STE WILLIAMS

Google security engineers have spotted not one, not two, but seven serious flaws in Dnsmasq, a fairly widely used DNS forwarder and DHCP server.

This open-source program is present in a lot of home routers and certain Internet of Things gadgets, and included in desktop Linux distributions such as Ubuntu and Debian. According to Shodan, there are right now 1,098,179 devices facing the public internet with Dnsmasq services running.

The worst bugs can be exploited over the network to execute malicious code on a vulnerable system and hijack it.

Version 2.78, released today by developer Simon Kelley, has all the fixes you need, so you should be running that version. You can get this by upgrading your packages on your system as per usual, fetching October’s security fixes for Android, badgering your device’s firmware maker for updates, and so on. Kubernetes versions 1.5.8, 1.6.11, 1.7.7, and 1.8.0 have patches available, too, we’re told.

“We discovered seven distinct issues (listed below) over the course of our regular internal security assessments,” the Google team said in a blog post on Monday.

“Once we determined the severity of these issues, we worked to investigate their impact and exploitability and then produced internal proofs of concept for each of them. We also worked with the maintainer of Dnsmasq, Simon Kelley, to produce appropriate patches and mitigate the issue.”

The seven flaws include three that can be exploited to perform remote code execution, three more that can be used in denial of service attacks, and one information-leaking blunder. The full list of flaws is as follows:

• CVE-2017-14491 – Remote code execution in the DNS subsystem that can be exploited from the other side of the internet against public-facing systems and against stuff on the local network. The previously latest version had a two-byte overflow bug, which could be leveraged, and all prior builds had an unlimited overflow.
• CVE-2017-14492 – The second remote code execution flaw works via a heap-based overflow.
• CVE-2017-14493 – Google labels this one as trivial to exploit. It’s a stack-based buffer overflow vulnerability that enables remote code execution if it’s used in conjunction with the flaw below.
• CVE-2017-14494 – This is an information leak in DHCP which, when using in conjunction with CVE-2017-14493, lets an attacker bypass the security mechanism ASLR and attempt to run code on a target system.
• CVE-2017-14495 – A limited flaw this one, but can be exploited to launch a denial of service attack by exhausting memory. Dnsmasq is only vulnerable, however, if the command line switches –add-mac, –add-cpe-id or –add-subnet are used.
• CVE-2017-14496 – Here the DNS code performs invalid boundary checks, allowing a system to be crashed using an integer underflow leading to a huge memcpy() call. Android systems are affected if the attacker is local or tethered directly to the device.
• CVE-2017-13704 – A large DNS query can crash the software.

Patches and proofs of concept are available on GitHub. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/02/dnsmasq_flaws/

Hewlett Packard Enterprise handed over the source code for its ArcSight security platform to Russian investigators in exchange for being allowed to sell kit in the former Soviet Union.

That’s kinda awkward because the Pentagon is one of ArcSight’s most high-profile customers. The US military uses the software, which is designed to trawl through millions of log files looking for suspicious activity, in its Secret Internet Protocol Router Network, aka SIPRNet, that manages secure communications for the US intelligence services.

In other words, if there are any exploitable vulnerabilities in the ArcSight code, and therefore in SIPRNet, then the Russians may well also know about them, which would be very handy in snooping on American spies.

“It’s a huge security vulnerability,” Greg Martin, a former security architect for ArcSight, told Reuters. “You are definitely giving inner access and potential exploits to an adversary.”

Red panic: Best Buy yanks Kaspersky antivirus from shelves

READ MORE

Over the past three years, Russia has insisted that if Western companies want to sell their wares in the country, they have to hand over their blueprints, ostensibly to protect the nation and its citizens from backdoors that could be exploited by Western snoops. HP, Cisco, IBM, McAfee and SAP have all reportedly done so, although Symantec declined on security grounds.

HPE, which sold ArcSight and some other software companies to Micro Focus in May this year, confirmed that the code was revealed at one of its offices outside Russia, and that none of its source left the building. The Russian researchers found no “backdoor vulnerabilities,” according to HPE.

“Our source code and products are in no way compromised,” a spokeswoman for the enterprise IT goliath added.

She also said HPE “always ensures our clients are kept informed of any developments that may affect them.” A Pentagon spokeswoman said the IT titan had not mentioned the Russian source code examination to its military customers.

