STE WILLIAMS

Canada’s Communications Security Establishment has open-sourced its own malware detection tool.

The Communications Security Establishment (CSE) is a signals intelligence agency roughly equivalent to the United Kingdom’s GCHQ, the USA’s NSA and Australia’s Signals Directorate. It has both intelligence-gathering and advisory roles.

It also has a tool called “Assemblyline” which it describes as a “scalable distributed file analysis framework” that can “detect and analyse malicious files as they are received.”

The agency explains the tool with the example of a financial officer who “… receives an email from an outside sender that includes a password-protected .zip file that contains a spreadsheet and a Word document with text for an annual report.” Said officer later “forwards that email to three colleagues within the department and attaches a .jpeg image of a potential cover for the report.”

“Assemblyline will start by examining the initial email. It automatically recognizes the various file formats (email, .zip file, spreadsheet, Word document) and triggers the analysis of each file.” That analysis gives the file a score and “Scores over a certain threshold trigger alerts, at which point a security analyst may manually examine the file.”

The tool is also smart enough that it “recognizes the duplication of files and focuses on new content that may be part of the email, such as the .jpeg image.”

It’s possible to customise Assemblyline with what the CSE calls “services” that perform whatever analysis you fancy.

The tool was written in Python and can run on a single PC or in a cluster. CSE claims it can process millions of files a day. “Assemblyline was built using public domain and open-source software; however the majority of the code was developed by CSE.” Nothing in it is commercial technology and the CSE says it is “easily integrated in to existing cyber defence technologies.”

The tool’s been released under the MIT licence and is available here.

The organisation says it released the code because its job is to improve Canadian’s security, and it’s confident Assemblyline will help. The CSE’s head of IT security Scott Jones has also told the Canadian Broadcasting Corporation that the release has a secondary goal of demystifying the organisation. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/20/canadian_communications_security_establishment_open_sources_assemblyline/

It’s going to be an unpleasant weekend for some Mac users who are facing a complete system wipe and reinstall – after hackers stashed malware in legitimate applications.

Eltima Software, which makes the popular Elmedia Player and download manager Folx, today confessed the latest versions of those two apps came with an unwelcome extra – the rather horrid OSX.Proton malware.

The software nasty, which was injected into downloads of the applications, was spotted by security shop ESET, which alerted Elmedia. A subsequent investigation revealed miscreants had got into the developer’s servers, implanted the malware into the download files, and then let the company infect its users as they fetched the software.

Proton is a remote-control trojan designed specifically for Mac systems. It opens a backdoor granting root-level command-line access to commandeer the computer, and can steal passwords, encryption and VPN keys, and crypto-currencies from infected systems. Its creator also claims that it’ll give full access to iCloud, even if two-factor authentication is used and was put on sale in March for $50,000.

The malware was clocked by ESET in new downloads of the applications on October 19, and removed by Eltima by 3.10pm PDT that day. If you were already using the software and simply updated it, you should be malware free, but just in case, do a scan for the following files:

/tmp/Updater.app/
/Library/LaunchAgents/com.Eltima.UpdaterAgent.plist
/Library/.rand/
/Library/.rand/updateragent.app/

If any of those exist, then you’ve got Proton on your computer. While the malware is recognized by antivirus packages, it’s difficult to remove. Eltima’s advice is to nuke the entire site from orbit, it’s the only way to be sure.

“A total system OS reinstall is the only guaranteed way to totally rid your system of this Malware,” it warned. “This is a standard procedure for any system compromise with the affection of administrator account.”

Have a good weekend. And, for heaven’s sake, secure your supply chains and build systems. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/20/a_total_system_os_reinstall_is_the_only_guaranteed_way_to_totally_rid_your_system_of_this_malware_this_is_a_standard_procedure_for_any_system_compromise_with_the_affection_of_administrator_account/

New analysis says heavy reliance on overlays and manual remote execution of transactions being combined with more advanced features of traditional banking Trojans

Could we be sitting on the precipice of a shift in banking fraud? Some researchers say yes, if attackers follow the playbook of a little known attack technique that’s plagued victims in Brazil under the radar for a couple of years now.

According to new analysis of the Boleto Trojan by researchers from Check Point Research this week, this new variant takes the very rare but effective tack of using malicious overlays triggered after a victim’s legitimate bank sign-in in order to manually take over their account. This unorthodox mechanism has been around for a couple years now, but attackers are also layering in some more advanced features used by traditional banking Trojans.

Whereas the typical banking malware such as Trickbot or numerous flavors of Zeus usually rely upon tried-and-true phishing techniques that send victims to a fake login screen to mine credentials, this one goes a totally different route.

Once the malware makes it onto a victim’s machine it sits and waits until the user logs into a legitimate online banking account. At that point it sends an SMS to the attacker and pops up a very legitimate looking overlay screen on top of the browser. The Trojan is programmed to match the browser type and the bank information so that it looks completely like the bank’s branding and the message of the overlay is meant to distract the user–with a warning or long message that they’ll need to read. Under that overlay, the account information is open and running, and the attacker actually uses that window of distraction to manually go into the user’s account and run transactions from their account. All of this happens underneath the overlay.

“It’s pretty smart and these guys probably will make a lot of money,” says Balmas, who explains that with this method the attackers can even go after accounts that have used a multi-factor authentication token, getting around common account transfer limits of $1000 imposed on Brazilian accounts that don’t use MFA.

This is essentially a new variant of the KL-Remote discovered by IBM Security Trusteer researchers way back in 2015.  

Balmas says that consumers and vendors should keep their eyes open, because even though this is still limited to South American victims, the situation could change if more bad guys believe this business model can work for them. While a lot of banking malfeasance online depends upon a high level of automation, attackers might be willing to put the work into this kind of manual attack if they feel they can carry out enough high-value fraudulent transfers. The fact that Brazilian criminals have been updating this technique with newer technical advancements might be a sign that security experts need to keep on the lookout for similar methods used in other regions, says Balmas, who believes that most of the world remains in the dark about Brazilian malware because its historically been considered technically pretty crude, and therefore not dangerous enough to warrant attention. 

“I think this rapid pace of new variants, ongoing maintenance, anti-evasion techniques, and overall technical advancements we are observing strengthens our point that it is now more possible than ever that these Brazilian malware may start looking to other victims at other parts of the world, and we would like to raise awareness for these new type of risks,” he says. 

First discovered by researchers with Cisco Talos last month, Boleto initially drew a high level of scrutiny from the security community due to its sophistication in using a commercial packer, Themida, in order to obfuscate under-the-hood workings of the malware from threat analysis. Talos engineers gave their initial analysis, but stated that they were still working on unpacking the malware. 

“Using commercial packing platforms like Themida will continue to make analysis difficult for analysts and shows that some attackers are willing to obtain these types of commercial packers in an attempt to thwart analysis,” they wrote.

Check Point’s team managed to take the ball from there and presented additional details yesterday after finally getting the Trojan unpacked. As Balmas explains, commercial level packing is just the start. From top to bottom it is a sophisticated piece of malware. Other examples of modernization include process termination protection and removal of previously installed hooks. Additionally, the overlay graphics have seen a significant upgrade to improve authenticity.

“They put a lot of effort into doing great graphics, everything looks legit and everything feels right, only it’s not,” Balmas says.

Related content:

• Bank Fraud Toolkit Circumvents 2FA and Device Authentication
• Old Flaws, New Tricks: CVE-2017-0199 and PowerPoint Abuse
• Uptick in Malware Targets the Banking Community
• 10 Social Engineering Attacks Your End Users Need To Know About

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/overlay-technique-from-brazilian-banking-trojans-making-resurgence/d/d-id/1330173?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

There is no simple answer to the question ‘Are we protected against the latest brand-name malware attack?’ But there is a smart one.

WannaCry scared the world with its massive disruption. NotPetya reminded everyone why they can’t forget about exploits after the first time they are used. Mirai irritated consumers for a full day with record-breaking distributed denial-of-service levels from its infected botnet. The good news is that headlines from all of these attacks caught the attention of executives who suddenly started asking if they were vulnerable to these attacks. The bad news? They started asking the wrong questions.

Security is not a one-and-done project; it is a constant battle against creative hackers evolving new and improved threats. But top executives and board members are still learning about security practices, so when they stop at their CISO’s desk they only know to ask “Are we protected against WannaCry?”

The only job-preserving answer to that question is “Yes,” but that omits so many other factors that leave the executive with a false sense of security. A smart CISO can take advantage of the executive’s attention to explain how blocking specific malware variants is only a stopgap measure.

The reality is that malware changes so rapidly that blocking any single variant will provide only a day or two of relief before it comes back just different enough to slip through those defenses again. SentinelOne’s Enterprise Risk Index released this April found that less than 50% of malware detected is included in malware repositories. This shows how quickly new threats come and go and the sheer volume of threats to monitor.

Instead, companies need to focus on the underlying vulnerabilities in their systems that leave them open to these kinds of attacks. That could involve finding a SQL injection vulnerability in their databases or reworking a poorly configured network that allows malware to jump from insecure Internet of Things devices to mission-critical systems.

Navigating Internal Team Dynamics
The job of the CISO is to understand these vulnerabilities and to have the knowledge required to close them. Despite the skills shortages that have made finding experienced cybersecurity professionals difficult, most companies have found very competent people to fill these roles. These vulnerabilities remain when CISOs meet roadblocks imposed by the limited resources they have available and by their inability to convince other teams of the necessity of these changes.

Many technology departments resist change. As recently as five years ago, many antivirus users failed to update signature lists on a weekly basis. When it comes to more effective changes such as software updates, IT teams can be even slower. That is not to say they do not sometimes have good reasons; the longer a legacy system is in use, the harder it is to be sure it is compatible with the latest software updates. CISOs may know that these updates are part of the framework that protect vital corporate systems, but without executive backing they don’t have the power to force IT teams to keep a regular patching schedule.

The Shifting Malware Landscape
Today, hackers no longer need to invest time in targeted attacks because there are a vast number of unsecured, vulnerable systems that are accessible to them. Instead, they have adopted a “spray and pray” mentality. The end result is that every Internet-connected device —router, server, mobile phone, computer, coffee maker — is under constant threat from constantly evolving malware issued by hackers who don’t really care who they infect, as long as it is profitable.

This constant bombardment across all possible attack vectors means that CISOs must be even more vigilant than ever in identifying and closing potential vulnerabilities, not just relying on standardized filters to catch malware as it tries to infect the network. It may seem like a hopeless predicament fighting a never-ending battle against an ever-growing list of unknowns. But the upside is that the executive attention these branded malware attacks have captured brings a new opportunity.

A savvy CISO will take advantage of that momentary attention to say, “Yes, we are protected against WannaCry… today. But we have some vulnerabilities in our systems that need immediate attention.” Then, she can impart the expertise she is being paid to have, and convince the executive of the need for a real change in protecting the underlying vectors that leave companies exposed.

Related Content:

• Why Security Leaders Can’t Afford to Be Just ‘Left-Brained’
• 5 Problems That Keep CISOs Awake at Night
• The ‘Team of Teams’ Model for Cybersecurity

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Raj Rajamani is the vice president of product management at SentinelOne. He joined SentinelOne from Cylance, where he was part of the original executive team. Raj has been developing security solutions for over a decade through his time at McAfee and Solidcore. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/how-to-talk-to-the-c-suite-about-malware-trends-/a/d-id/1330164?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

If you’re a teen computer whiz trying to create an “annoying but harmless” online prank that will impress your friends and the “hacker community,” probably best not to aim it at anything having to do with real-life emergency services.

Hopefully Meetkumar Hiteshbhai Desai, 19, had learned at least that much by the time he was sentenced last week to three years probation for creating a bug a year ago that, between 24 and 26 October, almost shut down 911 services throughout Maricopa County, Arizona and beyond.

Law enforcement officials were definitely impressed, but not in a good way. According to the state Attorney General’s Office, Desai’s bug caused more than 300 hang-up calls – 100 of them within minutes on 25 October 2017 – in the county’s 911 operating systems, which include Phoenix, Scottsdale, Glendale and Mesa.

The Maricopa County Sheriff’s Office (MCSO) said the bug affected call centers in Avondale, Chandler, Surprise and the MCSO.

Desai pleaded guilty to one count of computer tampering. The sentencing agreement allows law enforcement to monitor his computer during the probation period.

Ars Technica reported that at the time of his arrest, authorities referred to Desai as an “iPhone app developer.” Which was a major stretch. But in a press release following the arrest, the MSCO said Desai (who they referred to as “Meet” since the web page that linked to the bug was called “Meet Desai”) told detectives that he was indeed hoping to impress the computer giant:

He was interested in programs, bugs, and viruses which he could manipulate and change to later inform Apple about (how) to fix their bug issues for further iOS updates. He claimed that Apple would pay for information about bugs and viruses and provide that particular programmer with credit for the discovery.

No word on whether Apple was impressed.

According to the MSCO, Desai told them that an online friend had shared a bug with him that they thought they could modify. He said he discovered that he could:

… add annoying pop ups, commands to open email, and activate the telephone dialing feature on iOS cell phones by utilizing a java script code that he created.

His intent, he told them, was just to create a, “non-harmful but annoying bug that he believed was ‘funny.’”

However, his project went from prank to crime when he modified the bug to include the 1+911 phone number for emergency services and – by mistake, he told detectives – pushed it out to the public.

Meet stated that although he did add that feature to the bug he had no intention of pushing it out to the public, because he knew it was illegal and people would “freak out”.

Probably not the kind of mistake someone looking to impress Apple would make. But Desai was right about the reaction – people indeed freaked out.

On the night of 25 October 2016, the MCSO heard from a surprised Surprise Police Department that their communications division had received more than 100 911 hang-up calls which, as the MSCO put it, put their Cyber Crimes Unit into, “full force after a serious disruption into the emergency 911 system for the entire Phoenix metro area and possibly even other states.”

Detectives tracked the 911-dialing code to the “Meet Desai” web page, hosted out of San Francisco. They were able to shut it down, “to stop the potential immediate threat to the 911 emergency systems, which could possibly have been compromised if enough users had clicked on the link.”

But by that time the link, which had been posted to the YouTube channel “TheHackSpot” and several Twitter accounts, had been clicked 1,849 times. When people clicked on it, it launched continuous calls to 911 and wouldn’t let the caller hang up.

According to the Arizona AG, Desai will not serve any jail time because he, “cooperated with authorities, expressed remorse and had never been in trouble before.”

But the incident demonstrates that the security of 911 services has a significant soft spot. This was a localized version of what sounds like a phone DDoS attack that could disrupt emergency services over a much wider area – possibly the entire nation. As Ars Technica noted at the time of Desai’s arrest last year:

According to recently released research reported in the Washington Post (paywall) by journalist Kim Zetter, a proof-of-concept attack devised by researchers in Israel required just 6,000 infected smartphones in a geographical area to tamper with the 911 system for the entire state of North Carolina. The researchers estimated 200,000 infected phones distributed across the US could significantly disrupt 911 services for the entire country.

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/f2CIzFvSYd0/

Something for the Weekend, Sir? Flee! Flee! It’s the return of the frozen heads!

With childish inevitability, this steaming pile of perennial medi-nonsense is trying to stage a comeback. Walt Disney did it, and now your own bonce can jostle with his for space in the freezer at a fraction of the price. And it’s all going to happen within the next ten years.

Millennials reading this may be wondering why you’d want to freeze your head. You may also be wondering what a “Walt Disney” is but let that pass. Well, according to the old theory, future doctors will be able to cure illnesses that are currently terminal, so they should be able to revive your brain if it’s iced immediately after your death and safely stored as far from the Haagen Dazs as possible.

Of course, it doesn’t matter what terminal illness you had, you are now dead. Doctors might come up with clever ways of prolonging life indefinitely one day but it might be a while before they find a way of curing death itself once you’ve already snuffed it.

The chances of this coming about are as likely as oh, I dunno, something really unlikely… such as building a commercial hover bike by Christmas, developing a pocket time machine, or stumbling across a sci-fi space cowboy gunfight amid the sombre pebbled wastes of Dungeness beach.

OK so that last one’s unlikely AND random. That’s how very unlikely it is.

As a problem-solving management technique, “giving up” has a long and respectable pedigree…

The latest headcases to revive this ghoulish heap of illogic as a means to drum up publicity is stem cell bank stemprotect.co.uk, an organisation that ought to know better.

In fact, I imagine that somewhere in the world – probably next door to a warehouse of unsold flared jeans – is a massive storage facility stuffed with public relations collateral for the non-science of frozen head technology. It may even have a plaque on the front door labelled “The Michael Mouse Institute for Gullible Dead Heads”.

I reckon there’s an old geezer who has keys for both warehouses and opens one or the other every few years, in the vain hope that one day he’ll finally be able to shift the buggers for good.

My advice: give up now. Give up before it kills you and you’re forced to have your own head squeezed in between the Birds Eye peas and chicken nuggets.

As a problem-solving management technique, “giving up” has a long and respectable pedigree. I observe that it remains very much in fashion at the moment. PwC Global State of Information Survey figures indicate that British companies have been cutting their expenditure on IT security by a third over the last year.

Why would a company cut costs on security at a time when security breaches are at an all-time high? Well, it’s obvious, isn’t it: the millions they’ve been pouring into protecting data has been proven to be an utter waste. Hackers break in regardless.

One moment you’re signing off on a contract to surround your organisation’s data with a ring of steel, the next moment one of the contractor’s employees has wandered off with all your data on a CD crudely hand-labelled Madonna’s Greatest Hits. You may as well allow the security breaches to continue unchecked rather than fooling yourself that flushing cash down the toilet of IT security offered you some sort of protection.

Oh, and once you suffer massive irretrievable data loss, do what the professionals do: blame someone else.

Youtube Video

Alternatively, take some advice from Gojko Adzic, author of Humans vs. Computers, who proposes five cost-free ways to avoid IT mishaps in the first place. Allow me to save you time looking these up by summarising them as follows:

1. Don’t do any work on the last day of February in a leap year.
2. Don’t trust anything with a repeating reference number such as 1-1-1-1-1 or 222222.
3. Don’t trust anything with a date stamp of 1 January 1970.
4. Always total percentages to see if they come to 100, thereby exposing rounding errors.
5. Print everything out.

There: all your IT problems sorted. None of this solves your security problems but hey, no data is safe, so why worry? Indeed, most hackers don’t really care what data they hack and are content simply to amass useless detail about human activity so they can blackmail you or sell you stuff you don’t want.

Hang on, am I writing about hackers or Google, Amazon and Facebook? I’ve forgotten.

I read that scientists at MIT and Brigham and Women’s Hospital in Boston have developed a sensor that monitors stomach movement and food intake. Inevitably someone has dubbed it (inaccurately and unfairly) “a Fitbit for the stomach”.

You might think that no one would want to hack into the data picked up by a stomach sensor. Wrong!

My guess is that it will be mere weeks before someone hijacks it – sorry, I mean monetises it – and makes it communicate with your other devices. It’ll notice if you’re drinking more booze and duly add you to mailing lists for wine merchants. It’ll detect when you eat a particularly spicy curry and automatically tell Alexa to order more toilet paper, ice cream and extra-strong mints.

Just don’t give yourself brain-freeze on all that ice cream – at least not unless freezing your brain is the ultimate goal, which I think we’ve already established is ridiculous.

Hover bikes, pocket time machines and space cowboys in Dungeness, right?

Youtube Video

Alistair Dabbs is a freelance technology tart, juggling tech journalism, training and digital publishing. He recommends a trip down to Dungeness in Kent if you ever get the opportunity. It is not what you’d call a typical beach by any stretch of the imagination… unless your previous experience of beaches was acquired on Mars.

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/20/your_data_will_get_hacked_anyway_so_you_may_as_well_give_up_protecting_it/

The US is starting to fall well behind China in terms of the speed at which organizations are alerted to reported security vulnerabilities, according to a study out this week by threat intel biz Recorded Future.

The US government’s National Vulnerability Database (NVD) lags China’s National Vulnerability Database (CNNVD) in average time between bug reports submitted to the database and the report being included in the centralized database – 33 days versus 13 days, respectively. In other words, companies and other organizations in China subscribing to the CNNVD are warned of a hole potentially within their systems in 13 days, on average, after details of the flaw are filed, versus 33 days for those following NVD.

China’s CNNVD isn’t involved in managing the disclosure of vulnerabilities globally, unlike the US’s NVD, but it has been able to overcome this potential disadvantage to push out warnings of bug discoveries twice as fast as its North America counterpart, on average.

NVD’s publication of bugs is delayed by days and weeks, we’re told, because it relies on submissions from vendors and organizations that assign unique ID numbers, dubbed Common Vulnerabilities and Exposures or CVEs, to flaws. China, by contrast, has achieved timely disclosure by combing extensive online sources to spot any details of newly discovered bugs. While the US government has focused on an official process, China has focused on the key goal: detecting talk of new bugs and disclosing warnings about them.

Vulnerability disclosure timeline for NVD … Source: Recorded Future. Click to enlarge

Recorded Future concludes that US bug indexers need to get more proactive if they want to alert IT departments, government agencies and users of new threats before hackers stumble across details of vulnerabilities and exploit them to infect systems. The team noted:

When hackers and security teams are racing to exploit or patch vulnerabilities, having access to the latest vulnerability information is critical. The United States National Vulnerability Database (NVD) is an obvious place security teams should be able to rely on to get this latest information.

Unfortunately, because NVD relies on voluntary submissions, NVD is often updated weeks after a vulnerability is initially disclosed. This gap ensures that NVD cannot provide comprehensive vulnerability coverage.

NVD should extend its mission to proactively gather vulnerability information as its Chinese counterpart (CNNVD) does.

Bill Ladd, chief data scientist at Recorded Future, argued that NVD could improve its performance simply by incorporating content from China’s CNNVD. “1,746 CVEs are currently in CNNVD and absent in NVD,” Ladd said.

An earlier study by Recorded Future found that more than three-quarters of vulnerabilities are publicly reported online before National Vulnerability Database publication.

On the one hand, it’s highly useful to have a centralized database in which details and alerts of bugs and patches are pooled. On the other, it’s not an easy task, and an area that private-sector infosec companies can do for paying corporations.

Bug bounty pioneer Katie Moussouris‏ told El Reg: “NVD is run by a small group with limited resources. Most who need real time vulnerability info don’t rely on it. Commercial services fill that role.” ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/20/us_china_vuln_reporting/

Google is offering cash to those who can find, exploit and report bugs in its Android apps, or similarly hack other programs in its Play Store.

The goal is to get a large number of people and developers working together on improving security in the Android world. The advertising giant is very familiar with bug bounties, and has paid out big bucks to the research community over the past couple of years for discovering and detailing flaws in Chrome, the Android operating system, and its websites.

On Thursday this week, Google announced it was extending this to third-party apps in its official Android software store, and its own app offerings, with a new bounty program run by HackerOne called the Play Security Reward Program.

“As the Android ecosystem evolves, we continue to invest in leading-edge ideas to strengthen security,” said Vineet Buch, director of product management at Google Play.

“Our goal is continue to make Android a safe computing platform by encouraging our app developers and hackers to work together to resolve unknown vulnerabilities, we are one step closer to that goal.”

Researchers who take part in the program can examine apps from participating vendors and get at least $1,000 for each flaw they find. After reporting the issue to the app developer and getting it fixed – which is in itself no easy task – the hacker then applies to Google for their reward.

Not all flaws will be worth Google’s moolah however, only the most serious. At this stage Google wants news of remote-code-execution vulnerabilities for Android 4.4 devices and higher, and – if possible – proof-of-concept exploits should be provided.

This bounty program isn’t going to clear up many issues soon, however. So far only eight app developers have signed up to the program, leaving thousands more to go. And the reported bugs actually have to be resolved, which may turn into a fight between the researcher and the vendor itself. Also $1,000 isn’t much of an incentive compared to other payouts, although it’s not as bad as some firms that just offer a free t-shirt or air miles.

Meanwhile, deliberately malicious programs continue to, from time to time, sneak into Google’s Play store. The online souk’s gatekeepers aren’t exactly perfect. Improving those guardians, which are supposed to stop malware getting into the store, should be a higher priority. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/20/google_play_bug_bounty/

Canada’s Communications Security Establishment has open-sourced its own malware detection tool.

The Communications Security Establishment (CSE) is a signals intelligence agency roughly equivalent to the United Kingdom’s GCHQ, the USA’s NSA and Australia’s Signals Directorate. It has both intelligence-gathering and advisory roles.

It also has a tool called “Assemblyline” which it describes as a “scalable distributed file analysis framework” that can “detect and analyse malicious files as they are received.”

The agency explains the tool with the example of a financial officer who “… receives an email from an outside sender that includes a password-protected .zip file that contains a spreadsheet and a Word document with text for an annual report.” Said officer later “forwards that email to three colleagues within the department and attaches a .jpeg image of a potential cover for the report.”

“Assemblyline will start by examining the initial email. It automatically recognizes the various file formats (email, .zip file, spreadsheet, Word document) and triggers the analysis of each file.” That analysis gives the file a score and “Scores over a certain threshold trigger alerts, at which point a security analyst may manually examine the file.”

The tool is also smart enough that it “recognizes the duplication of files and focuses on new content that may be part of the email, such as the .jpeg image.”

It’s possible to customise Assemblyline with what the CSE calls “services” that perform whatever analysis you fancy.

The tool was written in Python and can run on a single PC or in a cluster. CSE claims it can process millions of files a day. “Assemblyline was built using public domain and open-source software; however the majority of the code was developed by CSE.” Nothing in it is commercial technology and the CSE says it is “easily integrated in to existing cyber defence technologies.”

The tool’s been released under the MIT licence and is available here.

The organisation says it released the code because it’s job is to improve Canadian’s security, and it’s confident Assemblyline will help. The CSE’s head of IT security Scott Jones has also told the Canadian Broadcasting Corporation that the release has a secondary goal of demystifying the organisation. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/20/canadian_communications_security_establishment_open_sources_assemblyline/

CyberArk shows how attackers can leverage Intel’s MPX technology to burrow deeper into a compromised Windows system.

Security researchers at CyberArk have developed a technique showing how attackers can exploit a feature in the Memory Protection Extension (MPX) technology on modern Intel chips to steal data from Windows 10 systems and to remain completely undetected on them.

CyberArk’s new BoundHook technique is similar to the GhostHook method that the company revealed earlier this year in that it is a post-exploitation technique. In other words, for BoundHook to work, an attacker would need to already have privileged access on a Windows 10 system.

Microsoft itself, for that reason, has refused to categorize the issue as a vulnerability that merits a security patch. “The technique described in this marketing report does not represent a security vulnerability and requires a machine to already be compromised to potentially work,” the company said in a statement. “We encourage customers to always keep their systems updated for the best protection.”

Intel’s MPX technology, introduced with the chipmaker’s Skylake line in 2015, is designed to protect applications against buffer overflows, out-of-bounds access, and other memory errors and attacks. Applications running on Windows 10 systems use the feature as protection against buffer overflow attacks.

CyberArk’s BoundHook technique uses a boundary check instruction in MPX to hook processes on a system, and to essentially change its behavior. “The BoundHook technique allows you to run your own code inside foreign processes and change its normal behavior, without leaving any traces inside these foreign processes,” says Doron Naim, senior security researcher at CyberArk.

Hooking is about changing the behavior of certain functions in the operating system or application software on a system, he says. As one example, he points to the key input function. “If an attacker were able to hook this function, they would be able to sniff and steal your keystrokes.”

Typically, to do hooking you have to write hooking code inside a target process, he says. With BoundHook, the code is not used to execute the hook itself but to cause an error, like a boundary exception error in the process. From there an attacker can take complete control of the thread execution, Naim notes. “If you control the thread execution, you can do anything you want by the name of the target process. For example, if it’s Word.exe, you can steal credentials or send information to the Internet through this process.” Most antivirus tools are not equipped to detect the malicious activity that is enabled via BoundHook, according to CyberArk.

While Microsoft has downplayed BoundHook just as it did with GhostHook, Naim insists CyberArk’s latest technique indeed poses a threat. “The first thing to note is that this technique is most likely to be used by nation-state attackers, or very well financed criminal organizations that are looking for infiltrations that last.”

In the current threat environment, gaining administrative privileges on an endpoint system is something that administrators should assume even the most basic attacker can accomplish, he says. In most cases, all it takes is for a single individual to click on the wrong link or fall for a phishing scam.

Techniques such as the one that CyberArk demonstrated this week are important because they show how attackers can improve their dwell-time on a compromised network, Naim notes. “Techniques like this are incredibly powerful in helping attackers disappear after the initial infection point — allowing them to build in backdoors and plan their attacks in de facto stealth mode.”

Related content:

• ‘GhostHook’ Foils Windows 10 64-bit’s Kernel Protection
• New Microsoft Kernel Bug Could Permit Malicious Modules
• Linux Kernel Bug Allows Local-to-Root Privilege Escalation
• Locking Down Windows 10: 6 New Features

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/boundhook-technique-enables-attacker-persistence-on-windows-systems/d/d-id/1330174?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple