STE WILLIAMS

Which of Google, Apple and Microsoft think a content security bypass doesn’t warrant a browser patch?

Thanks to Cisco Talos security bod Nicolai Grødum, who found the cross-site scripting bug that affects older Chrome and Safari plus current versions of Edge, we know the answer is “Microsoft”.

Grødum posted news of Microsoft’s attitude here, explaining that if you use Chrome 57.0.2987.98 or later, you’re already protected against CVE-2017-5033. Ditto users of iOS later than 10.3 and Safari later than 10.1, who are spared the ravages of CVE-2017-2419. However, Talos writes, “Microsoft stated that this is by design and has declined to patch this issue”.

The bug/feature is that the browser mishandles about:blank in a way that lets an attacker:

Once exploited, an attacker could use JavaScript to contact other sites, and it works, because about:blank has the same origin as the loading document, but without the CSP restrictions.

As Talos explains, the CSP specification is clear that “restrictions should be inherited” – whatever restrictions apply to an origin page should also apply to pages opened from it. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/07/talos_says_msft_edge_content_security_bypass_is_a_feature_wont_be_patched/

Your daily round-up of some of the other stories in the news

Don’t fall for this Bitcoin scam

With the (now slightly abating) boom in Bitcoin prices, it was only a matter of time before scams to entrap the unwary started popping up, designed to hook those not au fait with the nitty-gritty of how to use the cryptocurrency but who want to get in on the action.

And sometimes it’s the most unsophisticated scams that might tempt the vulnerable: researchers warned via Twitter on Tuesday of an app that promised the greedy or the unwary to double their cybermoney.

The app, called Bitcoin Doubler, throws up a dialog that asks users to enter their private key into a dialog box and click a Load Key and then Double button. To add insult to injury, it adds “If you make a mistake or need to double the value of multiple keys, click reset to start again.”

We hope we don’t have to remind Naked Security readers never to share private keys, but you never know when people will forget the ancient adage: if it sounds too good to be true, it is too good to be true.

Samsung facial recognition bypassed – again

Samsung may have worked hard not to repeat the problems its Galaxy Note 7 had with overheating batteries for its new Galaxy Note 8, but it appears the Korean giant seems not to have learned the lesson about easily fooled facial recognition.

As we reported back in April, the Galaxy S8’s facial recognition could be fooled with a photo of the user, and we recommended then that you don’t rely on that for authentication on your phone.

Now it seems that the Galaxy Note 8 can also be fooled with a photo – at least, in a demo device that developer Mel Tajon was able to bypass. The news organisation CNET later confirmed that its review device could also be bypassed by a photo.

So our advice stands: you don’t have to use facial recognition to unlock your phone, and you shouldn’t make it too easy, either.

As Paul Ducklin wrote at the time, “aim for the greatest amount of inconvenience you think you can tolerate, plus a bit extra” when it comes to unlocking your device.

Apple rejects Indian government app over privacy fears

Apple is refusing to add the Indian government’s anti-spam app to its App Store in the country, warning that it violates its privacy policy.

The Do Not Disturb app, from India’s Telecom Regulatory Authority, is designed to help users file complaints about spam calls and texts, but Apple is concerned that it would allow access to the device owner’s full call history.

Ram Sewak Sharma, the chairman of the regulator, told Bloomberg: “Nobody’s asking Apple to violate its privacy policy. It is a ridiculous situation; no company can be allowed to be the guardian of a user’s data.”

This latest skirmish over privacy for Indians comes in the wake of a ruling by the Supreme Court that the country’s constitution establishes a fundamental right to privacy, the conclusion of a challenge to the country’s widely criticised “Orwellian” Aadhaar digital ID scheme.

Sharma added: “The problem of who controls user data is getting acute and we have to plug the loose ends. This is not the regulator versus Apple, but Apple versus its own users.”

Catch up with all of today’s stories on Naked Security

Follow @NakedSecurity
Follow @katebevan

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/IcsIT-NLiMw/

Analysis A survey on global mobile wallet adoption, published Tuesday, has sparked a lively debate about how banks and fintech might face off in the expanding market for mobile payments.

Global payments software firm ACI Worldwide found that security concerns, while present, are not holding back uptake.

Steven Murdoch, a security researcher at University College London and authentication vendor VASCO, said that the situation with mobile payment security is mixed.

“In terms of risks, it’s far easier to compromise a smartphone than a card. Cards are simple special-purpose computers, engineered primarily for security, whereas smartphones are complex, general-purpose computers potentially running software from dubious sources.”

The iOS Secure Enclave, and Apple’s prompt software update practices, makes iPhones pretty good in terms of security. By contrast, Android is considerably less secure with most phones having delayed or no security updates, and hardware security features are either absent or unused.

Bringing smartphones into the payments mix also offers the potential of introducing security benefits. Applications can incorporate their own security protections which can improve the situation.

Murdoch told El Reg: “There is the potential of having the phone act as a trustworthy display showing the customer what’s going on. Contactless cards almost never have a display and so customers have to rely on the potentially malicious terminal and hence are vulnerable to the relay attack.

“The phone can also maintain a log of transactions, that’s under the control of the customer, which could help them in the case of disputes. Finally there’s biometric (face, fingerprint, perhaps iris) authentication, which is far from perfect but in many ways superior to the four-digit PINs that myself and others have shown to be very problematic for customers.”

Lu Zurawski, practice lead for retail banking and consumer payments at ACI Worldwide, told El Reg: “It is clear that mobile devices will play an increasingly central role in the future of payments; not just as mobile wallet enablers, but also as vital components of digital payment security. Our research suggests that consumer confidence in mobile security is firm, which is good news as payments providers increasingly seek to integrate authentication and notification capabilities within their mobile service offerings.

“The challenge ahead is to use mobile technology, including identity and credentials checking, biometric capabilities and transaction initiation (using contactless technology as well as QR codes), in a way that is easy to use and trustworthy for consumers.”

Mobile payment is becoming the new battleground between banks and fintech firms, according to ACI Worldwide. The rollout of immediate payments schemes worldwide, combined with new regulation in Europe based on the Revised Directive on Payment Services (PSD2), is pushing increased competition.

“Fintechs are much better at it than incumbents,” said Neira Jones, a payments expert who serves as non-executive director for Cognosec and Comcarde, adding that developments in biometrics and the push for frictionless experiences will be a factor in the market shakeup.

Competition will extend beyond mobile payments into the wider field of mobile services (banking, insurance) and everything related to them, such as identity/authentication, Jones said.

Competition will vary with geography – mobile payments like M-PESA have a specific market and specific infrastructure issues, which the Western World does not. For example, QR is very popular in Asia, but not in Europe/US, she added. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/06/mobile_wallet_security_analysis/

Much of our Android security coverage focuses on malicious apps Sophos researchers find in Google Play and elsewhere. But the latest threat comes from a different direction: bootloader vulnerabilities that bad actors could exploit to gain root access to phones and use to launch attack code.

Nine computer scientists from the University of California at Santa Barbara made the discovery while analyzing the interaction between the Android operating system and phone bootloading chips at power-up. Ultimately, they wrote in a paper:

Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks. Our tool also identified two bootloader vulnerabilities that can be leveraged by an attacker with root privileges on the OS to unlock the device and break the CoT.

What that means, warns SophosLabs, is that

… at least some of the vulnerabilities work even if the bootloader is not unlocked. In fact, one of the case studies shows a vulnerability where the malicious code can unlock the bootloader, allowing it to load any unsigned firmware.

The danger exposed

The tool they built for this research is called BootStomp, which uncovered exploitable flaws in chips from Huawei, Qualcomm, MediaTek and NVIDIA.  Six flaws were new, while another had previously been identified and outlined in Common Vulnerabilities and Exposures bulletin CVE-2014-9798.

The researchers focused on five different bootloaders from four different vendors:

• Huawei / HiSilicon chipset [Huawei P8 ALE-L23]
• NVIDIA Tegra chipset [Nexus 9]
• MediaTek chipset [Sony Xperia XA]
• Qualcomm’s new LK bootloader
• Qualcomm’s old LK bootloader

They already knew about the CVE-2014-9798 bug, and when BootStomp re-identified it, they knew their tool would work. The researchers then branched out and uncovered one security hole in the NVIDIA chipset and five in HiSilicon’s bootloaders.

The vulnerabilities compromise the entire chain of trust, enabling malicious capabilities such as access to the code and storage normally restricted to TrustZone, and to perform permanent denial-of-service attacks (i.e., device bricking), the researchers wrote.

The researchers noted that if the bootloaders’ chain of trust were the same for any chipset, the vulnerabilities might not have appeared. But they are not the same. To make it easier for silicon vendors, Google left plenty of wiggle room for customization.

Mass infections unlikely

Since most of the flaws are newly discovered, it could be a while before the vendors patch them. Fortunately, according to Sophos researchers who analyzed the report, a fair amount of effort is required to exploit these attack vectors. SophosLabs Android researcher Jagadeesh Chandraiah put it this way:

From a Sophos customer’s  perspective, malware could be written using this knowledge but to penetrate devices they need a lot of effort and also, since this is at the bootloader level, malware authors also need more expertise to write successful malware as nothing exists on the internet at the moment.  

When the exploit goes public, Chandraiah said we might see them used in targeted attacks. But, he added:

For now, mass infections are unlikely from what I can see. Customers should not be too worried. If they are not tech-savvy, they should avoid trying to unlock and root the bootloader and follow the usual best practices.

The continued presence of malicious and compromised Android apps and processes demonstrates the need to use an Android antivirus such as our free Sophos Mobile Security for Android. By blocking the install of malware from the outset, you can spare yourself lots of trouble.

Follow @NakedSecurity
Follow @BillBrenner70

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/W8s0LwiPUuo/

It seems only yesterday – in fact, it was six months ago – that we wrote about a nasty security hole in Apache Struts.

Unfortunately, it’s time for déjà vu all over again, with a similar sort of hole that can apparently be exploited in a similar way.

To explain.

Apache Struts is a software toolkit for creating Java-based web applications that run on your web server.

Struts can be used for building internet-facing services such as online shops or discussion forums: with Struts, you can generate web pages on the fly, tailor web content for the current user as they move around on your site, respond to web forms filled in by your visitors, and much more.

You can tell where this is going, given that an important part of any web application framework is dealing with the security risks implicit in requesting, acquiring and responding to data that is uploaded by outsiders.

And that’s where this Struts bug, known as CVE-2017-9805, comes in.

All applications should treat all input data as potentially hostile, even if it comes from an internal source that is supposedly under your own control. But when data comes from untrusted outsiders, you should go one step further, and assume that it is actively hostile – in other words, that it is booby-trapped in some way – unless and until you have good reason to think otherwise.

What’s the bug?

With a plugin called Struts REST, your web application can interact with visitors by means of Representational State Transfer (REST for short).

A REST-based web service – known colloquially as a RESTful service, because it is considered programmatically mellow – doesn’t have wild-looking URLs with data encoded into them like this:

Instead, there’s a standard URL for transactions to use, and the data needed for the web request or the reply is placed RESTfully in the HTTP body.

RESTful web requests are typically either GET (for example, to show a database record), PUT (to update a record), PATCH (to change one field in a record) or POST (to create new record), something like this:

Note that the REST process doesn’t specify how you’re supposed to represent, or encode, the data you want to send or receive – that’s up to you.

In the above example, we used basic HTML (more precisely, XHTML), but there are numerous ways to turn complex data structures into lines of text that are safe and suitable for a web request.

Popular formats include JSON (JavaScript Object Notation) and XML (Extensible Markup Language).

Struts REST supports XML using a programming library called XStream, which turns out to be way more powerful than is strictly necessary for exchanging data between browsers and servers.

Indeed, XStream allows you to encode any sort of Java object into XML (this is a technique with the fancy-sounding jargon name of serialisation, because it converts arbitrarily complex collections of structured binary data into a serial string of text characters), not just numbers and text.

How does this affect me?

As the XStream security documentation rather blandly explains:

By design, there are few limits to the type of objects XStream can handle. This flexibility comes at a price. […] The XML generated by XStream includes all information required to build Java objects of almost any type. This introduces a potential security problem.

[XStream XML data] can be manipulated by injecting the XML representation [of Java objects that aren’t supposed to be there]. An attacker could take advantage of this to execute arbitrary code or shell commands in the context of the server running the XStream process.

In short, any application that uses XStream, and thus, by association, any RESTful Struts application that uses XML for its data exchange, needs to take care not to allow crooks to feed it booby-trapped data.

Unfortunately, until Struts 2.5.13, which came out yesterday (Tuesday 05 September 2017), booby-trapped XML could be fed to a Struts server so that attackers could embed commands into what was supposed to be plain data.

Indeed, a well-informed crook could present XML-encoded data to Struts that would be processed as commands during the process of decoding the data in the first place.

In other words, by the time your Struts app got to the point that it could validate the data it just received – for example, to check that it hadn’t been fed a fake phone number or given a website URL that was littered with exploits and malware – the damage might already have been done.

This sort of bug is known as RCE, or Remote Code Execution, and it generally means that crooks can take control of your server automatically from afar.

For example, crookd could carry out an operation that looked innocent – for example, a product search or a stock-level check – but that deliberately triggered a malicious side-effect such as tricking your server into leaking data, acting as a distribution point for malware, or opening up a hole to let the crooks back into your network later.

What to do?

The discoverers of this vulnerability claim to have a “simple working exploit” as a proof of concept.

They claim that “[a]t the time of the announcement [2017-09-05] there is no suggestion that an exploit is publicly available, but it is likely that there will be one soon,” implying that crooks may figure out their own tricks easily enough.

• If you use Struts, patch immediately. Struts versions from 2.5 to 2.5.12 inclusive are affected.
• If you use Struts but aren’t using REST, remove the Struts REST plugin. This reduces your attack surface area by giving crooks less to aim at in future.
• If you use Struts REST but don’t use XML, turn off XML support. Apache lists the configuration setting you need (ironically, the configuration is itself specified using XML) so that the Struts REST plugin will work only with plain web pages or with JSON data, neither of which are processed by XStream.
• If you use third-party web hosting or development services, ask your providers if they’re patched. You can outsource your operations, but not your accountability.
• For future web applications, consider sticking to JSON instead of XML for data exchange. Programming libraries that handle JSON aren’t immune to security problems like this one, but the comparative simplicity of JSON compared to XML often makes it a better choice because it reduces your attack surface.

Regular readers of Naked Security will know that when it comes to boosting security by stripping down the plugins you install, restricting the options you enable, and simplifying the technologies you choose…

…we often end up quoting Mr Miagi from The Karate Kid: Best way to avoid punch – no be there.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/mIx65GuP9EM/

From August 2014 to December 2014, Lenovo sold laptops that had Visual Discovery spyware pre-installed, as Naked Security’s Paul Ducklin discussed back in February 2015. Visual Discovery is software that’s developed by Superfish, which describes itself as a marketing company.

Visual Discovery compares images you see in your web browser to its massive cloud database of images. A compared image is then associated with a related image. For example, if I were looking at a picture of the North American cover of Hyperdimension Neptunia Re;Birth 2 for the PSVita, Visual Discovery could possibly link it to an image of the North American cover of Hyperdimension Neptunia Re;Birth 3. If I hadn’t already purchased that game, Superfish’s adware could remind me that the game exists. If, hypothetically, Neptunia publisher Idea Factory International were one of Superfish’s clients, Superfish would make some ad revenue from them.

If a Lenovo customer agreed to have Visual Discovery installed on their laptop for whatever reason, there would have been less of an ethical problem. But a lot of people who bought Lenovo laptops in the last quarter of 2014 were unaware that what amounted to spyware was pre-installed on their Windows OEM PCs.

It gets worse. Visual Discovery isn’t a web browser plugin. The Lenovo laptops in question were designed to send all web traffic to a Superfish proxy server regardless of which web browser the customer uses. Here’s where the major cybersecurity problem comes into play. Visual Discovery performed as a man in the middle for all HTTPS connections. Ducklin wrote:

Instead of treating your HTTPS traffic as sacrosanct, and leaving it alone so it remains end-to-end encrypted all the way from the server to your browser, Superfish uses keybridging, also known as Man in The Middle, or MiTM.

The Superfish MiTM works pretty much as the name suggests.

When your browser connects to, say, https://example.com/, the connection is handled directly by Visual Discovery.

Your encrypted connection actually terminates inside Superfish’s filter.

The filter then connects onwards to https://example.com/ and grabs the content on your behalf (that’s why this sort of software is called a “proxy”), using an HTTPS connection of its own.

Of course, that means the HTTPS replies from example.com actually terminate inside the filter, too, so your traffic is unencrypted, both outbound and inbound, with the result that Superfish can read it…

Your browser thinks it made an end-to-end encrypted connection, and in a sense it did, except that the other end of the connection was not the example.com server – it was the Superfish filter on your own computer.”

Also, Superfish’s spyware was configured in such a way that users would not be notified of a TLS (for HTTPS) certificate problem, because Superfish itself was signing certificates. That’s a clever – and dislikeable – MiTM attack.

Once this was discovered and widely discussed, users were urged to uninstall Visual Discovery via Programs and Features in Windows’ Control Panel. By early 2015, according to Lenovo, the company had ceased selling laptops with Superfish’s unwelcome additions.

Fast forward to now, September 2017, and Lenovo has settled a lawsuit from the US’s Federal Trade Commission, the state of Connecticut, and 31 other American states, for $3.5m. Said acting FTC chairman Maureen Ohlhausen:

Lenovo compromised consumers’ privacy when it preloaded software that could access consumers’ sensitive information without adequate notice or consent to its use. This conduct is even more serious because the software compromised online security protections that consumers rely on.

Lenovo said in response:

While Lenovo disagrees with allegations contained in these complaints, we are pleased to bring this matter to a close after two and a half years. To date, we are not aware of any actual instances of a third party exploiting the vulnerabilities to gain access to a user’s communications.

Hopefully this sets a precedent within the PC manufacturing industry, as well as the mobile device manufacturing industry. Preloading adware that could compromise user security might look like a tempting way to make extra profit from PCs, which have notoriously slim profit margins. But compromising user security isn’t worth it.

Follow @NakedSecurity
Follow @kim_crawley

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Vj5oqaTgQ1A/

Companies operating in Europe must balance workplace surveillance with employees’ privacy rights, the European Court of Human Rights has ruled.

The decision reverses a 2016 ruling by a lower chamber of the court that found no privacy issue with workplace communication monitoring. It marks the first time Europe’s top human rights body has addressed the monitoring of electronic communication at a private company.

In August 2007, Bogdan Mihai Bărbulescu of Bucharest, Romania, was fired for personal use of Yahoo Messenger. He had created the account at the request of his employer, a company not named in court documents.

Bărbulescu challenged his termination in a Romanian court, insisting that his right to privacy, under Article 8 of the European Convention on Human Rights, had been violated. He claimed he had not been properly informed about communication monitoring.

Article 8, the “Right to respect for private and family life,” says: “Everyone has the right to respect for his private and family life, his home and his correspondence,” except as required by law, for public safety, national security, economic necessity, and upholding other rights.

The Bucharest County ruled against Bărbulescu in December 2007, finding that employers have the right to define internal rules for internet usage.

Bărbulescu appealed and lost again in 2008. That same year, he appealed to the ECHR.

The Chamber of the ECHR ruled against him in 2016.

Again, Bărbulescu appealed and on Tuesday he received satisfaction from the court’s Grand Chamber, the highest authority on human rights rules among the 47 Council of Europe members states.

The ECHR found that Romanian courts failed to consider whether Bărbulescu had been adequately notified that his communication might be monitored and whether the employer’s objectives could have been accomplished with less intrusion.

In a phone interview with The Register, Pam Dixon, founder and executive director of the World Privacy Forum, said the case is incredibly significant for Europeans because it means employers cannot completely ban personal communication while on the job.

Dixon said Bărbulescu for years kept losing in court. “It was basically the US argument: We’ve given you notice, you have no right to privacy in the workplace,” she explained. “But under Article 8, the Grand Chamber judgement was that employers do not have the right to disallow private communication in the workplace.”

Dixon doubts the ruling will have much impact in the US, but she said it raises some questions for multinational companies that operate both in the US and Europe. At the very least, she expects affected companies will have to draft new communications policies for employees. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/06/human_rights_court_limits_workplace_surveillance/

Analysis A survey on global mobile wallet adoption, published Tuesday, has sparked a lively debate about how banks and fintech might face off in the expanding market for mobile payments.

Global payments software firm ACI Worldwide found that security concerns, while present, are not holding back uptake.

Steven Murdoch, a security researcher at University College London and authentication vendor VASCO, said that the situation with mobile payment security is mixed.

“In terms of risks, it’s far easier to compromise a smartphone than a card. Cards are simple special-purpose computers, engineered primarily for security, whereas smartphones are complex, general-purpose computers potentially running software from dubious sources.”

The iOS Secure Enclave, and Apple’s prompt software update practices, makes iPhones pretty good in terms of security. By contrast, Android is considerably less secure with most phones having delayed or no security updates, and hardware security features are either absent or unused.

Bringing smartphones into the payments mix also offers the potential of introducing security benefits. Applications can incorporate their own security protections which can improve the situation.

Murdoch said: “There is the potential of having the phone act as a trustworthy display showing the customer what’s going on,” Murdoch told El Reg. “Contactless cards almost never have a display and so customers have to rely on the potentially malicious terminal and hence are vulnerable to the relay attack.

“The phone can also maintain a log of transactions, that’s under the control of the customer, which could help them in the case of disputes. Finally there’s biometric (face, fingerprint, perhaps iris) authentication, which is far from perfect but in many ways superior to the four-digit PINs that myself and others have shown to be very problematic for customers.”

Lu Zurawski, practice lead for retail banking and consumer payments at ACI Worldwide, told El Reg: “It is clear that mobile devices will play an increasingly central role in the future of payments; not just as mobile wallet enablers, but also as vital components of digital payment security. Our research suggests that consumer confidence in mobile security is firm, which is good news as payments providers increasingly seek to integrate authentication and notification capabilities within their mobile service offerings.

“The challenge ahead is to use mobile technology, including identity and credentials checking, biometric capabilities and transaction initiation (using contactless technology as well as QR codes), in a way that is easy to use and trustworthy for consumers.”

Mobile payment is becoming the new battleground between banks and fintech firms, according to ACI Worldwide. The rollout of immediate payments schemes worldwide, combined with new regulation in Europe based on the Revised Directive on Payment Services (PSD2), is pushing increased competition.

“Fintechs are much better at it than incumbents,” said Neira Jones, a payments expert who serves as non-executive director for Cognosec and Comcarde, adding that developments in biometrics and the push for frictionless experiences will be a factor in the market shakeup.

Competition will extend beyond mobile payments into the wider field of mobile services (banking, insurance) and everything related to them, such as identity/authentication, Jones said. Competition will vary with geography – mobile payments like M-PESA have a specific market and specific infrastructure issues, which the Western World does not. For example, QR is very popular in Asia, but not in Europe/US, she added. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/06/mobile_wallet_security_analysis/

France is fitting weapons to its fleet of reconnaissance drones, according to reports.

French defence minister Florence Parly said the EU nation’s six Reaper drones would equipped with weapons, though she did not specify precisely what weapons, by 2020.

The drone fleet is reportedly deployed in northwest Africa, being used in surveillance operations against Islamist terrorists in the region.

General Atomics Reaper drones are used by a number of nations, including the US and UK, for surveillance and strike (bombing) missions. Last year the Royal Air Force announced that it was rebranding the unmanned aerial vehicles as Protectors, to shake off the negative connotations of the Reaper name.

“Arming the drones will give them ‘endurance, discretion, surveillance and strike capability at the right place and the right moment,” she said in a speech in the southeastern city of Toulon,” as the American Associated Press newspaper reported.

France’s Reapers appear to be very similar to the models deployed by the UK and the US, meaning they could be fitted with Hellfire anti-tank missiles. It is also possible that French-owned missile firm MBDA will want to integrate its weapons with the Reaper platform over time.

France is reportedly expecting delivery of a further six drones, bringing its Reaper fleet up to 12, by 2019. These will be delivered already armed with Hellfire missiles.

The AP also reported that the EU nations of Germany, France, Spain and Italy are working on a so-called European drone. This comes as part of the general EU trend to rely less on the US-led NATO alliance for defence matters.

British Reaper drone operations are carried out remotely from RAF Warrington and from US Air Force Base Creech, in Nevada. Critics have pointed out that this reduces the killing of human beings to a mechanised process carried out through a screen and a controller, much like a video game. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/06/france_drones_report/

Symantec is warning of a resurgence in cyber-attacks against firms in the energy sector by a group of hackers it calls Dragonfly.

Dragonfly maintained a low profile for more than a year following exposure by Symantec and other researchers back in 2014 before a series of attacks over the last two years since December 2015. The group is blamed by the security researchers for recent attacks on energy companies in Europe and the US, with highly sophisticated attempts to control – or even sabotage – operational systems at energy facilities.

This “Dragonfly 2.0” campaign, which appears to have begun in late 2015, shares tactics and tools used in earlier campaigns by the group that first began in 2011, according to Symantec. Activities associated with the group have kicked up a gear this year.

The energy sector has become a focus of attacks by state-sponsored hackers over the last two years. Cyber attacks have been blamed for disruptions to Ukraine’s utilities that led to power outages affecting hundreds of thousands of people. In recent months, there have also been reports of attempted attacks on the electricity grids of Western countries, mostly driven through phishing attacks and aimed at reconnaissance or gaining a foothold in targeted networks rather than immediate disruption. Targets included energy firms in the UK, Ireland and the US, as previously reported.

Symantec doesn’t finger Russia in its report. But the US Department of Homeland Security claimed Dragonfly was a Kremlin op in a report last year (pdf). Symantec confines itself to describing the group as “highly capable” and pointing out conflicting evidence for attribution such as the presence of both French and Russian language in code strings found in malware associated with the attacks.

The value in Symantec’s work is providing more detail rather than flagging up a previously unknown campaign.

“The Dragonfly group appears to be interested in both learning how energy facilities operate and also gaining access to operational systems themselves, to the extent that the group now potentially has the ability to sabotage or gain control of these systems should it decide to do so,” Symantec warns.

Symantec has strong indications of attacker activity in organisations in the US, Turkey, and Switzerland, with traces of activity in organisations outside of these countries. The U.S. and Turkey were also among the countries targeted by Dragonfly in its earlier campaign, though the focus on organisations in Turkey does appear to have increased dramatically in this more recent campaign.

As it did in its prior campaign between 2011 and 2014, Dragonfly 2.0 uses a variety of infection vectors in an effort to gain access to a victim’s network, including malicious emails, watering hole attacks, and Trojanized software.

The initial vector of the attacks is spear phishing emails posing as anything from an invitation to a New Year’s Eve party to specific content related to the energy sector and general business concerns. Once opened, the attached malicious document would attempt to leak victims’ network credentials to a server outside of the targeted organisation.

Cisco recently blogged about email-based attacks targeting the energy sector using a toolkit called Phishery. Dodgy emails spotted by Symantec also used the Phishery toolkit to steal victims’ credentials via a template injection attack. The toolkit became generally available on GitHub in late 2016.

“As well as sending malicious emails, the attackers also used watering hole attacks to harvest network credentials, by compromising websites that were likely to be visited by those involved in the energy sector,” Symantec reports.

The stolen credentials were then used in follow-up attacks against the target organisations. In one instance, after a victim visited one of the compromised servers, the Goodor backdoor was installed on their machine via PowerShell 11 days later.

Symantec also has evidence to suggest that files masquerading as Flash updates may be used to install malicious backdoors onto target networks, probably after tricking users using social engineering attacks. Such attacks falsely claim a Flash update is necessary to view content.

An outline of the Dragonfly group’s most recent activities [source: Symantec blog post]

Various factors link the latest run of attacks with earlier Dragonfly campaigns. In particular, the Heriplor and Karagany Trojans used in Dragonfly 2.0 were both also used in the earlier Dragonfly campaigns between 2011 and 2014. Heriplor is a backdoor that appears to be exclusively used by Dragonfly, Symantec reports. The Karagany Trojan was leaked on underground markets, so its recent use by Dragonfly is not necessarily exclusive.

The latest assaults on energy sector targets go beyond those associated with previous campaigns, Symantec warns.

The original Dragonfly campaigns now appear to have been a more exploratory phase where the attackers were simply trying to gain access to the networks of targeted organisations. The Dragonfly 2.0 campaigns show how the attackers may be entering into a new phase, with recent campaigns potentially providing them with access to operational systems, access that could be used for more disruptive purposes in future.

Andrew Clarke, EMEA director at security vendor One Identity, said: “Studies in the US report that cyber-attacks are a constant and daily occurrence on utility companies with some facilities receiving upwards of 10,000 attempted cyber-attacks each month – which equates to one attack every four minutes.”

Segmenting networks with firewalls, improved access controls and patching are needed to better defend infrastructure sector firm from potential attack, he added. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/06/energy_sector_attacks/