The Pentagon spokeswoman added that US military doesn’t check off-the-shelf code it buys from vendors, trusting the manufacturer to get the security of its systems right. According to an April report by the Pentagon’s logistics agency, ArcSight “software and hardware are so embedded,” that it would be impossible to remove it “absent an overhaul of the current IT infrastructure.”

The examination of ArcSight was carried out by Russian outfit Echelon, which works closely with Russia’s FSB spy agency. Echelon boss Alexey Markov said it was required to report any uncovered vulnerabilities to the Russian government, but always told vendors about any discovered bugs first.

“If a vulnerability is found, everyone is happy,” Markov said. “The developer is happy that a mistake was detected, since by fixing it the product will become better.”

Suffice to say, other nations have inspected source code of products from overseas suppliers – such as China and Microsoft. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/02/hpe_handed_over_source_code_for_pentagon_security_system_to_russia/

Equifax was just as much of a trash-fire as it looked: the company saw the Apache Struts 2 vulnerability warning, failed to patch its systems, and held back a public announcement for weeks for fear of “copycat” attacks.

Those Infosec for Absolute Dummies tips were made official by ex-CEO Richard Smith, by way of evidence published by a US House committee ahead of his in-person appearance Tuesday.

Smith’s written statement [PDF] to the House Committee on Energy and Commerce says the company received the US CERT’s advisory for CVE-2017-5638 on March 8, and IT was told to patch it in accordance with the company’s policy of patching within 48 hours of notifications.

That didn’t happen: “We now know that the vulnerable version of Apache Struts within Equifax was not identified or patched”.

“On March 15,” Smith’s testimony continues, “Equifax’s information security department also ran scans that should have identified any systems that were vulnerable to the Apache Struts issue identified by U.S. CERT. Unfortunately, however, the scans did not identify the Apache Struts vulnerability.”

Just why Equifax couldn’t find vulnerable Struts implementations remains the subject of ongoing investigations.

For a while, Equifax was lucky, and nobody noticed its exposed systems, but in July, that changed, when the company (finally) identified suspicious activity.

“On July 29, however, Equifax’s security department observed suspicious network traffic associated with the consumer dispute website”, Smith’s statement says, and investigation suggests its systems were first compromised as early as May 13, giving attackers plenty of time to pull down customer records.

From July 29, when Equifax IT first spotted the activity, it took more than two weeks for consultants from Mandiant to determine that personally identifiable information was accessed in the breach.

Smith justifies the company’s much-criticised delay announcing the breach on the grounds that a disclosure might have seen crims pile on with multiple attacks.

“A mounting concern also was that when any notification is made, the experts informed us that we had to prepare our network for exponentially more attacks after the notification, because a notification would provoke ‘copycat’ attempts and other criminal activity.”

Smith fell on his sword last week, with Paulino do Rego Barros Jr sitting in as interim CEO while the company searches for a replacement willing to take on the task of extracting it from a deep, dark, hole. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/02/equifax_ceo_richard_smith_congressional_testimony/

Another month, another round of Android patches – although October’s batch is pleasantly small compared to other recent releases.

Of the 14 CVE flaws released, six cover Android’s troubled media engine. This has been a top choice for vulnerability fixers but – compared to the usual number of patches released for it every month – Google appear to have fixed a lot of the major issues. The details are as follows:

Three flaws (CVE-2017-0809, CVE-2017-0810, CVE-2017-0811) in the media framework are rated critical by Google since they allow remote code execution into privileged processes and affect Android 4.4 to the current version. CVE-2017-0811, rated high, is a privilege escalation issue in versions 7 and 8.

There are also two moderate flaws, CVE-2017-0815 and CVE-2017-0816, that would allow information leakage on all currently supported Android builds. In addition there’s a high severity flaw (CVE-2017-0806) in the overall framework of Android 6 or newer versions. It allows an attacker to work their way up the privilege chain.

System flaws are usually the most serious but there’s only one this month – CVE-2017-14496. This is a high severity flaw allowing remote attack code to be run on a handset and is found in all versions of Android from version 4.4 onwards.

There’s also a pair of high-severity privilege escalation flaws in the Android kernel – CVE-2017-7374 for the file system and CVE-2017-9075 for the Network subsystem. All Android versions need these patches. The same issue also affects MediaTek system-on-a-chip software and is addressed with CVE-2017-0827.

Finally there are three updates for Qualcomm components used by all versions of Android. Two of these are critical; CVE-2017-11053 for fix an issue with the system-on-a-chip driver that allows remote code execution and CVE-2017-9714 fixing the network subsystem to block privilege escalation.

The last patch, rated as high severity, blocks an attacker from increasing their privileges by exploiting a flaw in the Linux boot system used by Qualcomm hardware.

All patches can be found here and will be pushed out to phones this month. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/03/october_android_patches/

Now that we know what was taken from Equifax, how it was taken, and what is being sold, what more do we need to learn before the next time?

Equifax recently confirmed that the vulnerability responsible for the massive breach of 143 million records was indeed for the ApacheStruts 2 Web framework, but not CVE-2017-9805 as was initially circulated. Rather, CVE-2017-5638, which could enable an attacker to perform a remote code execution using malicious content in the absence of suitable security measures, has been pinpointed as the flaw that permitted access to the yet-to-be identified actors. CVE-2017-9805 is certainly worthy of our attention: until last week, it was essentially a zero day with exploits available in the wild.

The bug was first found in March, and a patch has been available since its discovery. In essence, Equifax could have been working to address the shortcomings and protect the personal information of millions using publicly available information approximately two months before the breach occurred. For reasons yet unknown, it did not. As a result, millions of Americans are scrambling to find out if they have been breached and to protect their information from being used for identity theft.

On the other hand, Equifax is facing federal scrutiny and a massive hit to its reputation and consumer trust. The firm’s top information security executives — its CIO and chief security officer — have departed the company following what’s being called one of the worst breaches in US history.

What happened at Equifax, and how can organizations patch their systems and improve their security posture to prevent breaches of this magnitude in the future?

Let’s start with what happened: The data exfiltrated between May to July 2017 included names, Social Security numbers (SSNs), dates of birth, and “other information,” according to Equifax. That data may now be for sale. Security blogger Krypt3ia found a listing on the Dark Web (shown in the image below) ostensibly placed by the Equifax hackers offering records for sale in return for digital currency. The listing includes some samples of the data in the form of screenshots. How much are the records worth? Four Bitcoins would net you 1 million entries; at today’s rate, that’s approximately $13,840. It’s unclear if the purchaser could specify what type of entries they could acquire, as an SSN would certainly command more money than dates of birth on secondary markets.

The listing is very disconcerting. Until recently, we were aware of the breach’s grand scale and some rough order of magnitude in terms of the number of records: 143 million in comparison to the Yahoo hack, which included more, but arguably less-sensitive, records. Seeing records — and the personal identifiable information of individuals — is sobering. For those engaged in threat modeling, the price points provide a marker by which to assess the value of such records in underground markets, although both wallets appeared to be empty at the time of writing.

Vulnerabilities Matter but Do Not Stop Business
We can elicit a number of lessons from this event. In response to Equifax’s disclosure of the Struts2 bug, the Apache Software Foundation released some cogent guidance to those using any Web framework. As always, Brian Krebs has provided practical advice to those who may have been affected by the breach. Gartner’s Strategic Planning Assumptions are also worth repeating here:

• Through 2021, the single most impactful enterprise activity to improve security will be patching.
• Through 2021, the second most impactful enterprise activity to improve security will be removing Web server vulnerabilities.

This incident highlights the importance of a multilayer application security strategy. Firstly, it is absolutely critical to patch systems in a timely fashion. Had Equifax had an effective, multilayered application security strategy that includes the underlying infrastructure, middleware, application, and edge, the company likely would have prevented the intrusion or caught it much sooner. Appropriate data governance also could have diminished the scale of exposure of sensitive data: an understanding of what kind of records are in their possession, their classification, how long they can be kept for, and the security that must be applied to safeguard them accordingly appears to have been elusive.

A mature security regime requires organizations to implement a combination of technical vulnerability management processes and the ability to deploy effective security controls — including compensating controls when patches cannot be deployed in a timely manner.

Web applications and services (like APIs) represent critical business drivers as well as an exposed attack surface for a growing number of organizations. That attack surface can be reduced by properly hardening infrastructure and middleware, using up-to-date frameworks, and defeating attacks at the edge of the network: a Web application firewall, a security control that proxies all Internet traffic while applying a security posture to block traffic deemed malicious or unauthorized, is a highly effective control when properly configured. This year’s Verizon Data Breach Investigations Report confirms that Web application attacks lead the pack with respect to breaches, with botnet activity bolstering that number considerably.

Hackers tend to view the human user as a path of least resistance, but that calculus changes considerably when vulnerabilities are discovered in technologies. Today’s time-to-exploit has become relatively shorter as security expertise proliferates, even if the number of publicly available exploits is dropping.

Don’t give attackers a window of opportunity! Vulnerabilities don’t need to slow down or stop business operations. Deploying patches is absolutely imperative to maintain a strong security posture, but the process can be disruptive or complex, especially for legacy systems, making additional security measures — acting as compensating controls — necessary to provide suitable defenses to maintain exploitable systems while patches are deployed.

Related Content:

• 7 Takeaways From The Equifax Data Breach
• FTC Opens Probe into Equifax Data Breach
• Equifax Data Breach Prompts Calls For Tougher Security Requirements On Data Aggregators
• Equifax Exec Departures Raise Questions About Responsibility for Breach

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Nick Deshpande, CISSP, is the vice president of product development at Zenedge, where he combines his passions for user experience and security. He’s a graduate of the Royal Military College of Canada and American Military University. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/equihax-identifying-and-wrangling-vulnerabilities/a/d-id/1329966?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Revealing vendor’s name and pricing details a threat to national security, DC court says.

The identity of the vendor that helped the FBI unlock an encrypted iPhone belonging to one of the terror suspects in the San Bernardino shootings in December 2015 will remain under wraps. So too, will the amount of money the government paid the vendor for the technology.

A Washington, DC, federal court on Friday rejected separate requests for the information that the Associated Press, USA Today, and Vice Media LLC had filed last year under the Freedom of Information Act (FOIA). The three media companies had claimed the public had a right to know details of the FBI’s transactions with the vendor after then-director James Comey publicly disclosed some non-specific details about the tool and its purchase cost.

In a 27-page ruling, United States District Judge Tanya Chutkan denied the FOIA request and agreed with the FBI that releasing the information would give adversaries a way to undermine the agency’s ability to use the tool in similar investigations. The FBI has also maintained that the vendor did not have the same abilities as the FBI to protect its networks against attacks. So disclosing the company’s name could lead to attacks against it and compromise the technology.

“If an adversary were determined to learn more information about the iPhone hacking tool the FBI acquired, it is certainly logical that the release of the name of the company that created the tool could provide insight into the tool’s technological design,” Judge Chutkan wrote. Such information could allow adversaries to enhance their own encryption capabilities to better guard against the FBI, she said.

John Pescatore, director of emerging security threats at the SANS Institute, says the ruling makes little sense. “It seems kind of odd that the identity of the vendor selling the tool would be kept confidential because if that was known, the bad guys would somehow find ways to thwart the FBI,” he notes. The identity of the vendor alone is unlikely to give adversaries any more of an advantage, he says. “Security through obscurity very rarely lends much to security.”

Syed Rizwan Farook and Tashfeen Malik killed 14 people at the Inland Regional Center in San Bernardino in December 2015. During the ensuing investigation, the FBI recovered a company-issued password protected iPhone 5C running iOS 9 belonging to Farook. Since the device had a capability to auto-erase the data on its disks after 10 failed password entry attempts, the FBI sought Apple’s help in unlocking the device.

When Apple refused, the FBI commenced legal action against the company seeking to compel its help in unlocking the device. The FBI also sought the assistance of other third parties in finding a way to break into Farook’s device, which they said could provide vital clues to his motives and terror affiliations.

In March 2016, the FBI stayed its case against Apple and announced that it had found a vendor with a demonstrated method for unlocking the phone safely. The FBI asked that it be allowed to single-source the contract rather than go through the usual competitive bidding process. Later that same month, the agency claimed that it had managed to break into Farook’s iPhone and recover the data using technology from the undisclosed third-party.

In subsequent public comments, then FBI director Comey hinted that the FBI had paid upwards of $1.2 million for the tool. He described the technology as being narrowly tailored for breaking into the iPhone 5C running iOS 9. In May this year during a Congressional hearing, one lawmaker said the FBI had paid $900,000 for the tool.

The media companies had claimed that since such details were already publicly available, the vendor’s identity and transaction details should be made public.

In siding with the FBI, Judge Chutkan held that releasing the vendor’s identity could cause demonstrable harm to US national security interests. She said the FBI had demonstrated a ‘logically reasonable risk” that the third-party vendor would be harmed if its name was released. Similarly, disclosing pricing details is not wise, she said,

“Releasing the purchase price would designate a finite value for the technology and help adversaries determine whether the FBI can broadly utilize the technology to access their encrypted devices,” she held.

Pescatore, however, notes that there is little that adversaries can gain from merely the pricing details of a product. Rather, since the FBI contracted with the company on a single-source basis, it becomes important to know if the agency overpaid, he says. “Keeping the pricing secret makes even less sense to me,” than not identifying the vendor, he says.

Related Content:

• FBI Cracks Terrorist’s iPhone — Sans Apple
• ‘FBiOS’ Case Heading For A New Firestorm
• FBI’s Claim It Can Access iPhone Without Apple’s Help Prompts Questions
• How End-User Devices Get Hacked: 8 Easy Ways

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/endpoint/fbi-wont-have-to-reveal-iphone-cracking-tool-used-in-terror-case-/d/d-id/1330028?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Credit bureau provides update on its breach investigation.

Equifax late Monday said forensics investigators have concluded that some 2.5 million more US consumers were affected by the data breach it revealed early last month, bringing the total number to 145.5 million. 

The latest victim headcount comes as Mandiant, which is conducting the breach investigation of Equifax, confirmed that the attack only affected the firm’s databases in the US. Initial speculation by Equifax that some 100,000 Canadian citizens were affected by the breach were incorrect, according to the company. The actual number was 8,000.

Equifax said its UK forensics investigation analysis is not yet complete.

“I want to apologize again to all impacted consumers. As this important phase of our work is now completed, we continue to take numerous steps to review and enhance our cybersecurity practices. We also continue to work closely with our internal team and outside advisors to implement and accelerate long-term security improvements,” said Equifax interim CEO Paulino do Rego Barros, Jr.

Read the Equifax news release here. 

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/equifax-number-of-us-breach-victims-rises-to-1455-million/d/d-id/1330030?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Whole Foods Market suffers payment card breach

The Whole Foods Market chain is investigating a payment card breach at locations with taprooms and full table-service restaurants.

The company’s statement acknowledging the investigation is brief and leaves many questions unanswered:

Whole Foods Market recently received information regarding unauthorized access of payment card information used at certain venues such as taprooms and full table-service restaurants located within some stores.

Questions yet to be answered include which specific locations were affected, what kind of card data may have been put at risk and how the breach happened.

Whole Foods Market has close to 500 stores in the US, Canada and UK.

With facial recognition, Facebook can unlock your account

Facebook is working on a facial recognition approach to help users regain access to their accounts if locked out. Users who can’t receive two-factor authentication SMS because they’re in transit will no doubt benefit from such a tool.

Answering a query from TechCrunch, Facebook confirmed it’s working on the new tool:

We are testing a new feature for people who want to quickly and easily verify account ownership during the account recovery process. This optional feature is available only on devices you’ve already used to log in. It is another step, alongside two-factor authentication via SMS, that we’re taking to make sure account owners can confirm their identity.

This isn’t the first time Facebook has experimented with ways to help users get back into a locked account. In some cases, it has asked the user to identify photos of their friends to prevent unauthorized logging in. It has also played around with a technique of letting users designate several “trusted friends” who receive a code they can then ask for to unlock their account.

Of course, facial recognition isn’t foolproof – as both Apple and Samsung can attest.

Malware maker mined Monero, made $63,000

One or more malware creators made around $63,000 in five months by invading unpatched IIS 6.0 servers and mining the cryptocurrency Monero.

Bleepingcomputer reported that attackers exploited the CVE-2017-7269 vulnerability in IIS 6.0 servers to hijack machines and install a Monero miner. Monero is a cryptocurrency like Bitcoin that’s designed for even greater privacy than its more well known peer.

Windows Server owners still running IIS 6.0 should install a patch Microsoft released in June.

Two Chinese researchers discovered the CVE-2017-7269 vulnerability in March. They made proof-of-concept exploit code available on GitHub to help sysadmins find vulnerable IIS 6.0 installations in their organizations.

Catch up with all of today’s stories on Naked Security

Follow @NakedSecurity
Follow @BillBrenner70

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Exr4G2PvFTQ/

Guess what?

It’s October, and that means it’s Cybersecurity Awareness Month.

In the US, it’s a big enough deal to be officially known as National Cybersecurity Awareness Month (NCSAM), and it started back in 2004 as “a collaborative effort between government and industry to ensure every American has the resources they need to stay safer and more secure online”.

In short, it’s not about pushing products, or crowing that your way of doing it is better than everyone else’s, or pulling off publicity stunts to promote a particular technology over all others.

For Naked Security, at least, it’s about presenting easily-digested articles that are plainly written, educational and, as far as possible, fun.

After all, computer security doesn’t have to be boring, doesn’t have to be awash in jargon, and doesn’t have to end up as a set of proscriptions and prohibitions.

So here are 3 simple steps to online safety that aren’t just clicking a button.

Each of these steps requires a little bit of commitment and some ongoing extra effort on your part…

…but although you might find them a hassle at first, we think you will soon consider them second nature.

The theme for Week 1 of NCSAM is STOP. THINK. CONNECT: Simple steps to online safety.

All our steps will quite literally make you STOP and THINK before you CONNECT, thus increasing your advantage over the cybercrooks.

#CYBERAWARE STEP 1
TRY 2FA WHEREVER YOU CAN

As you probably know, 2FA is short for two-factor authentication, also known as two-step verification or 2SV.

Typically, 2FA works by asking you for your regular password, which is the same every time, and then asking you for a one-time code that is calculated by, or sent as a text message to, your phone.

2FA isn’t foolproof – the crooks could steal your phone, booby-trap the code generation app using malware, or swap out your SIM card and intercept the messages – but it does make things harder for the crooks.

In particular, they can no longer steal your password today and use it again and again for hours, days or weeks.

The downside, and we’ll be honest here, is that 2FA isn’t as convenient as just using a password, at least for what you might consider your “less important” accounts that you use a lot.

If you leave your phone at home, you probably won’t be able to login from your laptop at the coffee shop.

Also, logging in takes a bit longer, every time, and there are more things to go wrong that could keep you out of your account.

So, 2FA is indeed a simple step to online safety, but it isn’t a one-off action: it adds an extra step to every login, so you have to change your login procees – what time management and user interface experts like to call “workflow”.

But we think the effort is worth it, and we encourage you to try 2FA wherever you can.

If you really can’t get on with it, you can always turn it off, but give it a fair go first.

#CYBERAWARE STEP 2
TRY THE LONGEST MOBILE PHONE LOCKCODE YOU CAN MANAGE

Back in 2015, Apple upped the shortest permitted lockcode for iPhones from four digits to six.

That’s because adding two digits doesn’t increase the number of different codes by 50% (6 digits / 4 digits = 1.5 = 150%), but takes you from 10×10×10×10 codes (10,000) to 10⁶ (1 million), a 100-fold boost in complexity.

We suggest upping your lockcode even further, say to 10 digits, even though it’s harder to memorise to start with, and takes longer to type in every time.

Although 10-digit codes take 2.5 times longer to type in than 4-digit codes – let’s say close to three seconds instead of about one second – they are, at least in theory, a cool one million times more secure. (The arithmetic here is 10/4 = 2.5, but 10¹⁰/10⁴ = 1,000,000.)

That means that it’s easier to pick something unique and hard to guess, and harder for crooks – or for your oh-so-witty friends who are dying to send out off-colour tweets in your name – to shoulder-surf by watching you typing in your code out of the corner of their eye.

We think the effort is worth it, and we encourage you to increase the length of your lockcode as much as you can.

If you’re worried about forgetting your new, superlong code and being faced with resetting your phone and losing any data you haven’t yet backed up, consider writing down the new code and locking it away at home until you’re happy you’ve mastered the new finger pattern.

#CYBERAWARE STEP 3
TRY LOGGING OUT FROM APPS YOU’RE NOT USING

Have you ever retweeted something without realising it, or Liked something on Facebook without meaning to?

Have you realised your blunder only when your friends started pestering you to find out when you adopted your new and uncharacteristic political opinions, or when you fell in love with a certain Mr J. Bieber? (Those are rhetorical questions. You don’t need to answer.)

The problem is that social networks put a lot of effort into what they call frictionlessness, so that it’s as easy as possible – and sometimes much too easy, especially when you are somewhat lubricated yourself – to participate in online discussions at a moment’s notice.

Ironically, you may find – if you have made more than your fair share of online faux pas – that you can make your social networking life a lot easier, or at least a lot less prone to blunders, by making its operation a bit more difficult.

We suggest learning how to log out fully from services such as Twitter and Facebook, especially on your phone, where simply closing the app is not enough.

It means logging back in every time you start up the app or load the website again, which is mildly annoying at first.

But it means you’ll be much less likely to share something unintentionally, which will not only protect your friends from scams apparently “approved” by you, but also protect you from what could turn into career-limiting moves.

We think the effort is worth it, and we encourage you to learn to logout regularly.

Admittedly, for all that this is a simple step in theory, it’s irritating to get right in practice, because each social media app seems to have its own way of handling the logout function, and it isn’t always obvious where to find it.

Try looking for a “hamburger menu” (see below) on your main account page, or follow your nose to setup pages labelled Settings or Account.

To give you a hint of where to start and where in each app to go digging, here’s how to do it in the iOS versions of Facebook and Twitter:

There you have it.

As we said above, you might consider these steps a bit of a hassle at first, but that we think you will soon consider them second nature.

In fact, you might soon find yourself uncomfortable without them, like driving without a seatbelt or riding without a helmet.

Remember: STOP. THINK. And only then CONNECT.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-hsAW_xR6IU/

The infrastructure behind a Web shell used in an attack earlier this year suggests methodical and purposeful threat actors, Palo Alto Networks says.

A security vendor’s investigation into the source of malware that was used in a recent security incident involving a Middle Eastern organization has revealed just how sophisticated and interlinked modern cyberattack infrastructures have become.

For the past several months, researchers at Palo Alto Networks have been investigating a Web shell dubbed TwoFace that was used in the Mideast incident to remotely access the victim’s network and establish a persistent point for lateral movement.

In following IP addresses associated with the TwoFace attack, the researchers stumbled upon a much larger-than-expected adversary network that included multiple compromised websites, credential harvesting systems, command-and-control servers and post-exploitation tools.

Several of the credential harvesting websites were crafted to be identical replicas of legitimate websites belonging to organizations in Israel. The credential harvesting sites included those that purported to belong to the Institute of National Security Studies, a national security think tank, Tel Aviv University, strategic consulting firm Macro Advisory Partners, and the Hebrew University of Jerusalem.

The researchers also discovered a significant link between the operators of the TwoFace campaign and those behind OilRig, a malware used in a major data theft campaign targeting airline, financial services, government, and critical infrastructure organizations in Saudi Arabia last year.

Palo Alto Network researchers are still unraveling the full extent of the links between the two campaigns. But they have already found several overlaps in the targeting of organizations throughout the Middle East.

One possible scenario is that both OilRig and TwoFace are being used in conjunction to break into and infect systems on target networks and to enable additional post-exploitation tools to be uploaded to them, the researchers said. “While we cannot be absolutely certain that this is the same adversary in both attacks, we are able to ascertain that this specific entity does have access to OilRig tools,” they noted.

Christopher Budd, senior threat communications manager at Palo Alto Networks, says the findings are important considering the extent to which the Middle East has become a hotbed of threat activity in recent times. “It’s significant because we don’t have a total picture of the scope and scale of these operations yet,” Budd says. “It’s like pulling on a thread; the more we pull, the more it unravels.”

Palo Alto Network’s research showed that the networks of some victims of the two campaigns have been added as part of the attack infrastructure. For instance, one of the IPs interacting with the TwoFace web shell belonged to the Ministry of Oil of a Middle Eastern country. The IP address not only communicated with the TwoFace shell but was also used to upload post-exploitation tools to the network of a MidEast educational institution.

Budd says Palo Alto Networks researchers have been following these investigations for one-and-a-half years and have begun to gain better visibility of the operations of the threat actors behind OilRig and TwoFace.

“We see threat actors who are methodical in their approach,” he says. “We also see threat actors that are purposeful in their approach. Our research traces these threat actors back to at least May 2016 and the infrastructure we’ve found takes time to assemble, deploy, and maintain.”

There’s a lot more that remains to be uncovered, he says. “The important thing is the more we understand, the more we can share that information so everyone can better prevent attacks,” he says. The key takeaway from the research is that attacks don’t just “happen,” Budd noted. “There is planning and staging, infrastructure, and logistical work involved in attacks.”

Related content:

• Report: ‘OilRig’ Attacks Expanding Across Industries, Geographies
• 7 Indicted Iranian Nationals Now Hit with Sanctions by US Treasury
• ‘Operation Ghoul’ Targets Industrial, Engineering Companies In 30 Countries
• Meet Some Of The Emerging Israeli Cybersecurity Firms 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/malware-investigation-leads-to-sophisticated-mideast-threat-network/d/d-id/1330002?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple