon.

If the attack cons the victim, the poisoned document fetches a downloader which in turn pulls a copy of Locky to decrypt at the target.

Once the ransomware’s launched and it’s encrypted the victim’s hard drive, Locky is deleted (a downloader is left behind), and a demand for 0.25 Bitcoin issued.

Duncan writes: “This is an interesting development, because it shows how the DDE attack technique has spread to large-scale distribution campaigns. It’s not new, and I’m not sure how effective it really is. If you know of anyone who was infected from one of these DDE-based Office documents, please tell your story in the comments.”

The Register noted last week that DDE (Dynamic Data Exchange) has been around since 1987, and it’s an increasingly-popular target for attackers.

Since users have to okay execution, Microsoft steadfastly insists DDE is a feature, not a bug. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/23/locky_spread_by_necurs_botnet_in_dde_attack/

In the last two weeks, Sophos researchers have kept an eye on a vulnerability in Microsoft’s Dynamic Data Exchange (DDE) protocol used to send messages and share data between applications.

Yesterday, new developments revealed an additional dimension to this attack.

Early on, we noted that attackers could exploit DDE to launch malware via tainted Office attachments, for example in Word and Excel files, but without using macros. 

On Friday, independent reports surfaced showing that it’s possible to run DDE attacks in Outlook using emails and calendar invites formatted using Microsoft Outlook Rich Text Format (RTF), not just by sending Office files attached to emails.

In the original attack users had to be coaxed into opening malicious attachments. By putting the code into the email message body itself, the attack comes one step closer, meaning that the social engineering needed to talk a recipient into falling for it becomes easier.

The good news is that whether a DDE attack comes via an attachment or directly in an email or a calendar invite, you can stop the attack easily:

Just say no

Attachments, emails and calendar invites pop up two giveway warning dialogs before triggering a DDEAUTO attack; if you say “No” at either dialog then you prevent the attack. (SophosLabs is not yet aware of any mechanism to bypass these dialog boxes.)

First, you’ll see a warning like this when DDE is used:

This document contains links that may refer to other files. Do you want to update this document with the data from the linked files?

Clicking “No” will stop a DDE attack from running.

If you click “Yes” at the first dialog, you will see a second dialog warning that a command is about to be run (the text in parenthesis and the program names referenced at the end will vary):

The remote data (k powershell -w hidden -NoP -NoExit -) is not accessible. Do you want to start the application C:windowssystem32cmd.exe?

Again, clicking “No” will stop the attack.

You can also neuter DDE attacks embedded directly in emails by viewing all your messages in plain text format, regardless of the format they were sent in.

Note, however, this will disable all formatting, colours and images in all messages, including those sent in the popular HTML email format. This will make some messages harder to read and may prevent you seeing content that the sender is expecting you to to see.

Please check the Microsoft Support website for details of how to view all emails in plain text format in Outlook.

Follow @NakedSecurity
Follow @BillBrenner70

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/bNVd8Mt67LQ/

Roundup IT admins aren’t always fond of patching. It’s like going to the dentist – it needs to be done but it can be a pain to do. Sadly, this week there was a lot of patching to be done.

The Wi-Fi WPA2 weakness dubbed KRACK burdened Android, Linux and macOS users at work and home with patch installation responsibilities, and Cisco added to the load with a bumper crop of four worryingly fixes for various security bugs, ranging from denial-of-service to authorization bypasses: two patches for its IP phones, one for FXOS and NX-OS users, and a critical fix for its Cloud Services Platform.

There is at least some good news on the patching front. Samsung users will have got their latest Android patches sent through automatically, and Huawei has said it is getting tighter about sending out updates to its handsets. And Debian fixed up a little embarrassing oversight in its ftpsync tool used to mirror the Linux distro.

If you have a Lenovo Android tablet, VIBE, Moto or ZUK phone, please grab and install this patch to avoid being hacked over the air: the mechanism Lenovo uses to push updates to devices can be hijacked by malicious code to install malware.

And if you use an Axalto or Gemalto .NET v2 smartcard, be aware the Infineon TPM cryptography screw up may well affect the security of your devices.

Meanwhile, there were some rather breathless headlines this week about a secret silo of un-patched security vulnerabilities in Microsoft products that Redmond was keeping all to itself, which hackers obtained in 2013. This led to much wailing about how could nasty old Microsoft be allowed to get away with this.

Yet, virtually every software company has the same sort of silo: it’s called a bug database, and contains all the things engineers are planning to fix and is usually kept confidential. Yes, it appears Microsoft did get hacked, meaning details of exploitable bugs potentially fell into the wrong hands, and the IT giant said as much at the time. Its Apple Mac computers, how ironic, were among its corporate machines compromised by the intruders, who then scoured other parts of Redmond’s internal networks for valuable information. However, the biz claims it all led to nothing.

“In February 2013, we commented on the discovery of malware, similar to that found by other companies at the time, on a small number of computers including some in our Mac business unit,” a Microsoft spokesperson told The Register. “Our investigation found no evidence of information being stolen and used in subsequent attacks.”

Eugene throws shade but IT bosses are the worst snoops

It’s clear that Eugene Kaspersky isn’t going to back down over claims that his antivirus giant was helping Russian intelligence spy on millions of computers around the world. In a lengthy blog post he offered an update in the situation.

“The past year has seen concerns about KL change from ‘what if their technology could be a tool for cyber-espionage by nation states’ to ‘they were hacked and used as a vehicle to spy on spies’,” he wrote. “And while it’s hard for us to keep up with the constantly evolving narrative, ask yourself one thing: ‘if these recent allegations are true, where’s the evidence?’”

One thing he didn’t mention, but we were wondering about, is that if the NSA staffer who was apparently taking work home is such a specialist, it’s rather interesting that the AV system this person chose for their home PC was Kaspersky. That’s quite an endorsement when you think about it.

While we’re on the topic of spying, a survey out this week from governance group One Identity found out the biggest snoops on IT networks are the IT bosses themselves. Some 56 per cent of IT security staffers admitted to looking at other people’s data on the network, but that rose to 71 per cent with IT management.

As for actual data theft, there appears to be trouble brewing for South Africa. Troy Hunt, who runs the Have I Been Pwned website, claims to have found an archive online containing the personal data of every pensioner in South Africa.

Hunt said that the archive is a 27.2GB backup file and that he found names, gender, ethnicity, home ownership records, people’s identity numbers and contact information. The data also contained and other information like their estimated income and details of their employer.

After opening it up, Hunt found 31.6 million records, but then the archive folder crashed. He estimated there could be 47 million records in all and this archive is just sitting out on torrenting sites for anyone to see.

Hutchins moves closer to freedom

So as not to end on a downer there’s some great news for Marcus Hutchins, the Brit malware researcher who stopped the Wannacry ransomware outbreak by discovering and activating its kill switch, and then got pinched by the Feds in the US and accused of being a black hat hacker himself.

After a short sojourn in jail, Hutchins was bailed, and is now living in Los Angeles, California, while he awaits trial and fend off claims he helped developed malware that targeted online bank accounts back in the day. He’s under a strict curfew, can’t really do his day job of security research due to restrictions placed on him, and has to wear a GPS ankle bracelet at all times.

The downside of the latter condition is that the GPS unit isn’t waterproof. Hutchins is a keen surfer and is living near some of the most iconic surfing spots in the world, but can’t get in for fear of the GPS tracker dying in the sea and him being arrested.

But now a judge has ruled [PDF] that he can take it off and doesn’t have to be at home promptly at 9pm each night – thus allowing him a measure of normality and the chance to catch some breaks. Sadly though it’s not that simple. The US government has appealed the decision so he’s stuck on shore for the moment, but it’s a hopeful step. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/21/security_roundup/

Between KRACK, ROCA, new threats to SSH keys, and the European Commission’s loosey-goosey stance on encryption backdoors, it’s been a difficult time for cryptography.

BY DAWN KAWAMOTO AND SARA PETERS — This week started off with a bang when the KRACK key reinstallation attack vulnerabilities upended the security of Wi-Fi and the ROCA factorization bug made all trusted platform module chips suddenly less trustworthy. That isn’t all the week had in store for the cryptography world, though.

Here’s a rundown on the latest news on KRACK, ROCA, and the news you might have missed about SSH and encryption backdoor regulation.

SSH Keys Being Scanned by Attackers and Ignored by Security
SSH (Secure Shell) got a little jolt this week, as well. Wordfence, a security service for WordPress, discovered a threat actor scanning up to 25,000 systems a day looking specifically for vulnerable private SSH keys. The attacker is specifically scanning for terms like “ssh,” “root,” and “id_rsa,” which might lead to a directory of private keys that was stored in the wrong place.

The rate of scanning for SSH keys from known-malicious IPs has continued at the same rate since Monday; roughly 25,000 systems per day, “which jumped up from just about zero,” according to Mark Maunder, CEO and founder of Wordfence.

In response, Wordfence is helping users determine if they have publicly exposed private SSH keys by adding this capability to their Gravity Scan service to users. Maunder says that users must prove site ownership before Gravity Scan will provide vulnerability details.

SSH is a ubiquitous but often overlooked cryptographic network protocol created largely as a secure alternative to telnet and rsh/rsec. It’s used for secure remote logins to remote computer systems and secure file transfer; it’s used not only for WordPress but across admin-to-machine and machine-to-machine communications in all manner of Linux- and Unix-based systems. 

[Don’t miss “Preventing Lateral Movement in Your IT Environment” with John Terrill, CISO of OPAQ Networks, at Dark Reading’s upcoming INsecurity conference, Nov. 29-30 in the D.C. area.]

So far, Wordfence has not seen any active exploits as a result of this SSH key hunt. Maunder says that problems like this are often a result of users accidentally placing private keys in the wrong place because they don’t know it’s a risk. “It’s really an education problem,” says Maunder. 

In a survey released Tuesday, conducted by Dimensional Research on behalf of Venafi, 90% of respondents conceded that they do not have a complete and accurate inventory of all their SSH keys, “so there is no way to determine if keys have been stolen, misused or should be trusted,” according to researchers.

The author of SSH, Tatu Ylonen, has himself lamented organizations’ woeful management of SSH keys and has suggested improvements to his protocol to eliminate problems like the proliferation of rogue keys. For now, though, respondents to Venafi’s study continue to commit the key management sins that SSH experts warn against. Forty percent of respondents do not rotate SSH keys at all, or only occasionally; 61% do not limit or monitor the number of administrators who manage SSH; 54% do not limit the locations from which SSH keys can be used (thereby making remote attacks easier); and 51% do not enforce “no port forwarding” rules (thereby effectively allowing users to bypass firewalls).

The Impact of KRACK
Key Reinstallation Attacks (KRACKs), which affect all modern Wi-Fi devices and access points, are hitting Cisco particularly hard. The networking giant released Thursday an updated security advisory on KRACK, noting 71 of its products had at least one or more of the 10 vulnerabilities tied to KRACK.

For Cisco’s customers using these products, there are currently no fixes available and only a workaround for one of the 10 vulnerabilities, the company notes.

“Cisco will release software updates that address these vulnerabilities. There is a workaround that addresses the vulnerability in CVE-2017-13082. There are no workarounds that address the other vulnerabilities described in this advisory,” the company stated.

In addition to the 71 products that are vulnerable to KRACK, Cisco has another 22 products it is actively investigating to determine if they are also at risk, the company notes.

Earlier this week, researchers at a Belgium university discovered the KRACK vulnerabilities in the Wi-Fi Protected Access II (WPA2) protocol that is used to secure Wi-Fi networks. These vulnerabilities can be exploited to allow attackers to decrypt data and information, hijack traffic, and other nefarious activities as the data and information moves across Wi-Fi networks.

The WPA2 encryption protocol flaws also have industry titans Microsoft, Apple, and Google hustling to develop patches for their devices, as TechCrunch reports.

Microsoft has a patch out for its Windows 7, Windows 8, Windows 8.1, and Windows 10 devices, but Apple is working to roll out a fix to customers and currently has a beta version of macOS, iOS, tvOS, and watchOS available for download, notes TechCrunch.

And while exact figures on the number of users who are affected by these KRACK vulnerabilities are not available, it would not be hard to envision millions of users could potentially be affected given the omnipresence of WPA2 encryption protocols in Wi-Fi devices.

The Electronic Frontier Foundation (EFF) released a few calming observations. One is that any attack would need to have an active antenna within range of the targeted wireless network and would require the interception and delay of many packets traveling on the Wi-Fi networks. The EFF states it’s a complex task to trick a device and reset its encryption key as packets are actively being broadcast. Additionally, sensitive Wi-Fi traffic would not be affected by the WPA2 vulnerabilities if the site is encrypted with HTTPS.

European Commission Discusses Encryption
The European Commission this week revisited the topic of encryption backdoors. The EC seemed to subtly say no to backdoors when releasing the statement that it would support law enforcement when it encountered encryption “without weakening encryption at a more general level or affecting a large or indiscriminate number of people.” However, its set of proposals to enhance law enforcement’s ability to obtain the electronic evidence it desires include “to support Europol to further develop its decryption capability.” It also stated that “in early 2018, the Commission will present proposals to provide for a legal framework to facilitate access to electronic evidence.” (Emphasis not added.)

ROCA Rocks
Another crypto vulnerability revealed this week includes The Return of Coppersmith’s Attack (ROCA). 

The ROCA flaw is found in the PC motherboard chipset inside Infineon Technology’s Trusted Platform Module, which is used to store encryption keys, passwords, and certificates, reports Kaspersky’s Threatpost.

When an RSA encryption key is generated, a remote attacker uses the value of a public key to compute the private key by crunching the numbers through practical factorization, according to researchers with the Centre for Research on Cryptography and Security at Masaryk University in the Czech Republic, Enigma Bridge in Cambridge, United Kingdom, and Ca’ Foscari University of Venice, Italy. These researchers discovered the vulnerability.

Once the private key has been compromised, attackers can impersonate the legitimate owner, decrypt sensitive messages, engage in signature forgery, and other attacks, according to a blog post by the researchers.

The researchers discovered the flaws when inspecting a large number of RSA keys that were generated and exported from the manufacturer of smartcards. The group notified Infineon Technologies of the vulnerability in February and also reached out to other affected parties, such as, Microsoft, Google, HP, Lenovo, and Fujitsu, which have since released updates.

“We found and analyzed vulnerable keys in various domains including electronic citizen documents, authentication tokens, trusted boot devices, software package signing, TLS/HTTPS keys and PGP,” the researchers stated. “The currently confirmed number of vulnerable keys found is about 760,000 but possibly up to two to three magnitudes more are vulnerable.”

Researchers noted Friday that “Gemalto IDPrime .NET smart cards have been generating weak RSA keys since 2008 or earlier.” You can check if keys are vulnerable here.

Related Content:

• Businesses Fail to Properly Secure, Assess SSH: ISACA
• Secure WiFi Hijacked by KRACK Vulns in WPA2 
• Factorization Bug Exposes Millions of Crypto Keys to ‘ROCA’ Exploit
• Cryptographic Key Reuse Remains Widespread In Embedded Products
• 8 Most Overlooked Security Threats

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/the-week-in-crypto-bad-news-for-ssh-wpa2-rsa-and-privacy-/d/d-id/1330187?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

But developers not the only ones to blame, company says.

Application security continues to stink at many organizations, a new report from Veracode shows. But developers are not the only ones to blame. 

A failure by organizations to provide adequate security training and by operational teams to address vulnerabilities in the production environment have a big impact on application safety as well, the company said.

Veracode’s State of Software Security 2017 report is based on a code-level analysis of nearly 250 billion lines of code across 400,000 assessments conducted for 1,400 customers between April 2016 and March 2017.

The analysis showed more than 75% of the applications having one or more security vulnerabilities in code written by the development team, on initial scan. About 12% had either a very-high-severity or a high-severity flaw on first scan. A startling 88%, nearly nine out of 10, Java applications had at least one serious component-level flaw.

[See Veracode’s vice president of research Chris Eng discuss Security, Application Development and DevOps at DarkReading’s upcoming INsecurity Conference, Nov. 29-30 in the D.C. area.]

Veracode’s 2017 analysis found applications riddled with the same vulnerabilities that it uncovered last year. Information leakage flaws were most common and were present in more than 65% of the applications in which a security bug was found on initial scan. About 62% had cryptographic flaws while 56% had what Veracode described as code quality issues.

The Top 10 list of most frequent vulnerabilities on initial scan this year was identical to the list of top flaws last year and suggested that organizations are continuing to grapple with the same issues as they have been for quite some time.

“This year’s study included confirmation of trends we’ve seen for a while,” says Tim Jarrett, senior director of product marketing at Veracode. But there were also some surprises, he says.

The analysis, for instance showed accelerating adoption of scanning earlier in the software development lifecycle, he says. The number of organizations doing at least 12 scans per year ticked up slightly from 10.5% to 11.1%. Over 36% though continued to do just one scan per year.

There was also evidence that findings, which are prioritized by a policy, for instance higher severity findings, get fixed about twice as often as do findings not prioritized by policy, Jarrett says.

“We see evidence that scan frequencies are increasing, with a 3% to 4% increase in applications scanning at least daily,” he says. “[Such] frequent scanning is a sign of both early-lifecycle scanning and automated scanning.” But the majority of applications are still only being tested quarterly—or less frequently. “There’s plenty of room for improvement,” he notes.

Developers, according to Veracode, are not the only ones to blame for the continuing struggles with applications that many organizations appear to be having.

“It’s time to put the lazy developer trope to bed,” the company noted in its report.  “It may be easy for cybersecurity pros to blame AppSec woes on indifferent, uncaring, or slothful coders.” But the reality is very different, Veracode said.

Operational teams for instance have a part in undermining application security as well. When Veracode took a look at the overall hygiene of the production environments at the organizations in its survey the company found an “alarming number” of vulnerable servers running production applications.

When Veracode queried the public-facing web applications of the companies in its report, it discovered nearly 25% of the sites operating on web servers with one or more vulnerabilities with a CVSS rating of 6 or higher. Nearly 19% had web servers that were at least a decade old.

At many organizations developers also simply don’t get the security training they require. Few managers consider a software developer’s security skills as an important metric when evaluating performance, the application security vendor noted.

The Veracode report quoted a previous study the company had sponsored, in which 68 percent of developers and IT pros said their organizations did not provide adequate security training. Some 76% in that survey said they had not been required to take a single security course in college. Another study that Veracode conducted with analyst firm Enterprise Strategy Group showed a high-level of awareness about the importance of security knowledge among development teams. But only 18% said security was the most important metric for measuring developers’ performance, Veracode said.

Related content:

• Why Your AppSec Program Is Doomed to Fail How to Save It
• 98% of Companies Favor Integrating Security with DevOps
• Software Assurance: Thinking Back, Looking Forward
• 7 Steps to Transforming Yourself into a DevSecOps Rockstar

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/application-security/veracode-75--of-apps-have-at-least-one-vulnerability-on-initial-scan/d/d-id/1330188?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The IoT botnet is expected to spread faster than Mirai.

A new IoT botnet dubbed IOTroop is expected to spread faster than Mirai because it has infected more than 1 million organizations since its discovery in late September, according to Check Point Software Technologies, which made the discovery.

IOTroop’s malware seeks out vulnerabilities in wireless IP camera devices, such as GoAhead, D-Link, TP-Link, AVTECH, NETGEAR, MikroTik, Linksys, Synology, and others. “The malware is able to spread faster than Mirai for it leverages numerous vulnerabilities, rather than only compromising devices that use default credentials,” says Maya Horowitz, Check Point’s group manager of Threat Intelligence.

Although IOTroop shares some technical aspects with Mirai, Check Point stresses it is a new botnet with a far more sophisticated attack campaign. IOTroop, for example, uses the Internet of Things devices that it infects to scan additional devices and report back to the command-and-control server with its findings, Horowitz says. This helps IOTroop to accelerate the speed at which it spreads, she notes. IOTroop takes advantage of users’ failure to patch existing vulnerabilities in their IoT devices, and also the ability to launch its malware without human interaction.

Read more about IOTroop here. 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/iotroop-botnet-hits-over-a-million-organizations-in-under-30-days/d/d-id/1330189?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

If there’s one cybersecurity practice that absolutely everybody can do, that absolutely everybody should do, that should be as much a part of your day as brushing your teeth, making the first cup of coffee and correcting people who are wrong on Reddit, it’s this:

Keep your software up to date.

There’s an army of criminal hackers out there using computer programs to scour the internet for devices with out of date software. When they find a bug they’re looking for they can use it like a crowbar to prize open your electronic life.

They can steal your photos; spy on you through your camera; sniff out your banking password; exhaust your battery by mining cryptocoins; sell access to your Facebook account or wrap up all your stuff with encryption and demand a ransom.

Regularly updating your software is the single best, most efficient, most easy-as-falling-off-a-log thing you can do to shut them out.

That’s why we were delighted to hear about the UK government’s new Cyber Aware campaign.

Cyber Aware is encouraging you to take time to update your software with the inducement of giving yourself 15 minutes away from your screen while your tech feeds and waters itself (a #techfree15 minutes, if you will).

Just think what you can do with an extra 15 minutes.

Wait… what? 15 minutes?

Clearly these guys haven’t done a major Windows or MacOS update recently. To be fair to them I guess #techfreeFor­AnythingUpTo­AnHourMaybe­EvenLonger­It’sHardToSay is a hard sell.

Cyber Aware suggest you spend your 15ish minutes doing sensible things like taking a walk in your local park, talking to other humans or having a 15 minute tech-free rest before bed.

A rest.

Don’t they know you’ve got other people’s computers to protect too? Moreover, don’t they know you’ve already drunk seven cans of Monster today.

Rest. Meh. There’s no rest for the wicked and not having a computer is no excuse for giving up the cyberfight. Here’s five things you can do without a computer to make everyone else’s computers more secure while you’re taking your #techfree15:

1. Make friends with your IT team

• Duration: 5 minutes
• Difficulty: 3/5

If you already work in IT, skip to #3. Actually don’t. Go and speak to a colleague you don’t know. If you work with Windows go and speak to somebody wearing a heavy metal t-shirt. If you work with *nix go and speak to somebody wearing a shirt.

If you don’t work in IT, go and say hi. You’re going to need them one day so don’t wait for a crisis before you introduce yourself.

Not only is “Hello” a better greeting than “is the network down?”, but if the network is down then they’ll be too busy to talk to you anyway because the network’s down and it isn’t going to fix itself.

And while we’re on the subject, there is nothing more annoying than trying to fix a network and being constantly  interrupted by people who want to tell you the thing they’ve just stopped you from fixing isn’t working. If the network isn’t down and they still don’t want to talk to you, well, let’s just say it’s not them, it’s you, and it’s time to brush up on what you sound like to a sysadmin.

2. Put up some posters

• Duration: 15 minutes
• Difficulty: 1/5

Get some security posters and stick them up around your office to remind other people who’ve torn themselves away from their computers to go back to them. They need to stop making coffee and sort out those awful passwords.

If you don’t want to make your own posters, you can find some snazzy posters in the Sophos Anti-Ransomware toolkit (you’ll have to do a little data capture tap dance to get it).

Pro tip: don’t put posters where people can walk past them. Put them at eye height where people don’t move much and don’t have anything to read. Yes, that’s right, I’m telling you to put them above the urinals and on the back of the toilet stall doors. Seriously.

3. Write a risk register

• Duration: never ending
• Difficulty: 162/5

Risk registers: everybody needs one, nobody wants to write it. Well, guess what, you’ve got at least 15 minutes to spare so get writing. Be careful though, risk registers can get quite long and you’ll have to write it by hand so don’t forget to add writer’s cramp and carpal tunnel syndrome to the register. Oh and if it’s as lengthy and comprehensive as your project manager’s PRINCE2 trainer would like it to be, be careful not to break your foot if you drop it.

4. Clean, wipe, shred

• Duration: 15 minutes
• Difficulty: 1/5

Lift your head up from your computer and look around you: you’re leaking data. The pay slip in the unlocked drawer; the password on a post-it stuck to your monitor; the bound conference notes you’re never going to read; the work of art on the whiteboard behind you.

Everyone can see them. They’ve got to go.

For your confidential paper waste that means a trip to Mordor the shredder. Unfortunately shredders, like their stablemates photocopiers and faxes, aren’t governed by the normal rules of physics nor any kind of recognisable logic. They are emotional, moody and vindictive machines that hate the taste of paper and hate you for feeding it to them. Luckily for you, you only have 15 minutes so there’s only enough time to jam the shredder 27 times.

5. Make a tinfoil hat

• Duration: 2 minutes
• Difficulty: 2/5

If you don’t have a tinfoil hat already you clearly don’t understand the seriousness of the situation. You live in a surveillance state, your identity is toast, your phone is lying to you about being off and in a few years time you’ll consider yourself lucky if you’re kept around as a pet by some post-singularity AI.

You’re going to need a tinfoil hat.

I said it takes two minutes to make a tinfoil hat at the top of this section, but that’s not quite right. It takes a second to Google “how to make a tinfoil hat” and (bizarrely) 2:45 to watch the the YouTube video How to make a tin foil hat in less than two minutes. But you can’t use them because you’re having a tech free 15ish minutes, remember?

You don’t have Google, YouTube, iFixit, WikiHow or Stack Overflow. You’re on your own with some scissors and a roll of aluminium foil.

You’ll be lucky if you get out of this with ten fingers…

Best check if your updates have finished.

Follow @NakedSecurity
Follow @MarkStockley

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/xejs4bKqWqk/

Are you a high-risk user whose Google account hackers might want to target? If you are, how much hassle would you put up with to make your account more secure?

These are questions Google is inviting its users to ask themselves with the announcement of the Advanced Protection Program (APP), a reassuring but also potentially awkward way to add extra layers of security to Google accounts.

Available from this week, it’s free to all consumer Google account holders, but before you rush off to sign up let’s dig a little deeper into what is on offer because the downsides won’t be for everyone.

First, APP’s target user base, which includes:

Campaign staffers preparing for an upcoming election, journalists who need to protect the confidentiality of their sources, or people in abusive relationships seeking safety.

But also:

Human rights defenders, environment campaigners and civil society activists working on any number of sensitive issues.

To that could be added high net-worth individuals, VIPs and perhaps politicians and company management using a Google account in a personal capacity (see the infamous attack on the DNC’s John Podesta in 2016).

It first dawned on Google that some users faced a higher risk than others in 2010 when it went public on the aggressive Aurora attacks conducted on its Chinese users by an unnamed nation state that everybody twigged must be China itself.

Google has tried to contain targeted attacks by introducing security protections such as two-step and multi-factor authentication, and HTTPS connections by default, as well as gradually limiting attachment behaviour in Gmail.

Google thinks this is no longer enough and has launched APP with three new protections.

Anti-phishing

The first is mandating that users authenticate themselves using a hardware token such as the FIDO U2F YubiKey. Other authentication methods (including backup codes and SMS) will no longer work.

These cost a reasonable $18 (£15), but users will also have to buy an additional Bluetooth token (another $25 perhaps) to authenticate from smartphones lacking a USB port. That’s two keys to look after and you can’t lose either without incurring a temporary loss of account access.

It’s not clear whether these will be needed for every authentication, but if they are that will mean users can’t allowlist access from a regularly-used device and will have to plug in a key for every login, from every device.

The extra security of using a token means that attackers who successfully steal your user name and password can’t access your account, even if they also steal the device you normally use to access that account.

Limiting app access

APP’s second defence is to constrain access to accounts from third-party apps, by which it means anything not made by Google. The risk these pose:

By giving permission, you might introduce vulnerabilities that could be used to access your personal data. For example, an app you trust could be exploited or impersonated.

Third-party apps will never be able to access Gmail, Google Drive or Google Photos, and using Chrome to access Google services will become mandatory. Anyone using iOS will have to use Google’s apps to access services.

This feature sounds straightforward enough but this will nix any website or service that either uses a Google account for authentication (or which needs access to it), for example WhatsApp, Dropbox, or the New York Times.

It’s not clear whether users will still be able to forward email to third-party accounts. In principle, there’s no reason why not although whether that’s a good idea for secure email is another matter.

Account verification

Attackers sometimes try to gain access to an account by initiating a reset after pretending they’ve been locked out. As researchers have noted, this can happen in a number of ways. Under APP, additional checks will become necessary although it hasn’t yet specified what these will be.

The company has said “these added verification requirements will take a few days to restore access to your account,” which makes clear that users resetting credentials could be left without access for some time (including if they lose their tokens – see above).

The extra inconvenience APP adds to using a Google account will be more than worth it for some users. The lingering question is whether, in time, all regular Google users might end up being part of this group given the industrial scale of sophisticated attacks.

That said, users can already opt for a sort of halfway house between standard account security and what APP offers simply by turning on multi-factor verification, either using the Google Authenticator app or, better still, by enrolling a YubiKey. For most people, this might be the place to start dialling up security before tangling with the APP.

Follow @NakedSecurity
Follow @JohnEDunn

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/fO0VmmFzuIo/

If you want to know where the world of malware is heading…

…ask an expert!

So that’s exactly what we did – we spoke to Fraser Howard of SophosLabs, live on Facebook.

Fraser is one of the world’s leading threat researchers, with knowledge that is deep as well as broad.

He’s well worth listening to, and here’s what he told us:

(Can’t see the video directly above this line? Watch on Facebook instead.)

(You don’t need a Facebook account to watch the video, and if you do have an account you don’t need to be logged in. If you can’t hear the sound, try clicking on the speaker icon in the bottom right corner of the video player to unmute.)

PS. If you like the T-shirt in the video, you can buy one at https://shop.sophos.com/.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/AsyPZagCOA8/

A couple of years ago, a counterterrorism expert had an idea: let’s arm US companies with cyber weaponry so they can hack-back cyberattackers, suggested Juan Zarate, a former US deputy national security advisor for counterterrorism during the administration of US President George W. Bush.

Mike Rogers, a former Republican congressman from Michigan and former FBI agent, said at the time that given the plethora of attacks coming from other nations, many businesses would wind up in over their heads in an escalating conflict – a nasty can of worms to open.

Besides, Rogers argued, who says that a given company has the capacity to track down culprits behind an attack? It’s not like all companies are adept at the forensics needed. Sources can be spoofed.

Figuring out the origin of an attack can hinge on subtle clues: what inference should be drawn, for example, in the similarities between the code in the WannaCry ransomware worm and the malware created by Lazarus, a hacking group believed to be linked to North Korea?

Nor is it a given that companies can launch a counter-attack that doesn’t wind up harming a slew of innocents. For example, a hack-back at the vast array of Internet of Things (IoT) devices that got sucked into the Mirai botnet would have seen attacks on home users’ cameras, with the perpetrators left unharmed.

Would we really want to empower an Equifax or a Yahoo, giving them a “cyberwarrant” that would grant private companies license to protect their systems, “to go and destroy data that’s been stolen, or maybe even something more aggressive,” as Zarate suggested?

Their histories of protecting their assets, after all, don’t inspire confidence. Why would we believe they have the ability to competently attack hackers without causing harm?

Rogers:

Some can do it very, very well. Some don’t have a clue of how to do it, but that wouldn’t stop them from [responding] anyway. How do you contain that?

Well, here’s how two legislators have contained the hack-back suggestion: they want to make it the law of the land.

As CNN Money reports, H.R.4036 – formerly called the Active Cyber Defense Certainty (ACDC) Act and informally called the hack-back bill – was introduced as an amendment to the Computer Fraud and Abuse Act (CFAA) last week. Its backers are US Representatives Tom Graves, a Georgia Republican, and Kyrsten Sinema, an Arizona Democrat.

ACDC would give a company the go-ahead to take active defensive measures to access an attacker’s computer or network to identify hackers, as well as to find and destroy stolen information. It makes sense to introduce it as an amendment to the CFAA, given that the CFAA outlaws unauthorized access to somebody else’s computer: a big legal hammer that’s found many nails.

ACDC would give authorized individuals and companies the legal authority to leave their network to:

1. Establish attribution of an attack.
2. Disrupt cyberattacks without damaging others’ computers.
3. Retrieve and destroy stolen files.
4. Monitor the behavior of an attacker.
5. Utilize beaconing technology.

Will this lead to cyber-vigilantism? Graves says no; he told CNN that the bill is not opening the door to the Wild Cyber West. The horse is already out of the barn: we’re already living in the Wild Cyber West:

We are already dealing with the Wild West and there’s a lot of outlaws out there but we don’t have a sheriff, we don’t have a deputy and all we were asking for is a neighborhood watch.

But just as they did when Zarate brought up the notion two years ago, security experts are warning that the bill could have dire unintended consequences. CNN quotes digital forensics expert Lesley Carhart on the difficulties of determining whether the source of an attack has been spoofed:

In cybercrime and in nation state attacks, there are often lots of attempts to mislead and confuse researchers analyzing the attack timeline or malware. A savvy bad guy could fairly easily emulate an innocent third party, and draw down the wrath of unskilled analysts on them.

And if an attack were in fact coming from, say, North Korea, the ACDC wouldn’t be worth much. That’s because it limits hack-back actions to within the US. It also requires companies to report to the FBI-led National Cyber Investigative Joint Task Force before taking active-defense measures: a measure that “will help federal law enforcement ensure defenders use these tools responsibly.”

OK… so, why not just entrust cyber investigations and countermeasures with the FBI and the Department of Justice (DOJ) to begin with? According to a news release (PDF) from Graves, we can’t – they’re swamped.

While DOJ and the FBI do great work, the number of cyberattacks far exceeds the government’s ability to respond, identify and prosecute criminals.

At any rate, Graves told CNN, whether we like it or not, companies are already hacking back:

Word on the street is many companies are already doing some of these things. They know, you know, and I know that what they are doing is illegal. What we would be doing is bringing clarity to what some might already be doing and what tools might be successful.

In fact, he’s hoping that if the bill passes, it could spark the creation of new tools to protect against hackers.

One security expert likened the bill to the old Biblical law about retaliation: an eye for an eye, a tooth for a tooth. That dates back to Hammurabi, King of Babylon from 1792-1750BC.

Wise he may have been, but Hammurabi didn’t have to deal with (and nor could he have foreseen) the complex issue of figuring out who hacked who.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/WBOdLrDo6Jo/